AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)

CVE-2026-69244

### Summary An out-of-bounds heap read could occur in the C response parser while building an error message for a malfo

历史摘要 · 未重新核验 · GitHub Advisory

AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate

CVE-2026-59881

### Summary The client accepts and decompresses frames with the RSV1 bit set even when the `permessage-deflate` extensi

历史摘要 · 未重新核验 · GitHub Advisory

Hono: ReDoS in CORS middleware via Access-Control-Request-Headers

CVE-2026-69207

### Summary The built-in CORS middleware (`hono/cors`) parses the attacker-controlled `Access-Control-Request-Headers`

历史摘要 · 未重新核验 · GitHub Advisory

undici vulnerable to CRLF Injection via blob-like body 'type' property

CVE-2026-15157

### Impact When an application passes a duck-typed blob-like body to undici's HTTP/1.1 dispatcher (via `request()`, `st

历史摘要 · 未重新核验 · GitHub Advisory

undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives

CVE-2026-14643

## Impact Undici's cache interceptor mishandles optional whitespace (OWS) placed around the `=` of a qualified `no-cach

历史摘要 · 未重新核验 · GitHub Advisory

undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields

CVE-2026-16729

## Impact The `setCookie` function has two attribute injection paths. `validateCookieDomain` does not reject semicolons

历史摘要 · 未重新核验 · GitHub Advisory

undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives

CVE-2026-13697

### Summary Two issues in undici's cache interceptor, both fixed by the same patch on `lib/util/cache.js`: 1. **Shared

历史摘要 · 未重新核验 · GitHub Advisory

fast-uri vulnerable to host confusion via backslash authority introducer

CVE-2026-18446

### Impact `fast-uri` v4.1.1 and earlier require a literal `//` to recognize a URI authority, so a reference that uses

历史摘要 · 未重新核验 · GitHub Advisory

Socket.IO: Zero-attachment Memory Exhaustion

CVE-2026-69185

### Impact A specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and b

历史摘要 · 未重新核验 · GitHub Advisory

PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset

CVE-2026-69153

## Summary The fix for GHSA-6g55-p6wh-862q added a guard in `lib/previous-map.js` `PreviousMap.loadFile()` that restric

历史摘要 · 未重新核验 · GitHub Advisory

brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

CVE-2026-69152

### Summary The `maxLength` mitigation added in `5.0.8` for GHSA-mh99-v99m-4gvg / CVE-2026-14257 is incomplete. It boun

历史摘要 · 未重新核验 · GitHub Advisory

Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes

CVE-2026-69151

A Cross-Site Scripting (XSS) vulnerability has been identified in the Angular compiler's internationalization (i18n) pip

历史摘要 · 未重新核验 · GitHub Advisory

Russh: Channel-scoped server callbacks can be reached without an open channel

CVE-2026-68930

There is a server-side channel state issue in `russh`. After a client is authenticated, `russh` can dispatch channel-sc

历史摘要 · 未重新核验 · GitHub Advisory

Paper专业的技术文章，安全经验的积累。Paper 栏目专注于安全技术文章的收录。我们推崇黑客精神，技术分享和热衷解决问题及超越极限，Seebug Paper 期待您的分享。

Paper专业的技术文章，安全经验的积累。Paper 栏目专注于安全技术文章的收录。我们推崇黑客精神，技术分享和热衷解决问题及超越极限，Seebug Paper 期待您的分享。

历史摘要 · 未重新核验 · 知道创宇 / Seebug

Cookie settings

Cookie settings

历史摘要 · 未重新核验 · Mozilla Security Advisories

Mozilla Monitor

Mozilla Monitor

历史摘要 · 未重新核验 · Mozilla Security Advisories

The Mozilla Manifesto

The Mozilla Manifesto

历史摘要 · 未重新核验 · Mozilla Security Advisories

Mozilla Foundation

Mozilla Foundation

历史摘要 · 未重新核验 · Mozilla Security Advisories

Accessibility Policy

Accessibility Policy

历史摘要 · 未重新核验 · Oracle Critical Patch Updates

Create an Account

Create an Account

历史摘要 · 未重新核验 · Oracle Critical Patch Updates