https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 14:13:37 +0000 https://cve.radiocsirt.org/vuln/alsa-2026:7350 <p><strong>Affected:</strong> AlmaLinux:9: nodejs, AlmaLinux:9: nodejs-devel, AlmaLinux:9: nodejs-docs, AlmaLinux:9: nodejs-full-i18n, AlmaLinux:9: nodejs-libs, AlmaLinux:9: nodejs-nodemon, AlmaLinux:9: nodejs-packaging, AlmaLinux:9: nodejs-packaging-bundler, AlmaLinux:9: npm, AlmaLinux:9: v8-13.6-devel</p> <p>Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.</p> <p>Security Fix(es):</p> <p>* nodejs: Nodejs denial of service (CVE-2026-21637) * brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547) * minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996) * undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581) * undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527) * undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526) * undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229) * undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525) * undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528) * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135) * Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712) * Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710) * Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesyste…</p> <p><strong>Affected:</strong> AlmaLinux:9: nodejs, AlmaLinux:9: nodejs-devel, AlmaLinux:9: nodejs-docs, AlmaLinux:9: nodejs-full-i18n, AlmaLinux:9: nodejs-libs, AlmaLinux:9: nodejs-nodemon, AlmaLinux:9: nodejs-packaging, AlmaLinux:9: nodejs-packaging-bundler, AlmaLinux:9: npm, AlmaLinux:9: v8-13.6-devel</p> <p>Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.</p> <p>Security Fix(es):</p> <p>* nodejs: Nodejs denial of service (CVE-2026-21637) * brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547) * minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996) * undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581) * undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527) * undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526) * undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229) * undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525) * undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528) * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135) * Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712) * Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710) * Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesyste…</p> https://cve.radiocsirt.org/vuln/alsa-2026:7350 https://cve.radiocsirt.org/vuln/bell-cve-2026-2581 <p><strong>Affected:</strong> Alpaquita:stream: nodejs, BellSoft Hardened Containers:stream: nodejs</p> <p><strong>Affected:</strong> Alpaquita:stream: nodejs, BellSoft Hardened Containers:stream: nodejs</p> https://cve.radiocsirt.org/vuln/bell-cve-2026-2581 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0667 certfr-2026-avi-0667 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0667 https://cve.radiocsirt.org/vuln/cleanstart-2026-ce10526 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: renovate</p> <p>Multiple security vulnerabilities affect the renovate package. These issues are resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: renovate</p> <p>Multiple security vulnerabilities affect the renovate package. These issues are resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-ce10526 https://cve.radiocsirt.org/vuln/euvd-2026-275993 EUVD-2026-275993 https://cve.radiocsirt.org/vuln/euvd-2026-275993 https://cve.radiocsirt.org/vuln/fkie_cve-2026-2581 <p>This is an uncontrolled resource consumption vulnerability (CWE-400) that can lead to Denial of Service (DoS).</p> <p>In vulnerable Undici versions, when interceptors.deduplicate() is enabled, response data for deduplicated requests could be accumulated in memory for downstream handlers. An attacker-controlled or untrusted upstream endpoint can exploit this with large/chunked responses and concurrent identical requests, causing high memory usage and potential OOM process termination.</p> <p>Impacted users are applications that use Undici’s deduplication interceptor against endpoints that may produce large or long-lived response bodies.</p> <p>PatchesThe issue has been patched by changing deduplication behavior to stream response chunks to downstream handlers as they arrive (instead of full-body accumulation), and by preventing late deduplication when body streaming has already started.</p> <p>Users should upgrade to the first official Undici (and Node.js, where applicable) releases that include this patch.</p> <p>This is an uncontrolled resource consumption vulnerability (CWE-400) that can lead to Denial of Service (DoS).</p> <p>In vulnerable Undici versions, when interceptors.deduplicate() is enabled, response data for deduplicated requests could be accumulated in memory for downstream handlers. An attacker-controlled or untrusted upstream endpoint can exploit this with large/chunked responses and concurrent identical requests, causing high memory usage and potential OOM process termination.</p> <p>Impacted users are applications that use Undici’s deduplication interceptor against endpoints that may produce large or long-lived response bodies.</p> <p>PatchesThe issue has been patched by changing deduplication behavior to stream response chunks to downstream handlers as they arrive (instead of full-body accumulation), and by preventing late deduplication when body streaming has already started.</p> <p>Users should upgrade to the first official Undici (and Node.js, where applicable) releases that include this patch.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-2581 https://cve.radiocsirt.org/vuln/ghsa-phc3-fgpg-7m6h <p><strong>Affected:</strong> npm: undici</p> <p>## Impact This is an uncontrolled resource consumption vulnerability (CWE-400) that can lead to Denial of Service (DoS).