CVE-2026-82936 describes a resource exhaustion vulnerability in the mH-DEVELOPER smart home module. The Express bodyParser middleware is configured with a high 250 MB limit for JSON and URL-encoded request bodies, allowing an attacker to send large payloads that consume excessive memory. This can cause out-of-memory conditions and crash the fh-node process, resulting in denial of service. The attack's success depends on the device's current memory usage. Additionally, due to CVE-2026-82930, all endpoints are accessible without authentication, allowing any user on the LAN to perform this attack. The issue was resolved in version 3.0.30.

Successful exploitation leads to denial of service by crashing the fh-node process through memory exhaustion. This disrupts the smart home module's operation. The attack requires local network access and depends on device memory state. No remote or unauthenticated internet exploitation is indicated beyond LAN access.

Upgrade mH-DEVELOPER to version 3.0.30 or later where this vulnerability is fixed. Until then, restrict LAN access to trusted users and monitor for unusual large request payloads. No other vendor advisories indicate additional mitigations or that the issue is already mitigated.