https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 11:04:15 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1233 certfr-2026-avi-1233 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1233 https://cve.radiocsirt.org/vuln/cleanstart-2026-bg21634 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: langfuse-worker</p> <p>Package langfuse-worker version 3.216.0-r1 fixes 29 vulnerabilities: ghsa-frvp-7c67-39w9, ghsa-p63j-vcc4-9vmv, ghsa-55q2-fjhq-7xh7, ghsa-c2j3-45gr-mqc4, CVE-2026-69192...</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: langfuse-worker</p> <p>Package langfuse-worker version 3.216.0-r1 fixes 29 vulnerabilities: ghsa-frvp-7c67-39w9, ghsa-p63j-vcc4-9vmv, ghsa-55q2-fjhq-7xh7, ghsa-c2j3-45gr-mqc4, CVE-2026-69192...</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-bg21634 https://cve.radiocsirt.org/vuln/euvd-2026-342741 EUVD-2026-342741 https://cve.radiocsirt.org/vuln/euvd-2026-342741 https://cve.radiocsirt.org/vuln/fkie_cve-2026-15157 <p>undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, an application that passes a hand-rolled blob-like body (via request, stream, pipeline, or dispatch) whose type is derived from untrusted input allows an attacker to inject CRLF sequences and append arbitrary HTTP headers, potentially smuggling a second request past the upstream. Native Blob objects are safe because their constructor strips CRLF from the type, and fetch is unaffected because it validates headers, but ecosystem libraries that build duck-typed blob shapes from user input can reach the vulnerable path. This is the same defect class as CVE-2022-35948 and CVE-2026-1527, on a header sink that the earlier fixes did not cover. The issue is fixed in undici 6.28.0, 7.29.0, and 8.9.0.</p> <p>undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, an application that passes a hand-rolled blob-like body (via request, stream, pipeline, or dispatch) whose type is derived from untrusted input allows an attacker to inject CRLF sequences and append arbitrary HTTP headers, potentially smuggling a second request past the upstream. Native Blob objects are safe because their constructor strips CRLF from the type, and fetch is unaffected because it validates headers, but ecosystem libraries that build duck-typed blob shapes from user input can reach the vulnerable path. This is the same defect class as CVE-2022-35948 and CVE-2026-1527, on a header sink that the earlier fixes did not cover. The issue is fixed in undici 6.28.0, 7.29.0, and 8.9.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-15157 https://cve.radiocsirt.org/vuln/ghsa-m8rv-5g2x-5cg5 <p><strong>Affected:</strong> npm: undici</p> <p>### Impact</p> <p>When an application passes a duck-typed blob-like body to undici&#39;s HTTP/1.1 dispatcher (via `request()`, `stream()`, `pipeline()`, or `dispatch()`) with a `.type` derived from untrusted input, an attacker can inject CRLF sequences (`\r\n`) to append arbitrary HTTP headers and potentially smuggle a second request past the upstream.</p> <p>The vulnerable branch in `lib/dispatcher/client-h1.js` pushes `body.type` directly into the outgoing headers with no validation, while every other header path in undici goes through `isValidHeaderValue()`:</p> <p>```javascript } else if (util.isBlobLike(body) &amp;&amp; request.contentType == null &amp;&amp; body.type) { headers.push(&#39;content-type&#39;, body.type) // bypasses isValidHeaderValue() } ```</p> <p>The bug requires a hand-rolled duck-typed blob object or a Blob subclass with a controlled `.type`. Native `Blob` is safe because its constructor strips CRLF from `.type`. `fetch()` is unaffected because it validates via the `Headers` class. Ecosystem consumers that build duck-typed blob shapes from user input include `form-data-encoder`, `formdata-polyfill`, and `formdata-node`.</p> <p>Same defect class as `CVE-2022-35948` (explicit `content-type` sink, fixed in undici 5.8.2) and `CVE-2026-1527` (`upgrade` option sink, fixed in 6.24.0 / 7.24.0), both closed by adding `isValidHeaderValue()` on their respective sinks. This branch was missed.</p> <p>### Patches</p> <p>Patched in undici v6.28.0, v7.29.0, and v8.9.0. Users should upgrade to one of these versions or later.</p> <p>### Wor…</p> <p><strong>Affected:</strong> npm: undici</p> <p>### Impact</p> <p>When an application passes a duck-typed blob-like body to undici&#39;s HTTP/1.1 dispatcher (via `request()`, `stream()`, `pipeline()`, or `dispatch()`) with a `.type` derived from untrusted input, an attacker can inject CRLF sequences (`\r\n`) to append arbitrary HTTP headers and potentially smuggle a second request past the upstream.</p> <p>The vulnerable branch in `lib/dispatcher/client-h1.js` pushes `body.type` directly into the outgoing headers with no validation, while every other header path in undici goes through `isValidHeaderValue()`:</p> <p>```javascript } else if (util.isBlobLike(body) &amp;&amp; request.contentType == null &amp;&amp; body.type) { headers.push(&#39;content-type&#39;, body.type) // bypasses isValidHeaderValue() } ```</p> <p>The bug requires a hand-rolled duck-typed blob object or a Blob subclass with a controlled `.type`. Native `Blob` is safe because its constructor strips CRLF from `.type`. `fetch()` is unaffected because it validates via the `Headers` class. Ecosystem consumers that build duck-typed blob shapes from user input include `form-data-encoder`, `formdata-polyfill`, and `formdata-node`.