294 matches found
CLEANSTART-2026-YW11932 undici's WebSocket client crashes the whole Node
Security vulnerability affects the npm package. undici's WebSocket client crashes the whole Node...
CVE-2026-47848
A flaw was found in the Reactor Netty WebSocket client. In specific scenarios, when the HTTP client is explicitly configured to follow redirects, a WebSocket handshake redirect to a different origin may lead to the leakage of credentials. This information disclosure vulnerability could allow an...
Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses dependencies which is vulnerable to multiple Critical severity CVEs.
Summary Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses dependencies which is vulnerable to multiple Critical severity CVEs. This bulletin contains information regarding the vulnerability and its remediation. Vulnerability Details CVEID:CVE-2026-11525 DESCRIPTIO...
CLEANSTART-2026-BF71397 undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error listener, while that stream can still ...
Security vulnerability affects the npm package. undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error listener, while that stream can still emit...
CLEANSTART-2026-PF52310 undici's WebSocket client crashes the whole Node
Security vulnerability affects the npm package. undici's WebSocket client crashes the whole Node...
CLEANSTART-2026-ID50427 ws is an open source WebSocket client and server for Node
Security vulnerability affects the argo-workflows package. ws is an open source WebSocket client and server for Node...
CLEANSTART-2026-OM66043 undici's WebSocket client crashes the whole Node
Security vulnerability affects the renovate package. undici's WebSocket client crashes the whole Node...
CLEANSTART-2026-VO10406 undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error listener, while that stream can still ...
Security vulnerability affects the renovate package. undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error listener, while that stream can still emit...
CLEANSTART-2026-XW34925 ws is an open source WebSocket client and server for Node
Security vulnerability affects the argo-workflows package. ws is an open source WebSocket client and server for Node...
CLEANSTART-2026-HO32000 In specific scenarios involving WebSocket handshake redirects to a different origin, the Reactor Netty WebSocket client may leak credentials
Security vulnerability affects the sonarqube package. In specific scenarios involving WebSocket handshake redirects to a different origin, the Reactor Netty WebSocket client may leak credentials...
Undici WebSocket Client Vulnerable To Denial Of Service Via Unbounded Automatic PONG Buffering
Impact undici's WebSocket client including Node.js's bundled "globalThis.WebSocket" can be driven to exhaust process memory by a malicious or compromised WebSocket server. For every PING frame received, the receiver automatically writes a PONG response to the socket and ignores the "false" return...
npm: undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering
npm: undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering vulnerability discovered by ? in WordPress npm undici versions = 5.15.0, 6.29.1...
GHSA-9FM3-97PX-RJF6 undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering
Impact undici's WebSocket client including Node.js's bundled globalThis.WebSocket can be driven to exhaust process memory by a malicious or compromised WebSocket server. For every PING frame received, the receiver automatically writes a PONG response to the socket and ignores the false return val...
undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering
Impact undici's WebSocket client including Node.js's bundled globalThis.WebSocket can be driven to exhaust process memory by a malicious or compromised WebSocket server. For every PING frame received, the receiver automatically writes a PONG response to the socket and ignores the false return val...
EUVD-2026-102321
undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering...
undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake
Impact undici's experimental WebSocket client enabled by default via allowH2: true crashes the Node.js process when it connects to a malicious server over HTTP/2. If the server answers the WebSocket upgrade with a response that fails handshake validation, undici aborts the request, but the abort ...
GHSA-QQ8J-7V2V-3RWP undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake
Impact undici's experimental WebSocket client enabled by default via allowH2: true crashes the Node.js process when it connects to a malicious server over HTTP/2. If the server answers the WebSocket upgrade with a response that fails handshake validation, undici aborts the request, but the abort ...
npm: undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake
npm: undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake vulnerability discovered by ? in WordPress npm undici versions = 8.11.0, 8.11.2...
EUVD-2026-105148
Vitest: Code injection via unauthenticated manual mock registration...
CVE-2026-112949
Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 2.1.0-beta.7 until 4.1.12 and 5.0.3, an unauthenticated non-browser WebSocket client that can reach a development server using interceptorPlugin can register a manual mock whose attacker-controlled url...