CVE-2026-103921 GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 1.1.35, the executor-legacy-ws buildWSLegacyExecutor function hardcodes TLS certificate rejection off for Node.js connections to wss:// endpoints. Applications using the executor directly, or url-loade...

CVE-2026-103921

The GraphQL Tools library (prior to version 1.1.35 ) contains a vulnerability where the executor-legacy-ws buildWSLegacyExecutor() function hardcodes TLS certificate rejection to be disabled for Node.js connections to wss:// endpoints. If an application uses this executor directly or uses url-loa...

CVE-2026-103921 GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 1.1.35, the executor-legacy-ws buildWSLegacyExecutor function hardcodes TLS certificate rejection off for Node.js connections to wss:// endpoints. Applications using the executor directly, or url-loade...

NPM: vm2 exposes host HTTPS credentials and TLS traffic through globalAgent

NPM: vm2 exposes host HTTPS credentials and TLS traffic through globalAgent vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.3, = 3.11.6...

GHSA-H85J-HV3C-QFGQ vm2 exposes host HTTPS credentials and TLS traffic through globalAgent

Summary vm2 3.11.6 exposes the host process's real https.globalAgent when a NodeVM is explicitly allowed to require https. The module is wrapped as read-only, but calls to methods on the shared agent still mutate the host object. Sandbox code can register a free listener and receive host request...

vm2 exposes host HTTPS credentials and TLS traffic through globalAgent

Summary vm2 3.11.6 exposes the host process's real https.globalAgent when a NodeVM is explicitly allowed to require https. The module is wrapped as read-only, but calls to methods on the shared agent still mutate the host object. Sandbox code can register a free listener and receive host request...

GHSA-98XX-8MX4-X7CM vm2 NodeVM can replace the host process TLS trust store

Summary vm2 3.11.6 exposes the host tls module to a NodeVM when that builtin is explicitly allowed. Although the module object is wrapped as read-only, its functions still execute against process-wide host state. On Node.js versions that provide tls.setDefaultCACertificates, sandbox code can...

EUVD-2026-81591

vm2 NodeVM can replace the host process TLS trust store...

vm2 NodeVM can replace the host process TLS trust store

Summary vm2 3.11.6 exposes the host tls module to a NodeVM when that builtin is explicitly allowed. Although the module object is wrapped as read-only, its functions still execute against process-wide host state. On Node.js versions that provide tls.setDefaultCACertificates, sandbox code can...

NPM: vm2 NodeVM can replace the host process TLS trust store

NPM: vm2 NodeVM can replace the host process TLS trust store vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.3, = 3.11.6...

CVE-2026-79896 Fortra BoKS Manager boks_portmux TLS ClientHello out-of-bounds read vulnerability

Fortra BoKS Manager contains an out-of-bounds read vulnerability in the custom TLS ClientHello parser used by boksportmux. A remote unauthenticated attacker can submit a malformed ClientHello and terminate boksportmux. Although the daemon is normally restarted automatically, repeated requests can...

CVE-2026-79896

Fortra BoKS Manager is vulnerable to an out-of-bounds read in the custom TLS ClientHello parser utilized by boks_portmux . A remote unauthenticated attacker can exploit this by submitting a malformed ClientHello to terminate the boks_portmux daemon. While the daemon typically restarts automatical...

EUVD-2026-90881

Fortra BoKS Manager contains an out-of-bounds read vulnerability in the custom TLS ClientHello parser used by boksportmux. A remote unauthenticated attacker can submit a malformed ClientHello and terminate boksportmux. Although the daemon is normally restarted automatically, repeated requests can...

CVE-2026-79896 Fortra BoKS Manager boks_portmux TLS ClientHello out-of-bounds read vulnerability

Fortra BoKS Manager contains an out-of-bounds read vulnerability in the custom TLS ClientHello parser used by boksportmux. A remote unauthenticated attacker can submit a malformed ClientHello and terminate boksportmux. Although the daemon is normally restarted automatically, repeated requests can...

crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

A flaw was found in the crypto/tls package, part of golang. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service DoS...

crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

A flaw was found in the crypto/tls package, part of golang. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service DoS...

OPENSUSE-SU-2026:22010-1 Security update for distribution

This update for distribution fixes the following issues: - CVE-2026-81871: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass allows log telemetry interception and alteration bsc1281468. - CVE-2026-81872: go.opentelemetry.io/otel/sdk/log:...

SUSE-SU-2026:23990-1 Security update for distribution

This update for distribution fixes the following issues: - CVE-2026-81871: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass allows log telemetry interception and alteration bsc1281468. - CVE-2026-81872: go.opentelemetry.io/otel/sdk/log:...

RLSA-2026:73428 Important: nodejs24 security, bug fix, and enhancement update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices...

nodejs24 security, bug fix, and enhancement update

An update is available for nodejs24. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Node.js is a platform built on Chrome's JavaScript runtime for easily...