Threats affecting pkg:npm/@fastify/jwt

Kener versions 3.0.0 up to but not including 4.1.10 contain a critical authentication bypass vulnerability due to the use of a hard-coded cryptographic key fallback. If the environment variable KENER_SECRET_KEY is empty or unset, attackers who know an administrator's email can forge session tokens and gain full administrative access or create password-reset tokens. This flaw is fixed in version 4.1.10.

QloApps versions 1.6.0 through 1.7.0 have an authorization bypass vulnerability in the qlohotelreview module's AddReview AJAX action. This flaw allows unauthenticated attackers to submit fake reviews for arbitrary orders by exploiting a publicly exposed review_ajax_token and enumerating order IDs. The vulnerability enables attackers to impersonate other customers by posting unauthorized ratings and reviews.

QloApps versions up to 1.7.0 have an authorization bypass vulnerability in the OrderConfirmationController::init() function. This flaw allows unauthenticated attackers to sequentially guess guest id_cart values to obtain guest order references and emails. Attackers can read redirect headers, view booking details, and convert guest accounts into full accounts with attacker-chosen passwords.

ntop nDPI versions up to 6.0 contain an out-of-bounds read vulnerability in the dissect_softether_host_fqdn() function. This flaw arises because the function compares host_name using the consumed byte count instead of the actual data length. An attacker can exploit this by sending crafted short UDP datagrams on already-classified SoftEther flows, causing the strncmp function to read beyond the packet payload buffer.

CVE-2026-116743 is a double free vulnerability in libyal's libmsiecf library, specifically in the function libmsiecf_url_values_read_data(). This flaw allows attackers to corrupt heap memory by supplying a crafted MSIE cache index.dat file with a partial record containing an oversized unknown_offset. The vulnerability can cause forensic tools processing such files to crash. The CVSS 4.0 base score is 6.8, indicating a medium severity level.

HTSlib versions up to 1.24 contain a heap out-of-bounds read and write vulnerability in the function bgzf_index_load_hfile() due to improper handling of a crafted .gzi index entry count. This numeric truncation error can cause heap corruption or crashes in tools such as samtools and bcftools.

Speex (libspeex) versions up to 1.2.1 contain an out-of-bounds write vulnerability in the speex_bits_read_whole_bytes() function. This flaw occurs due to improper handling of length truncation for non-owned SpeexBits buffers, allowing attackers to stream crafted Speex data to corrupt memory and potentially crash applications.

A NULL pointer dereference vulnerability exists in libcss up to version 0.9.2 within the netsurf-browser project. This flaw occurs in the mq_parse_media_query() function when processing media lists that end with a trailing comma. An attacker can exploit this by serving a stylesheet with an @media or @import media list ending in a comma, causing the parser to crash.

VMime versions up to 0.9.2 have an information disclosure vulnerability in the uuEncoder::decode function. This flaw causes uninitialized stack memory to be written into decoded output when processing over-long lines in uuencoded MIME parts. An attacker can exploit this by sending crafted uuencode or x-uuencode MIME parts with large line length bytes, potentially leaking up to 15 bytes of stack memory per line in decoded attachments.

VMime versions up to 0.9.2 contain a stack-based buffer overflow vulnerability in the uuEncoder::decode function. This flaw arises from an integer underflow triggered by crafted uuencoded MIME parts in emails. An attacker can send a specially crafted email with a uuencoded line whose length character is 'b' but is not a 'begin' line, leading to stack memory corruption. This can cause the application to crash or potentially allow remote code execution.

CVE-2026-116737 is a heap out-of-bounds read vulnerability in libphdi, a component of libyal. The flaw occurs in the function libphdi_data_files_get_extent_data_file_path, which incorrectly calculates buffer size by using the directory prefix length instead of the basename length. This can be triggered by a crafted Parallels disk image descriptor with a long directory prefix and a short basename, potentially causing a process crash or exposure of adjacent heap memory.

CVE-2026-116736 is a heap out-of-bounds read vulnerability in libpff up to version 20260926. The flaw occurs in the libpff_table_read_values_array function due to improper validation of a 7c column definition's values_array_size against the remaining buffer bytes. An attacker can exploit this by supplying a crafted PST, OST, or PAB file, causing applications to read adjacent heap memory or crash.

CVE-2026-116735 is an off-by-one bounds check vulnerability in libpff through version 20260926. It occurs in the function libpff_table_read_6c_record_entries and allows attackers to trigger a heap out-of-bounds read by supplying crafted PST, OST, or PAB files. This can lead to reading adjacent heap memory or application crashes in tools like pffexport or pypff.

flatcc versions up to 0.6.4 have an integer overflow vulnerability in the check_header function of the FlatBuffers verifier. On 32-bit builds, this flaw allows crafted buffer offsets to bypass bounds checks, leading to out-of-bounds reads before the buffer and potential process crashes.

CVE-2026-116733 is an out-of-bounds read vulnerability in flatcc versions up to 0.6.4. It occurs in the __flatcc_json_parser_number function when parsing JSON numbers ending with a decimal point. This flaw allows attackers to read beyond the input buffer, potentially causing application crashes.

libdwarf versions up to 2.3.3 contain a heap out-of-bounds read vulnerability in the dwarf_debug_addr_table() function. This flaw occurs because the function omits the table starting offset when validating the .debug_addr unit length. An attacker can exploit this by supplying a crafted object file with a non-zero offset table, causing dwarf_debug_addr_by_index() to read beyond the allocated heap buffer. This can lead to disclosure of adjacent heap memory or cause a crash in programs using libdwarf.

Furnace versions up to 0.6.8.3 have an out-of-bounds write vulnerability in the DivEngine::loadFTM() function. This flaw allows attackers to corrupt heap memory by using a crafted FamiTracker module with a subsong count of two or more, causing a write beyond the subsong vector and potentially crashing the application when the module is opened.

Furnace versions up to 0.6.8.3 have an out-of-bounds heap read vulnerability in the DivEngine::loadFTM() function. This flaw occurs when importing FamiTracker modules with an unbounded DPCM note count, allowing crafted files to read beyond the noteMap array and cause a crash.

CVE-2026-116729 is a heap out-of-bounds read vulnerability in libfvde, a library for FileVault 2 volumes. The flaw occurs in the function libfvde_encrypted_metadata_read_type_0x001a() due to an unbounded strlen call on embedded XML plist data that is not properly NUL-terminated. An attacker can craft a malicious FileVault 2 volume with non-NUL-terminated plist data, causing libfvde_volume_open() to read beyond the allocated heap buffer.

CVE-2026-116728 is a heap out-of-bounds read vulnerability in libfvde, a library for FileVault 2 Core Storage volumes. The flaw occurs because the size of XML plist data is not properly checked against the source metadata block, allowing an attacker to cause a buffer over-read. This can lead to application crashes when processing crafted volumes.