CVE-2026-109841 undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens

undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch implementation verifies Subresource Integrity metadata by matching the algorithm token against a lowercase-only set, even though the SRI specification defines the token by its...

CVE-2026-109841 undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens

undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch implementation verifies Subresource Integrity metadata by matching the algorithm token against a lowercase-only set, even though the SRI specification defines the token by its...

CVE-2026-109841

undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch implementation verifies Subresource Integrity metadata by matching the algorithm token against a lowercase-only set, even though the SRI specification defines the token by its...

CVE-2026-109841 undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens

undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch implementation verifies Subresource Integrity metadata by matching the algorithm token against a lowercase-only set, even though the SRI specification defines the token by its...

CVE-2026-109841

The undici HTTP client library for Node.js (versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1 ) contains a vulnerability in its fetch() implementation. The library incorrectly handles case sensitivity when verifying Subresource Integrity (SRI) metadata, treating valid but non-lowercase algo...

CVE-2026-109841

undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch implementation verifies Subresource Integrity metadata by matching the algorithm token against a lowercase-only set, even though the SRI specification defines the token by its...

pfsense-separator-color-xss

abraxaslabs.tech · github.com/abraxas ·&...

pfsense-rules-if-xss

abraxaslabs.tech · github.com/abraxas ·&...

pfsense-logs-filter-xss

abraxaslabs.tech · github.com/abraxas ·&...

Security Bulletin: Multiple vulnerabilities have been identified in WebSphere Application Server shipped with WebSphere Service Registry and Repository

Summary WebSphere Application Server is shipped as a component of WebSphere Service Registry and Repository. Information about multiple vulnerabilities affecting WebSphere Application Server have been published in security bulletins. Vulnerability Details Refer to the security bulletins listed in...

Security Bulletin: IBM SPSS Modeler is affected by multiple vulnerabilities in Jackson Core

Summary IBM SPSS Modeler is affected by multiple vulnerabilities in Jackson Core. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-68494 DESCRIPTION: The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 GHSA-72hv-8253-57qq, number length...

Security Bulletin: IBM SPSS Modeler is affected by a Jackson-core denial-of-service vulnerability that may cause excessive memory consumption from crafted JSON input

Summary IBM SPSS Modeler is affected by a Jackson-core denial-of-service vulnerability that may cause excessive memory consumption from crafted JSON input. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-89425 DESCRIPTION:...

CVE-2026-18040

A flaw was found in Bouncy Castle. The Hamming Quasi-Cyclic HQC cryptographic algorithm leaks secret data through memory cache access patterns and execution timing variations during key encapsulation and decapsulation operations. A local attacker capable of monitoring cache activity or measuring...

IBM Db2 Genius Hub encryption issue vulnerability

The IBM Db2 Genius Hub 1.0 version has an encryption vulnerability. This vulnerability stems from the lack of an initialization vector in the encryption algorithm, which may allow remotely authenticated attackers to bypass security restrictions...

WordPress Modula Image Gallery Authorization Issue Vulnerability

WordPress Modula Image Gallery 3.0.11 and earlier versions have a vulnerability related to authorization. This vulnerability arises when accessing via the /wp-json/wp/v2/modula-gallery/id URL, where the id parameter is set to “none”. As a result, sensitive information in the modulaSettings REST...

Astra Linux – Vulnerability in RustC

A issue was discovered in the Bidirectional Algorithm in the Unicode Specification through version 14.0. This algorithm allows for the visual reordering of characters through control sequences, which can be used to create source code that implements logic different from the logical order of token...

Astra Linux – Vulnerability in gnutls28

A flaw was discovered in GnuTLS, which relies on libtasn1 for ASN.1 data processing. Due to an inefficient algorithm in libtasn1, decoding certain DER-encoded certificate data can take excessive time, leading to increased resource consumption. This flaw allows a remote attacker to send a speciall...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: ocfs2: Fixed data corruption caused by fallocate. When fallocate creates holes in the inode size, if the original size is located in the middle of the last cluster, then the portion of the block from the original size to the end ...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: powerpc/64s: Fixed the PTE update for kernel memory on radix. When adding a PTE, a ptesync is required to ensure that the PTE update is performed correctly. Otherwise, a spurious fault may occur. radixsetpteat does not perform th...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: btrfs: added handling for RAID1C23/DUP to btrfsreduceallocprofile Callers of btrfsreduceallocprofile expect it to return exactly one allocation profile flag. If this is not done, it may ultimately result in a WARNON and remount-r...