undici vulnerable to Denial of Service via WebSocketStream unclean close

Impact undici's WebSocketStream crashes the client process when a WebSocket connection is closed abruptly without a close handshake. On such an unclean close, the internal socket-close handler calls abort on the writable stream even when the application holds a writer lock. Per the WHATWG Streams...

GHSA-RX4F-C7P8-82VQ undici vulnerable to Denial of Service via WebSocketStream unclean close

Impact undici's WebSocketStream crashes the client process when a WebSocket connection is closed abruptly without a close handshake. On such an unclean close, the internal socket-close handler calls abort on the writable stream even when the application holds a writer lock. Per the WHATWG Streams...

NPM: undici vulnerable to Denial of Service via WebSocketStream unclean close

NPM: undici vulnerable to Denial of Service via WebSocketStream unclean close vulnerability discovered by ? in WordPress Npm undici versions = 7.0.0, 7.29.1...

undici: undici: Denial of Service via WebSocketStream unclean close

A flaw was found in undici's experimental WebSocketStream client. A remote attacker, operating as an untrusted server, can trigger a Denial of Service DoS by closing the TCP connection without a proper WebSocket close handshake. This action causes an unhandled error in the client, leading to the...

CVE-2026-85014 undici vulnerable to Denial of Service via WebSocketStream unclean close

undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection without a WebSocket close handshake. On an unclean close the internal socket-close handler calls abort on the writable stream unconditionally and discards the returned...

CVE-2026-85014 undici vulnerable to Denial of Service via WebSocketStream unclean close

undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection without a WebSocket close handshake. On an unclean close the internal socket-close handler calls abort on the writable stream unconditionally and discards the returned...

CVE-2026-85014 undici vulnerable to Denial of Service via WebSocketStream unclean close

undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection without a WebSocket close handshake. On an unclean close the internal socket-close handler calls abort on the writable stream unconditionally and discards the returned...

CVE-2026-85014

CVE-2026-85014 affects undici's experimental WebSocketStream client in Node.js. When a remote peer closes the TCP connection without a proper WebSocket close handshake, the internal socket-close handler calls abort on the locked writable stream and discards the returned promise. Per the WHATWG St...

undici: undici: Denial of Service via WebSocketStream unclean close

A flaw was found in undici's experimental WebSocketStream client. A remote attacker, operating as an untrusted server, can trigger a Denial of Service DoS by closing the TCP connection without a proper WebSocket close handshake. This action causes an unhandled error in the client, leading to the...

undici: undici: Denial of Service via WebSocketStream unclean close

A flaw was found in undici's experimental WebSocketStream client. A remote attacker, operating as an untrusted server, can trigger a Denial of Service DoS by closing the TCP connection without a proper WebSocket close handshake. This action causes an unhandled error in the client, leading to the...

Tickets: Cross-site scripting vulnerabilities

Tickets is an open-source public safety scheduling and tracking application developed by Open ISES. Versions of tickets prior to 3.44.2 contained a cross-site scripting vulnerability. This vulnerability stemmed from the lack of proper cleaning of multiple POST parameters in the dbloader.php file,...

CtrlPanel.gg: Operating System Command Injection Vulnerability

CtrlPanel.gg is an open-source hosting service billing management tool developed by CtrlPanel.gg. Versions of CtrlPanel.gg 1.1.1 and earlier contained a vulnerability related to operating system command injection. This vulnerability stemmed from the Web installer performing the install.lock check...

WordPress plugin IP2Location Country Blocker: Cross-site scripting vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows users to create personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be installed t...

Notepad Next Code Injection Vulnerability

Notepad Next is a notepad software developed by dail8859. Versions of Notepad Next prior to 0.14 contained a code injection vulnerability. This vulnerability stemmed from the detectLanguageFromExtension function, which directly inserted file extensions into Lua scripts without proper cleanup. Thi...

Apache Airflow security vulnerabilities

Apache Airflow is an open-source platform developed by the Apache Foundation in the United States. It allows for the creation, management, and monitoring of workflows. This platform features scalability and dynamic monitoring capabilities. There is a security vulnerability in Apache Airflow. This...

routing system() Privilege Escalation

The vulnerability of the system function in microprogrammed routing devices like EDIMAX BR-6208AC lies in the lack of measures taken to clean data at the control level when processing the parameter pppUserName. Exploiting this vulnerability can allow a malicious actor to enhance their privileges...

Koha Library Management System security vulnerabilities

Koha Library Management System is an open-source library automation system developed by Koha. Versions of the Koha Library Management System prior to 23.05.10 contained security vulnerabilities. These vulnerabilities stemmed from the lack of cleaning user-controllable file names before...

defu security vulnerabilities

Defu is a lightweight tool library developed by UnJS for recursively merging default values. Versions of Defu prior to 6.1.5 contained security vulnerabilities; these vulnerabilities stemmed from the practice of passing uncleaned user input into the Defu functions, which could lead to prototype...

Mattermost security vulnerabilities

Mattermost is an open-source collaboration platform developed by the American company Mattermost. There is a security vulnerability in Mattermost, which stems from the failure to clean up post content controlled by users. This vulnerability could allow attackers to manipulate administrator...

Foreman security vulnerabilities

Foreman is a set of open-source tools developed by Foreman for lifecycle management in both physical and virtual servers. This tool provides functions such as service activation, configuration management, and reporting status. There is a security vulnerability in Foreman, which stems from command...