CVE Watch11 nov 2026

CVE-2026-65833

iopress is a native HTTP server for Node.js with platform-specific async I/O. Prior to version 1.0.5, the chunked-transfer-encoding HTTP req

CVSS

—

Sin CVSS

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 11 nov 2026 · Última mod.: 11 nov 2026 · CWE-126

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

iopress is a native HTTP server for Node.js with platform-specific async I/O. Prior to version 1.0.5, the chunked-transfer-encoding HTTP request parser in @iopress/core reads past the end of the input buffer when a request declares a chunk size larger than the body actually received. This results in a heap-buffer-over-read. This issue has been patched in version 1.0.5.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-958845.3 MED

54.2%

——16Buffer over-read in Windows Active Directory Certificate Services allows an authorized attacker to disclose information over a network.23h CVE-2026-882205.5 MED

33.2%

——10Buffer over-read in Windows Performance Counters allows an authorized attacker to disclose information locally.23h CVE-2026-836847.5 ALT

62.5%

——19Buffer over-read in Windows iSCSI Target Service allows an unauthorized attacker to disclose information over a network.23h CVE-2026-1242336.5 MED

53.9%

——16Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.23h CVE-2026-1241836.5 MED

60.1%

——18Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.23h CVE-2026-1199437.8 ALT

26.9%

——8Buffer over-read in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.1d