Important: Red Hat Security Advisory: nodejs22 security update

An update for nodejs22 is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

undici: undici: Denial of Service via unrequested WebSocket subprotocol

A flaw was found in undici. A remote attacker can exploit this vulnerability by responding with an unrequested WebSocket subprotocol during the opening handshake. This causes the undici WebSocket client to crash the entire Node.js process, leading to a denial of service DoS...

Exploit for Missing Authentication for Critical Function in Coreweave Marimo

CVE-2026-39987 - Marimo Pre-Auth RCE xpl0ited by infrar3dh...

undici: undici: Denial of Service via unrequested WebSocket subprotocol

A flaw was found in undici. A remote attacker can exploit this vulnerability by responding with an unrequested WebSocket subprotocol during the opening handshake. This causes the undici WebSocket client to crash the entire Node.js process, leading to a denial of service DoS...

Important: Red Hat Security Advisory: nodejs:22 security update

An update for the nodejs:22 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

FreeRDP: FreeRDP: Denial of Service via integer overflow and double free in WinPR

A flaw was found in FreeRDP. A remote attacker, specifically a malicious RD Gateway peer, could send a crafted WebSocket Ping frame with an extended payload length. This action triggers an an integer overflow in the StreamEnsureRemainingCapacity function, leading to an integer wraparound and a...

ALSA-2026:75864 Important: nodejs22 security update

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed...

ALSA-2026:75870 Important: nodejs:22 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function CVE-2026-9496 undici: undici: Denial of Service via...

Important: nodejs:22 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function CVE-2026-9496 undici: undici: Denial of Service via...

RockyLinux 8 : nodejs:22 (RLSA-2026:75870)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:75870 advisory. pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function CVE-2026-9496 undici: undici: Denial of Service via unrequested...

RHEL 10 : nodejs22 (RHSA-2026:75864)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:75864 advisory. Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an...

RHEL 8 : nodejs:22 (RHSA-2026:75870)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:75870 advisory. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language...

Malicious code in ultimate-websocket (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7574e423b830695141ee6e089006e0c355109e240c69881512806869cfee8114 package.json declares its only dependency node-net-pool as a bare tarball URL pointing at the mutable main branch of an unrelated GitHub user...

MAL-2026-17529 Malicious code in ultimate-websocket (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7574e423b830695141ee6e089006e0c355109e240c69881512806869cfee8114 package.json declares its only dependency node-net-pool as a bare tarball URL pointing at the mutable main branch of an unrelated GitHub user...

Security Bulletin: Due to the use of Jetty, IBM Sterling Control Center is vulnerable to Allocation of Resources Without Limits or Throttling (CVE-2026-19204)

Summary Jetty is used by IBM Sterling Control Center as part of dependency in jetty-websocket-core-common-12.0.25.jar. Vulnerability Details CVEID:CVE-2026-19204 DESCRIPTION: A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to...

EUVD-2026-91824

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate charging stations. As a result, attackers can exploit this weakness to gain unauthorized access to sensitive data or perform unauthorized actions. Given that no authentication is required, this can lead t...

EUVD-2026-91821

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers. This vulnerability may allow unauthorized users to authenticate as oth...

EUVD-2026-91822

The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks or brute-force attacks to gain unauthorized access...

Linux Distros Unpatched Vulnerability : CVE-2026-92834

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use of uninitialized resource, Return of wrong status code vulnerability in Apache Thrift C++ WebSocket server. This issue affects Apache Thrift: before 0.25.0...

Headroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH)

Summary The Headroom WebSocket server does not validate the Origin header of incoming client WebSocket requests before forwarding the request to the upstream server, allowing malicious WebSocket clients to perform arbitrary LLM requests without authentication. This can be exploited by a malicious...