huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2026-24046: backstage/backend-defaults: backstage/plugin-scaffolder-backend: backstage/plugin-scaffolder-node: possible symlink path traversal in scaffolder actions
Component: backstage/backend-defaults
Severity: Important
CWE: CWE-59 (Improper Link Resolution Before File Access ('Link Following'))
CVSS v3: 9.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L)
Public date: 2026-01-21T22:36:30.794000+00:00

A flaw was found in Backstage. A symlink-based path traversal issue can be exploited in multiple Scaffolder actions and archive extraction utilities during template execution via malicious symlinks. An attacker with access to create and execute Scaffolder templates can read sensitive files, delete arbitrary files or write files outside the intended workspace, resulting in unauthorized information disclosure or system compromise.

Statement: To exploit this issue, an attacker needs to have access to create and execute Scaffolder actions, specifically the debug:log, fs:delete actions and archive extractions, limiting the exposure of this flaw. Additionally, file systems operations are constrained by the permissions of the process, limiting the impact to files that can be accessed by Backstage. Due to these reasons, this vulnerability has been rated with an important severity.

Affected upstream versions: @backstage/backend-defaults < 0.12.2, @backstage/backend-defaults >= 0.13.0, < 0.13.2, @backstage/backend-defaults >= 0.14.0, < 0.14.1, @backstage/plugin-scaffolder-backend < 2.2.2, @backstage/plugin-scaffolder-backend >= 3.0.0, < 3.0.2, @backstage/plugin-scaffolder-backend >= 3.1.0, < 3.1.1, @backstage/plugin-scaffolder-node < 0.11.2, @backstage/plugin-scaffolder-node >= 0.12.0, < 0.12.3
Fixed upstream versions: v1.47.0
Upstream repository: https://github.com/backstage/backstage
Upstream fix commit: c641c147ab371a9a8a2f5f67fdb7cb9c97ef345d
CVE-2026-24117: github.com/sigstore/rekor: Rekor Server-Side Request Forgery (SSRF)
Component: github.com/sigstore/rekor
Severity: Moderate
CWE: CWE-918 (Server-Side Request Forgery (SSRF))
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Public date: 2026-01-22T22:05:08.136000+00:00

A Server-Side Request Forgery (SSRF) flaw has been discovered in the Rekor transparency log tool. In versions 1.4.3 and below, attackers can trigger SSRF to arbitrary internal services because /api/v1/index/retrieve supports retrieving a public key via user-provided URL. Since the SSRF only can trigger GET requests, the request cannot mutate state. The response from the GET request is not returned to the caller so data exfiltration is not possible. A malicious actor could attempt to probe an internal network through Blind SSRF.


Affected upstream versions: < 1.5.0
Fixed upstream versions: v1.5.0
Upstream repository: https://github.com/sigstore/rekor
Upstream fix commit: 60ef2bceba192c5bf9327d003bceea8bf1f8275f
CVE-2026-24400: assertj: AssertJ: Information disclosure and denial of service via XML External Entity (XXE)
Component: assertj
Severity: Moderate
CWE: CWE-611 (Improper Restriction of XML External Entity Reference)
CVSS v3: 6.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L)
Public date: 2026-01-26T22:19:02.161000+00:00

A flaw was found in AssertJ. An XML External Entity (XXE) vulnerability exists in the `XmlStringPrettyFormatter` component, which is used by the `isXmlEqualTo(CharSequence)` assertion. If an application processes untrusted XML input using these methods, a remote attacker could exploit this flaw to read arbitrary local files, perform Server-Side Request Forgery (SSRF) by making the server request arbitrary URLs, or cause a Denial of Service (DoS) through entity expansion attacks.

Statement: Exploitation of this vulnerability requires that a user processes untrusted content with the affected package.

Affected upstream versions: >= 1.4.0, < 3.27.7
Fixed upstream versions: assertj-build-3.27.7
Upstream repository: https://github.com/assertj/assertj
Upstream fix commit: 85ca7eb6609bb179c043b85ae7d290523b1ba79a
CVE-2026-24401: avahi: Avahi: Denial of Service via recursive CNAME record in mDNS response
Component: avahi
Severity: Moderate
CWE: CWE-674 (Uncontrolled Recursion)
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2026-01-24T01:25:02.294000+00:00

A flaw was found in Avahi, a system that enables devices to discover services on a local network. A remote attacker can exploit this vulnerability by sending a specially crafted mDNS (multicast Domain Name System) response containing a recursive CNAME (Canonical Name) record. This triggers an uncontrolled recursion within the avahi-daemon process, leading to stack exhaustion and causing the service to crash. This results in a denial of service (DoS) for affected systems.

