Vulnerability feed
CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run
| Expand | Severity |
Score |
Advisory |
Title |
Source |
Flags |
Published |
|---|---|---|---|---|---|---|---|
| Low | 3.7 | CVE-2026-106070 |
A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails.
When...
OpenSSL, undici, Node.jsOpenSSL, undici, Node.js node, Node.js, c-ares, SQLite, Brotli
|
NVD | |||
|
CVE-2026-106070A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails.
When...
Executive summaryThis advisory covers a batch of security flaws in Node.js across its 26.x, 24.x, and 22.x release lines, including a high-severity Brotli decoder memory corruption issue that the advisory says could lead to remote code execution. The Node.js Project recommends updating to the fixed releases it names (v22.23.4, v24.22.1, v26.12.1) on or shortly after October 21, 2026, since end-of-life versions are always affected. Technical summaryThe advisory describes several vulnerability classes: an out-of-bounds write in the Brotli decoder (CVE-2026-111497, high) triggered by malformed compressed input passed to node:zlib, DNS name truncation at NUL bytes, TLS hostname verification bypasses for non-canonical IPv4 forms, HTTP keep-alive response confusion, entropy cache reuse in snapshots, ZipFile returning wrong bytes after header validation failure (26.x only), and Permission Model bypasses via wildcard matching and fs.realpathSync. Fixed versions are given as v22.23.4, v24.22.1, and v26.12.1. Workarounds are not stated in the advisory, and no CVSS scores or evidence of in-the-wild exploitation are stated. Detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: OpenJS Foundation Node.js Summarized from nodejs.org/en/blog/vulnerability/octobe…26-security-releases Impact if exploitedConfidentialityNone IntegrityLow AvailabilityNone
How it is exploited
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N AffectsOpenSSLundiciNode.jsc-aresSQLiteBrotliOpenSSLundiciNode.js nodeNode.jsc-aresSQLiteBrotli
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Unknown | n/a | DSA-6582-1 |
brotli security update
Debian, BrotliDebian Linux, Brotli, Debian brotli
|
Debian Security Advisories | |||
|
DSA-6582-1CVE-2026-111497brotli security update
Executive summaryDebian has released a security update for the brotli compression package, which is used in Debian's stable distribution (trixie). The advisory says the flaw could lead to denial of service or possibly arbitrary code execution, and Debian recommends upgrading brotli packages. Technical summaryThe advisory describes a vulnerability in Brotli, a general-purpose lossless compression suite, that could result in denial of service or potentially arbitrary code execution. It is tracked as CVE-2026-111497 with Debian bug 1151690. The vulnerability class, attack vector, and preconditions are not stated. For the stable distribution (trixie), the fixed version is 1.1.0-2+deb13u1. Workarounds are not stated, and no detection guidance is given beyond the recommendation to upgrade brotli packages and consult the Debian security tracker. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from lists.debian.org/debian-security-announce/2026/msg00498.html ScoreNo CVSS score published. Affects
Debian Security TeamPublished
Read the advisory
|
|||||||