Node.js HTTP client library undici versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1 have a vulnerability where the Agent dispatcher silently drops a caller-supplied tls option containing a checkServerIdentity callback due to JSON-based deep cloning. This causes custom TLS certificate verification callbacks to be ignored, potentially allowing acceptance of TLS peers that should be rejected. The issue affects the default dispatcher used by request, fetch, and setGlobalDispatcher, impacting most applications using undici. The vulnerability is fixed in versions 6.29.1, 7.30.1, and 8.12.2 and later.
Node.js HTTP client library undici versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1 have a cache poisoning vulnerability when an originless Agent uses redirect and cache interceptors composed in a specific order with a shared cache store. This flaw allows an attacker controlling a redirect target to poison the cache under a trusted URL or disclose private data by serving cached responses to unauthorized users. The issue is fixed in versions 7.30.1 and 8.12.2 by verifying origin consistency and preserving cache-control policies. Users should upgrade or apply recommended workarounds to mitigate the risk.
Node.js HTTP client library undici versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1 contain a vulnerability in their fetch() implementation's Subresource Integrity (SRI) verification. The algorithm token matching is case-sensitive and only recognizes lowercase tokens, causing valid uppercase or mixed-case tokens to be ignored. This results in the integrity check being bypassed, allowing an attacker controlling the response body to deliver modified content without detection. The issue affects response integrity but not confidentiality or availability. Fixed in versions 7.30.1 and 8.12.2 by normalizing tokens to lowercase before validation.
Node.js undici HTTP client versions 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1 contain a vulnerability in the EventSource client that allows a malicious Server-Sent Events peer to exhaust process memory. This occurs by sending many tiny completed data fields without blank event separators or a single unfinished line split across many chunks, causing unbounded parser state retention. The impact is denial of service via process termination due to memory exhaustion. The issue is fixed in versions 6.29.1, 7.30.1, and 8.12.2. No workaround exists other than upgrading.
Node.js HTTP client library undici versions 5.15.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1 contain a vulnerability in their WebSocket client. A malicious or compromised WebSocket server can cause the client to exhaust process memory by sending continuous small PING frames, which triggers automatic PONG responses that ignore backpressure signals. This leads to unbounded growth of the outbound write queue and heap, eventually causing the Node.js process to run out of memory and terminate. The issue affects availability only and requires no authentication. Fixed versions are 6.29.1, 7.30.1, and 8.12.2 and later. No workaround exists other than upgrading.
FreeRDP versions before 3.32.0 contain a NULL pointer dereference vulnerability in the websocket transport. This flaw allows a malicious gateway to crash FreeRDP clients by sending zero-length ping frames. The vulnerability triggers an assertion failure that terminates the client process, causing a denial of service condition.
FreeRDP versions from 3.0.0 up to but not including 3.32.0 contain an out-of-bounds read vulnerability in the Windows RAIL client. This flaw allows malicious RDP servers to trigger heap over-reads by sending non-NUL-terminated window titles, potentially causing client crashes or corruption of window titles. The vulnerability is identified as CVE-2026-111375 and has a CVSS score of 9.1, indicating high severity. A patch is available to address this issue.
CVE-2026-79610 (XSA-501) is a vulnerability in Xen involving race conditions during transitions between grant table versions v1 and v2. Specifically, a v2 to v1 to v2 change sequence can cause status pages to be freed and then reallocated, resulting in stale pointers due to changed addresses in the status array. This can lead to serious impacts on confidentiality, integrity, and availability.
A vulnerability in Xen hypervisor causes a fatal VMEntry failure to guest virtual machines when certain processor states coincide, specifically when debug exceptions (#DB) are intercepted, single stepping is active, and STI/MovSS blocking is enabled. An additional sub-case involving branch tracing also triggers this failure. This issue results in guest crashes but does not impact confidentiality or integrity.
