Red Hat: CVE-2026-110180: fast-uri: fast-uri: Security policy bypass via improper host canonicalization

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions from 2.4.2 through 2.4.7, from 3.1.3 through 3.1.8, and from 4.0.1 through 4.2.2, for HTTP-family schemes the canonicalizeHost function passes the parsed host to the WHATWG URL parser and adopts its hostname...

Linux Distros Unpatched Vulnerability : CVE-2026-110725

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2,...

Fastify fast-uri input validation vulnerability

Versions of Fastify prior to 2.4.8, as well as versions 3.0.0 to 3.1.8 and 4.0.0 to 4.2.2, contain security vulnerabilities. These vulnerabilities stem from the use of the outdated global unescape function for percent decoding before verifying scheme components. This may result in dangerous schem...

Fastify fast-uri: Vulnerability due to improper output processing

Versions of Fastify prior to 2.4.8, 3.0.0 through 3.1.8, and 4.0.0 through 4.2.2 contain security vulnerabilities. These vulnerabilities arise when the serialize, normalize, or resolve methods are used with a reference option set to a value other than the default suffix, and when the referenced...

Fastify fast-uri input validation vulnerability

The Fastify fast-uri versions from 2.4.2 to 2.4.7, 3.1.3 to 3.1.8, and 4.0.1 to 4.2.2 have security vulnerabilities. These vulnerabilities stem from the canonicalizeHost function, which does not check whether the WHATWG URL parser treats the entire input as a host for host name consumption. As a...

Security Bulletin: Platform Navigator and Automation Assets in IBM Integration are vulnerable to multiple vulnerabilities in fast-uri

Summary Platform Navigator and Automation Assets in IBM Integration are vulnerable to multiple vulnerabilities in fast-uri. CVE-2026-84292, CVE-2026-84394 The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2026-84292 DESCRIPTION: fast-uri serializes the port component of a U...

SUSE CVE-2026-98699

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix mesh fast xmit path deletion UAF meshfasttxcache stores raw meshpath pointers. Path deletion flushes the cache and then frees the path with kfreercu, but a lookup that already holds the path can insert a new...

DEBIAN-CVE-2026-98699

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix mesh fast xmit path deletion UAF meshfasttxcache stores raw meshpath pointers. Path deletion flushes the cache and then frees the path with kfreercu, but a lookup that already holds the path can insert a new...

CVE-2026-98699

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix mesh fast xmit path deletion UAF meshfasttxcache stores raw meshpath pointers. Path deletion flushes the cache and then frees the path with kfreercu, but a lookup that already holds the path can insert a new...

CVE-2026-98699 wifi: mac80211: fix mesh fast xmit path deletion UAF

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix mesh fast xmit path deletion UAF meshfasttxcache stores raw meshpath pointers. Path deletion flushes the cache and then frees the path with kfreercu, but a lookup that already holds the path can insert a new...

CVE-2026-98699

The Linux kernel contains a Use-After-Free (UAF) vulnerability in the wifi: mac80211 component related to the mesh fast xmit path . The issue occurs because mesh_fast_tx_cache() stores raw mesh_path pointers; while path deletion flushes the cache and frees the path via kfree_rcu() , a concurrent ...

CVE-2026-98699 wifi: mac80211: fix mesh fast xmit path deletion UAF

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix mesh fast xmit path deletion UAF meshfasttxcache stores raw meshpath pointers. Path deletion flushes the cache and then frees the path with kfreercu, but a lookup that already holds the path can insert a new...

EUVD-2026-103953

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix mesh fast xmit path deletion UAF meshfasttxcache stores raw meshpath pointers. Path deletion flushes the cache and then frees the path with kfreercu, but a lookup that already holds the path can insert a new...

CVE-2026-98699

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix mesh fast xmit path deletion UAF meshfasttxcache stores raw meshpath pointers. Path deletion flushes the cache and then frees the path with kfreercu, but a lookup that already holds the path can insert a new...

CVE-2026-98699: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix mesh fast xmit path deletion UAF meshfasttxcache stores raw meshpath pointers. Path deletion flushes the cache and then frees the path with kfreercu, but a lookup that already holds the path can insert a new...

PT-2026-116918

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix mesh fast xmit path deletion UAF mesh fast tx cache stores raw mesh path pointers. Path deletion flushes the cache and then frees the path with kfree rcu, but a lookup that already holds the path can insert a...

PT-2026-116980

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: recover after failure to start the frs ams Reset the port if the tcpm fails to start the FAST ROLE SWAP AMS by initiating error recovery on it. This helps in cases where some cables incorrectly signal an FRS to ...

CVE-2026-111612

netdisk-fast-download through 0.4.8 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve donated netdisk credentials via the /v2/randomAuth endpoint in ParserApi. Attackers can repeatedly call the endpoint and decrypt the encryptedAuth blob using the...

CVE-2026-111612 netdisk-fast-download through 0.4.8 Credential Disclosure via /v2/randomAuth

netdisk-fast-download through 0.4.8 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve donated netdisk credentials via the /v2/randomAuth endpoint in ParserApi. Attackers can repeatedly call the endpoint and decrypt the encryptedAuth blob using the...

CVE-2026-111612

The netdisk-fast-download software (versions through 0.4.8 ) is vulnerable to an information disclosure flaw in the ParserApi component. Unauthenticated attackers can access the /v2/randomAuth endpoint to retrieve donated netdisk credentials. The root cause is the use of a hard-coded AES key (nfd...