EUVD-2026-52564

A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion. This vulnerability affects Node.js 24.x and 22.x...

CVE-2026-56846

Node.js HTTP/2 handling flaw (CVE-2026-56846) affects Node.js 24.x and 22.x. The issue allows HTTP/2 retained header blocks to evade maxSessionMemory, enabling remote memory exhaustion. Exploitation details are not provided in the documents. Remediation follows the vendor advisory: apply the July...

EUVD-2026-51257

AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate...

CVE-2026-68981

Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding filter. The framework enforced a configurable maximum request size on the compressed payload rather than the decompressed output, allowing a malicious client to send crafted...

CVE-2026-69185

Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory...

EUVD-2026-52423

Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding filter. The framework enforced a configurable maximum request size on the compressed payload rather than the decompressed output, allowing a malicious client to send crafted...

CVE-2026-68981

The CVE-2026-68981 issue affects Apache NiFi versions 1.5.0 through 2.10.0, where gzip-encoded HTTP requests to the REST API are processed via a Jersey encoding filter. A configurable maximum is enforced on the compressed payload rather than the decompressed output, which could allow a malicious ...

CVE-2026-68981 Apache NiFi: Uncontrolled Resource Consumption through Decompression of HTTP Requests

Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding filter. The framework enforced a configurable maximum request size on the compressed payload rather than the decompressed output, allowing a malicious client to send crafted...

Socket.IO: Zero-attachment Memory Exhaustion

Impact A specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. Patches | Version range | Used by | Fixed version |...

CVE-2026-69185 Socket.IO: Zero-attachment Memory Exhaustion

Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory...

CVE-2026-69185

Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory...

EUVD-2026-52410

Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory...

CVE-2026-69185

Technical details describing affected product versions, root cause, and remediation are not publicly available in the provided documents; monitor for updates.

CVE-2026-69152

A flaw was found in the brace-expansion library. An attacker can provide specially crafted input to the expand function, which fails to apply length restrictions when creating intermediate arrays. This oversight allows the attacker to exhaust system memory or block the event loop, leading to a...

GHSA-RGW5-RVV9-X895 brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

Summary The maxLength mitigation added in 5.0.8 for GHSA-mh99-v99m-4gvg / CVE-2026-14257 is incomplete. It bounds the accumulator where results are combined, but not the intermediate arrays that feed it. A 25 KB input still crashes the Node process with an uncatchable out-of-memory error, so...

brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

Summary The maxLength mitigation added in 5.0.8 for GHSA-mh99-v99m-4gvg / CVE-2026-14257 is incomplete. It bounds the accumulator where results are combined, but not the intermediate arrays that feed it. A 25 KB input still crashes the Node process with an uncatchable out-of-memory error, so...

CVE-2026-69152

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memo...

CVE-2026-69152 brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memo...

CVE-2026-69152

Brace-expansion library vulnerability CVE-2026-69152: expand() mishandles maxLength for intermediate arrays and padded sequences, enabling memory exhaustion or event-loop stalls via attacker-controlled input. Affected versions: <1.1.18, <2.1.4, <3.0.6,

net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME

A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...