24h | 7d | 30d

CVE-2026-98432

Overview

  • Linux
  • Linux
15 Oct 2026
Published
31 Oct 2026
Updated
CVSS v3.1
CRITICAL (9.8)
EPSS
0.46%
KEV

Description

In the Linux kernel, the following vulnerability has been resolved: ipv4: free inet_opt and ireq_opt after an RCU grace period tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the child socket (newinet->inet_opt) without copying it. Another cpu can concurrently process a retransmitted SYN for the same request socket, and send a SYNACK from tcp_check_req(). tcp_v4_send_synack() and inet_csk_route_req() read ireq->ireq_opt under rcu_read_lock() only, and ip_build_and_send_pkt() and ip_options_build() then read opt->optlen twice. Note that the SYNACK timer itself is not an issue: it holds a reference on its request socket, and inet_csk_reqsk_queue_drop() calls timer_delete_sync() before the child can be freed. Since commit 079096f103fa ("tcp/dccp: install syn_recv requests into ehash table"), request sockets are processed without holding the listener lock, so nothing prevents the child socket from being freed while the SYNACK is still being built. TCP child sockets do not have SOCK_RCU_FREE, and inet_sock_destruct() frees inet_opt with a plain kfree(), leading to a use-after-free in ip_options_build(). A similar issue exists with request socket migration (net.ipv4.tcp_migrate_req=1, or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE program). reqsk_timer_handler() clones the request socket with inet_reqsk_clone(), so that the old request socket and its clone share the same ireq_opt, then reqsk_migrate_reset() clears the pointer in the old one. Another cpu holding a reference on the old request socket can still be using these options (sending a SYNACK, or creating a child in tcp_v4_syn_recv_sock()) when the clone is freed, and tcp_v4_reqsk_destructor() also uses a plain kfree(). Readers already use RCU, and other paths replacing inet_opt (do_ip_setsockopt(), cipso_v4_sock_setattr()...) already use kfree_rcu(). Use kfree_rcu() in inet_sock_destruct() and tcp_v4_reqsk_destructor() as well. IPv6 is not affected by the first issue, because tcp_v6_syn_recv_sock() duplicates the options. tcp_v6_reqsk_destructor() has the same migration issue with ipv6_opt, which is only set by CALIPSO. This will be addressed in a separate patch.

Statistics

  • 13 Posts
  • 53 Interactions
Last activity: Last hour

Fediverse

Profile picture fallback
Etienne / Tek @tek

Critical vulnerability in Linux network start, this is a nightmare scenario, I am shutting down some servers until there is a fix (and it is not Sunday night for me to fix it)
atlasum.net/blog/cve-2026-9843

  • 20
  • 17
  • 0
  • 11h ago
Profile picture fallback
Éric Freyssinet @ericfreyss

Linux's October 2026 TCP Use-After-Free: CVE-2026-98432 — Atlas
-> mptcp
-> IPv4 packets with options

atlasum.net/blog/cve-2026-9843

  • 3
  • 1
  • 0
  • 17h ago
Profile picture fallback
Janik Besendorf @besendorf

Ubuntu is shitty software and backporting is flawed
atlasum.net/blog/cve-2026-9843

  • 2
  • 5
  • 0
  • 4h ago
Profile picture fallback
Roy Tanck @roytanck

Someone argued recently that not all security issues need an ominous name (like "heartbleed" or "php2shell") and a fancy website. But then again, "CVE-2026-98432" doesn't really have a nice ring to it, or any ring at all.

Also, a fixed kernel update would be nice, Ubuntu. Debian has had one for days now.

  • 0
  • 2
  • 0
  • 23h ago
Profile picture fallback
benzogaga33 :verified: @benzogaga33

CVE-2026-98432 : la faille critique du noyau Linux qui peut offrir un accès root à distance it-connect.fr/cve-2026-98432-f #ActuCybersécurité #Cybersécurité #Vulnérabilité #Linux

  • 0
  • 1
  • 0
  • Last hour
Profile picture fallback
quoll (√) @quoll

apparently need to run a few commands to secure openwrt for a few days while we wait for an update:

forum.openwrt.org/t/cve-2026-9

it'll 11pm... and im to sick to care atm. hopefully that will cover my arse for now?!?!

