CVE-2026-62160

Daptin is a GraphQL/JSON-API headless CMS. Prior to 0.12.26, the global "LanguageMiddleware" in "server/language.go" passes the raw "Accept-Language" header from "LanguageMiddlewareFunc" through "GetLanguagePreference" to "golang.org/x/text/language.ParseAcceptLanguage" without a size or shape...