Most recent entries from all

certfr-2026-avi-0788 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2026-avi-0788

CLEANSTART-2026-AZ83054 — Security fix for CVE-2026-45740 applied in: azure-functions-node 4.1052.200-r0, jitsucom-jitsu 2.14.0-r1

Affected: CleanStart: azure-functions-node, CleanStart: jitsucom-jitsu

CVE-2026-45740 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.

EUVD-2026-318167

fkie_cve-2026-45740

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.8 and 8.2.0, protobufjs could recurse without a depth limit while expanding nested JSON descriptors through Root.fromJSON() and Namespace.addJSON(). A crafted JSON descriptor with deeply nested namespace definitions could cause the JavaScript call stack to be exhausted during descriptor loading. This vulnerability is fixed in 7.5.8 and 8.2.0.

GHSA-jggg-4jg4-v7c6 — protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion

Affected: npm: protobufjs

## Summary

protobufjs could recurse without a depth limit while expanding nested JSON descriptors through `Root.fromJSON()` and `Namespace.addJSON()`.

A crafted JSON descriptor with deeply nested namespace definitions could cause the JavaScript call stack to be exhausted during descriptor loading.

## Impact

An attacker who can provide JSON descriptors loaded by an application may be able to crash the process or otherwise cause schema loading to fail with a stack overflow.

This affects applications that load JSON descriptors from untrusted sources with affected versions.

## Preconditions

- The application must load JSON descriptor data influenced by an attacker. - The crafted descriptor must contain deeply nested `nested` namespace objects. - The affected `Root.fromJSON()` / `Namespace.addJSON()` descriptor expansion path must process the crafted input.

## Workarounds

Avoid loading untrusted protobuf JSON descriptors with affected versions. If immediate upgrade is not possible, reject excessively nested descriptor structures at an outer validation boundary where feasible, or isolate descriptor loading in a process that can be safely restarted.

RHSA-2026:41929 — Red Hat Security Advisory: Red Hat Developer Hub 1.9.7 release.

undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy form-data: form-data: Form field override via CRLF injection undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header opentelemetry-js: opentelemetry/exporter-prometheus: opentelemetry-js: Denial of Service via malformed HTTP request protobufjs: protobufjs: Denial of Service via crafted JSON descriptors

WID-SEC-W-2026-2452 — Red Hat Ansible Automation Platform (node-tar, linkify-it, protobufjs, brace-expansion, fast-uri, DOMPurify): Mehrere S…

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Ansible Automation Platform ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen, Daten zu manipulieren, einen Denial-of-Service-Zustand auszulösen oder beliebigen Code auszuführen.