#OpenWRT

  • 0
  • 0
  • 0
  • 23h ago
Profile picture fallback
Raphael @0x3e4

what the heck?

CVE-2026-98432 is a CVSS 9.8 remote use-after-free in Linux's IPv4 TCP handshake, fixed upstream Oct 15. Ubuntu and RHEL haven't shipped a fixed kernel yet.

atlasum.net/blog/cve-2026-9843

  • 0
  • 0
  • 0
  • 13h ago
Profile picture fallback
crypto news 🧠 eicker.crypto @crypto

Anza has urged Solana mainnet-beta validators to act on CVE-2026-98432, a critical Linux kernel use-after-free bug scored 9.8 that lets a remote attacker run commands as root. Ubuntu still lists the fix as work in progress, so operators should disable Multipath TCP. A host takeover could expose the validator identity key. thedefiant.io/news/security/an #Web3 #Blockchain #Solana

  • 0
  • 0
  • 0
  • 7h ago
Profile picture fallback
Tomasz Nurkiewicz @nurkiewicz

9.8 CVE in Linux kernel: cve.org/CVERecord?id=CVE-2026-

  • 0
  • 0
  • 0
  • 2h ago

Bluesky

Profile picture fallback
セキュリティ対策Lab @securitylab-jp.bsky.social
Go 1.24以降のLinuxサーバーに注意　MPTCPの既定有効化で遠隔root侵害リスク、CVE-2026-98432の確認方法と対策 rocket-boys.co.jp/security-mea... #セキュリティ対策Lab #security #securitynews #セキュリティ #セキュリティニュース
  • 1
  • 0
  • 0
  • 14h ago
Profile picture fallback
IT-Connect @it-connect.bsky.social
CVE-2026-98432 : une faille du noyau #Linux notée 9,8/10 permettrait d’exécuter une commande en root à distance, sans authentification. Le bug est dans le code TCP IPv4 du noyau : le risque ne se limite pas aux serveurs Go. Noyaux corrigés et mesures 👇 www.it-connect.fr/cve-2026-984...
  • 0
  • 1
  • 0
  • 2h ago
Profile picture fallback
tamosan @tamosan.bsky.social
夜行性インコさんのまとめ。例のRCE出来る件のやつ：Linuxカーネルの脆弱性 CVE-2026-98432 についてまとめてみた - piyolog piyolog.hatenadiary.jp/entry/2026/1...
  • 0
  • 0
  • 0
  • 11h ago
Profile picture fallback
キタきつね @kitafox.bsky.social
Linuxカーネルの脆弱性CVE-2026-98432によりリモートルート権限が付与される #SecurityOnline (Oct 30) securityonline.info/linux-kernel...
  • 0
  • 0
  • 0
  • 8h ago

CVE-2026-112816

Overview

  • Canonical
  • LXD
  • lxd
30 Oct 2026
Published
31 Oct 2026
Updated
CVSS v4.0
CRITICAL (10.0)
EPSS
0.30%
KEV

Description

Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15, 5.0.11, 5.21.9, 6.10.1 allows an unauthenticated attacker to authenticate as any trusted client and gain full access to the cluster and managed virtual machines via a crafted certificate chain.

Statistics

  • 4 Posts
  • 3 Interactions
Last activity: 1 hour ago

Fediverse

Profile picture fallback
Dark Web Informer :verified_paw: @DarkWebInformer

🚨 Critical LXD and MicroCloud authentication bypass rated CVSS 10.0

CVE-2026-112816 allows an unauthenticated attacker to impersonate a trusted TLS client using only its public certificate, potentially gaining full access to clusters, virtual machines and the host as root.
⠀
The attacker must be able to reach the HTTPS API and obtain the public certificate of an existing trusted client.
⠀
• CVSS: 10.0
• Affected: LXD 4.0.14, 5.0.10, 5.21.8 and 6.9
• Fixed: LXD 4.0.15, 5.0.11, 5.21.9 and 6.10.1
• MicroCloud fixes: 2.1.5 and 3.4.1
• Active exploitation: Not reported
• Public exploit: None reported
⠀
Administrators should update immediately and restrict access to the HTTPS API.

