CVE-2026-111768

In affected versions, servers put no limit on how many array elements and object keys they validated in one request. One HTTP request within the default 4 MiB size limit could exhaust the server's memory, and the process aborted with "JavaScript heap out of memory". No credentials are needed,...