CVE-2026-59160

@yeger/turbo-graph (an npm package in the Yeger monorepo) prior to version 2.8.9 exposes an embedded Next.js server on all network interfaces (0.0.0.0:29312 by default) due to a missing hostname argument in .listen() at packages/turbo-graph/src/index.ts:44. The /api/run GET handler (packages/turb...