  • 0
  • 1
  • 0
  • 18h ago
Profile picture fallback
The CyberSec Guru @guru

CVE-2026-112816 Explained: The LXD and MicroCloud Authentication Bypass That Scored a Perfect CVSS 10.0

CVE-2026-112816 is a CVSS 10.0 LXD and MicroCloud authentication bypass. Learn how the PeerCertificates loop works, affected versions, and how to patch

thecybersecguru.com/exploits/c

  • 0
  • 0
  • 0
  • 17h ago
Profile picture fallback
Daily CyberSecurity @DailyCyberSecurity

Canonical fixes LXD vulnerability CVE-2026-112816 (CVSS 10) in LXD and MicroCloud, letting attackers impersonate trusted TLS clients. Update now.

securityonline.info/lxd-vulner

  • 0
  • 0
  • 0
  • 10h ago

Bluesky

Profile picture fallback
Tech Trending @tech-trending.bsky.social
CVE-2026-112816 | Ubuntu https://ubuntu.com/security/CVE-2026-112816
  • 0
  • 2
  • 0
  • 1h ago

CVE-2026-31419

Overview

  • Linux
  • Linux
13 Apr 2026
Published
30 Oct 2026
Updated
CVSS v3.1
HIGH (7.8)
EPSS
0.13%
KEV

Description

In the Linux kernel, the following vulnerability has been resolved: net: bonding: fix use-after-free in bond_xmit_broadcast() bond_xmit_broadcast() reuses the original skb for the last slave (determined by bond_is_last_slave()) and clones it for others. Concurrent slave enslave/release can mutate the slave list during RCU-protected iteration, changing which slave is "last" mid-loop. This causes the original skb to be double-consumed (double-freed). Replace the racy bond_is_last_slave() check with a simple index comparison (i + 1 == slaves_count) against the pre-snapshot slave count taken via READ_ONCE() before the loop. This preserves the zero-copy optimization for the last slave while making the "last" determination stable against concurrent list mutations. The UAF can trigger the following crash: ================================================================== BUG: KASAN: slab-use-after-free in skb_clone Read of size 8 at addr ffff888100ef8d40 by task exploit/147 CPU: 1 UID: 0 PID: 147 Comm: exploit Not tainted 7.0.0-rc3+ #4 PREEMPTLAZY Call Trace: <TASK> dump_stack_lvl (lib/dump_stack.c:123) print_report (mm/kasan/report.c:379 mm/kasan/report.c:482) kasan_report (mm/kasan/report.c:597) skb_clone (include/linux/skbuff.h:1724 include/linux/skbuff.h:1792 include/linux/skbuff.h:3396 net/core/skbuff.c:2108) bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5334) bond_start_xmit (drivers/net/bonding/bond_main.c:5567 drivers/net/bonding/bond_main.c:5593) dev_hard_start_xmit (include/linux/netdevice.h:5325 include/linux/netdevice.h:5334 net/core/dev.c:3871 net/core/dev.c:3887) __dev_queue_xmit (include/linux/netdevice.h:3601 net/core/dev.c:4838) ip6_finish_output2 (include/net/neighbour.h:540 include/net/neighbour.h:554 net/ipv6/ip6_output.c:136) ip6_finish_output (net/ipv6/ip6_output.c:208 net/ipv6/ip6_output.c:219) ip6_output (net/ipv6/ip6_output.c:250) ip6_send_skb (net/ipv6/ip6_output.c:1985) udp_v6_send_skb (net/ipv6/udp.c:1442) udpv6_sendmsg (net/ipv6/udp.c:1733) __sys_sendto (net/socket.c:730 net/socket.c:742 net/socket.c:2206) __x64_sys_sendto (net/socket.c:2209) do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) </TASK> Allocated by task 147: Freed by task 147: The buggy address belongs to the object at ffff888100ef8c80 which belongs to the cache skbuff_head_cache of size 224 The buggy address is located 192 bytes inside of freed 224-byte region [ffff888100ef8c80, ffff888100ef8d60) Memory state around the buggy address: ffff888100ef8c00: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc ffff888100ef8c80: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff888100ef8d00: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc ^ ffff888100ef8d80: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb ffff888100ef8e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================

Statistics

  • 3 Posts
  • 4 Interactions
Last activity: 4 hours ago

Fediverse

Profile picture fallback
Daily CyberSecurity @DailyCyberSecurity

Details and a Linux kernel vulnerability PoC exploit are public for CVE-2026-31419. Patch this high-severity flaw to prevent local privilege escalation.

