CVE-2026-18174 @fastify/forwarded vulnerable to improper input validation via unstripped tab characters in X-Forwarded-For

@fastify/forwarded resolves client addresses from the X-Forwarded-For header. In versions before 3.0.2, when the header contains two or more comma separated entries, the parser trims only space characters and does not strip horizontal tabs, even though RFC 7230 defines optional whitespace as both...

CVE-2026-18174

The CVE-2026-18174 entry concerns @fastify/forwarded. In versions before 3.0.2, the X-Forwarded-For parser trims only spaces when entries are comma-separated and does not strip horizontal tabs. As a result, an entry padded with a tab retains a literal tab in the resolved client IP string, potenti...

CVE-2026-67216

cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSONCompare. When comparing objects, the function recurses into each shared subtree twice, once in each direction, with no depth guard, making the running time exponential in nesting depth. A small, deeply nested documen...

CVE-2016-3239

creationtimestamp| type| source ---|---|--- 2026-07-29 13:01:14+00:00| seen| Telegram/7S6GTcGTrOkazNYM6aCjvvQCh58ZZ0xQJO4nXoU5wy4UXQ 2026-07-30 00:01:50+00:00| seen| Telegram/7S6GTcGTrOkazNYM6aCjvvQCh58ZZ0xQJO4nXoU5wy4UXQ 2026-08-01 11:00:12+00:00| seen|...

CVE-2026-41709

creationtimestamp| type| source ---|---|--- 2026-07-29 13:00:55+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0269 2026-07-29 16:45:15+00:00| seen| https://www.ncsc.nl/alerts/kritieke-kwetsbaarheden-in-vmware-vcenter-en-esx-producten-update-onmiddellijk 2026-07-29 17:00:04+00:00|...

CVE-2026-58186

creationtimestamp| type| source ---|---|--- 2026-07-29 12:01:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrruw54hma23 2026-08-01 05:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mryqt2qdmn2r...

CVE-2019-6279

creationtimestamp| type| source ---|---|--- 2026-07-29 12:01:44+00:00| seen| Telegram/hhZMJNRwMGWB05aEplvT4hGEDdkClxDTtHSm9w48zN5J5g 2026-07-30 00:02:01+00:00| seen| Telegram/hhZMJNRwMGWB05aEplvT4hGEDdkClxDTtHSm9w48zN5J5g 2026-08-01 13:00:04+00:00| seen|...

CVE-2016-0180

creationtimestamp| type| source ---|---|--- 2026-07-29 12:01:43+00:00| seen| Telegram/PjuRxPzvGjVabf4gPWbBh7F8WJi6OJk2WzpXql3KPPBgA 2026-07-30 00:02:00+00:00| seen| Telegram/PjuRxPzvGjVabf4gPWbBh7F8WJi6OJk2WzpXql3KPPBgA 2026-08-01 12:00:05+00:00| seen|...

CVE-2015-0075

creationtimestamp| type| source ---|---|--- 2026-07-29 12:01:43+00:00| seen| Telegram/PjuRxPzvGjVabf4gPWbBh7F8WJi6OJk2WzpXql3KPPBgA 2026-07-30 00:02:00+00:00| seen| Telegram/PjuRxPzvGjVabf4gPWbBh7F8WJi6OJk2WzpXql3KPPBgA 2026-08-01 12:00:05+00:00| seen|...

CVE-2015-6108

creationtimestamp| type| source ---|---|--- 2026-07-29 12:01:37+00:00| seen| Telegram/PjuRxPzvGjVabf4gPWbBh7F8WJi6OJk2WzpXql3KPPBgA 2026-07-30 00:01:59+00:00| seen| Telegram/PjuRxPzvGjVabf4gPWbBh7F8WJi6OJk2WzpXql3KPPBgA 2026-08-01 12:00:06+00:00| seen|...

CVE-2016-3215

creationtimestamp| type| source ---|---|--- 2026-07-29 12:01:36+00:00| seen| Telegram/PjuRxPzvGjVabf4gPWbBh7F8WJi6OJk2WzpXql3KPPBgA 2026-07-30 01:01:19+00:00| seen| Telegram/PjuRxPzvGjVabf4gPWbBh7F8WJi6OJk2WzpXql3KPPBgA 2026-08-01 12:00:09+00:00| seen|...

