joi: Quadratic regular-expression backtracking in `Joi.string().isoDate()`

Impact Any application that validates a user-supplied string with Joi.string.isoDate can be stalled by a single request. One of the regular expressions the rule runs over the input was unanchored, so a valid ISO date followed by a long run of fractional-second digits made the regex engine restart...

NPM: joi: Quadratic regular-expression backtracking in `Joi.string().isoDate()`

NPM: joi: Quadratic regular-expression backtracking in Joi.string.isoDate vulnerability discovered by ? in WordPress Npm joi versions = 17.2.0, 17.13.7...

GHSA-6H2X-M376-MQJQ joi: Quadratic regular-expression backtracking in `Joi.string().isoDate()`

Impact Any application that validates a user-supplied string with Joi.string.isoDate can be stalled by a single request. One of the regular expressions the rule runs over the input was unanchored, so a valid ISO date followed by a long run of fractional-second digits made the regex engine restart...

EUVD-2026-81261

OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full...

EUVD-2026-81260

OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation...

NPM: markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds

NPM: markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds vulnerability discovered by ? in WordPress Npm markdown-it versions 14.3.1...

GHSA-253C-MCHW-3W2R markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds

Summary Two independent quadratic paths in the linkify: true handling. Both are in markdown-it's own code rather than in linkify-it, which stays linear on both payloads. src/rulescore/linkify.ts calls arrayReplaceAt once per linkified text token, and that rebuilds the whole children array each...

markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds

Summary Two independent quadratic paths in the linkify: true handling. Both are in markdown-it's own code rather than in linkify-it, which stays linear on both payloads. src/rulescore/linkify.ts calls arrayReplaceAt once per linkified text token, and that rebuilds the whole children array each...

NPM: js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

NPM: js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources vulnerability discovered by ? in WordPress Npm js-yaml versions = 5.0.0, = 5.4.0...

CVE-2026-102728

Two client-side TLS/DTLS handshake parsers in NetX Secure read fields from a server-supplied message before validating that the message is long enough to contain them. Both are bounded out-of-bounds reads on a remotely reachable path, both are reached from a TLS or DTLS client connecting to a...

EUVD-2026-89195

Two client-side TLS/DTLS handshake parsers in NetX Secure read fields from a server-supplied message before validating that the message is long enough to contain them. Both are bounded out-of-bounds reads on a remotely reachable path, both are reached from a TLS or DTLS client connecting to a...

CVE-2026-102728

The NetX Secure software contains two out-of-bounds reads within its client-side TLS/DTLS handshake parsers . The vulnerability occurs because the parsers read fields from a server-supplied message before validating that the message is sufficiently long. Although bounds checks are present and fun...

CVE-2026-102728

Two client-side TLS/DTLS handshake parsers in NetX Secure read fields from a server-supplied message before validating that the message is long enough to contain them. Both are bounded out-of-bounds reads on a remotely reachable path, both are reached from a TLS or DTLS client connecting to a...

CVE-2026-102716

An unauthenticated client can cause a Denial of Service (DoS) on an RTSP server by draining its packet pool. The vulnerability exists in the Session branch of the parser within nx_rtsp_server.c, where a failure in _nx_utility_string_to_uint returns a raw NetX error code instead of a proper RTSP s...

EUVD-2026-89180

An unauthenticated client can drain the RTSP server's packet pool with a couple of dozen requests that carry a Session header the parser cannot convert. The Session branch returns the raw NetX error code instead of an RTSP status code: c / addons/rtsp/nxrtspserver.c:2754 / status =...

CVE-2026-102716

An unauthenticated client can drain the RTSP server's packet pool with a couple of dozen requests that carry a Session header the parser cannot convert. The Session branch returns the raw NetX error code instead of an RTSP status code: c / addons/rtsp/nxrtspserver.c:2754 / status =...

CVE-2026-102716

An unauthenticated client can drain the RTSP server's packet pool with a couple of dozen requests that carry a Session header the parser cannot convert. The Session branch returns the raw NetX error code instead of an RTSP status code: c / addons/rtsp/nxrtspserver.c:2754 / status =...

CVE-2026-102716

An unauthenticated client can drain the RTSP server's packet pool with a couple of dozen requests that carry a Session header the parser cannot convert. The Session branch returns the raw NetX error code instead of an RTSP status code: c / addons/rtsp/nxrtspserver.c:2754 / status =...

CVE-2026-97906

A flaw was found in the Linux kernel. A local attacker with the ability to supply a crafted initial RAM disk initrd can trigger an integer overflow during boot configuration parsing. This flaw allows the attacker to bypass memory bounds checks, causing the system to read unmapped memory and crash...

CVE-2026-102714

nxicmpv6validateoptions scans the option area with while length 2 common/src/nxicmpv6validateoptions.c:79. An area whose size leaves a one- or two-byte residue exits the loop with that tail unexamined; the residue is not negative, so the function returns NXSUCCESS. Its zero-length rejection never...