golang: net/url: Memory exhaustion in query parameter parsing in net/url

A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted...

CVE-2026-73658

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.5, Aws4FetchClient.buildUrl and Aws4FetchClient.presign in apps/webapp/app/v3/objectStoreClient.server.ts assign user-controlled packet keys to URL.pathname, while...

CVE-2026-56860

The golang net/url package is vulnerable to a Denial of Service (DoS) condition due to quadratic time complexity during path resolution. The flaw occurs when resolving relative paths containing parent directory (..) segments, which previously triggered string conversions and buffer rewrites at ev...

CVE-2026-56860 Avoid quadratic complexity in resolvePath in net/url

Previously, resolving relative paths containing parent directory '..' segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking f...

CVE-2026-56860 Avoid quadratic complexity in resolvePath in net/url

Previously, resolving relative paths containing parent directory '..' segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking f...

GO-2026-6218 Avoid quadratic complexity in resolvePath in net/url

Previously, resolving relative paths containing parent directory '..' segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking f...

Denial of Service (DoS)

Overview std/net/url is a Go standard library package std/net/url Affected versions of this package are vulnerable to Denial of Service DoS. Go Vulnerability Report:Previously, resolving relative paths containing parent directory '..' segments performed string conversions and buffer rewrites on...

CVE-2026-73659

Trigger.dev CVE-2026-73659 affects the open-source platform (Trigger.dev) in versions 4.4.2–4.5.0. The packet presign routes (apps/webapp/app/routes/api.v1.packets.$.ts) pass a caller-controlled filename through resolveStoreProtocolForPacketPresign to generatePresignedUrl/generatePresignedRequest...

CVE-2026-73659 Trigger.dev: Cross-tenant object read/write via path traversal in packet presign API

Trigger.dev is the open-source platform for building AI workflows in TypeScript. From 4.4.2 until 4.5.0, the packet presign routes in apps/webapp/app/routes/api.v1.packets.$.ts pass a caller-controlled filename through resolveStoreProtocolForPacketPresign to generatePresignedUrl and...

EUVD-2026-58480

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.5, Aws4FetchClient.buildUrl and Aws4FetchClient.presign in apps/webapp/app/v3/objectStoreClient.server.ts assign user-controlled packet keys to URL.pathname, while...

CVE-2026-73658 Trigger.dev: Cross-tenant object store read and write via URL path traversal

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.5, Aws4FetchClient.buildUrl and Aws4FetchClient.presign in apps/webapp/app/v3/objectStoreClient.server.ts assign user-controlled packet keys to URL.pathname, while...

CVE-2026-73658 Trigger.dev: Cross-tenant object store read and write via URL path traversal

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.5, Aws4FetchClient.buildUrl and Aws4FetchClient.presign in apps/webapp/app/v3/objectStoreClient.server.ts assign user-controlled packet keys to URL.pathname, while...

CVE-2026-73658

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.5, Aws4FetchClient.buildUrl and Aws4FetchClient.presign in apps/webapp/app/v3/objectStoreClient.server.ts assign user-controlled packet keys to URL.pathname, while...

CVE-2026-73658

Trigger.dev CVE-2026-73658 affects versions 4.4.2 through 4.5.0-rc.5 where Aws4FetchClient.buildUrl() and Aws4FetchClient.presign() assign user-controlled packet keys to URL.pathname, and routes/api.v1.packets.$.ts accepts wildcard params with insufficient per-resource ownership checks. WHATWG pa...

MAL-2026-13979 Malicious code in eslint-generate-prerelease (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26b3f1a7acd55a1642c9615fe72871781a6c0d6bea6f9d31aa42c700aa799704 Package ships an empty module index.js = 'module.exports = ;' under a name that resembles internal tooling, published at an inflated version 99.9.1 —...

Malicious code in eslint-generate-prerelease (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26b3f1a7acd55a1642c9615fe72871781a6c0d6bea6f9d31aa42c700aa799704 Package ships an empty module index.js = 'module.exports = ;' under a name that resembles internal tooling, published at an inflated version 99.9.1 —...

CVE-2026-72777 Next AI Draw.io 0.4.16 SSRF via DNS Rebinding in parse-url

Next AI Draw.io through 0.4.16 contains a server-side request forgery vulnerability in the POST /api/parse-url endpoint due to hostname validation that only checks string patterns without DNS resolution. Unauthenticated attackers can supply hostnames that bypass string validation but resolve to...

CVE-2026-72777 Next AI Draw.io 0.4.16 SSRF via DNS Rebinding in parse-url

Next AI Draw.io through 0.4.16 contains a server-side request forgery vulnerability in the POST /api/parse-url endpoint due to hostname validation that only checks string patterns without DNS resolution. Unauthenticated attackers can supply hostnames that bypass string validation but resolve to...

CVE-2026-72777

Next AI Draw.io

CVE-2026-72777

Next AI Draw.io through 0.4.16 contains a server-side request forgery vulnerability in the POST /api/parse-url endpoint due to hostname validation that only checks string patterns without DNS resolution. Unauthenticated attackers can supply hostnames that bypass string validation but resolve to...