node-cve-2026-58042-check

node-cve-2026-58042-check Offline evidence checker for CVE-2026-58042 — Node.js: DNS resolveAny process abort. It compares Node.js versions that you report against the fixed releases named in the vendor advisory and writes a CSV, JSON or HTML report. Python 3.10+, standard library only; the singl...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: freerdp (UTSA-2026-152911)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-152911 advisory. FreeRDP before 3.31.0 contains a buffer over-read vulnerability in the rtsreadresult function within the RPC gateway transport parser. Attackers can send a malicious...

Node.js < 22.23.5, < 24.22.3, < 26.13.1 - NULL Pointer Dereference in StreamPipe Teardown When a respondWithFile() Download Is Cancelled leading to Remote Process Abort

NULL Pointer Dereference in StreamPipe Teardown When a respondWithFile Download Is Cancelled leading to Remote Process Abort vulnerability discovered by ? in WordPress npm Node.js versions 26.13.1...

Node.js < 24.22.3, < 26.13.1 - Heap Buffer Overflow in Http2Session.altsvc() via an Over-Long Origin leading to a One-Byte Out-of-Bounds Write and Process Abort

Heap Buffer Overflow in Http2Session.altsvc via an Over-Long Origin leading to a One-Byte Out-of-Bounds Write and Process Abort vulnerability discovered by ? in WordPress npm Node.js versions 26.13.1...

Node.js < 24.22.3, < 26.13.1 - Reachable Assertion in HTTP/2 Session Teardown via Streams Retaining nghttp2 Header Buffers leading to Remote Process Abort

Reachable Assertion in HTTP/2 Session Teardown via Streams Retaining nghttp2 Header Buffers leading to Remote Process Abort vulnerability discovered by ? in WordPress npm Node.js versions 26.13.1...

Astra Linux – vulnerability in libsoup3

A flaw was found in libsoup. When a client sends an HTTP/2 request body from a non-pollable input stream, the library can buffer more data than the current flow-control window later allows. A malicious HTTP/2 server can shrink SETTINGSINITIALWINDOWSIZE while that buffered read is still in progres...

Uncaught Exception

Overview ddtrace is a Datadog APM client library Affected versions of this package are vulnerable to Uncaught Exception via moduloaspect in the IAST taint-tracking C++ extension, when a lone surrogate character is passed as a format argument to the % modulo string operator. The unhandled surrogat...

UBUNTU-CVE-2026-116541

Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcnwritetobytebuffer BIO write callback that overreports bytes consumed. Remote TLS 1.3 peers can provoke queued post-handshake records like NewSessionTicket or KeyUpdate to truncate flights, fail...

CVE-2026-116541 netty-tcnative before 2.0.84.Final Denial of Service via BIO Write Overcount

Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcnwritetobytebuffer BIO write callback that overreports bytes consumed. Remote TLS 1.3 peers can provoke queued post-handshake records like NewSessionTicket or KeyUpdate to truncate flights, fail...

CVE-2026-116541

Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcnwritetobytebuffer BIO write callback that overreports bytes consumed. Remote TLS 1.3 peers can provoke queued post-handshake records like NewSessionTicket or KeyUpdate to truncate flights, fail...

EUVD-2026-109911

Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcnwritetobytebuffer BIO write callback that overreports bytes consumed. Remote TLS 1.3 peers can provoke queued post-handshake records like NewSessionTicket or KeyUpdate to truncate flights, fail...

PT-2026-123394

Content removed...

Node.js DNS resolveAny Process Abort

Node.js versions 22.x, 24.x, and 26.x contain a flaw where dns.resolveAny can abort the process when a DNS response has more than 256 A records. The supplied offline checker compares reported version evidence against fixed releases...

Node.js DNS resolveAny Process Abort

Node.js versions 22.x, 24.x, and 26.x contain a flaw where dns.resolveAny can abort a process when DNS responses contain more than 256 A records. This submission provides source-backed research and an implementation plan; it contains no checker or proof of concept...

Exploit for CVE-2026-58042

node-cve-2026-58042-check Standal...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: freerdp (UTSA-2026-130071)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130071 advisory. FreeRDP before 3.31.0 contains a buffer over-read vulnerability in the rtsreadresult function within the RPC gateway transport parser. Attackers can send a malicious...

CVE-2026-109242

FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 renders uninitialized heap memory from un-decoded progressive tiles because the tile-current buffer is allocated without zeroing. A malicious RDP server can send a crafted WBTTILEFIRST then WBTTILEUPGRADE sequence to paint heap bytes onscreen or abort...

EulerOS 2.0 SP13 : glibc (EulerOS-SA-2026-4049)

According to the versions of the glibc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Calling wordexp with WRDEAPPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the wewordv...

EulerOS 2.0 SP11 : glibc (EulerOS-SA-2026-4321)

According to the versions of the glibc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : When expanding paths that begin with a tilde followed by a username, the internal parsetilde function extracts the username to determine the user's...

CVE-2026-109242: Use of Uninitialized Resource

FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 renders uninitialized heap memory from un-decoded progressive tiles because the tile-current buffer is allocated without zeroing. A malicious RDP server can send a crafted WBTTILEFIRST then WBTTILEUPGRADE sequence to paint heap bytes onscreen or abort...