securityonline.info/linux-kern

  • 0
  • 1
  • 0
  • 8h ago
Profile picture fallback
AllAboutSecurity @allaboutsecurity

Linux-Kernel: Öffentlicher Exploit für Bonding-Lücke CVE-2026-31419

Sicherheitsforscher haben technische Details und funktionierenden Exploit-Code für eine Schwachstelle im Linux-Kernel veröffentlicht. Die Lücke CVE-2026-31419 steckt im Bonding-Treiber und erlaubt lokalen Angreifern, ihre Rechte bis auf Root auszuweiten. Administratoren sollten die aktuellen Kernel-Updates einspielen.

all-about-security.de/linux-ke

#linux

  • 0
  • 0
  • 0
  • 4h ago

Bluesky

Profile picture fallback
All About Security @allaboutsecurity.bsky.social
Linux-Kernel: Öffentlicher Exploit für Bonding-Lücke CVE-2026-31419- Die Lücke CVE-2026-31419 steckt im Bonding-Treiber und erlaubt lokalen Angreifern, ihre Rechte bis auf Root auszuweiten. Administratoren sollten die aktuellen Kernel-Updates einspielen. shorturl.at/mxruh #linux #security
  • 1
  • 2
  • 0
  • 4h ago

CVE-2026-120283

Overview

  • Linksys
  • E8450
02 Nov 2026
Published
02 Nov 2026
Updated
CVSS v4.0
CRITICAL (10.0)
EPSS
Pending
KEV

Description

A vulnerability was identified in Linksys E8450 1.2.00.360516. Affected is the function strcpy of the file /www/cgi-bin/portal.cgi. Such manipulation of the argument hidden_timezone leads to stack-based buffer overflow. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Statistics

  • 2 Posts
Last activity: 10 hours ago

Fediverse

Profile picture fallback
OffSequence @offseq

CVE-2026-120283 – CRITICAL stack buffer overflow in Linksys E8450 v1.2.00.360516. Remote, unauthenticated RCE possible via /www/cgi-bin/portal.cgi (hidden_timezone). No patch from vendor. Restrict access ASAP. radar.offseq.com/threat/cve-20

  • 0
  • 0
  • 0
  • 10h ago

Bluesky

Profile picture fallback
Aiutocomputerhelp.it @aiuto-ch.bsky.social
CVE Radar | CVE-2026-120283 | CVSS 10.0 Linksys E8450 Remote Stack Overflow CVE-2026-120283 affects Linksys E8450 firmware version 1.2.00.360516, according to the supplied NVD record. Full analysis: https://t.me/aiutocomputerhelp_lab/1357
  • 0
  • 0
  • 0
  • 10h ago

CVE-2026-120338

Overview

  • PrefectHQ
  • prefab-ui
  • prefab-ui
01 Nov 2026
Published
01 Nov 2026
Updated
CVSS v3.1
CRITICAL (10.0)
EPSS
Pending
KEV

Description

Prefab UI's Generative UI sandbox runs caller-supplied Python inside Pyodide, Python compiled to WebAssembly, in a Deno subprocess. The feature is documented as isolation for untrusted code, including LLM-written UI. From prefab-ui 0.14.0 through 0.20.2 the launcher starts Deno with unrestricted --allow-read, --allow-write, and --allow-net, and the runner leaves the Deno API on the JavaScript global object. Pyodide's js module proxies that global, so the Python can call Deno.readTextFileSync and Deno.writeTextFileSync. A caller who can supply the code can read and write files as the server OS user, and can persist code execution by writing a .pth file into the server virtualenv's site-packages. The usual remote path is FastMCP's GenerativeUI provider, which registers the MCP tool generate_prefab_ui and forwards that tool's code argument into this sandbox. On a FastMCP server with no authentication configured, any client who can reach the server can call the tool. With authentication, any client allowed to call tools can. Generative UI is opt-in, and the host must have Deno installed. Confirmed on prefab-ui 0.20.2. Fixed in 0.21.0: after the runtime and Prefab sources load, the runner revokes Deno read, write, and network permission before it accepts code, the process is started with --no-prompt so a permission request cannot grant them again, and bootstrap network access is limited to cdn.jsdelivr.net. The fix is commit 030f074 (pull request 538).

