https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T14:17:27.167392+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2026-avi-0500 certfr-2026-avi-0500 — De multiples vulnérabilités ont été découvertes dans VMware Tanzu. Elles permettent à un attaquant de provoquer un prob… 2026-10-02T14:17:27.355377+00:00 certfr-2026-avi-0500 https://cve.radiocsirt.org/vuln/euvd-2026-266389 EUVD-2026-266389 2026-10-02T14:17:27.355434+00:00 EUVD-2026-266389 https://cve.radiocsirt.org/vuln/fkie_cve-2026-22036 fkie_cve-2026-22036 2026-10-02T14:17:27.355450+00:00

Undici is an HTTP/1.1 client for Node.js. Prior to 7.18.0 and 6.23.0, the number of links in the decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert thousands compression steps leading to high CPU usage and excessive memory allocation. This vulnerability is fixed in 7.18.0 and 6.23.0.

 https://cve.radiocsirt.org/vuln/ghsa-g9mf-h72j-4rw9 GHSA-g9mf-h72j-4rw9 — Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resour… 2026-10-02T14:17:27.355480+00:00

Affected: npm: undici

### Impact

The `fetch()` API supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., Content-Encoding: gzip, br). This is also supported by the undici decompress interceptor.

However, the number of links in the decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert thousands compression steps leading to high CPU usage and excessive memory allocation.

### Patches

Upgrade to 7.18.2 or 6.23.0.

### Workarounds

It is possible to apply an undici interceptor and filter long `Content-Encoding` sequences manually.

### References

* https://hackerone.com/reports/3456148 * https://github.com/advisories/GHSA-gm62-xv2j-4w53 * https://curl.se/docs/CVE-2022-32206.html

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10074-1 openSUSE-SU-2026:10074-1 — corepack22-22.22.0-1.1 on GA media 2026-10-02T14:17:27.355516+00:00

corepack22-22.22.0-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2026:24841 RHSA-2026:24841 — Red Hat Security Advisory: Red Hat Developer Hub 1.10.0 release. 2026-10-02T14:17:27.355538+00:00

lodash: Lodash: Prototype pollution allows deletion of built-in prototype properties via array path bypass path-to-regexp: path-to-regexp: Denial of Service via specially crafted paths with multiple wildcards undici: Undici: Denial of Service via excessive decompression steps Underscore.js: Underscore.js: Denial of Service via recursive data structures in flatten and isEqual functions yauzl: yauzl: Denial of Service vulnerability in zip file processing @backstage/plugin-auth-backend: @backstage/plugin-auth-backend: OAuth redirect URI allowlist bypass fast-xml-parser: fast-xml-parser: Denial of Service via unbounded entity expansion due to incorrect configuration limit handling

 https://cve.radiocsirt.org/vuln/suse-su-2026:0295-1 SUSE-SU-2026:0295-1 — Security update for nodejs22 2026-10-02T14:17:27.355566+00:00

Security update for nodejs22

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-22036 UBUNTU-CVE-2026-22036 2026-10-02T14:17:27.355584+00:00

Affected: Ubuntu:24.04:LTS: node-undici, Ubuntu:25.10: node-undici, Ubuntu:26.04:LTS: node-undici

Undici is an HTTP/1.1 client for Node.js. Prior to 7.18.0 and 6.23.0, the number of links in the decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert thousands compression steps leading to high CPU usage and excessive memory allocation. This vulnerability is fixed in 7.18.0 and 6.23.0.

 https://cve.radiocsirt.org/vuln/vde-2026-064 VDE-2026-064 — METTLER TOLEDO: LabX Standard Report on External Component Analysis - v21.3 2026-10-02T14:17:27.355606+00:00

Multiple vulnerabilities have been discovered in LabX Standard v21.3.22. Most of the vulnerabilities are fixed in LabX Standard v21.4.23. The Vulnerabilities CVE-2025-69419, CVE-2026-0915, CVE-2025-15467 and CVE-2025-58187 are not yet fixed. The fix will be available in the upcoming releases.

Notice: LabX Standard was formerly known as LabX Cloud Local.