https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 12:30:54 +0000 https://cve.radiocsirt.org/vuln/cve-2026-14257 <p><strong>Affected:</strong> juliangruber brace-expansion</p> <p>brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input (&#39;{a,b}&#39;.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays.</p> <p><strong>Affected:</strong> juliangruber brace-expansion</p> <p>brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input (&#39;{a,b}&#39;.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays.</p> https://cve.radiocsirt.org/vuln/cve-2026-14257 https://cve.radiocsirt.org/vuln/ghsa-9mqv-5hh9-4cgg <p><strong>Affected:</strong> npm: @hono/node-server</p> <p>## Summary</p> <p>A WebSocket upgrade request to an `upgradeWebSocket` route with a missing or malformed `Sec-WebSocket-Key` header leaks memory permanently. The request&#39;s `IncomingMessage` is retained in an internal map and a pending promise is never settled, even though no connection is established. Since the route is reachable pre-handshake without authentication, an unauthenticated attacker can flood it to gradually exhaust memory.</p> <p>## Details</p> <p>The built-in WebSocket helper cleans up its internal map only on a successful handshake or when the route guard rejects the request. When `ws` aborts the handshake because `Sec-WebSocket-Key` is missing or malformed, no `connection` event is emitted, so neither cleanup path runs and the entry is retained forever. A present-but-malformed key leaks identically, so a proxy that only checks for the header&#39;s presence does not mitigate it.</p> <p>## Impact</p> <p>An unauthenticated attacker can flood any public `upgradeWebSocket` route with malformed-key upgrade requests, causing unbounded memory growth and eventual loss of availability. No confidentiality or integrity impact.</p> <p>Reported by @TarPeg007.</p> <p><strong>Affected:</strong> npm: @hono/node-server</p> <p>## Summary</p> <p>A WebSocket upgrade request to an `upgradeWebSocket` route with a missing or malformed `Sec-WebSocket-Key` header leaks memory permanently. The request&#39;s `IncomingMessage` is retained in an internal map and a pending promise is never settled, even though no connection is established. Since the route is reachable pre-handshake without authentication, an unauthenticated attacker can flood it to gradually exhaust memory.</p> <p>## Details</p> <p>The built-in WebSocket helper cleans up its internal map only on a successful handshake or when the route guard rejects the request. When `ws` aborts the handshake because `Sec-WebSocket-Key` is missing or malformed, no `connection` event is emitted, so neither cleanup path runs and the entry is retained forever. A present-but-malformed key leaks identically, so a proxy that only checks for the header&#39;s presence does not mitigate it.</p> <p>## Impact</p> <p>An unauthenticated attacker can flood any public `upgradeWebSocket` route with malformed-key upgrade requests, causing unbounded memory growth and eventual loss of availability. No confidentiality or integrity impact.</p> <p>Reported by @TarPeg007.</p> https://cve.radiocsirt.org/vuln/ghsa-9mqv-5hh9-4cgg