</p> <p>In vulnerable Undici versions, when `interceptors.deduplicate()` is enabled, response data for deduplicated requests could be accumulated in memory for downstream handlers. An attacker-controlled or untrusted upstream endpoint can exploit this with large/chunked responses and concurrent identical requests, causing high memory usage and potential OOM process termination.</p> <p>Impacted users are applications that use Undici’s deduplication interceptor against endpoints that may produce large or long-lived response bodies.</p> <p>## Patches</p> <p>The issue has been patched by changing deduplication behavior to stream response chunks to downstream handlers as they arrive (instead of full-body accumulation), and by preventing late deduplication when body streaming has already started.</p> <p>Users should upgrade to the first official Undici (and Node.js, where applicable) releases that include this patch.</p> <p>## Workarounds If upgrading immediately is not possible:</p> <p>- Disable `interceptors.deduplicate()` for affected clients/routes. - Use `skipHeaderNames` with a marker header to force high-risk requests to bypass deduplication. - Avoid concurrent identical requests to untrusted endpoints that may return very large/chunked bodies. - Apply upstream/proxy response-size and timeout limits.</p> <p><strong>Affected:</strong> npm: undici</p> <p>## Impact This is an uncontrolled resource consumption vulnerability (CWE-400) that can lead to Denial of Service (DoS).</p> <p>In vulnerable Undici versions, when `interceptors.deduplicate()` is enabled, response data for deduplicated requests could be accumulated in memory for downstream handlers. An attacker-controlled or untrusted upstream endpoint can exploit this with large/chunked responses and concurrent identical requests, causing high memory usage and potential OOM process termination.</p> <p>Impacted users are applications that use Undici’s deduplication interceptor against endpoints that may produce large or long-lived response bodies.</p> <p>## Patches</p> <p>The issue has been patched by changing deduplication behavior to stream response chunks to downstream handlers as they arrive (instead of full-body accumulation), and by preventing late deduplication when body streaming has already started.</p> <p>Users should upgrade to the first official Undici (and Node.js, where applicable) releases that include this patch.</p> <p>## Workarounds If upgrading immediately is not possible:</p> <p>- Disable `interceptors.deduplicate()` for affected clients/routes. - Use `skipHeaderNames` with a marker header to force high-risk requests to bypass deduplication. - Avoid concurrent identical requests to untrusted endpoints that may return very large/chunked bodies. - Apply upstream/proxy response-size and timeout limits.</p> https://cve.radiocsirt.org/vuln/ghsa-phc3-fgpg-7m6h https://cve.radiocsirt.org/vuln/opensuse-su-2026:11121-1 <p>corepack24-24.17.0-1.1 on GA media</p> <p>corepack24-24.17.0-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11121-1 https://cve.radiocsirt.org/vuln/suse-su-2026:22565-1 <p>Security update for nodejs24</p> <p>Security update for nodejs24</p> https://cve.radiocsirt.org/vuln/suse-su-2026:22565-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-2581 <p><strong>Affected:</strong> Ubuntu:24.04:LTS: node-undici, Ubuntu:25.10: node-undici, Ubuntu:26.04:LTS: node-undici</p> <p>This is an uncontrolled resource consumption vulnerability (CWE-400) that can lead to Denial of Service (DoS). In vulnerable Undici versions, when interceptors.deduplicate() is enabled, response data for deduplicated requests could be accumulated in memory for downstream handlers. An attacker-controlled or untrusted upstream endpoint can exploit this with large/chunked responses and concurrent identical requests, causing high memory usage and potential OOM process termination. Impacted users are applications that use Undici’s deduplication interceptor against endpoints that may produce large or long-lived response bodies. PatchesThe issue has been patched by changing deduplication behavior to stream response chunks to downstream handlers as they arrive (instead of full-body accumulation), and by preventing late deduplication when body streaming has already started. Users should upgrade to the first official Undici (and Node.js, where applicable) releases that include this patch.</p> <p><strong>Affected:</strong> Ubuntu:24.04:LTS: node-undici, Ubuntu:25.10: node-undici, Ubuntu:26.04:LTS: node-undici</p> <p>This is an uncontrolled resource consumption vulnerability (CWE-400) that can lead to Denial of Service (DoS). In vulnerable Undici versions, when interceptors.deduplicate() is enabled, response data for deduplicated requests could be accumulated in memory for downstream handlers. An attacker-controlled or untrusted upstream endpoint can exploit this with large/chunked responses and concurrent identical requests, causing high memory usage and potential OOM process termination. Impacted users are applications that use Undici’s deduplication interceptor against endpoints that may produce large or long-lived response bodies. PatchesThe issue has been patched by changing deduplication behavior to stream response chunks to downstream handlers as they arrive (instead of full-body accumulation), and by preventing late deduplication when body streaming has already started. Users should upgrade to the first official Undici (and Node.js, where applicable) releases that include this patch.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-2581 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0933 <p>Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuführen oder andere nicht näher bezeichnete Angriffe durchzuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuführen oder andere nicht näher bezeichnete Angriffe durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0933