Labs

Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.

• highCVE-2026-47071

  CVE-2026-47071: hackney SOCKS5 TLS Upgrade Infinite Timeout

  When hackney routes an HTTPS request through a SOCKS5 proxy, the TLS handshake after the tunnel is established has no timeout, so a malicious or compromised proxy can stall the handshake forever and…

• highCVE-2026-47073

  CVE-2026-47073: erlang/hackney WebSocket Unbounded Memory Consumption

  A malicious WebSocket server can drain all memory from any Erlang/Elixir process using hackney's WebSocket client, crashing the BEAM node with no authentication required.

• highCVE-2026-47067

  CVE-2026-47067: hackney Atom-Table Exhaustion via URL Scheme Parsing

  hackney's URL parser converts every URL scheme it sees into a permanent BEAM atom, so an attacker who can supply URLs with unique scheme prefixes can exhaust the VM's 1,048,576-atom limit and crash…

• highCVE-2026-48801

  CVE-2026-48801: linkify-it O(N²) DoS in match() scan loop

  Sending a large block of repeated email-like text to any app that uses linkify-it (including markdown-it with linkify enabled) causes the server to burn CPU for seconds per request, making…

• highCVE-2026-48809

  CVE-2026-48809: python-engineio Unauthenticated Memory Exhaustion (DoS)

  An unauthenticated attacker can crash or slow down a python-engineio server by sending oversized messages that bypass the configured payload size limit, causing unbounded memory allocation.

• highCVE-2026-49260

  CVE-2026-49260: php-weasyprint OS Command Injection via Binary Path

  A logic error in php-weasyprint's command builder means the safety check that should quote and validate the WeasyPrint binary path is permanently bypassed, letting any shell metacharacters in that…

• critical

  CVE-2026-42208: semantic-router Unbounded litellm Pin Pulls Credential-Stealing Wheel

  Installing semantic-router 0.1.8 through 0.1.14 could silently pull in a backdoored version of litellm that steals every credential on the machine the moment Python starts, with no import required.

• high

  muhammara NULL Pointer Dereference in LZWDecode DecodeParms Handling

  Sending a crafted PDF with an LZWDecode filter and an empty DecodeParms dictionary to any app using muhammara crashes the Node.js process instantly, enabling denial of service by anyone who can…

• highCVE-2026-48979

  CVE-2026-48979: php-standard-library/h2 HTTP/2 Request Smuggling via Missing Content-Length Validation

  A missing content-length check in the PHP Standard Library's HTTP/2 server lets a malicious client send a different number of bytes than it declared, bypassing size limits or corrupting application…

• high

  CVE-2026-56396: phpMyFAQ Privilege Escalation via Missing Authorization in editUser and updateUserRights

  A non-SuperAdmin administrator in phpMyFAQ can promote themselves to SuperAdmin or grant arbitrary permissions to any account, because two admin API endpoints never check whether the caller has the…

• high

  better-helperjs Path Traversal via String Prefix Bypass in Static Server

  The production static file server in better-helperjs lets attackers read files from adjacent directories on disk by exploiting a flawed string prefix check that mistakes a shared directory name…

• criticalCVE-2026-49252

  CVE-2026-49252: @deepstream/server Prototype Pollution via Record Path

  Any authenticated deepstream user with write access to a record can pollute the server's JavaScript prototype by sending a crafted path in a record update, potentially escalating their own…