Statement: This MODERATE impact flaw in Avahi's `avahi-daemon` can lead to a denial of service. An attacker on the local network could send a specially crafted, unsolicited mDNS response containing a recursive CNAME record, causing unbounded recursion and a crash. This affects systems where Avahi's record browsers explicitly use multicast, such as those utilizing `nss-mdns`.

Affected upstream versions: < 78eab31128479f06e30beb8c1cbf99dd921e2524
Fixed upstream versions: v0.9-rc3
Upstream repository: https://github.com/avahi/avahi
Upstream fix commit: 78eab31128479f06e30beb8c1cbf99dd921e2524
CVE-2026-24486: python-multipart: Python-Multipart: Arbitrary file write via path traversal vulnerability
Component: python-multipart
Severity: Important
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L)
Public date: 2026-01-27T00:34:06.229000+00:00

A flaw was found in Python-Multipart, a tool for parsing multipart form data in Python applications. This vulnerability, known as path traversal, allows a remote attacker to write uploaded files to any location on the server's file system. This exploitation occurs when specific non-default configuration options, `UPLOAD_DIR` and `UPLOAD_KEEP_FILENAME=True`, are enabled, and a malicious filename is provided during a file upload. The primary consequence is unauthorized file creation or modification, which could lead to system compromise.


Affected upstream versions: < 0.0.22
Fixed upstream versions: 0.0.22
Upstream repository: https://github.com/Kludex/python-multipart
Upstream fix commit: 9433f4bbc9652bdde82bbe380984e32f8cfc89c4
CVE-2026-24491: freerdp: FreeRDP has a heap-use-after-free in video_timer
Component: freerdp
Severity: Moderate
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2026-02-09T18:13:44.302000+00:00

A use after free flaw has been discovered in FreeRDP. The video_timer can send client notifications after the control channel is closed, dereferencing a freed callback and triggering a use after free. A malicious server can trigger a client‑side heap use after free causing a crash (DoS).

Statement: Availability impact is limited to the FreeRDP instance on Red Hat Products. General system availability is not at risk.

Affected upstream versions: < 3.22.0
Fixed upstream versions: 3.22.0
Upstream repository: https://github.com/FreeRDP/FreeRDP
Upstream fix commit: e02e052f6692550e539d10f99de9c35a23492db2
CVE-2026-24675: freerdp: FreeRDP has a Heap-use-after-free in urb_select_interface
Component: freerdp
Severity: Moderate
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2026-02-09T18:14:40.667000+00:00

A heap buffer use after free has been discovered in FreeRDP. urb_select_interface can free the device's MS config on error but later code still dereferences it, leading to a use after free in libusb_udev_select_interface.

Statement: Availability impact is limited to the FreeRDP instance on Red Hat Products. General system availability is not at risk.

Affected upstream versions: < 3.22.0
Fixed upstream versions: 3.22.0
Upstream repository: https://github.com/FreeRDP/FreeRDP
Upstream fix commit: d676518809c319eec15911c705c13536036af2ae
CVE-2026-24676: freerdp: FreeRDP: Denial of Service via use-after-free in AUDIN format renegotiation
Component: freerdp
Severity: Moderate
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2026-02-09T18:15:33.646000+00:00

A use after free flaw was found in FreeRDP. AUDIN format renegotiation frees the active format list while the capture thread continues using audin->format, leading to a use after free in audio_format_compatible. A malicious server can trigger a client‑side heap use after free causing a crash.

Statement: Availability impact is limited to the FreeRDP instance on Red Hat Products. General system availability is not at risk.

Affected upstream versions: < 3.22.0
Fixed upstream versions: 3.22.0
Upstream repository: https://github.com/FreeRDP/FreeRDP
Upstream fix commit: 026b81ae5831ac1598d8f7371e0d0996fac7db00
CVE-2026-24678: freerdp: FreeRDP: Denial of Service via use after free in ecam_channel_write
Component: freerdp
Severity: Important
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2026-02-09T18:17:27.040000+00:00

A denial of service flaw has been found in FreeRDP. A capture thread sends sample responses using a freed channel callback after a device channel close, leading to a use after free in ecam_channel_write.


