SUSE-SU-2026:4212-1 Security update for distribution

This update for distribution fixes the following issues: Security issues fixed: - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header bsc1260283. - CVE-2026-33540: information disclosure via improper validation of authenticati...

Uncaught Exception

Overview fastify is an overhead web framework, for Node.js. Affected versions of this package are vulnerable to Uncaught Exception via the reply.trailer function when handling HTTP/2 trailer responses. An attacker can cause the server process to crash and terminate all active requests by sending ...

CVE-2026-92081

A flaw was found in fastify. When a route registers a response trailer and is served over HTTP/2, fastify incorrectly sets the 'Transfer-Encoding: chunked' header. This leads to an unhandled exception in Node.js, causing the server process to crash and resulting in a Denial of Service DoS. A...

CVE-2026-92081

fastify is a fast and low-overhead web framework for Node.js. In versions before 5.12.5, when a route registers a response trailer via reply.trailer and is served over HTTP/2, fastify unconditionally sets the Transfer-Encoding: chunked header, which is forbidden on HTTP/2, so Node.js throws while...

CVE-2026-92081 fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses

fastify is a fast and low-overhead web framework for Node.js. In versions before 5.12.5, when a route registers a response trailer via reply.trailer and is served over HTTP/2, fastify unconditionally sets the Transfer-Encoding: chunked header, which is forbidden on HTTP/2, so Node.js throws while...

CVE-2026-92081

fastify (a Node.js web framework) versions before 5.12.5 are vulnerable to a Denial of Service when a route registers a response trailer via reply.trailer() and is served over HTTP/2 . The root cause is that fastify unconditionally sets the Transfer-Encoding: chunked header, which is forbidden on...

CVE-2026-86043: Incorrect Authorization

Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.27.37, the opaAuthorizeRequestWithBody filter can authorize an oversized request after Skipper truncates the body presented to Open Policy Agent because the input.truncatedbody signal is derived from...

PT-2026-93918

Name of the Vulnerable Software and Affected Versions Skipper versions prior to 0.27.37 Description Skipper is an HTTP router and reverse proxy for service composition. The opaAuthorizeRequestWithBody filter can authorize oversized requests by incorrectly signaling the truncation state to the Ope...

CVE-2026-92081: Uncaught Exception

fastify is a fast and low-overhead web framework for Node.js. In versions before 5.12.5, when a route registers a response trailer via reply.trailer and is served over HTTP/2, fastify unconditionally sets the Transfer-Encoding: chunked header, which is forbidden on HTTP/2, so Node.js throws while...

PT-2026-93404

Name of the Vulnerable Software and Affected Versions fastify versions prior to 5.12.5 Description When a route registers a response trailer using the reply.trailer function and is served over HTTP/2, the framework unconditionally sets the Transfer-Encoding: chunked header. Because this header is...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS in the readLoop process. An attacker can exhaust system memory by sending HTTP/2 frames with a declared payload size significantly larger than the configured maximum, causing the server or client to buffer excessiv...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS in the readLoop process. An attacker can exhaust system memory by sending HTTP/2 frames with a declared payload size significantly larger than the configured maximum, causing the server or client to buffer excessiv...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS in the readLoop process. An attacker can exhaust system memory by sending HTTP/2 frames with a declared payload size significantly larger than the configured maximum, causing the server or client to buffer excessiv...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS due to the unbounded queue used for outbound HTTP/2 frames. An attacker can exhaust server memory by continuously sending frames that trigger the server to enqueue responses faster than they are processed. Workarou...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS due to the unbounded queue used for outbound HTTP/2 frames. An attacker can exhaust server memory by continuously sending frames that trigger the server to enqueue responses faster than they are processed. Workarou...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS due to the unbounded queue used for outbound HTTP/2 frames. An attacker can exhaust server memory by continuously sending frames that trigger the server to enqueue responses faster than they are processed. Workarou...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS due to the lack of enforcement of SETTINGSMAXCONCURRENTSTREAMS in HTTP/2 connections. Details Denial of Service DoS describes a family of attacks, all aimed at making a system inaccessible to its intended and...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS due to the lack of enforcement of SETTINGSMAXCONCURRENTSTREAMS in HTTP/2 connections. Details Denial of Service DoS describes a family of attacks, all aimed at making a system inaccessible to its intended and...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS due to the lack of enforcement of SETTINGSMAXCONCURRENTSTREAMS in HTTP/2 connections. Details Denial of Service DoS describes a family of attacks, all aimed at making a system inaccessible to its intended and...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS in the HTTP/2 flow-control process. An attacker can exhaust system memory by sending data faster than it is consumed by the application, causing unbounded buffering and potential service disruption. Details Denial ...