CVE-2026-85594

A flaw was found in Traefik. The software fails to enforce crossProviderNamespaces restrictions on the traefik.ingress.kubernetes.io/service.middlewares Service annotation within the Kubernetes Ingress provider. This vulnerability allows a namespace-limited tenant, even if excluded from the...

CVE-2026-67309

A flaw was found in Traefik. This path traversal vulnerability exists in the Kubernetes Ingress NGINX provider's RewriteTarget middleware. A remote attacker can craft a special request that uses dot-segment traversal to bypass authentication mechanisms like BasicAuth, DigestAuth, or ForwardAuth...

DEBIAN-CVE-2026-87776

compression is a Node.js and Express compression middleware. In versions before 1.8.2, when a client aborts the connection while a compressed response is still being sent, the zlib stream created to compress that response is never destroyed, so each aborted compressed response leaks its native zl...

CVE-2026-87776

compression is a Node.js and Express compression middleware. In versions before 1.8.2, when a client aborts the connection while a compressed response is still being sent, the zlib stream created to compress that response is never destroyed, so each aborted compressed response leaks its native zl...

UBUNTU-CVE-2026-87776

compression is a Node.js and Express compression middleware. In versions before 1.8.2, when a client aborts the connection while a compressed response is still being sent, the zlib stream created to compress that response is never destroyed, so each aborted compressed response leaks its native zl...

CVE-2026-87776

A flaw was found in the compression Node.js and Express middleware. A remote unauthenticated attacker can exploit this vulnerability by repeatedly initiating and then prematurely aborting connections while compressed responses are being sent. This action prevents the zlib stream, used for...

CVE-2026-87776 compression vulnerable to Denial of Service via memory leak on premature response close

compression is a Node.js and Express compression middleware. In versions before 1.8.2, when a client aborts the connection while a compressed response is still being sent, the zlib stream created to compress that response is never destroyed, so each aborted compressed response leaks its native zl...

CVE-2026-87776 compression vulnerable to Denial of Service via memory leak on premature response close

compression is a Node.js and Express compression middleware. In versions before 1.8.2, when a client aborts the connection while a compressed response is still being sent, the zlib stream created to compress that response is never destroyed, so each aborted compressed response leaks its native zl...

CVE-2026-87776 compression vulnerable to Denial of Service via memory leak on premature response close

compression is a Node.js and Express compression middleware. In versions before 1.8.2, when a client aborts the connection while a compressed response is still being sent, the zlib stream created to compress that response is never destroyed, so each aborted compressed response leaks its native zl...

CVE-2026-87776

compression is a Node.js and Express compression middleware. In versions before 1.8.2, when a client aborts the connection while a compressed response is still being sent, the zlib stream created to compress that response is never destroyed, so each aborted compressed response leaks its native zl...

CVE-2026-87859

A flaw was found in morgan, an HTTP request logger middleware for Node.js. An unauthenticated remote attacker can exploit this vulnerability by injecting an unescaped double quote into a log field they control, such as the User-Agent or Referer header. This causes the log field to close...

DEBIAN-CVE-2026-87859

morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField function does not escape the double quote character, which delimits the quoted fields of the Apache combined log format that morgan emits. An unauthenticated remote attacker who controls a value...

CVE-2026-87859

morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField function does not escape the double quote character, which delimits the quoted fields of the Apache combined log format that morgan emits. An unauthenticated remote attacker who controls a value...

CVE-2026-87859 morgan vulnerable to Log Injection via unescaped double quote in quoted log fields

morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField function does not escape the double quote character, which delimits the quoted fields of the Apache combined log format that morgan emits. An unauthenticated remote attacker who controls a value...

CVE-2026-87859

morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1 , the escapeLogField() function fails to escape the double quote character, which delimits quoted fields in the Apache combined log format. An unauthenticated remote attacker who controls a value written to a quote...

CVE-2026-87859 morgan vulnerable to Log Injection via unescaped double quote in quoted log fields

morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField function does not escape the double quote character, which delimits the quoted fields of the Apache combined log format that morgan emits. An unauthenticated remote attacker who controls a value...

PT-2026-89865

Name of the Vulnerable Software and Affected Versions compression versions prior to 1.8.2 Description This Node.js and Express compression middleware contains a memory leak. When a client aborts a connection while a compressed response is being transmitted, the zlib stream used for compression is...

Linux Distros Unpatched Vulnerability : CVE-2026-87859

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField function does not escape the double quote character, whic...

Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization

Summary There is a high-severity request-smuggling vulnerability in Traefik's handling of the HTTP/1.1 Upgrade mechanism. Since Traefik moved to unencrypted HTTP/2 with prior knowledge Go 1.24, a client-initiated Upgrade: h2c request header and its connection-specific HTTP2-Settings header were...

GHSA-W4V4-9RW7-5326 Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization

Summary There is a high-severity request-smuggling vulnerability in Traefik's handling of the HTTP/1.1 Upgrade mechanism. Since Traefik moved to unencrypted HTTP/2 with prior knowledge Go 1.24, a client-initiated Upgrade: h2c request header and its connection-specific HTTP2-Settings header were...