basic-ftp: Uncaught exception crashes the Node.js process when a password (or resumed-download path) contains CR/LF

Summary Client.login calls FTPContext.send from inside the control-socket data event handler. send throws on CR, LF or NUL, and nothing catches the throw. A password containing \r\n therefore raises an uncaught exception and terminates the whole Node.js process. It does not reject the returned...

GHSA-R4JH-29PC-GFQR basic-ftp: Uncaught exception crashes the Node.js process when a password (or resumed-download path) contains CR/LF

Summary Client.login calls FTPContext.send from inside the control-socket data event handler. send throws on CR, LF or NUL, and nothing catches the throw. A password containing \r\n therefore raises an uncaught exception and terminates the whole Node.js process. It does not reject the returned...

CVE-2026-126051

A deferred-callback use-after-destroy in Node.js TLS server handshake handling allows a remote, unauthenticated attacker to terminate the server process. When a TLS server uses any of the SNICallback, OCSPRequest, newSession, or resumeSession hooks, or server.addContext, the corresponding OpenSSL...

CVE-2026-126051 Node.js is vulnerable to a remotely triggerable uncaught exception in TLS servers via deferred handshake callbacks

A deferred-callback use-after-destroy in Node.js TLS server handshake handling allows a remote, unauthenticated attacker to terminate the server process. When a TLS server uses any of the SNICallback, OCSPRequest, newSession, or resumeSession hooks, or server.addContext, the corresponding OpenSSL...

CVE-2024-38355-PoC

CVE-2024-38355 Demo Socket.IO Crash This project is a Proof of Concept demonstrating CVE-2024-38355 , a denial-of-service vulnerability in socket.io. The project was created for educational purposes to show the attack mechanism and how to protect applications. About the Vulnerability CVE-2024-383...

Node.js < 24.22.3, < 26.13.1 - Improper Handling of Deferred TLS Handshake Callbacks After Socket Destruction leading to a Remotely Triggerable Uncaught Exception

Improper Handling of Deferred TLS Handshake Callbacks After Socket Destruction leading to a Remotely Triggerable Uncaught Exception vulnerability discovered by ? in WordPress npm Node.js versions 26.13.1...

multiparty-CVE-2026-8161

CVE-2026-8161 Proof of concept of CVE-2026-8161 Multiparty Description [email protected] and earlier are vulnerable to denial of service through an uncaught exception. The parser stores uploaded fields and files in plain JavaScript objects and does not safely distinguish parser owned keys fr...

CVE-2026-66749-Unchecked-Room-Lookup-Leads-to-Server-Crash-Let-s-Chat-

Security Advisory: Unchecked Room Lookup Leads to Server Crash Let's Chat Assigned CVE ID: CVE-2026-66749 Summary One HTTP request from any logged-in account shuts down the Let's Chat server process. GET /messages takes a room parameter, looks that room up by id, and then calls a method on the...

Security Bulletin: IBM i is Affected by Multiple Vulnerabilities in WebSphere Application Server Liberty

Summary IBM i is vulnerable to multiple vulnerabilities CVE-2026-14532, CVE-2026-79715, CVE-2026-93879, CVE-2026-91865, CVE-2026-91863, CVE-2026-91864, CVE-2026-89058, CVE-2026-89059, CVE-2026-108039, CVE-2026-107937, CVE-2026-10844, CVE-2026-11547, CVE-2026-78636, CVE-2026-103320, CVE-2026-10828...

CVE-2026-120222

undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when the cache interceptor is composed with a downstream handler that throws during response processing such as the built-in dump interceptor exceeding its maxSize, or the decompress interceptor...

Linux Distros Unpatched Vulnerability : CVE-2026-120222

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when the cache interceptor is composed with a downstream handle...

Uncaught Exception

Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Uncaught Exception via the cache interceptor in lib/interceptor/cache.js when it is composed with a downstream handler that throws during response processing. When a cach...

DEBIAN-CVE-2026-120222

undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when the cache interceptor is composed with a downstream handler that throws during response processing such as the built-in dump interceptor exceeding its maxSize, or the decompress interceptor...

AZL-113239 CVE-2026-120222 affecting package nodejs 24.22.1-1

undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when the cache interceptor is composed with a downstream handler that throws during response processing such as the built-in dump interceptor exceeding its maxSize, or the decompress interceptor...

CVE-2026-120222

undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when the cache interceptor is composed with a downstream handler that throws during response processing such as the built-in dump interceptor exceeding its maxSize, or the decompress interceptor...

EUVD-2026-118179

undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when the cache interceptor is composed with a downstream handler that throws during response processing such as the built-in dump interceptor exceeding its maxSize, or the decompress interceptor...

CVE-2026-120222: undici: undici is an HTTP client for Node.js

undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when the cache interceptor is composed with a downstream handler that throws during response processing such as the built-in dump interceptor exceeding its maxSize, or the decompress interceptor...

UBUNTU-CVE-2026-120222

undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when the cache interceptor is composed with a downstream handler that throws during response processing such as the built-in dump interceptor exceeding its maxSize, or the decompress interceptor...

Uncaught Exception

Overview parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Uncaught Exception via an object update that uses a dot notation key targeting the object identifier of a pointer field on a...

Security Bulletin: IBM Edge Data Collector uses multiple third-party libraries that are vulnerable to several security vulnerabilities.

Summary IBM Edge Data Collector uses multiple third-party libraries that are vulnerable to several security vulnerabilities. The CVE details are listed below. This bulletin provides information about the affected components and the remediation for these vulnerabilities. Vulnerability Details...