Most recent entries from all

certfr-2026-avi-0500 — De multiples vulnérabilités ont été découvertes dans VMware Tanzu. Elles permettent à un attaquant de provoquer un prob…

certfr-2026-avi-0500

EUVD-2026-266389

fkie_cve-2026-22036

Undici is an HTTP/1.1 client for Node.js. Prior to 7.18.0 and 6.23.0, the number of links in the decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert thousands compression steps leading to high CPU usage and excessive memory allocation. This vulnerability is fixed in 7.18.0 and 6.23.0.

GHSA-g9mf-h72j-4rw9 — Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resour…

Affected: npm: undici

### Impact

The `fetch()` API supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., Content-Encoding: gzip, br). This is also supported by the undici decompress interceptor.

However, the number of links in the decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert thousands compression steps leading to high CPU usage and excessive memory allocation.

### Patches

Upgrade to 7.18.2 or 6.23.0.

### Workarounds

It is possible to apply an undici interceptor and filter long `Content-Encoding` sequences manually.

### References

* https://hackerone.com/reports/3456148 * https://github.com/advisories/GHSA-gm62-xv2j-4w53 * https://curl.se/docs/CVE-2022-32206.html

openSUSE-SU-2026:10074-1 — corepack22-22.22.0-1.1 on GA media

corepack22-22.22.0-1.1 on GA media

RHSA-2026:24841 — Red Hat Security Advisory: Red Hat Developer Hub 1.10.0 release.

lodash: Lodash: Prototype pollution allows deletion of built-in prototype properties via array path bypass path-to-regexp: path-to-regexp: Denial of Service via specially crafted paths with multiple wildcards undici: Undici: Denial of Service via excessive decompression steps Underscore.js: Underscore.js: Denial of Service via recursive data structures in flatten and isEqual functions yauzl: yauzl: Denial of Service vulnerability in zip file processing @backstage/plugin-auth-backend: @backstage/plugin-auth-backend: OAuth redirect URI allowlist bypass fast-xml-parser: fast-xml-parser: Denial of Service via unbounded entity expansion due to incorrect configuration limit handling

SUSE-SU-2026:0295-1 — Security update for nodejs22

Security update for nodejs22

UBUNTU-CVE-2026-22036

Affected: Ubuntu:24.04:LTS: node-undici, Ubuntu:25.10: node-undici, Ubuntu:26.04:LTS: node-undici

VDE-2026-064 — METTLER TOLEDO: LabX Standard Report on External Component Analysis - v21.3

Multiple vulnerabilities have been discovered in LabX Standard v21.3.22. Most of the vulnerabilities are fixed in LabX Standard v21.4.23. The Vulnerabilities CVE-2025-69419, CVE-2026-0915, CVE-2025-15467 and CVE-2025-58187 are not yet fixed. The fix will be available in the upcoming releases.

Notice: LabX Standard was formerly known as LabX Cloud Local.