CVE-2026-65833
iopress is a native HTTP server for Node.js with platform-specific async I/O. Prior to version 1.0.5, the chunked-transfer-encoding HTTP req
CVSS
—
No CVSS
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Nov 11, 2026 · Last modified: Nov 11, 2026 · CWE-126
Not enough EPSS history yet.
iopress is a native HTTP server for Node.js with platform-specific async I/O. Prior to version 1.0.5, the chunked-transfer-encoding HTTP request parser in @iopress/core reads past the end of the input buffer when a request declares a chunk size larger than the body actually received. This results in a heap-buffer-over-read. This issue has been patched in version 1.0.5.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-958845.3 MED54.2%
——16Buffer over-read in Windows Active Directory Certificate Services allows an authorized attacker to disclose information over a network.23hCVE-2026-882205.5 MED33.2%
——10Buffer over-read in Windows Performance Counters allows an authorized attacker to disclose information locally.23hCVE-2026-836847.5 HIG62.5%
——19Buffer over-read in Windows iSCSI Target Service allows an unauthorized attacker to disclose information over a network.23hCVE-2026-1242336.5 MED53.9%
——16Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.23hCVE-2026-1241836.5 MED60.1%
——18Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.23hCVE-2026-1199437.8 HIG26.9%
——8Buffer over-read in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.1d