Statistics

  • 2 Posts
Last activity: 15 hours ago

Fediverse

Profile picture fallback
Kyle Reddoch (CybersecKyle) @cyberseckyle

Prefab UI's opt-in Generative UI sandbox has a bypass (CVE-2026-120338). The Pyodide/Deno boundary let caller-supplied Python read and write host files as the server OS user.

Relevant to FastMCP servers that expose generate_prefab_ui. Unauthenticated exposure depends on the server's access controls.

Fixed in prefab-ui 0.21.0, released Oct 26. Check versions and tool access.

github.com/PrefectHQ/prefab/pu

  • 0
  • 0
  • 0
  • 15h ago

Bluesky

Profile picture fallback
Aiutocomputerhelp.it @aiuto-ch.bsky.social
CVE Radar | CVE-2026-120338 | CVSS 10.0 Prefab UI Sandbox Permission Bypass Prefab UI versions 0.14.0 through 0.20.2 run caller-supplied Python in Pyodide within a Deno subprocess, but expose unrestricted file and network permissions and… Full analysis: https://t.me/aiutocomputerhelp_lab/1351
  • 0
  • 0
  • 0
  • 19h ago

CVE-2026-111497

Overview

  • Google
  • Brotli
  • github.com/google/brotli
22 Oct 2026
Published
30 Oct 2026
Updated
CVSS v4.0
CRITICAL (9.2)
EPSS
82.64%
KEV

Description

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

Statistics

  • 2 Posts
Last activity: 9 hours ago

Fediverse

Profile picture fallback
Daily CyberSecurity @DailyCyberSecurity

Brotli vulnerability CVE-2026-111497 affected products list: fixes for Node.js, .NET, Envoy, PAN-OS and distros, plus VMware and others still unpatched.

securityonline.info/brotli-vul

  • 0
  • 0
  • 0
  • 10h ago

Bluesky

Profile picture fallback
BABA Toshiaki @netmarkjp.bsky.social
#ばばさん通信ダイジェスト 賛否関わらず話題になった/なりそうなものを共有しています。 BrotliのC言語実装における境界外書き込みの脆弱性（CVE-2026-111497）に関する注意喚起 https://www.jpcert.or.jp/at/2026/at260034.html
  • 0
  • 0
  • 0
  • 9h ago

CVE-2026-120345

Overview

  • WAVLINK
  • WN551X3-A
02 Nov 2026
Published
02 Nov 2026
Updated
CVSS v4.0
CRITICAL (10.0)
EPSS
Pending
KEV

Description

A vulnerability was found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This impacts the function sub_41a430 of the file /bin/ioos of the component DNS Resolution Handler. Performing a manipulation of the argument data results in os command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.

Statistics

  • 3 Posts
Last activity: 4 hours ago

Fediverse

Profile picture fallback
OffSequence @offseq

CVE-2026-120345: CRITICAL OS command injection in WAVLINK WN551X3-A (DNS Handler, /bin/ioos). Remote code execution possible — public exploit exists. Restrict network access & monitor device activity. Details: radar.offseq.com/threat/cve-20

  • 0
  • 0
  • 0
  • 5h ago
Profile picture fallback
OffSequence @offseq

CVE-2026-120345: CRITICAL RCE in WAVLINK WN551X3-A (M51X3_V251020-WO-182e965) via DNS handler. Public exploit. No patch. Isolate devices from untrusted networks until fix released. radar.offseq.com/threat/a-vuln

  • 0
  • 0
  • 0
  • 4h ago

Bluesky

Profile picture fallback
Aiutocomputerhelp.it @aiuto-ch.bsky.social
CVE Radar | CVE-2026-120345 | CVSS 10.0 WAVLINK Router DNS Command Injection CVE-2026-120345 affects the WAVLINK WN551X3-A running M51X3_V251020-WO-182e965. Full analysis: https://t.me/aiutocomputerhelp_lab/1359
  • 0
  • 0
  • 0
  • 5h ago

CVE-2026-120277

Overview

  • WAVLINK
  • WN536AX6-A
01 Nov 2026
Published
01 Nov 2026
Updated
CVSS v4.0
CRITICAL (10.0)
EPSS
Pending
KEV

Description

A security vulnerability has been detected in WAVLINK WN536AX6-A V260507_2.0.0. This issue affects the function sub_41a1d8 of the file /bin/ioos of the component WireGuard CLI Group Handler. Such manipulation of the argument group_name leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.