Affected upstream versions: < 3.22.0
Fixed upstream versions: 3.22.0
Upstream repository: https://github.com/FreeRDP/FreeRDP
Upstream fix commit: f3ab1a16139036179d9852745fdade18fec11600
CVE-2026-24679: freerdp: FreeRDP has a heap-buffer-overflow in urb_select_interface
Component: freerdp
Severity: Moderate
CWE: CWE-1285 (Improper Validation of Specified Index, Position, or Offset in Input)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2026-02-09T18:19:00.409000+00:00

A heap buffer overflow has been discovered in FreeRDP. The URBDRC client uses server-supplied interface numbers as array indices without bounds checks, causing an out-of-bounds read in libusb_udev_select_interface.

Statement: Availability impact is limited to the FreeRDP instance on Red Hat Products. General system availability is not at risk.

Affected upstream versions: < 3.22.0
Fixed upstream versions: 3.22.0
Upstream repository: https://github.com/FreeRDP/FreeRDP
Upstream fix commit: 2d563a50be17c1b407ca448b1321378c0726dd31
CVE-2026-24681: freerdp: FreeRDP has a heap-use-after-free in urb_bulk_transfer_cb
Component: freerdp
Severity: Moderate
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2026-02-09T18:20:39.732000+00:00

A heap buffer use after free has been discovered in FreeRDP. Asynchronous bulk transfer completions can use a freed channel callback after URBDRC channel close, leading to a use after free in urb_write_completion.

Statement: Availability impact is limited to the FreeRDP instance on Red Hat Products. General system availability is not at risk.

Affected upstream versions: < 3.22.0
Fixed upstream versions: 3.22.0
Upstream repository: https://github.com/FreeRDP/FreeRDP
Upstream fix commit: 414f701464929c217f2509bcbd6d2c1f00f7ed73
CVE-2026-24682: freerdp: FreeRDP has a Heap-buffer-overflow in audio_formats_free
Component: freerdp
Severity: Moderate
CWE: CWE-131 (Incorrect Calculation of Buffer Size)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2026-02-09T18:21:39.733000+00:00

A heap buffer overflow has been discovered in FreeRDP. audin_server_recv_formats frees an incorrect number of audio formats on parse failure (i + i), leading to out-of-bounds access in audio_formats_free.

Statement: Availability impact is limited to the FreeRDP instance on Red Hat Products. General system availability is not at risk.

Affected upstream versions: < 3.22.0
Fixed upstream versions: 3.22.0
Upstream repository: https://github.com/FreeRDP/FreeRDP
Upstream fix commit: 1c5c74223179d425a1ce6dbbb6a3dd2a958b7aee
CVE-2026-24683: freerdp: FreeRDP has a heap-use-after-free in ainput_send_input_event
Component: freerdp
Severity: Moderate
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2026-02-09T18:22:17.636000+00:00

A heap buffer use after free has been discovered in FreeRDP. ainput_send_input_event caches channel_callback in a local variable and later uses it without synchronization; a concurrent channel close can free or reinitialize the callback, leading to a use after free.

Statement: Availability impact is limited to the FreeRDP instance on Red Hat Products. General system availability is not at risk.

Affected upstream versions: < 3.22.0
Fixed upstream versions: 3.22.0
Upstream repository: https://github.com/FreeRDP/FreeRDP
Upstream fix commit: d9ca272dce7a776ab475e9b1a8e8c3d2968c8486
CVE-2026-24684: freerdp: FreeRDP has a Heap-use-after-free in play_thread
Component: freerdp
Severity: Moderate
CWE: CWE-131 (Incorrect Calculation of Buffer Size)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2026-02-09T18:23:02.882000+00:00

A heap use after free has been discovered in FreeRDP. The RDPSND async playback thread can process queued PDUs after the channel is closed and internal state is freed, leading to a use after free in rdpsnd_treat_wave.

Statement: Availability impact is limited to the FreeRDP instance on Red Hat Products. General system availability is not at risk.

Affected upstream versions: < 3.22.0
Fixed upstream versions: 3.22.0
Upstream repository: https://github.com/FreeRDP/FreeRDP
Upstream fix commit: 622bb7b4402491ca003f47472d0e478132673696
CVE-2026-24737: jsPDF: jsPDF: Arbitrary code execution via unsanitized input in Acroform module
Component: jsPDF
Severity: Important
CWE: CWE-917 (Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection'))
CVSS v3: 8.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L)
Public date: 2026-02-02T20:29:05.011000+00:00

A flaw was found in jsPDF, a JavaScript library for generating PDFs. A remote attacker could exploit this vulnerability by providing unsanitized input to specific methods within the Acroform module, such as AcroformChoiceField.addOption or AcroFormCheckBox.appearanceState. This allows the attacker to inject arbitrary PDF objects, including JavaScript actions, which are then executed when a victim opens the crafted PDF document, leading to arbitrary code execution.

