Rocky Linux 8 [CIQ] Security Update: delve / delve-debuginfo / delve-debugsource / go-toolset / golang / etc (crlsa-2025_8478)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20258478 advisory. net/http: Request smuggling due to acceptance of invalid chunked data in net/http CVE-2025-22871 Tenable has extracted the preceding description block directly from...

Rocky Linux 8 [CIQ] Security Update: grafana / grafana-debuginfo / grafana-debugsource / grafana-selinux (crlsa-2025_8667)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20258667 advisory. net/http: Request smuggling due to acceptance of invalid chunked data in net/http CVE-2025-22871 Tenable has extracted the preceding description block directly from...

Rocky Linux 10.0 [CIQ] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc (crlsa-2025_8477)

The Rocky Linux 10.0 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20258477 advisory. net/http: Request smuggling due to acceptance of invalid chunked data in net/http CVE-2025-22871 Tenable has extracted the preceding description block directly...

Rocky Linux 10.0 [CIQ] Security Update: grafana / grafana-debuginfo / grafana-debugsource / grafana-selinux (crlsa-2025_8666)

The Rocky Linux 10.0 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20258666 advisory. net/http: Request smuggling due to acceptance of invalid chunked data in net/http CVE-2025-22871 Tenable has extracted the preceding description block directly...

AlmaLinux 9.2 [TuxCare] Security Update: toolbox / toolbox-tests Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1778109988)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1778109988 advisory. - Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP...

Rocky Linux 9 [CIQ] Security Update: skopeo / skopeo-debuginfo / skopeo-debugsource / skopeo-tests (crlsa-2025_9145)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20259145 advisory. net/http: Request smuggling due to acceptance of invalid chunked data in net/http CVE-2025-22871 Tenable has extracted the preceding description block directly from...

Rocky Linux 10.0 [CIQ] Security Update: git-lfs / git-lfs-debuginfo / git-lfs-debugsource (crlsa-2025_9063)

The Rocky Linux 10.0 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20259063 advisory. net/http: Request smuggling due to acceptance of invalid chunked data in net/http CVE-2025-22871 Tenable has extracted the preceding description block directly...

Rocky Linux 9 [CIQ] Security Update: gvisor-tap-vsock / gvisor-tap-vsock-debuginfo / etc (crlsa-2025_9150)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20259150 advisory. net/http: Request smuggling due to acceptance of invalid chunked data in net/http CVE-2025-22871 Tenable has extracted the preceding description block directly from...

Rocky Linux 9 [CIQ] Security Update: grafana-pcp / grafana-pcp-debuginfo / grafana-pcp-debugsource (crlsa-2025_8916)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20258916 advisory. net/http: Request smuggling due to acceptance of invalid chunked data in net/http CVE-2025-22871 Tenable has extracted the preceding description block directly from...

Rocky Linux 10.0 [CIQ] Security Update: gvisor-tap-vsock / gvisor-tap-vsock-debuginfo / etc (crlsa-2025_9151)

The Rocky Linux 10.0 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20259151 advisory. net/http: Request smuggling due to acceptance of invalid chunked data in net/http CVE-2025-22871 Tenable has extracted the preceding description block directly...

Rocky Linux 9 [CIQ] Security Update: podman / podman-debuginfo / podman-debugsource / podman-docker / etc (crlsa-2025_9144)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20259144 advisory. net/http: Request smuggling due to acceptance of invalid chunked data in net/http CVE-2025-22871 Tenable has extracted the preceding description block directly from...

EUVD-2026-70984

fastify vulnerable to request body replacement via an async validation result collision...

GHSA-667R-XXJV-C9MM fastify vulnerable to request body replacement via an async validation result collision

Impact Fastify runs a route's validator and, for a result shaped like value, error , unwraps it: an error becomes a validation failure and value replaces the request part. This convention is intended for synchronous custom compilers for example Joi. A JSON Schema $async validator, however, resolv...

NPM: fastify vulnerable to request body replacement via an async validation result collision

NPM: fastify vulnerable to request body replacement via an async validation result collision vulnerability discovered by ? in WordPress Npm fastify versions 5.12.2...

fastify vulnerable to request body replacement via an async validation result collision

Impact Fastify runs a route's validator and, for a result shaped like value, error , unwraps it: an error becomes a validation failure and value replaces the request part. This convention is intended for synchronous custom compilers for example Joi. A JSON Schema $async validator, however, resolv...

CVE-2026-103530 decolua 9Router Search Endpoint ssrfGuard.js fetch server-side request forgery

A vulnerability was detected in decolua 9Router up to 0.5.55. The affected element is the function fetch of the file src/shared/utils/ssrfGuard.js of the component Search Endpoint. Performing a manipulation of the argument provideroptions.baseUrl results in server-side request forgery. The attack...

CVE-2026-103530 decolua 9Router Search Endpoint ssrfGuard.js fetch server-side request forgery

A vulnerability was detected in decolua 9Router up to 0.5.55. The affected element is the function fetch of the file src/shared/utils/ssrfGuard.js of the component Search Endpoint. Performing a manipulation of the argument provideroptions.baseUrl results in server-side request forgery. The attack...

CVE-2026-103530 decolua 9Router Search Endpoint ssrfGuard.js fetch server-side request forgery

A vulnerability was detected in decolua 9Router up to 0.5.55. The affected element is the function fetch of the file src/shared/utils/ssrfGuard.js of the component Search Endpoint. Performing a manipulation of the argument provideroptions.baseUrl results in server-side request forgery. The attack...

fastify vulnerable to request validation bypass via skipped boolean false schemas

Impact Fastify decided whether to validate a request part by checking its schema for JavaScript truthiness. JSON Schema Draft 7 defines the boolean false as a valid schema that rejects every instance, but because false is falsy, a route that set body, querystring, params, or headers to false had...

NPM: fastify vulnerable to request validation bypass via skipped boolean false schemas

NPM: fastify vulnerable to request validation bypass via skipped boolean false schemas vulnerability discovered by ? in WordPress Npm fastify versions 5.12.2...