</p> <p>Same defect class as `CVE-2022-35948` (explicit `content-type` sink, fixed in undici 5.8.2) and `CVE-2026-1527` (`upgrade` option sink, fixed in 6.24.0 / 7.24.0), both closed by adding `isValidHeaderValue()` on their respective sinks. This branch was missed.</p> <p>### Patches</p> <p>Patched in undici v6.28.0, v7.29.0, and v8.9.0. Users should upgrade to one of these versions or later.</p> <p>### Wor…</p> https://cve.radiocsirt.org/vuln/ghsa-m8rv-5g2x-5cg5 https://cve.radiocsirt.org/vuln/msrc_cve-2026-15157 msrc_CVE-2026-15157 https://cve.radiocsirt.org/vuln/msrc_cve-2026-15157 https://cve.radiocsirt.org/vuln/rhsa-2026:48273 <p>undici: undici: Information disclosure and Denial of Service via malformed Cache-Control directives undici: undici: Cross-user information disclosure due to improper Cache-Control directive parsing undici: undici: HTTP header injection via unvalidated blob-like body type property undici: undici: Response desynchronization via retry interceptor with mismatched Content-Length undici: Undici: Cookie attribute injection allows bypassing security protections nodejs: Node.js: Permission Model flaw allows trace logs to bypass filesystem write restrictions nodejs: Node.js: mTLS client identities can be reused due to HTTPS Agent connection flaw nodejs: Information disclosure due to improper permission enforcement nodejs: HTTPS Agent TLS session reuse skips hostname verification nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw</p> <p>undici: undici: Information disclosure and Denial of Service via malformed Cache-Control directives undici: undici: Cross-user information disclosure due to improper Cache-Control directive parsing undici: undici: HTTP header injection via unvalidated blob-like body type property undici: undici: Response desynchronization via retry interceptor with mismatched Content-Length undici: Undici: Cookie attribute injection allows bypassing security protections nodejs: Node.js: Permission Model flaw allows trace logs to bypass filesystem write restrictions nodejs: Node.js: mTLS client identities can be reused due to HTTPS Agent connection flaw nodejs: Information disclosure due to improper permission enforcement nodejs: HTTPS Agent TLS session reuse skips hostname verification nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw</p> https://cve.radiocsirt.org/vuln/rhsa-2026:48273 https://cve.radiocsirt.org/vuln/suse-su-2026:4248-1 <p>Security update for nodejs18</p> <p>Security update for nodejs18</p> https://cve.radiocsirt.org/vuln/suse-su-2026:4248-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-15157 <p><strong>Affected:</strong> Ubuntu:24.04:LTS: node-undici, Ubuntu:26.04:LTS: node-undici</p> <p>undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, an application that passes a hand-rolled blob-like body (via request, stream, pipeline, or dispatch) whose type is derived from untrusted input allows an attacker to inject CRLF sequences and append arbitrary HTTP headers, potentially smuggling a second request past the upstream. Native Blob objects are safe because their constructor strips CRLF from the type, and fetch is unaffected because it validates headers, but ecosystem libraries that build duck-typed blob shapes from user input can reach the vulnerable path. This is the same defect class as CVE-2022-35948 and CVE-2026-1527, on a header sink that the earlier fixes did not cover. The issue is fixed in undici 6.28.0, 7.29.0, and 8.9.0.</p> <p><strong>Affected:</strong> Ubuntu:24.04:LTS: node-undici, Ubuntu:26.04:LTS: node-undici</p> <p>undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, an application that passes a hand-rolled blob-like body (via request, stream, pipeline, or dispatch) whose type is derived from untrusted input allows an attacker to inject CRLF sequences and append arbitrary HTTP headers, potentially smuggling a second request past the upstream. Native Blob objects are safe because their constructor strips CRLF from the type, and fetch is unaffected because it validates headers, but ecosystem libraries that build duck-typed blob shapes from user input can reach the vulnerable path. This is the same defect class as CVE-2022-35948 and CVE-2026-1527, on a header sink that the earlier fixes did not cover. The issue is fixed in undici 6.28.0, 7.29.0, and 8.9.0.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-15157 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3596 <p>Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren und um einen Cross-Site Scripting Angriff durchzuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren und um einen Cross-Site Scripting Angriff durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3596