Statement: This IMPORTANT vulnerability in jsPDF affects Red Hat Advanced Cluster Security (RHACS) where it could allow arbitrary JavaScript execution. The flaw occurs if an attacker provides a specially crafted PDF document containing injected JavaScript actions, and a victim subsequently opens this malicious document. Exploitation requires user interaction with a malicious file.

Affected upstream versions: < 4.1.0
Fixed upstream versions: v4.1.0
Upstream repository: https://github.com/parallax/jsPDF
Upstream fix commit: da291a5f01b96282545c9391996702cdb8879f79
CVE-2026-24747: pytorch: PyTorch: Arbitrary code execution via malicious checkpoint file loading
Component: pytorch
Severity: Important
CWE: CWE-502 (Deserialization of Untrusted Data)
CVSS v3: 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2026-01-27T21:13:46.878000+00:00

A flaw was found in PyTorch, a Python package for tensor computation. A remote attacker could craft a malicious checkpoint file, which, when loaded using the `weights_only` unpickler, could lead to memory corruption. This vulnerability may enable an attacker to achieve arbitrary code execution on the affected system.


Affected upstream versions: < 2.10.0
Upstream repository: https://github.com/pytorch/pytorch/163122
Upstream fix commit: 954dc5183ee9205cbe79876ad05dd2d9ae752139
CVE-2026-24779: vLLM: vLLM: Server-Side Request Forgery allows internal network access
Component: vLLM
Severity: Important
CWE: CWE-918 (Server-Side Request Forgery (SSRF))
CVSS v3: 7.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L)
Public date: 2026-01-27T22:01:13.808000+00:00

A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). A Server-Side Request Forgery (SSRF) vulnerability exists in the MediaConnector class, specifically within the load_from_url and load_from_url_async methods. An attacker can exploit differing interpretations of backslashes by Python parsing libraries used for host restrictions to bypass these restrictions. This allows the attacker to force the vLLM server to make arbitrary requests to internal network resources, potentially leading to information disclosure, denial of service, or unauthorized access within containerized environments.

Statement: This IMPORTANT Server-Side Request Forgery (SSRF) vulnerability in vLLM's `MediaConnector` allows an attacker to bypass host restrictions when processing user-provided URLs. This enables the vLLM server to be coerced into making arbitrary requests to internal network resources. This is critical in containerized deployments, including Red Hat AI Inference Server, Red Hat Enterprise Linux AI, and Red Hat OpenShift AI, where it could facilitate internal network reconnaissance and unauthorized access to other services.

Affected upstream versions: < 0.14.1
Fixed upstream versions: v0.14.1
Upstream repository: https://github.com/vllm-project/vllm
Upstream fix commit: f46d576c54fb8aeec5fc70560e850bed38ef17d7
CVE-2026-24781: vm2: vm2: Arbitrary code execution via sandbox breakout through inspect function
Component: vm2
Severity: Important
CWE: CWE-653 (Improper Isolation or Compartmentalization)
CVSS v3: 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-05-04T16:33:32.869000+00:00

A flaw was found in vm2, an open-source virtual machine (VM) sandbox for Node.js. This vulnerability allows an attacker to escape the sandbox environment by exploiting the `inspect` function. Successful exploitation can lead to arbitrary code execution on the host system, compromising the integrity and confidentiality of the system.


Affected upstream versions: < 3.11.0
Fixed upstream versions: v3.11.0
Upstream repository: https://github.com/patriksimek/vm2
Upstream fix commit: 8d30d93213c1898b3e035298b89a814970dd1189
CVE-2026-24842: node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check
Component: node-tar
Severity: Important
CWE: CWE-59 (Improper Link Resolution Before File Access ('Link Following'))
CVSS v3: 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N)
Public date: 2026-01-28T00:20:13.261000+00:00

A flaw was found in node-tar, a Node.js module for handling TAR archives. This vulnerability allows a remote attacker to bypass path traversal protections by crafting a malicious TAR archive. The security check for hardlink entries uses different path resolution logic than the actual hardlink creation, enabling the attacker to create hardlinks to arbitrary files outside the intended extraction directory. This could lead to unauthorized information disclosure or further system compromise.

