CVE-2026-65833

The iopress native HTTP server for Node.js is vulnerable to a heap-buffer-over-read in the @iopress/core component. The root cause is located in the chunked-transfer-encoding HTTP request parser, which fails to validate input properly and reads past the end of the buffer when a request declares a...