10224 matches found
EUVD-2026-61222
fastify vulnerable to X-Forwarded- spoofing under trustProxy hop-count...
Your DNS Is Hiding in HTTPS — This Is Why It Matters
Discover why unmanaged DNS over HTTPS DoH creates security visibility gaps and how a controlled DoH strategy restores visibility without compromising privacy...
nodejs: HTTPS Agent TLS session reuse skips hostname verification
A flaw was found in Node.js. An incomplete fix for a previous vulnerability allows the HTTPS Agent to reuse Transport Layer Security TLS sessions, bypassing hostname verification across different identity policies. This could enable an attacker to impersonate a legitimate server, leading to...
nodejs: Node.js: mTLS client identities can be reused due to HTTPS Agent connection flaw
A flaw was found in Node.js. The HTTPS Agent, responsible for managing secure connections, can incorrectly reuse client identities across different requests. This occurs due to a technical issue with PFX object-array key collisions during connection reuse. As a result, a client's identity,...
native CA store conn reuse
A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting CURLSSLOPTNATIVECA than when the connection was created...
CURL-CVE-2026-80231 native CA store conn reuse
A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting CURLSSLOPTNATIVECA than when the connection was created...
nodejs: Node.js: mTLS client identities can be reused due to HTTPS Agent connection flaw
A flaw was found in Node.js. The HTTPS Agent, responsible for managing secure connections, can incorrectly reuse client identities across different requests. This occurs due to a technical issue with PFX object-array key collisions during connection reuse. As a result, a client's identity,...
nodejs: HTTPS Agent TLS session reuse skips hostname verification
A flaw was found in Node.js. An incomplete fix for a previous vulnerability allows the HTTPS Agent to reuse Transport Layer Security TLS sessions, bypassing hostname verification across different identity policies. This could enable an attacker to impersonate a legitimate server, leading to...
certbot v5.8.0
.. This file contains a series of comments that are used to include sections of this README in other files. Do not modify these comments unless you know what you are doing. tag:intro-begin |build-status| .. |build-status| image::...
PT-2026-84656
Name of the Vulnerable Software and Affected Versions curl affected versions not specified Description A flaw in libcurl causes the software to incorrectly reuse an existing HTTPS connection setup for a specific hostname, even if a different Native CA Store setting CURLSSLOPT NATIVE CA is used...
nodejs: HTTPS Agent TLS session reuse skips hostname verification
A flaw was found in Node.js. An incomplete fix for a previous vulnerability allows the HTTPS Agent to reuse Transport Layer Security TLS sessions, bypassing hostname verification across different identity policies. This could enable an attacker to impersonate a legitimate server, leading to...
nodejs: Node.js: mTLS client identities can be reused due to HTTPS Agent connection flaw
A flaw was found in Node.js. The HTTPS Agent, responsible for managing secure connections, can incorrectly reuse client identities across different requests. This occurs due to a technical issue with PFX object-array key collisions during connection reuse. As a result, a client's identity,...
TrustTunnel v1.1.0
Clients · App Store iOS · App Store macOS · Play store Table of Contents Introduction Server Features Client Features Quick start Endpoint setup Install the endpoint Updating the endpoint Endpoint configuration wizard Let's Encrypt certificate lifecycle Running endpoint Export client configuratio...
Updated nodejs packages fix security vulnerabilities
http2: retain header memory in session accounting. CVE-2026-56846 http2: defer rst stream while in scope. CVE-2026-56848 permission: avoid granting radix split nodes. CVE-2026-58043 https: distinguish PFX object-array agent keys. CVE-2026-56850 https: bind identity checks to session reuse...
Malicious code in accounts-appointment (npm)
Source: amazon-inspector b85924ae1e24ede2acf333de8af5ca1d8ae2854652be2b3b82a01df710adc27a index.js unconditionally requires./setup, which on load selects a platform-specific payload path, fetches bytes over HTTPS from Cloudflare workers.dev subdomains oob-worker.cf99-9b3.workers.dev and siblings...
Malicious code in mfaatest (npm)
Source: amazon-inspector 73e4ce261829117e316f9152160cdcb35c6ba66064f631baba1f8d528673b584 package.json declares dependency node-net-pool with its value set to an arbitrary HTTPS tarball URL https://limbomail.com/api/attachment/fpwvxc9DvM.Bjuueu1K2SkBCKkgATls-oq05UsrNNY/pkg.tgz rather than a...
nodejs: Node.js: mTLS client identities can be reused due to HTTPS Agent connection flaw
A flaw was found in Node.js. The HTTPS Agent, responsible for managing secure connections, can incorrectly reuse client identities across different requests. This occurs due to a technical issue with PFX object-array key collisions during connection reuse. As a result, a client's identity,...
nodejs: HTTPS Agent TLS session reuse skips hostname verification
A flaw was found in Node.js. An incomplete fix for a previous vulnerability allows the HTTPS Agent to reuse Transport Layer Security TLS sessions, bypassing hostname verification across different identity policies. This could enable an attacker to impersonate a legitimate server, leading to...
nodejs: Node.js: mTLS client identities can be reused due to HTTPS Agent connection flaw
A flaw was found in Node.js. The HTTPS Agent, responsible for managing secure connections, can incorrectly reuse client identities across different requests. This occurs due to a technical issue with PFX object-array key collisions during connection reuse. As a result, a client's identity,...
nodejs: HTTPS Agent TLS session reuse skips hostname verification
A flaw was found in Node.js. An incomplete fix for a previous vulnerability allows the HTTPS Agent to reuse Transport Layer Security TLS sessions, bypassing hostname verification across different identity policies. This could enable an attacker to impersonate a legitimate server, leading to...