Statement: This is an IMPORTANT vulnerability in node-tar, a Node.js module for handling TAR archives. The flaw allows an attacker to bypass path traversal protections by crafting a malicious TAR archive. This could lead to the creation of hardlinks to arbitrary files outside the intended extraction directory, potentially resulting in unauthorized information disclosure or further system compromise in affected Red Hat products utilizing node-tar for archive processing.

Affected upstream versions: < 7.5.7
Fixed upstream versions: v7.5.7
Upstream repository: https://github.com/isaacs/node-tar
Upstream fix commit: f4a7aa9bc3d717c987fdf1480ff7a64e87ffdb46
CVE-2026-2492: tensorflow: TensorFlow: Local privilege escalation via uncontrolled search path for plugins
Component: tensorflow
Severity: Important
CWE: CWE-427 (Uncontrolled Search Path Element)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-02-20T22:22:54.392000+00:00

A flaw was found in TensorFlow. This vulnerability allows a local attacker to escalate privileges and execute arbitrary code. The flaw exists within the HDF5 library's handling of plugins, which are loaded from an unsecured location. An attacker with low-privileged code execution can exploit this uncontrolled search path to achieve privilege escalation.


Affected upstream versions: 2.17.0
Fixed upstream versions: v2.21.0
Upstream repository: https://github.com/tensorflow/tensorflow
Upstream fix commit: 46e7f7fb144fd11cf6d17c23dd47620328d77082
CVE-2026-25068: alsa-lib: alsa-lib Topology Decoder Heap-based Buffer Overflow
Component: alsa-lib
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Public date: 2026-01-29T19:08:03.986000+00:00

alsa-lib versions 1.2.2 up to and including 1.2.15.2, prior to commit 5f7fe33, contain a heap-based buffer overflow in the topology mixer control decoder. The tplg_decode_control_mixer1() function reads the num_channels field from untrusted .tplg data and uses it as a loop bound without validating it against the fixed-size channel array (SND_TPLG_MAX_CHAN). A crafted topology file with an excessive num_channels value can cause out-of-bounds heap writes, leading to a crash.


Affected upstream versions: 1.2.2 <= 1.2.15.2
Fixed upstream versions: v1.2.16
Upstream repository: https://github.com/alsa-project/alsa-lib
Upstream fix commit: 5f7fe33002d2d98d84f72e381ec2cccc0d5d3d40
CVE-2026-25128: fast-xml-parser: fast-xml-parser has RangeError DoS Numeric Entities Bug
Component: fast-xml-parser
Severity: Moderate
CWE: CWE-248 (Uncaught Exception)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2026-01-30T15:14:58.244000+00:00

A denial of service flaw has been discovered in the fast-xml-parser npm library. In fast-xml-parser, a RangeError vulnerability exists in the numeric entity processing of fast-xml-parser when parsing XML with out-of-range entity code points (e.g., `&#9999999;` or `&#xFFFFFF;`). This causes the parser to throw an uncaught exception, crashing any application that processes untrusted XML input.

Statement: The availability impact of this flaw is limited to the application which bundles the fast-xml-parser library. Red Hat host systems are not at risk of availability impact.

Affected upstream versions: >= 5.0.9, <= 5.3.3
Fixed upstream versions: v5.3.4
Upstream repository: https://github.com/NaturalIntelligence/fast-xml-parser
Upstream fix commit: 4e387f61c4a5cef792f6a2f42467013290bf95dc
CVE-2026-25223: Fastify: Fastify: Validation bypass due to malformed Content-Type header leading to integrity impact
Component: Fastify
Severity: Important
CWE: CWE-179 (Incorrect Behavior Order: Early Validation)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Public date: 2026-02-03T21:21:40.268000+00:00

A flaw was found in Fastify, a web framework for Node.js. A remote attacker can exploit a validation bypass vulnerability by appending a tab character followed by arbitrary content to the Content-Type header. This circumvents the request body validation schemas, allowing the server to process the body as the original content type without proper validation. This could lead to unexpected data processing and potential integrity impact.

Statement: This IMPORTANT vulnerability in Fastify, a Node.js web framework, allows remote attackers to bypass request body validation by manipulating the Content-Type header. This can lead to unexpected data processing and integrity issues in applications. Red Hat products such as Red Hat Enterprise Linux AI, Red Hat OpenShift AI, and Red Hat OpenShift Dev Spaces are affected.

Affected upstream versions: < 5.7.2
Fixed upstream versions: v5.7.2
Upstream repository: https://github.com/fastify/fastify
Upstream fix commit: 32d7b6add39ddf082d92579a58bea7018c5ac821