By weakness (CWE)

CWE-248: related vulnerabilities

CVEs classified under CWE-248. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

17 published vulnerabilities

• CVE-2026-14181HIGH 7.5

  A vulnerability in @fastify/middie versions 9.1.0 through 9.3.2 allows an attacker to crash Node.js applications by sending HTTP requests with malformed URL encodings. When the middleware attempts to normalize incoming request paths containing broken percent-encoded sequences—such as incomplete escape codes or truncated multibyte characters—the underlying decoder throws an unhandled exception that terminates the entire process. This causes immediate service unavailability for all connected users until the application restarts. The vulnerability only affects applications using middie's standalone engine API; those using the Fastify plugin integration are protected because Fastify's error handler catches the exception before it propagates.

• CVE-2026-45685HIGH 7.5

  OpenTelemetry eBPF Instrumentation versions 0.1.0 through 0.8.x contain a denial-of-service vulnerability in their MongoDB wire protocol parser. An attacker on the network can send specially crafted MongoDB messages to crash the telemetry agent without needing authentication or user interaction. When the malformed message reaches the parser, it triggers an unhandled panic that terminates telemetry collection for the affected process or entire node. This is a remote, unauthenticated attack that requires only network access to the listening port.

• CVE-2026-46545HIGH 7.5

  Nimiq, a blockchain implementation using Rust, contains a vulnerability that allows remote attackers to crash nodes that are synchronizing state data from the network. This affects newly joining nodes and nodes recovering from downtime. The issue stems from improper handling of data chunks during state synchronization, enabling any peer on the network to send malicious input that triggers a denial-of-service condition. The vulnerability has been resolved in version 1.5.0.

• CVE-2026-50129HIGH 7.5

  Mastodon, the open-source social network platform, contains a denial-of-service vulnerability in how it processes mathematical markup (math tags). An attacker can send specially crafted math content that causes the server to crash or become unavailable, potentially affecting either the entire Mastodon instance or specific user services. The flaw stems from missing error handling in the code that sanitizes mathematical notation. Three security updates fix this issue across Mastodon's active maintenance branches.

• CVE-2026-59162HIGH 7.5

  Excelize, a Go library for reading and writing Excel files, has a flaw that causes it to crash when processing malicious XLSX files. An attacker can craft a spreadsheet with a specially crafted cell reference that points to an invalid memory location, causing the application using Excelize to panic and stop working. This is a denial-of-service vulnerability that affects any application built with Excelize prior to version 2.11.0.

• CVE-2026-59892HIGH 7.5

  A vulnerability exists in OpenTelemetry's Jaeger propagator for JavaScript that allows an attacker to crash a Node.js application by sending specially crafted HTTP headers. When the propagator attempts to decode malformed percent-encoded values in trace context headers, it fails to catch the resulting error, causing the entire process to terminate. This is a denial-of-service issue that requires no authentication and can be triggered remotely by any network-connected client.

• CVE-2026-58208MEDIUM 6.8

  NATS Server, a popular messaging platform used in cloud and edge deployments, contains a flaw in its WebSocket listener that can be exploited by an unauthenticated attacker to crash the server. The vulnerability arises because the WebSocket component attempts to route MQTT-over-WebSocket traffic to MQTT handling logic even when MQTT is not actually configured or initialized on that server instance. An attacker with network access to the WebSocket listener can send specially crafted requests that trigger this uninitialized state, causing the server process to crash and disrupting messaging services. The issue affects versions prior to 2.14.3 and 2.12.12.

• CVE-2026-46411MEDIUM 6.5

  FlashMQ, an MQTT broker used in multi-CPU environments, contains a flaw that allows authenticated users to deliberately overwhelm the server's write buffer beyond its intended limits. When this happens, the server triggers a safety mechanism that crashes the entire broker rather than gracefully handling the condition. An attacker with valid credentials can exploit this to cause a denial of service, taking the messaging broker offline.