Statistics

  • 2 Posts
Last activity: 11 hours ago

Fediverse

Profile picture fallback
OffSequence @offseq

CVE-2026-120277: CRITICAL OS command injection in WAVLINK WN536AX6-A (V260507_2.0.0). Remote attackers can execute OS commands – no patch yet. Restrict access & monitor for updates. Exploit code is public. radar.offseq.com/threat/cve-20

  • 0
  • 0
  • 0
  • 11h ago

Bluesky

Profile picture fallback
Aiutocomputerhelp.it @aiuto-ch.bsky.social
CVE Radar | CVE-2026-120277 | CVSS 10.0 Critical WAVLINK WireGuard CLI Injection CVE-2026-120277 affects WAVLINK WN536AX6-A running firmware V260507_2.0.0. Full analysis: https://t.me/aiutocomputerhelp_lab/1353
  • 0
  • 0
  • 0
  • 11h ago

CVE-2026-120279

Overview

  • WAVLINK
  • WN536AX6-A
02 Nov 2026
Published
02 Nov 2026
Updated
CVSS v4.0
CRITICAL (10.0)
EPSS
Pending
KEV

Description

A flaw has been found in WAVLINK WN536AX6-A V260507. The affected element is an unknown function of the file /protocol.csp of the component openvpn_cli Handler. Executing a manipulation of the argument file_id can lead to os command injection. The attack can be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.

Statistics

  • 2 Posts
Last activity: 7 hours ago

Fediverse

Profile picture fallback
OffSequence @offseq

WAVLINK WN536AX6-A V260507 is impacted by CVE-2026-120279 (CRITICAL, CVSS 10) – remote OS command injection via /protocol.csp openvpn_cli Handler. Exploit is public. Patch or isolate devices now! radar.offseq.com/threat/a-flaw

  • 0
  • 0
  • 0
  • 7h ago

Bluesky

Profile picture fallback
Aiutocomputerhelp.it @aiuto-ch.bsky.social
CVE Radar | CVE-2026-120279 | CVSS 10.0 WAVLINK WN536AX6-A Command Injection CVE-2026-120279 affects WAVLINK WN536AX6-A version V260507. Full analysis: https://t.me/aiutocomputerhelp_lab/1354
  • 0
  • 0
  • 0
  • 10h ago

CVE-2026-120213

Overview

  • @fastify/http-proxy
  • @fastify/http-proxy
02 Nov 2026
Published
02 Nov 2026
Updated
CVSS v3.1
CRITICAL (9.1)
EPSS
Pending
KEV

Description

@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 9.0.0 through 11.6.5, when an application uses parameterized prefix and rewritePrefix options to pin clients to a fixed upstream path, the plugin substitutes URL-decoded route parameters into rewritePrefix without re-encoding them. A parameter value that encodes a path separator together with a fragment or query delimiter therefore decodes into real separators and delimiters that inject extra upstream path segments and strip the mandatory suffix the rewritePrefix was meant to enforce, without using any dot-dot traversal. An unauthenticated remote attacker can use this to reach upstream locations outside the intended prefix, leading to path-restriction bypass and, depending on the upstream, server-side request forgery or authorization bypass in the proxied service. The issue is fixed in @fastify/http-proxy 11.6.6, and users should upgrade to 11.6.6 or later. There is no workaround other than upgrading.

Statistics

  • 3 Posts
Last activity: 1 hour ago

Fediverse

Profile picture fallback
Ulises Gascon @ulisesgascon

🚨 Critical-severity security fix in @fastify/http-proxy@11.6.6 just released!

Patches CVE-2026-120213: @fastify/http-proxy vulnerable to prefix escape via decoded route parameters

github.com/fastify/fastify-htt

  • 0
  • 0
  • 1
  • 1h ago
Profile picture fallback
OffSequence @offseq

CVE-2026-120213 (CRITICAL, CVSS 9.1) impacts @fastify/http-proxy v9.0.0 – 11.6.5. Path traversal flaw lets unauthenticated attackers bypass prefix restrictions, risking SSRF. Update to 11.6.6+ ASAP. radar.offseq.com/threat/cve-20

  • 0
  • 0
  • 0
  • 1h ago
Showing 1 to 10 of 115 CVEs