CVE-2016-7217

creationtimestamp| type| source ---|---|--- 2026-07-29 12:01:36+00:00| seen| Telegram/PjuRxPzvGjVabf4gPWbBh7F8WJi6OJk2WzpXql3KPPBgA 2026-07-30 00:01:58+00:00| seen| Telegram/PjuRxPzvGjVabf4gPWbBh7F8WJi6OJk2WzpXql3KPPBgA 2026-08-01 12:00:07+00:00| seen|...

CVE-2016-7223

creationtimestamp| type| source ---|---|--- 2026-07-29 12:01:35+00:00| seen| Telegram/PjuRxPzvGjVabf4gPWbBh7F8WJi6OJk2WzpXql3KPPBgA 2026-07-30 00:01:57+00:00| seen| Telegram/PjuRxPzvGjVabf4gPWbBh7F8WJi6OJk2WzpXql3KPPBgA 2026-08-01 12:00:11+00:00| seen|...

CVE-2016-7295

creationtimestamp| type| source ---|---|--- 2026-07-29 12:01:34+00:00| seen| Telegram/PjuRxPzvGjVabf4gPWbBh7F8WJi6OJk2WzpXql3KPPBgA 2026-07-30 00:01:56+00:00| seen| Telegram/PjuRxPzvGjVabf4gPWbBh7F8WJi6OJk2WzpXql3KPPBgA 2026-08-01 12:00:11+00:00| seen|...

CVE-2015-2534

creationtimestamp| type| source ---|---|--- 2026-07-29 12:01:32+00:00| seen| Telegram/PjuRxPzvGjVabf4gPWbBh7F8WJi6OJk2WzpXql3KPPBgA 2026-07-30 00:01:56+00:00| seen| Telegram/PjuRxPzvGjVabf4gPWbBh7F8WJi6OJk2WzpXql3KPPBgA 2026-08-01 12:00:13+00:00| seen|...

CVE-2016-7260

creationtimestamp| type| source ---|---|--- 2026-07-29 12:01:32+00:00| seen| Telegram/PjuRxPzvGjVabf4gPWbBh7F8WJi6OJk2WzpXql3KPPBgA 2026-07-30 00:01:56+00:00| seen| Telegram/PjuRxPzvGjVabf4gPWbBh7F8WJi6OJk2WzpXql3KPPBgA 2026-08-01 12:00:12+00:00| seen|...

CVE-2016-0184

creationtimestamp| type| source ---|---|--- 2026-07-29 12:01:31+00:00| seen| Telegram/PjuRxPzvGjVabf4gPWbBh7F8WJi6OJk2WzpXql3KPPBgA 2026-07-30 01:01:17+00:00| seen| Telegram/PjuRxPzvGjVabf4gPWbBh7F8WJi6OJk2WzpXql3KPPBgA 2026-08-01 12:00:13+00:00| seen|...

CVE-2014-0317

creationtimestamp| type| source ---|---|--- 2026-07-29 12:01:28+00:00| seen| Telegram/7S6GTcGTrOkazNYM6aCjvvQCh58ZZ0xQJO4nXoU5wy4UXQ 2026-07-30 00:01:54+00:00| seen| Telegram/7S6GTcGTrOkazNYM6aCjvvQCh58ZZ0xQJO4nXoU5wy4UXQ 2026-08-01 11:00:04+00:00| seen|...

CVE-2017-0076

creationtimestamp| type| source ---|---|--- 2026-07-29 12:01:26+00:00| seen| Telegram/7S6GTcGTrOkazNYM6aCjvvQCh58ZZ0xQJO4nXoU5wy4UXQ 2026-07-30 00:01:54+00:00| seen| Telegram/7S6GTcGTrOkazNYM6aCjvvQCh58ZZ0xQJO4nXoU5wy4UXQ 2026-08-01 11:00:05+00:00| seen|...

CVE-2015-1697

creationtimestamp| type| source ---|---|--- 2026-07-29 12:01:24+00:00| seen| Telegram/7S6GTcGTrOkazNYM6aCjvvQCh58ZZ0xQJO4nXoU5wy4UXQ 2026-07-30 00:01:53+00:00| seen| Telegram/7S6GTcGTrOkazNYM6aCjvvQCh58ZZ0xQJO4nXoU5wy4UXQ 2026-08-01 11:00:06+00:00| seen|...