https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 13:24:18 +0000 https://cve.radiocsirt.org/vuln/cve-2026-13697 <p><strong>Affected:</strong> undici</p> <p>undici&#39;s cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive, such as private set to an empty value, can be stored in the default shared cache and later served to a different caller with the same cache key, disclosing private response bodies and headers including Set-Cookie. Separately, a Cache-Control header that combines an unqualified private directive with a qualified one triggers an uncaught TypeError in the cache-control parser, which rejects the request and, depending on the consumer&#39;s error handling, can terminate the process. Both issues affect applications using the cache interceptor in shared mode, including the default configuration. The issues are fixed in undici 7.29.0 and 8.9.0.</p> <p><strong>Affected:</strong> undici</p> <p>undici&#39;s cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive, such as private set to an empty value, can be stored in the default shared cache and later served to a different caller with the same cache key, disclosing private response bodies and headers including Set-Cookie. Separately, a Cache-Control header that combines an unqualified private directive with a qualified one triggers an uncaught TypeError in the cache-control parser, which rejects the request and, depending on the consumer&#39;s error handling, can terminate the process. Both issues affect applications using the cache interceptor in shared mode, including the default configuration. The issues are fixed in undici 7.29.0 and 8.9.0.</p> https://cve.radiocsirt.org/vuln/cve-2026-13697 https://cve.radiocsirt.org/vuln/ghsa-f88m-g3jw-g9cj <p><strong>Affected:</strong> npm: sharp</p> <p>### Impact</p> <p>A number of vulnerabilities, two rated as &#34;High&#34; severity using CVSSv4, have been discovered and fixed in the upstream libvips dependency.</p> <p>Those processing untrusted input with versions of sharp prior to 0.35.0 are affected.</p> <p>### Patches</p> <p>#### Using prebuilt binaries provided by sharp?</p> <p>Most people rely on the prebuilt binaries provided by sharp.</p> <p>Please upgrade sharp to the latest version, currently 0.35.3, which provides libvips 8.18.3.</p> <p>#### Using a globally-installed libvips?</p> <p>Please ensure you are using the latest libvips 8.18.3.</p> <p>### Workarounds Add the following to your code to prevent sharp from decoding GIF, TIFF and VIPS images. ```js sharp.block({ operation: [&#34;VipsForeignLoadNsgif&#34;, &#34;VipsForeignLoadTiff&#34;, &#34;VipsForeignLoadVips&#34;] }); ```</p> <p><strong>Affected:</strong> npm: sharp</p> <p>### Impact</p> <p>A number of vulnerabilities, two rated as &#34;High&#34; severity using CVSSv4, have been discovered and fixed in the upstream libvips dependency.</p> <p>Those processing untrusted input with versions of sharp prior to 0.35.0 are affected.</p> <p>### Patches</p> <p>#### Using prebuilt binaries provided by sharp?</p> <p>Most people rely on the prebuilt binaries provided by sharp.</p> <p>Please upgrade sharp to the latest version, currently 0.35.3, which provides libvips 8.18.3.</p> <p>#### Using a globally-installed libvips?</p> <p>Please ensure you are using the latest libvips 8.18.3.</p> <p>### Workarounds Add the following to your code to prevent sharp from decoding GIF, TIFF and VIPS images. ```js sharp.block({ operation: [&#34;VipsForeignLoadNsgif&#34;, &#34;VipsForeignLoadTiff&#34;, &#34;VipsForeignLoadVips&#34;] }); ```</p> https://cve.radiocsirt.org/vuln/ghsa-f88m-g3jw-g9cj