• CVE-2026-54775MEDIUM 6.5

  CoreWCF, a .NET Core implementation of Windows Communication Foundation (WCF), contains a denial-of-service vulnerability in versions prior to 1.8.1 and 1.9.1. When a Kafka-based CoreWCF service receives a null-value tombstone record—a special Kafka message type used to signal deletion—the service stops processing all subsequent messages from that topic. An attacker with permission to produce messages to the Kafka topic can exploit this to disable the affected endpoint indefinitely, forcing service restarts or intervention to recover. This is a network-accessible vulnerability requiring only standard produce credentials.

• CVE-2026-45676MEDIUM 5.5

  OpenTelemetry eBPF Instrumentation, a tool that uses eBPF technology to gather observability data, contains a flaw in how it parses ELF executable files. An attacker with local access can craft a malicious executable that tricks the instrumentation agent into reading invalid memory locations or accessing incorrect parts of files, causing the agent to crash. This prevents the agent from operating until it's restarted, which could disrupt monitoring visibility in affected environments. The issue affects all versions prior to 0.9.0.

• CVE-2026-12644MEDIUM 5.3

  ts-deepmerge is a JavaScript utility library for merging nested objects. Versions before 8.0.0 have a critical flaw: when merging objects that contain properties named after built-in JavaScript methods like `toString` or `valueOf` with non-function values, the library corrupts the resulting object. Any attempt to use the merged object in a string context—such as logging, concatenation, or template operations—triggers a TypeError crash. This means an application using vulnerable versions of ts-deepmerge can be made to crash by an attacker providing specially crafted JSON or configuration objects for merging.

• CVE-2026-14631MEDIUM 5.3

  webpack-dev-server versions 5.2.5 and earlier can be crashed by an unauthenticated attacker sending a specially crafted HTTP request or WebSocket upgrade message. The vulnerability exists in the host validation logic, which fails to handle malformed headers gracefully. When triggered, it terminates the entire Node.js process running the dev server, causing a denial of service. This affects only development environments and does not expose sensitive data or allow code execution.

• CVE-2026-45554MEDIUM 5.3

  NiceGUI, a Python UI framework built on FastAPI, contains a vulnerability in how it handles requests for static assets. Two specific routes can be manipulated to point to directories instead of files. When this happens, the framework throws an error that gets logged with full technical details—and these routes don't require authentication. An attacker can repeatedly trigger these errors to flood the server logs, potentially filling up disk space or overwhelming logging infrastructure. This affects NiceGUI versions before 3.12.0 and has been fixed in version 3.12.0 and later.

• CVE-2026-59875MEDIUM 5.3

  A vulnerability in node-tar, a popular Node.js library for reading and writing tar archives, allows an attacker to craft a malicious tar file that crashes applications processing it. The flaw stems from improper handling of special characters (NUL bytes) embedded in file path metadata within tar archives. When an affected version of node-tar encounters such an archive, the resulting error terminates the application unexpectedly, causing a denial of service. This impacts any Node.js application that extracts or processes untrusted tar files without additional validation.

• CVE-2026-55517MEDIUM 4.3

  Deno, a modern JavaScript/TypeScript runtime, has a flaw in how it processes WebSocket connection responses. When a remote server sends back specially crafted response headers containing non-ASCII bytes, Deno crashes entirely rather than handling the malformed data gracefully. An attacker controlling a WebSocket server could exploit this to deny service to any Deno client that connects to it. The issue affects Deno versions before 2.7.5 and is resolved in that release.

• CVE-2026-27790LOW 2.7

  CVE-2026-27790 is a low-severity vulnerability affecting Gallagher Command Centre and its T20 reader hardware. An authenticated operator with proper authorization can send crafted requests to trigger an unhandled exception that forces the T20 Readers to restart, causing temporary unavailability. Because it requires valid credentials and administrator-level access to exploit, the practical risk is contained, but the impact in access control environments where reader downtime disrupts operations should not be dismissed.

• CVE-2026-27844LOW 2.7

  A flaw in Gallagher's Command Centre diagnostic web interface allows an authenticated operator to restart the Controller 6000 or Controller 7000 by sending specially crafted requests. This causes temporary unavailability of access control functions. The vulnerability requires valid credentials and high-level operator privileges, limiting real-world exposure. Affected versions span from 9.10 and earlier through 9.50, though multiple maintenance releases have introduced patches.