#security

Deep Dive

Rejected WebSocket upgrades through Echo's Proxy middleware leave a raw tunnel open to the upstream, and later HTTP requests on that connection skip Echo's router and route middleware, so authentication enforced only at Echo routes is bypassed. The GitHub Advisory Database rates it Critical, CVSS v4.0 9.1, while Echo's own advisory rates it Moderate. Fixed in v4.16.1 and v5.4.1, released October 22, 2026. No public proof of concept and no exploitation in the wild are known.

Deep Dive

Laravel rates CVE-2026-114509 as Critical, CVSS v4.0 9.2: an unauthenticated attacker can sign in as an existing user of the legacy token API guard on MySQL or MariaDB by sending a JSON body like {"api_token": [0]}, without knowing any valid API token. Fixed in 12.68.0 and 13.29.0, with the fix also present in the 11.56.1 tag. A public proof of concept has existed since October 22, 2026, and no exploitation in the wild is known.

Deep Dive

Decoding a crafted FlashPix image in Pillow 12.3.0 or older with olefile installed lets an attacker run commands; Pillow 13.0.0 fixes CVE-2026-112398.

Deep Dive

Collabora rates CVE-2026-110447 as Critical, CVSS v4.0 9.2: an unauthenticated attacker can run operating-system commands as the web server user through proxy.php of the Collabora Online Built-in CODE Server app (richdocumentscode) for Nextcloud, in versions before 26.4.303, whenever the built-in CODE server is not running. Fixed in app release 26.4.303. CISA added it to the KEV catalog on October 23, 2026, and administrators have reported attacks since mid-September 2026.

Deep Dive

Sentry rates CVE-2026-114139 as Critical, CVSS v4.0 9.1: the @sentry/nextjs SDK skips the application middleware for every path under a configured tunnelRoute on webpack builds, while the tunnel rewrite serves only the exact tunnel path, so an unauthenticated request can reach a route under the tunnel path without middleware authorization. Affected are @sentry/nextjs 9.36.0 to 9.47.1, 10.x before 10.75.2 and 11.0.0 prereleases before 11.0.0-rc.1. Fixed in 9.47.2, 10.75.2 and 11.0.0-rc.1; no exploitation in the wild is known.

Deep Dive

CVE-2026-115889 is a Critical Wasmtime sandbox escape: Cranelift packs indices into 24-bit fields that a crafted module overflows. Fixed in 36.0.19 and 43.0.0.

Deep Dive

Vercel rates GHSA-2464-fhr4-w9xw Critical, CVSS v4.0 9.5: an unauthenticated attacker can run code on a Next.js 10.0.0–15.5.27 or 16.0.0–16.4.0 server whose Image Optimization API processes SVG on glibc-based Linux. The bug is a use-after-free in librsvg (CVE-2026-96889), bundled in sharp's prebuilt binaries. Next.js 15.5.28 and 16.4.1 fix it on Node.js 20.9.0 or later by resolving sharp 0.35.5, which bundles the patched librsvg 2.63.2.

Deep Dive

GHSA-673q-mjm6-r5xr is rated Critical, CVSS v4.0 9.5, in the GitHub Advisory Database: an unauthenticated attacker can run code on a Next.js 16 server that uses App Router with Cache Components and has a use cache function returning multiple typed arrays. The database review classifies the flaw as deserialization of untrusted data (CWE-502) in the React Server Components transport protocol that Next.js bundles. Fixed in Next.js 16.4.1, with no workaround available.

Deep Dive

DOMPurify 3.4.4–3.4.16 lets split ${...} expressions survive SAFE_FOR_TEMPLATES inside attached shadow roots (Critical, CVSS v4.0 9.2). Upgrade to 3.4.17.

Security

Ostorlab vs MobSF (Mobile Security Framework) for mobile app security testing: static and dynamic analysis, device requirements, exploit proof, authenticated testing, integrations, deployment and cost, with alternatives and an FAQ.