Threats Tagged 'cwe-177'

CVE-2026-67448 is a vulnerability in axllent mailpit versions 1.29.0 through 1.30.5 involving improper handling of URL encoding in WebSocket origin checks. The origin check relies on the raw request URI prefix, but Go's ServeMux routes on the percent-decoded path, allowing an attacker to bypass origin validation by encoding the path. This leads to unauthorized WebSocket connections that can leak sensitive email data. The issue arises because the upgrader accepts all origins and the middleware origin check is bypassed due to inconsistent handling of encoded URLs.

CVE-2026-15371 is a high-severity vulnerability in Rapid7 Velociraptor versions from 0 up to but not including 0.77.2. The web GUI allows users to specify a custom column type as a URL, but it does not restrict URL schemes. This flaw permits an attacker to use a JavaScript scheme, leading to a cross-site scripting (XSS) risk when users click the crafted URL in the GUI.

Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.0.M1 through 9.0.119, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected. Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120, which fix the issue.

URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino. This issue affects Apache Gravitino: from 1.0.0 before 1.2.1. Users are recommended to upgrade to version 1.2.1, which fixes the issue.

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, when using serveStatic together with route-based middleware protections (e.g.app.use('/admin/*', ...)), inconsistent URL decoding allowed protected static resources to be accessed without authorization. The router used decodeURI, while serveStatic used decodeURIComponent. This mismatch allowed paths containing encoded slashes (%2F) to bypass middleware protections while still resolving to the intended filesystem path. This issue has been patched in version 4.12.4.

HighVulnerabilityUnited StatesGermanyJapan+7#cve#cve-2026-29045#cwe-177

The @fastify/express plugin adds full Express compatibility to Fastify. A security vulnerability exists in @fastify/express prior to version 4.0.3 where middleware registered with a specific path prefix can be bypassed using URL-encoded characters (e.g., `/%61dmin` instead of `/admin`). While the middleware engine fails to match the encoded path and skips execution, the underlying Fastify router correctly decodes the path and matches the route handler, allowing attackers to access protected endpoints without the middleware constraints. The vulnerability is caused by how @fastify/express matches requests against registered middleware paths. This vulnerability is similar to, but differs from, CVE-2026-22031 because this is a different npm module with its own code. Version 4.0.3 of @fastify/express contains a patch fort the issue.

HighVulnerabilityGermanyUnited KingdomFrance+3#cve#cve-2026-22037#cwe-177

CVE-2026-22031 is a high-severity vulnerability in the @fastify/middie plugin prior to version 9.1.0 that allows bypassing middleware protections via URL-encoded path prefixes. The middleware fails to decode URL-encoded characters when matching paths, while Fastify's router correctly decodes them, enabling attackers to access protected routes without middleware enforcement. This can lead to unauthorized access, compromising confidentiality and integrity of applications using vulnerable versions. The vulnerability requires network access and low privileges but no user interaction. Although no known exploits are reported, the impact on affected systems is significant. Upgrading to version 9.1.0 or later mitigates the issue.

HighVulnerabilityGermanyFranceNetherlands+4#cve#cve-2026-22031#cwe-177