This record relates to multiple vulnerabilities in the Xen hypervisor. CVE-2026-102702 concerns a lack of restriction on using invalidate-without-clean operations against read-only grant mappings, which may corrupt granted memory. It affects various Ubuntu Xen package versions. The CVSS score is 7.5, indicating a medium severity. There is no indication of known exploits in the wild or vendor patch information provided.
CVE-2026-109715 is a vulnerability involving incorrect boundary conditions in the JavaScript Engine component of mozjs52. This issue was addressed and fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. The vulnerability has a CVSS score of 8.1, indicating a high severity impact primarily affecting confidentiality and integrity. No known exploits in the wild have been reported. Multiple specific versions of mozjs52 are affected.
CVE-2026-109716 is a vulnerability involving incorrect boundary conditions in the JavaScript Engine component of mozjs52. This flaw was addressed and fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. The vulnerability has a CVSS 3.1 score of 8.1, indicating a high impact on confidentiality and integrity, but no impact on availability. No known exploits are reported in the wild.
CVE-2026-109721 is a vulnerability involving incorrect boundary conditions in the JavaScript Engine's JIT component. This flaw was addressed and fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. The vulnerability has a medium severity rating with a CVSS score of 5.4. It does not have known exploits in the wild. Multiple specific affected versions of the mozjs52 package are identified.
CVE-2026-109731 is a medium severity vulnerability involving incorrect boundary conditions in the Graphics: Canvas2D component of mozjs52. This flaw was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. The vulnerability could potentially lead to limited confidentiality and integrity impacts but does not affect availability. No known exploits are reported in the wild.
CVE-2026-109754 is a vulnerability involving incorrect boundary conditions in the DOM Editor component of mozjs52. This issue was addressed and fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. The vulnerability has a CVSS score of 8.1, indicating a high severity level with potential for high confidentiality and integrity impact. No known exploits in the wild have been reported. A comprehensive vendor advisory from Mozilla confirms the fix availability.
CVE-2026-109762 is a vulnerability involving incorrect boundary conditions in the SVG component of mozjs52. This flaw was addressed and fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. The vulnerability has a high CVSS score of 8.8, indicating a serious security impact. It allows for potential high impact on confidentiality, integrity, and availability. Multiple specific affected versions of mozjs52 are identified. No known exploits in the wild have been reported.
CVE-2026-102700 is a medium severity vulnerability in Xen related to the GNTTAB_cache_flush function. The issue stems from an error path that fails to drop a page reference when the page is owned by special system domains such as DOM_IO and DOM_COW. This flaw originated from an incomplete fix in a previous advisory (XSA-232 / CVE-2017-14318) where a NULL pointer check was added but the error handling was not fully corrected. The vulnerability affects multiple specific Ubuntu Xen package versions.
FreeRDP versions before 3.32.0 contain a vulnerability where a NULL pointer dereference occurs in the arm_handle_request_ok function when an ARM endpoint returns an empty HTTP 200 response body. This can cause the client to crash if an attacker controlling the ARM gateway returns a zero-length body. The vulnerability has a medium severity with a CVSS score of 5.3 and affects multiple Ubuntu package versions of FreeRDP.
FreeRDP versions before 3.32.0 contain a heap-based out-of-bounds write vulnerability in the function freerdp_interruptible_get_line. This occurs because the buffer is shrunk to 32 bytes while retaining the length of a pre-filled suggested username as the write offset. A malicious or compromised ARM routing service can exploit this by returning a long redirectedUsername, which reaches the CLI credential prompt and causes the client to crash when the user inputs data. The vulnerability has a CVSS score of 6.5, indicating medium severity. A patch is available to address this issue.
CVE-2026-92707 is a medium severity vulnerability in .NET involving improperly controlled sequential memory allocation that allows an unauthorized attacker to cause a denial of service over a network. The issue affects multiple Ubuntu-distributed .NET versions prior to specific patched releases. Official patches have been released by Ubuntu to address this vulnerability.