EUVD-2026-125628

Nuxt: Incomplete fix for GHSA-9v7c-q64q-vv33: a leading // in the request path bypasses server/middleware path checks and server route rules on page routes...

Nuxt: Incomplete fix for GHSA-9v7c-q64q-vv33: a leading `//` in the request path bypasses `server/middleware` path checks and server route rules on page routes

Summary Since 4.6.0, Nuxt parses a request path that starts with // as a URL with a host before rendering a page, so //x/admin renders the page at /admin. Nitro's routing, Nitro's route rules and server/middleware see the path as //x/admin, so server-side checks keyed on /admin do not apply. The...

GHSA-R99W-JH2X-3MG9 Nuxt: Incomplete fix for GHSA-9v7c-q64q-vv33: a leading `//` in the request path bypasses `server/middleware` path checks and server route rules on page routes

Summary Since 4.6.0, Nuxt parses a request path that starts with // as a URL with a host before rendering a page, so //x/admin renders the page at /admin. Nitro's routing, Nitro's route rules and server/middleware see the path as //x/admin, so server-side checks keyed on /admin do not apply. The...

CVE-2026-128088

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to version 0.65.1, trysign captures an Arc before awaiting Agent::confirm and does not revalidate the shared lock state or key presence after the await. This is a distinct residual defect in th...

CVE-2026-128088

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to version 0.65.1, trysign captures an Arc before awaiting Agent::confirm and does not revalidate the shared lock state or key presence after the await. This is a distinct residual defect in th...

CVE-2026-128088 russh try_sign: asynchronous confirmation can sign after agent lock

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to version 0.65.1, trysign captures an Arc before awaiting Agent::confirm and does not revalidate the shared lock state or key presence after the await. This is a distinct residual defect in th...

GHSA-Q7GW-24FR-5P69 opentelemetry-go: AttributeValueLengthLimit is fully bypassed by attribute values composed of valid U+FFFD runes

Summary The AttributeValueLengthLimit span/log-record limit can be bypassed entirely with attribute values that consist of valid U+FFFD REPLACEMENT CHARACTER runes. The counting-based truncation introduced by the fix for GHSA-p9f8-wvj8-2fg8 commit e016a78c9, first released in v1.33.0 has an...

CVE-2026-128077

Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.4, Nuxt parses a request path beginning with // as a URL host before rendering a page, while Nitro server/middleware and routeRules continue to evaluate the original path. An unauthenticated request such as //x/admi...

EUVD-2026-125682

Authentication bypass by spoofing vulnerability in Apache APISIX. On routes using jwe-decrypt with strict: false and a forwardheader distinct from the token header an unauthenticated client can supply the value the upstream treats as gateway-decrypted plaintext. Similar can happen when forward-au...

CVE-2026-124679

Apache APISIX versions 3.18.0 through 3.19.0 are vulnerable to an authentication bypass by spoofing vulnerability. The root cause occurs when routes use jwe-decrypt with strict: false and a forward_header distinct from the token header, allowing unauthenticated clients to supply values treated as...

EUVD-2026-125681

Incorrect Authorization vulnerability in Apache APISIX. An authenticated user who holds any one of a route's required permissions or scopes can reach the protected upstream without the others, including HTTP methods the authorization server denied. This issue affects Apache APISIX: from 1.4.0...

CVE-2026-124666

Apache APISIX versions 3.8.0 through 3.19.0 are vulnerable to an authentication bypass by spoofing (CWE-290). The root cause is that during multi-auth processes, if the system falls back from wolf-rbac to another successful authenticator, client-supplied Wolf identity headers may persist in the r...

EUVD-2026-125679

Authentication bypass by spoofing vulnerability in Apache APISIX. On a route where multi-auth falls back from wolf-rbac to another successful authenticator, client-supplied Wolf identity headers can remain in the request. A downstream service that relies on those documented headers may therefore...

CVE-2026-124680

Apache APISIX versions 0.9 through 3.19.0 are vulnerable to an Interpretation Conflict leading to Incorrect Authorization . An unauthenticated client can bypass route-level auth plugins by accessing upstream paths when a route without authentication exists on the same upstream, provided the upstr...

CVE-2026-124680 Apache APISIX: Route-level authentication bypass via path normalization mismatch between routing and upstream forwarding

Interpretation Conflict, resulting in Incorrect Authorization vulnerability in Apache APISIX. An unauthenticated client can reach upstream paths protected by a route-level auth plugin when a route without auth exists on the same upstream and the upstream does not collapse encoded dot segments. Th...

CVE-2026-124719

Apache APISIX versions 3.19.0 through 3.19.x are vulnerable to an authentication bypass by spoofing in the openapi-to-mcp component. The vulnerability occurs when a Route's configured headers carry a caller identity while the OpenAPI document declares the same header, allowing a caller to imperso...

CVE-2026-124719 Apache APISIX: identity spoofing in openapi-to-mcp

Authentication bypass by spoofing vulnerability in Apache APISIX. When a Route's configured headers carry a caller identity and the OpenAPI document declares the same header, a caller can act as another identity against the upstream API. This issue affects Apache APISIX: from 3.19.0 before 3.20.0...

EUVD-2026-125677

Authentication bypass by spoofing vulnerability in Apache APISIX. When a Route's configured headers carry a caller identity and the OpenAPI document declares the same header, a caller can act as another identity against the upstream API. This issue affects Apache APISIX: from 3.19.0 before 3.20.0...

CVE-2026-128077 Nuxt: Incomplete fix for CVE-2026-119200: a leading `//` in the request path bypasses `server/middleware` path checks and server route rules on page routes

Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.4, Nuxt parses a request path beginning with // as a URL host before rendering a page, while Nitro server/middleware and routeRules continue to evaluate the original path. An unauthenticated request such as //x/admi...

CVE-2026-128077

The Nuxt web development framework (versions 4.6.0 through 4.6.4 ) is vulnerable to an interpretation conflict where request paths beginning with // are incorrectly parsed as URL hosts. Because Nitro server/middleware and routeRules evaluate the original path while the renderer uses the parsed ho...