32682 matches found
CVE-2026-6297
Google Chrome versions prior to 147.0.7727.101 are vulnerable to a use after free flaw in the Proxy component . This vulnerability allows an attacker in a privileged network position to perform a sandbox escape by navigating to a crafted HTML page. The issue is categorized as Critical by Chromium...
CVE-2026-6297
Use after free in Proxy in Google Chrome prior to 147.0.7727.101 allowed an attacker in a privileged network position to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Critical...
CVE-2026-6297
Use after free in Proxy in Google Chrome prior to 147.0.7727.101 allowed an attacker in a privileged network position to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Critical...
CVE-2026-6297
Use after free in Proxy in Google Chrome prior to 147.0.7727.101 allowed an attacker in a privileged network position to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Critical...
CVE-2026-35469
A flaw was found in the SPDY streaming code used by Kubelet, CRI-O, and kube-apiserver. An attacker with specific cluster roles, such as those allowing access to pod port forwarding, execution, or attachment, or node proxying, could exploit this vulnerability. This could lead to a Denial of Servi...
RLSA-2026:8119 Important: squid security update
Squid is a high-performance proxy caching server for web clients, supporting FTP, and HTTP data objects. Security Fixes: squid: Squid: Denial of Service via heap Use-After-Free vulnerability in ICP handling CVE-2026-33526 Squid: Squid: Denial of Service via crafted ICP traffic CVE-2026-32748 For...
CVE-2026-33805
@fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection header after the proxy has added its own headers via rewriteRequestHeaders. This allows attackers to retroactively strip proxy-added headers from upstream requests by listing them i...
@cedarjs/api-server (>=1.0.0-canary.12281, <=9.0.0-canary.1784), @cedarjs/cli (>=1.0.0-canary.12281, <=9.0.0-canary.1784) +23 more potentially affected by CVE-2026-33805 via @fastify/http-proxy (>=11.1.2, <=11.4.3)
@fastify/http-proxy NPM version =11.1.2, =1.0.0-canary.12281, =1.0.0-canary.12281, =1.0.0-canary.12281, =1.0.0-canary.12281, =1.0.0-canary.12281, =3.0.0-alpha-1, =0.1.0, =1.0.1, =0.0.1, =1.0.0, =1.0.1, =1.4.4, =1.0.50, =0.0.1, =0.1.65 and more Source cves: CVE-2026-33805 Source advisory:...
HTTP Header Injection
Overview @fastify/http-proxy is a proxy http requests, for Fastify Affected versions of this package are vulnerable to HTTP Header Injection via improper handling of the Connection header after proxy-added headers have been set. An attacker can remove headers intended for routing, access control,...
HTTP Header Injection
Overview @fastify/reply-from is a forward your HTTP request to another server, for fastify Affected versions of this package are vulnerable to HTTP Header Injection via improper handling of the Connection header after proxy-added headers have been set. An attacker can remove headers intended for...
CVE-2026-33805
@fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection header after the proxy has added its own headers via rewriteRequestHeaders. This allows attackers to retroactively strip proxy-added headers from upstream requests by listing them i...
CVE-2026-33805 @fastify/reply-from vulnerable to connection header abuse enabling stripping of proxy-added headers
@fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection header after the proxy has added its own headers via rewriteRequestHeaders. This allows attackers to retroactively strip proxy-added headers from upstream requests by listing them i...
CVE-2026-33805 @fastify/reply-from vulnerable to connection header abuse enabling stripping of proxy-added headers
@fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection header after the proxy has added its own headers via rewriteRequestHeaders. This allows attackers to retroactively strip proxy-added headers from upstream requests by listing them i...
CVE-2026-33805
CVE-2026-33805 affects @fastify/reply-from <= v12.6.1 and @fastify/http-proxy
CVE-2026-33805 @fastify/reply-from vulnerable to connection header abuse enabling stripping of proxy-added headers
@fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection header after the proxy has added its own headers via rewriteRequestHeaders. This allows attackers to retroactively strip proxy-added headers from upstream requests by listing them i...
CVE-2026-33805
@fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection header after the proxy has added its own headers via rewriteRequestHeaders. This allows attackers to retroactively strip proxy-added headers from upstream requests by listing them i...
@agentspec/claude-plugin (>=0.1.0, <=0.2.0), @agentspec/sidecar (0.1.0) +101 more potentially affected by CVE-2026-33805 via @fastify/http-proxy (>=7.1.0, <=11.4.3)
@fastify/http-proxy NPM version =7.1.0, =0.1.0, =0.0.2, =1.0.19, =2.1.22, =0.1.1, =0.1.0, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =1.0.0, =3.0.0-alpha-1, =3.0.0-alpha-6 and more Source cves: CVE-2026-33805 Source advisory: MEND:CVE-2026-33805...
HTTP client proxy tunnel headers not validated for CR/LF
...
MAL-2026-2674 Malicious code in chief-proxy-out (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b408fee03920bbac11e3f3e2a31fa1948a9d1b99041e54c1e10ba0f5e8cf949 The package chief-proxy-out was found to contain malicious code. Source: ghsa-malware cc92974c8b9f8dc914e29b747314307d52026764bd99c484f10fad298df29f6...
Malicious Package
Overview chief-proxy-out is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...