Security update for nodejs16

This update for nodejs16 fixes the following issues: CVE-2025-23085: memory leak when remote peer abruptly closes socket without sending GOAWAY notification bsc1236250. CVE-2025-23166: improper error handling in async cryptographic operations crashes process bsc1243218. CVE-2025-23167: llhttp:...

PT-2026-99853

Name of the Vulnerable Software and Affected Versions elixir-mint versions 0.1.0 through 1.10.x Description A resource allocation issue allows a malicious HTTP/2 server to force a client to buffer up to approximately 16 MiB per connection in frames that should be rejected, leading to excessive...

CVE-2026-92103: Allocation of Resources Without Limits or Throttling

Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a malicious HTTP/2 server to make the client hold up to about 16 MiB per connection in frames it should reject, consuming client memory. Mint.HTTP2.Frame.decodenext/2 in lib/mint/http2/frame.ex compares ...

PT-2026-99938

Name of the Vulnerable Software and Affected Versions Axios versions 1.13.0 through 1.19.x Description HTTP/2 request setup fails to consistently apply proxy settings and caller-supplied DNS lookup policies. When an HTTPS request is configured with httpVersion: 2 and uses config.proxy or...

CVE-2026-101898: Server-Side Request Forgery (SSRF)

Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Axios HTTP/2 request setup does not consistently apply proxy settings and caller-supplied DNS lookup policy. An HTTPS request uses httpVersion: 2 with explicit config.proxy or environment-derived proxy...

PT-2026-99852

Name of the Vulnerable Software and Affected Versions mint versions 1.1.0 through 1.10.x Description A malicious HTTP/2 server can cause a denial of service by exhausting memory on the client host. The issue occurs because Mint.HTTP2 only enforces the max header list size setting on the compresse...

CVE-2026-91043: Allocation of Resources Without Limits or Throttling

Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a malicious HTTP/2 server to exhaust memory on the client host and cause a denial of service. Mint.HTTP2 enforces the client's maxheaderlistsize setting only on the compressed size of an inbound header...

SUSE SLES16 Security Update : libsoup (SUSE-SU-2026:23857-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:23857-1 advisory. - CVE-2026-85197: heap use-after-free in HTTP/2 client ondataread via GOAWAY during body upload bsc1279238. - CVE-2026-85534: heap...

CLEANSTART-2026-NW24142 When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0

CVE-2026-33814 affects multiple packages. When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGSMAXFRAMESIZE with a value of 0. See references for individual vulnerability details...

CLEANSTART-2026-YT70018 When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface

Security vulnerability affects the loki package. When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface...

Exploit for CVE-2026-86350

abraxaslabs.tech · github.com/abraxas ·&...

OESA-2026-4126 curl security update

cURL is a computer software project providing a library libcurl and command-line tool curl for transferring data using various protocols. Security Fixes: Successfully using libcurl to do a transfer to a specific HTTP origin hostA with Digest authentication and then changing the origin to a...

OESA-2026-4127 curl security update

cURL is a computer software project providing a library libcurl and command-line tool curl for transferring data using various protocols. Security Fixes: Successfully using libcurl to do a transfer to a specific HTTP origin hostA with Digest authentication and then changing the origin to a...

OESA-2026-4128 curl security update

cURL is a computer software project providing a library libcurl and command-line tool curl for transferring data using various protocols. Security Fixes: Successfully using libcurl to do a transfer to a specific HTTP origin hostA with Digest authentication and then changing the origin to a...

OESA-2026-4125 curl security update

cURL is a computer software project providing a library libcurl and command-line tool curl for transferring data using various protocols. Security Fixes: Successfully using libcurl to do a transfer to a specific HTTP origin hostA with Digest authentication and then changing the origin to a...

OESA-2026-4076 libwebsockets security update

Libwebsockets LWS is a flexible, lightweight pure C library for implementing modern network protocols easily with a tiny footprint, using a nonblocking event loop. Security Fixes: libwebsockets HTTP/2 HPACK Path Header Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This...

OESA-2026-4044 libsoup security update

libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications. Security Fixes: A flaw was found in libsoup's WebSocket implementation when using the...

OESA-2026-4043 libsoup security update

libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications. Security Fixes: A flaw was found in libsoup's WebSocket implementation when using the...

OESA-2026-4042 libsoup security update

libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications. Security Fixes: A flaw was found in libsoup's WebSocket implementation when using the...

OESA-2026-4040 libsoup security update

libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications. Security Fixes: A flaw was found in libsoup's WebSocket implementation when using the...