https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 07:09:21 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1256 certfr-2026-avi-1256 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1256 https://cve.radiocsirt.org/vuln/euvd-2026-362042 EUVD-2026-362042 https://cve.radiocsirt.org/vuln/euvd-2026-362042 https://cve.radiocsirt.org/vuln/fkie_cve-2026-77078 <p>multer is a middleware for handling multipart/form-data in Node.js. A small multipart request containing two specially crafted text field names can cause an uncaught RangeError (Invalid array length) that terminates the Node.js process. The first field uses a very large numeric array index to allocate a maximum-length sparse array, and a second field then pushes past that length, which throws inside the append-field dependency and is not caught by multer. All versions before 2.3.0 are affected, and the issue is a remotely triggerable denial of service. The issue is fixed in multer 2.3.0. Upgrade to multer 2.3.0 to remediate.</p> <p>multer is a middleware for handling multipart/form-data in Node.js. A small multipart request containing two specially crafted text field names can cause an uncaught RangeError (Invalid array length) that terminates the Node.js process. The first field uses a very large numeric array index to allocate a maximum-length sparse array, and a second field then pushes past that length, which throws inside the append-field dependency and is not caught by multer. All versions before 2.3.0 are affected, and the issue is a remotely triggerable denial of service. The issue is fixed in multer 2.3.0. Upgrade to multer 2.3.0 to remediate.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-77078 https://cve.radiocsirt.org/vuln/ghsa-wc9g-mqfw-jrwm <p><strong>Affected:</strong> npm: multer</p> <p>### Impact</p> <p>A vulnerability in multer allows a remote, unauthenticated attacker to crash the Node.js process with a single `multipart/form-data` request. Two specially crafted text field names cause an uncaught `RangeError: Invalid array length` inside multer&#39;s field parsing, which is not routed to the application error handler and terminates the process. All applications using multer to parse multipart requests are affected.</p> <p>### Patches</p> <p>Users should upgrade to `2.3.0`.</p> <p>### Workarounds</p> <p>None.</p> <p><strong>Affected:</strong> npm: multer</p> <p>### Impact</p> <p>A vulnerability in multer allows a remote, unauthenticated attacker to crash the Node.js process with a single `multipart/form-data` request. Two specially crafted text field names cause an uncaught `RangeError: Invalid array length` inside multer&#39;s field parsing, which is not routed to the application error handler and terminates the process. All applications using multer to parse multipart requests are affected.</p> <p>### Patches</p> <p>Users should upgrade to `2.3.0`.</p> <p>### Workarounds</p> <p>None.</p> https://cve.radiocsirt.org/vuln/ghsa-wc9g-mqfw-jrwm https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3596 <p>Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren und um einen Cross-Site Scripting Angriff durchzuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren und um einen Cross-Site Scripting Angriff durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3596