libevent: libevent: Multiple HTTP Parser Bugs Enable Request Smuggling

A flaw was found in libevent. The evhttp parser in libevent's http.c component inconsistently handles HTTP Transfer-Encoding headers and chunked framing. This inconsistency allows an unauthenticated remote attacker to desynchronize request boundaries when libevent is used behind a proxy. Successf...

GHSA-FPH4-WMHF-6FWF vulnerabilities

Vulnerabilities for packages: keep-fips, wazuh-dashboard, opensearch-dashboards-fips, langfuse-fips, tensorflow-gpu-jupyter, wazuh-dashboard-fips, arangodb, prism, tileserver-gl-fips, langfuse, jupyter-base-notebook, tileserver-gl, unleash-fips, keep, kibana, gitlab-rails-ce-fips,...

GHSA-X5FP-WJ9C-MXMX vulnerabilities

Vulnerabilities for packages: dotstatsuite-supercore, pelias-api, code-server, wazuh-dashboard, opensearch-dashboards-fips, langfuse-fips, json-server, argo-workflows, redisinsight, sqlpad, arangodb, prism, tileserver-gl-fips, gitlab-rails-ce, langfuse, commercial-gitlab-rails-ee, tileserver-gl,...

SUSE CVE-2026-14199

Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled syncttl greater than zero are affected. The Auth Proxy cache key concatenated the username and forwarded identity attributes without a delimiter, so distinct identities could collide on one key. An...

SUSE CVE-2026-84377

LiteLLM is a proxy server AI Gateway to call LLM APIs in OpenAI or native format. Prior to versions 1.88.6 and 1.96.2, any authenticated LiteLLM proxy user could redirect an outbound provider call to a destination the user controls and cause the proxy to send its configured provider credentials t...

agent-vault-proxy v1.1.1

Keys on the Wire Your AI agent never holds your API keys. It sends a placeholder; the real secret is swapped in on the wire. Stops credential stealers Shai-Hulud and similar and prompt-injected agents from leaking your secrets. A compromised agent has nothing to take. How it works 1. Your agent...

curl: CVE-2026-86414: leaking host credentials to HTTP proxy

Hi all, I've found that found that an untrusted HTTP proxy can trick libcurl into sending the origin's credentials Basic password, or a Negotiate/Kerberos ticket to the proxy itself, by answering the CONNECT tunnel request with 401 WWW-Authenticate instead of the expected 407 Proxy-Authenticate...

CVE-2026-85124

@fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before forwarding them to the configured upstream. The plain HTTP request handler skips the destination validation that the WebSocket path performs, and the underlying reply-from...

@cedarjs/api-server (>=1.0.0-canary.12281, <=9.0.0-canary.1784), @cedarjs/api-server-watch (>=5.0.7-next.219, <=7.0.0-canary.3116) +41 more potentially affected by CVE-2026-85124 via @fastify/http-proxy (>=11.1.2, <=11.6.1)

@fastify/http-proxy NPM version =11.1.2, =1.0.0-canary.12281, =5.0.7-next.219, =1.0.0-canary.12281, =5.0.4-next.167, =1.0.0-canary.12281, =1.0.0-canary.12281, =4.0.0-canary.13864, =4.0.0-canary.13864, =1.0.0-canary.12281, =3.0.0-alpha-1, =0.0.4, =0.3.0, =0.1.0, =0.4.22 and more Source cves:...

Directory Traversal

Overview @fastify/http-proxy is a proxy http requests, for Fastify Affected versions of this package are vulnerable to Directory Traversal through the HTTP request path handling in index.js, including fastifyHttpProxy and reply.fromParameters. An attacker can bypass rewritePrefix path restriction...

io.netty/netty: Netty: Information disclosure via CORS Vary header overwrite

A flaw was found in Netty, an asynchronous, event-driven network application framework. The CorsHandler component incorrectly replaces application Vary headers, such as Authorization or Cookie, with Origin. This allows a caching proxy or Content Delivery Network CDN to reuse authenticated respons...

io.netty/netty: Netty: Information disclosure via CORS Vary header overwrite

A flaw was found in Netty, an asynchronous, event-driven network application framework. The CorsHandler component incorrectly replaces application Vary headers, such as Authorization or Cookie, with Origin. This allows a caching proxy or Content Delivery Network CDN to reuse authenticated respons...

CVE-2026-85124 @fastify/http-proxy vulnerable to prefix escape via backslash dot-segments

@fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before forwarding them to the configured upstream. The plain HTTP request handler skips the destination validation that the WebSocket path performs, and the underlying reply-from...

CVE-2026-85124 @fastify/http-proxy vulnerable to prefix escape via backslash dot-segments

@fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before forwarding them to the configured upstream. The plain HTTP request handler skips the destination validation that the WebSocket path performs, and the underlying reply-from...

CVE-2026-85124

@fastify/http-proxy versions before 11.6.2 are vulnerable to a path traversal (CWE-22) caused by insufficient validation of backslash-based dot-segments in proxied HTTP request paths. The plain HTTP handler skips the destination validation performed on the WebSocket path, and the underlying reply...

EUVD-2026-70381

@fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before forwarding them to the configured upstream. The plain HTTP request handler skips the destination validation that the WebSocket path performs, and the underlying reply-from...

CVE-2026-85124 @fastify/http-proxy vulnerable to prefix escape via backslash dot-segments

@fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before forwarding them to the configured upstream. The plain HTTP request handler skips the destination validation that the WebSocket path performs, and the underlying reply-from...

BIT-ELASTICSEARCH-2026-78605 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in Elasticsearch Leading to Information Disclosure

Inconsistent Interpretation of HTTP Requests 'HTTP Request Smuggling' CWE-444 in Elasticsearch can lead to information disclosure via HTTP Request Smuggling CAPEC-33. Under specific proxy deployment configurations, a network attacker could obtain confidential responses intended for other...

CVE-2026-43871 vulnerabilities

Vulnerabilities for packages: nri-kafka, telegraf, nri-jmx, jitsucom-bulker, datadog-agent, zipkin, seaweedfs, minio, wavefront-proxy, nri-cassandra, grafana, temporal, tempo, bento, amazon-cloudwatch-agent, jaeger...

GHSA-8WV5-X4W7-5GWW vulnerabilities

Vulnerabilities for packages: nri-kafka, telegraf, nri-jmx, jitsucom-bulker, datadog-agent, zipkin, seaweedfs, minio, wavefront-proxy, nri-cassandra, grafana, temporal, tempo, bento, amazon-cloudwatch-agent, jaeger...