Skip to content
Threat Feed
Subscribe

Tag

Library-Vulnerability

2 briefs RSS
high advisory

Oj: Use-After-Free in Oj::Doc Iterators via Reentrant Close

A heap use-after-free vulnerability (CVE-2026-54897) exists in `Oj::Doc` iterators (`each_value`, `each_child`, `each_leaf`) in the `oj` Ruby gem, allowing an attacker to cause application crashes or unpredictable behavior when a Ruby block yielded during iteration reentrantly calls `doc.close` or `d.close`.

oj gem ruby use-after-free library-vulnerability dos
2r 1t
high advisory

undici Library Vulnerable to Cross-Origin Request Routing via SOCKS5 Proxy Reuse (CVE-2026-6734)

The undici library, when using `Socks5ProxyAgent`, is vulnerable to cross-origin request routing if a single connection pool is reused across different origins, potentially misdirecting requests and credentials, trusting responses from the wrong origin, and silently downgrading HTTPS requests to HTTP (CVE-2026-6734).

undici >= 7.23.0 < 7.28.0 +1 library-vulnerability cross-origin-request data-leakage nodejs
2r 2t