3 casos · pág. 1/1
FoxIO disclosed a class of denial-of-service flaws in the QPACK header compression used by HTTP/3. It affects seven of the ten stacks the firm tested and was released with working proof-of-concept code. An unauthenticated remote attacker can send a small compressed header batch that expands in memory by thousands of times, exhausting a de…
The Node.js Project released security updates on October 21, 2026 for the 26.x, 24.x and 22.x lines (26.12.1, 24.22.1, 22.23.4), fixing 10 vulnerabilities: four high, three medium and three low (gbhackers.com). The most serious is CVE-2026-111497, nicknamed Node2Shell (aikido.dev), an out-of-bounds write in the bundled Brotli decoder that…
A critical Linux kernel networking flaw, CVE-2026-99999 (nicknamed PwnEscape, CVSS 9.3), lets code inside a guest VM read host memory, crash the host and, in lab conditions, run code on it. Researcher Paulos Yibelo of pwn.ai demonstrated the memory leak against Vercel's production sandboxes, which Vercel confirmed. The flaw was found in a…
