CVE-2026-62966

The ESPAsyncWebServer library (for ESP32, ESP8266, RP2040, and RP2350) contains a null pointer write vulnerability in the multipart parser within src/WebRequest.cpp prior to version 3.11.2 . The flaw occurs because _itemBuffer is freed and set to NULL when a file part boundary is matched, but _it...