PT-2026-91806

undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers. This happens when an upstream server delivers part of a body without a trustworthy resume...

toml-node: Prototype Pollution Leads to `Object.prototype` Corruption via `__proto__` Key-Path Desynchronization

Summary toml.parse writes attacker-controlled keys onto Object.prototype. The compiler protects the tables it builds by creating them with Object.createnull, which neutralizes a direct proto table. An attacker bypasses that protection by routing a table path through a scalar value and into the re...

CVE-2026-63376 toml-node: Prototype Pollution Leads to `Object.prototype` Corruption via `__proto__` Key-Path Desynchronization

toml-node is a TOML parser for Node.js and the browser. Prior to 4.1.2, toml.parse in lib/compiler.js can be tricked by a table path such as a.b.y.proto.proto, allowing traversal from a scalar value into Number.prototype and Object.prototype. The currentPath tracking value uses both arrays and...

CVE-2026-63376 toml-node: Prototype Pollution Leads to `Object.prototype` Corruption via `__proto__` Key-Path Desynchronization

toml-node is a TOML parser for Node.js and the browser. Prior to 4.1.2, toml.parse in lib/compiler.js can be tricked by a table path such as a.b.y.proto.proto, allowing traversal from a scalar value into Number.prototype and Object.prototype. The currentPath tracking value uses both arrays and...

CVE-2026-63376

toml-node , a TOML parser for Node.js and the browser, is affected by a prototype pollution vulnerability in toml.parse() (lib/compiler.js) prior to version 4.1.2. The root cause is a key-path desynchronization : currentPath tracking uses both arrays and strings, so valueAssignments records a com...

EUVD-2026-70738

toml-node is a TOML parser for Node.js and the browser. Prior to 4.1.2, toml.parse in lib/compiler.js can be tricked by a table path such as a.b.y.proto.proto, allowing traversal from a scalar value into Number.prototype and Object.prototype. The currentPath tracking value uses both arrays and...

SUSE CVE-2026-48932

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...

CVE-2026-84380

A flaw was found in HTTPX2, a Python HTTP client. The Request.prepare function can incorrectly add a Content-Length header to a request that already includes a Transfer-Encoding header. This conflict in HTTP framing headers can lead to request smuggling or connection desynchronization. This could...

CVE-2026-53600

A flaw was found in async-tar, a library for reading and writing tar archives in Rust. The library incorrectly applies a buffered PAX size extension to an intermediary extension header instead of the intended next file entry. This allows an attacker to craft a malicious tar archive that manipulat...

PT-2026-84846

Name of the Vulnerable Software and Affected Versions HTTPX2 versions prior to 2.11.0 Description The Request. prepare function in src/httpx2/httpx2/ models.py can add a body-derived Content-Length header to a request that already contains a caller-supplied Transfer-Encoding header. This occurs...

CVE-2026-84380: Inconsistent Interpretation of HTTP Requests

HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, Request.prepare in src/httpx2/httpx2/models.py can add a body-derived Content-Length header to a request that already contains a caller-supplied Transfer-Encoding header because its setdefault processing checks each default head...

CVE-2021-31188

creationtimestamp| type| source ---|---|--- 2026-09-01 20:02:42+00:00| seen| https://t.me/hackingAttack/8312 2026-09-02 01:03:18+00:00| seen| https://t.me/hackingAttack/8312 2026-09-08 07:00:05+00:00| seen| https://t.me/hackingAttack/8312 2026-09-09 00:00:39+00:00| seen|...

UBUNTU-CVE-2026-48932

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...

CVE-2026-48932

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...

CVE-2026-48932

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...

CVE-2026-48932

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...

CVE-2026-48932

A flaw in the Node.js HTTP client can cause request desynchronization in Node.js-based forwarding proxies that rebuild outbound headers from visible IncomingMessage headers while piping the original body to a reused backend connection. The root cause is that Node.js may omit headers beyond maxHea...

EUVD-2026-68923

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...

CVE-2026-48932: Inconsistent Interpretation of HTTP Requests

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...

PT-2026-84072

Name of the Vulnerable Software and Affected Versions Node.js version 22 Node.js version 24 Node.js version 26 Description A flaw in the HTTP client can cause request desynchronization for forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the...