PT-2026-3452

Name of the Vulnerable Software and Affected Versions @fastify/express versions prior to 4.0.3 Description A security issue exists in the @fastify/express plugin, which provides Express compatibility for Fastify. The problem occurs when middleware is registered with a specific path prefix...

PT-2026-3448

Name of the Vulnerable Software and Affected Versions @fastify/middie versions prior to 9.1.0 Description A security issue exists in @fastify/middie where middleware registered with a specific path prefix can be bypassed using URL-encoded characters. For example, using /%61dmin instead of /admin...

PT-2026-3495

Name of the Vulnerable Software and Affected Versions MyTube versions prior to 1.7.66 Description MyTube is a self-hosted downloader and player for several video websites. A flaw allows unauthenticated users to bypass the authentication check in the roleBasedAuthMiddleware. By not providing an...

OpenStack Keystone Middleware security vulnerabilities

OpenStack Keystone Middleware is a core certification component of the OpenStack open-source project. Vulnerabilities exist in versions prior to 10.7.2, 10.9.1, and 10.12.1 of OpenStack Keystone Middleware. These vulnerabilities stem from uncleaned authentication headers, which may lead to...

@fastify/express security vulnerability

@fastify/express is a compatibility plugin developed by Fastify. Versions of @fastify/express prior to 4.0.3 contained security vulnerabilities. These vulnerabilities were caused by improper path prefix matching, which could allow middleware to bypass security checks...

CVE-2026-23634

Pepr is a type safe K8s middleware. Prior to 1.0.5 , Pepr defaults to a cluster-admin RBAC configuration and does not explicitly force or enforce least-privilege guidance for module authors. The default behavior exists to make the “getting started” experience smooth: new users can experiment with...

ai_bouncer

AiBouncer AI-powered HTTP request classification for Ruby on...

CVE-2026-23634

Pepr is a type safe K8s middleware. Prior to 1.0.5 , Pepr defaults to a cluster-admin RBAC configuration and does not explicitly force or enforce least-privilege guidance for module authors. The default behavior exists to make the “getting started” experience smooth: new users can experiment with...

CVE-2026-23634

Pepr is a type safe K8s middleware. Prior to 1.0.5 , Pepr defaults to a cluster-admin RBAC configuration and does not explicitly force or enforce least-privilege guidance for module authors. The default behavior exists to make the “getting started” experience smooth: new users can experiment with...

CVE-2026-23634 Pepr Overly Permissive RBAC ClusterRole in Admin Mode

Pepr is a type safe K8s middleware. Prior to 1.0.5 , Pepr defaults to a cluster-admin RBAC configuration and does not explicitly force or enforce least-privilege guidance for module authors. The default behavior exists to make the “getting started” experience smooth: new users can experiment with...

Pepr security vulnerabilities

Pepr is a middleware open source by Defense Unicorns. Versions of Pepr prior to 1.0.5 contained security vulnerabilities. These vulnerabilities stemmed from the default use of RBAC configuration for cluster administrators, without enforcing the principle of least privilege...

Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect via the RedirectSlashes function. An attacker can redirect users to an external, attacker-controlled website by crafting a specially formatted URL containing backslashes, which browsers interpret as a protocol-relative...

Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect via the RedirectSlashes function. An attacker can redirect users to an external, attacker-controlled website by crafting a specially formatted URL containing backslashes, which browsers interpret as a protocol-relative...

GHSA-MQQF-5WVP-8FH8 chi has an open redirect vulnerability in the RedirectSlashes middleware

Summary The RedirectSlashes function in middleware/strip.go does not perform correct input validation and can lead to an open redirect vulnerability. Details The RedirectSlashes function performs a Trim to all forward slash / characters, while prepending a single one at the begining of the path...

chi has an open redirect vulnerability in the RedirectSlashes middleware

Summary The RedirectSlashes function in middleware/strip.go does not perform correct input validation and can lead to an open redirect vulnerability. Details The RedirectSlashes function performs a Trim to all forward slash / characters, while prepending a single one at the begining of the path...

EUVD-2026-2446

chi has an open redirect vulnerability in the RedirectSlashes middleware...

GHSA-3VHC-576X-3QV4 Hono JWK Auth Middleware has JWT algorithm confusion when JWK lacks "alg" (untrusted header.alg fallback)

Summary A flaw in Hono’s JWK/JWKS JWT verification middleware allowed the algorithm specified in the JWT header to influence signature verification when the selected JWK did not explicitly define an algorithm. This could enable JWT algorithm confusion and, in certain configurations, allow forged...

GHSA-F67F-6CW9-8MQ4 Hono JWT Middleware's JWT Algorithm Confusion via Unsafe Default (HS256) Allows Token Forgery and Auth Bypass

Summary A flaw in Hono’s JWK/JWKS JWT verification middleware allowed the JWT header’s alg value to influence signature verification when the selected JWK did not explicitly specify an algorithm. This could enable JWT algorithm confusion and, in certain configurations, allow forged tokens to be...

CVE-2026-22817

Hono JWT verification middleware (JWK/JWKS) allowed the JWT header alg to influence signature checks if the JWK didn’t specify an algorithm, enabling potential JWT algorithm confusion and, in some configurations, forged tokens. This CVE affects Hono prior to version 4.11.4. The vulnerability is f...

CVE-2026-22817 JWT Algorithm Confusion via Unsafe Default (HS256) in Hono JWT Middleware Allows Token Forgery and Auth Bypass

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.11.4, there is a flaw in Hono’s JWK/JWKS JWT verification middleware allowed the JWT header’s alg value to influence signature verification when the selected JWK did not explicitly specify an algorith...