fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority
CVE-2026-84394
### Impact `fast-uri` accepts a host that contains an unbalanced or misplaced authority bracket (`[` or `]`) without re
#cwe-436
共收录 120 条相关情报。
← 返回所有主题elysia has Inefficient Algorithmic Complexity and Interpretation Conflict
CVE-2026-56669
Elysia v1.4.28 is vulnerable to denial-of-service attacks due to CPU exhaustion in the form data normalization code. El
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, When ignore_path_parameters_in_path_matching...
CVE-2026-73553
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4,
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy normally matches the raw request path,...
CVE-2026-73511
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4,
http-cache-semantics through 4.2.0 contains a cache validation vulnerability in the _varyMatches() function that fails to properly validate Vary header wildcards due to byte-for...
CVE-2026-93750
http-cache-semantics through 4.2.0 contains a cache validation vulnerability in the _varyMatches() function that fails t
LMDeploy has an SSRF bypass
### Summary The URL checking logic in lmdeploy has a logical flaw that could be bypassed by attackers, leading to SSRF a
Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain...
CVE-2026-92598
Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain
Nodemailer versions >= 6.9.16 and < 9.1.0 mis-parse RFC 5322 comments in email addresses: in lib...
CVE-2026-92597
Nodemailer versions >= 6.9.16 and < 9.1.0 mis-parse RFC 5322 comments in email addresses: in lib/addressparser, a commen
Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than st...
CVE-2026-92598
Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain
Nodemailer versions >= 6.9.16 and < 9.1.0 mis-parse RFC 5322 comments in email addresses: in lib/addressparser, a comment closed immediately before a non-break character causes ...
CVE-2026-92597
Nodemailer versions >= 6.9.16 and < 9.1.0 mis-parse RFC 5322 comments in email addresses: in lib/addressparser, a commen
A vulnerability was detected in OpenClaw ClawScan up to 0.1.6. The impacted element is the function IsBinaryFile of the file internal/runner/static_scanner.go of the component F...
CVE-2026-91835
A vulnerability was detected in OpenClaw ClawScan up to 0.1.6. The impacted element is the function IsBinaryFile of the
fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv, that added a mailto scheme parser in version 4.1.3. In versions 4.1.3 and 4.1.4, the mail...
CVE-2026-86818
fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv, that added a mailto scheme parse
Traefik entrypoint header-name sanitization bypassed via request trailers
CVE-2026-88004
## Summary Traefik's entrypoint defenses against spoofed trusted header names — `aliasHeadersStrategy` / `underscoreHea
Traefik is an open source HTTP reverse proxy and load balancer. From 3.2.0 until 3.7.13, Traefik entrypoint defenses aliasHeadersStrategy, underscoreHeadersStrategy, and forward...
CVE-2026-88004
Traefik is an open source HTTP reverse proxy and load balancer. From 3.2.0 until 3.7.13, Traefik entrypoint defenses ali
Traefik entrypoint header-name sanitization bypassed via request trailers
CVE-2026-88004
Traefik is an open source HTTP reverse proxy and load balancer. From 3.2.0 until 3.7.13, Traefik entrypoint defenses ali
Interpretation conflict in Safebrowsing in Google Chrome on on Mac prior to 153.0.8010.36 allowed...
CVE-2026-87627
Interpretation conflict in Safebrowsing in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker leve
Nodemailer: IDN/Punycode domain allow-list bypass leads to email delivery to an attacker-controlled domain
### Summary Nodemailer resolves an international (IDN / non-ASCII) recipient **domain** to a different Punycode `xn--`
Nodemailer: Recipient-domain validation bypass via RFC 5322 comment mis-parsing leads to email delivery to an attacker-controlled domain
### Summary Nodemailer's email-address parser treats an **RFC 5322 comment** `( ... )` inside the domain as a point to
@fastify/middie versions >= 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by matching against the raw request target, while the Fastify router resolves an ...
CVE-2026-85184
@fastify/middie versions >= 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by matching against the
fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening bracket but does not end with a...
CVE-2026-84394
fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host th