CVE-2026-19534: Uncaught Exception

undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes a Sec-WebSocket-Protocol header, undic...

CVE-2026-85024: Uncaught Exception

undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error listener, while that stream can still emit. When a remote peer sends a compressed payload that crosses the built-in 128 MiB...

PT-2026-85807

Name of the Vulnerable Software and Affected Versions undici versions 6.25.0 through 6.28.0 undici versions 7.28.0 through 7.29.0 undici versions 8.1.0 through 8.10.1 Description A flaw in the WebSocket client's permessage-deflate size-limit cleanup removes all listeners from the internal zlib...

Linux Distros Unpatched Vulnerability : CVE-2026-85024

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error...

CVE-2026-85024: Uncaught Exception

undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error listener, while that stream can still emit. When a remote peer sends a compressed payload that crosses the built-in 128 MiB...

CVE-2026-19534: Uncaught Exception

undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes a Sec-WebSocket-Protocol header, undic...

Linux Distros Unpatched Vulnerability : CVE-2026-19534

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never...

aiohttp: AIOHTTP: HTTP Request Smuggling via WebSocket Upgrade

A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework. This vulnerability allows a remote attacker to perform HTTP request smuggling due to an edge case in the WebSocket upgrade procedure. When a WebSocket upgrade request includes a body, the parser may switch protocols before...

aiohttp: AIOHTTP: HTTP Request Smuggling via WebSocket Upgrade

A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework. This vulnerability allows a remote attacker to perform HTTP request smuggling due to an edge case in the WebSocket upgrade procedure. When a WebSocket upgrade request includes a body, the parser may switch protocols before...

aiohttp: AIOHTTP: HTTP Request Smuggling via WebSocket Upgrade

A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework. This vulnerability allows a remote attacker to perform HTTP request smuggling due to an edge case in the WebSocket upgrade procedure. When a WebSocket upgrade request includes a body, the parser may switch protocols before...

EUVD-2026-58625

SiYuan: Publish-boundary bypass via WebSocket broadcast: anonymous readers receive a live unfiltered feed of all edits including protected/forbidden documents publish mode...

SiYuan: Publish-boundary bypass via WebSocket broadcast: anonymous readers receive a live unfiltered feed of all edits including protected/forbidden documents (publish mode)

CVE: This vulnerability corresponds to CVE-2026-72810. Summary WebSocket sessions established through the publish surface port 6808, RoleReader anonymous when Publish.Auth.Enable is false are added to the same broadcast session pool as authenticated sessions. The kernel's broadcast functions push...

GHSA-MW8R-MW84-88V2 SiYuan: Publish-boundary bypass via WebSocket broadcast: anonymous readers receive a live unfiltered feed of all edits including protected/forbidden documents (publish mode)

CVE: This vulnerability corresponds to CVE-2026-72810. Summary WebSocket sessions established through the publish surface port 6808, RoleReader anonymous when Publish.Auth.Enable is false are added to the same broadcast session pool as authenticated sessions. The kernel's broadcast functions push...

aiohttp: AIOHTTP: HTTP Request Smuggling via WebSocket Upgrade

A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework. This vulnerability allows a remote attacker to perform HTTP request smuggling due to an edge case in the WebSocket upgrade procedure. When a WebSocket upgrade request includes a body, the parser may switch protocols before...

Phoenix: Unbounded channel joins per transport enables DoS over few connections

Summary Phoenix transports do not limit the number of channels in a given connection, making it easy to spawn hundreds of thousands of processes over a single connection, and, eventually reaching the max processes VM limit. The solution is to limit the number of channels per transport, so an...

GHSA-6983-JFQ8-485W Phoenix: Unbounded channel joins per transport enables DoS over few connections

Summary Phoenix transports do not limit the number of channels in a given connection, making it easy to spawn hundreds of thousands of processes over a single connection, and, eventually reaching the max processes VM limit. The solution is to limit the number of channels per transport, so an...

Security Bulletin: Langflow is affected by improper authorization due to missing access control on the voice-mode WebSocket endpoint

Summary Langflow provides a voice-mode feature through a WebSocket API endpoint that accepts a flow identifier as a URL path parameter and uses it to retrieve the target flow description and persist conversation messages against that flow. The endpoint authenticates the connecting user's identity...

Security Bulletin: IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to a Request/Response Smuggling vuln in Netty (CVE-2026-59898)

Summary Netty is used by IBM DevOps Deploy / IBM UrbanCode Deploy UCD as part of the server-agent communication systems. CVE-2026-59898. Vulnerability Details CVEID:CVE-2026-59898 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final an...

CVE-2026-85183

Taipy configures its socket.io server with wildcard CORS origin and credential flag enabled, allowing any web page to establish credentialed WebSocket connections to victim applications. Attackers can open socket.io sessions from arbitrary domains and invoke state variable modifications and actio...

CVE-2026-85183 Taipy through 4.1.1 Cross-Site WebSocket Hijacking via Wildcard socket.io CORS

Taipy configures its socket.io server with wildcard CORS origin and credential flag enabled, allowing any web page to establish credentialed WebSocket connections to victim applications. Attackers can open socket.io sessions from arbitrary domains and invoke state variable modifications and actio...