Most recent entries from all

CLEANSTART-2026-FC45371 — Security fix for CVE-2026-101899 applied in: langfuse 3.225.9-r5

2026-10-16T22:36:28.635115+00:00

Affected: CleanStart: langfuse

Security vulnerability affects the langfuse package. This issue is resolved in later releases. See references for vulnerability details.

fkie_cve-2026-101899

2026-10-16T22:36:28.635187+00:00

Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy treats the NO_PROXY CIDR form as a textual hostname suffix instead of evaluating the network range. A request targets an address covered by a CIDR entry in NO_PROXY while a proxy is configured. The CIDR bypass rule is not matched, so the request is sent through the configured proxy. For plaintext HTTP, the proxy can observe and modify URLs, headers, and bodies; for HTTPS, it can observe connection metadata and CONNECT requests. This issue is fixed in version 1.20.0.

GHSA-44g4-m2mj-wpvx — Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges

2026-10-16T22:36:28.635221+00:00

Affected: npm: axios

## Summary

Axios supports proxy environment variables and evaluates `NO_PROXY` exclusions in the Node.js adapter. CIDR-form `NO_PROXY` entries such as `127.0.0.0/8`, `10.0.0.0/8`, or `169.254.169.254/32` are not interpreted as IP ranges. As a result, a request to an IP address inside a configured CIDR exclusion can still be sent through the configured proxy.

This affects deployments that rely on CIDR notation to keep loopback, private, Kubernetes, CI, or cloud metadata traffic away from proxy infrastructure.

## Impact

If the configured proxy is outside the intended trust boundary, requests that operators expected to bypass the proxy may be exposed to it. For plaintext HTTP targets, the proxy can see and modify URLs, headers, and bodies. For HTTPS targets, the proxy still observes connection metadata and may receive CONNECT requests that policy expected to avoid.

This is a proxy exclusion bypass, not arbitrary proxy injection by itself.

## Affected Functionality

Affected:

- Node.js adapter proxy environment handling. - `HTTP_PROXY`, `HTTPS_PROXY`, `NO_PROXY`, or lowercase equivalents. - CIDR entries in `NO_PROXY`.

Not affected:

- Exact host or exact IP `NO_PROXY` entries where axios matching succeeds. - Requests configured with `proxy: false`. - Browser adapters.

## Technical Details

`lib/helpers/shouldBypassProxy.js` parses each `NO_PROXY` entry into a host and optional port, normalizes hostnames, and then compares exact hostnames, suffix entries, wildcard-prefix…

RHSA-2026:76430 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

2026-10-16T22:36:28.635312+00:00

google.golang.org/protobuf: golang-protobuf: Denial of Service via infinite loop when unmarshaling invalid JSON github.com/grafana/grafana: Grafana: Information disclosure via alert rules list API grafana: grafana: Dashboard modification lockout via forged file-provisioning metadata github.com/moby/sys/user: moby/sys/user: Denial of Service via crafted user or group database files grafana: Stored cross-site scripting in the Geomap panel allows privilege escalation grafana: grafana: Information disclosure via unrevoked access tokens in paused shared dashboards axios: Axios: Information disclosure via improper CIDR proxy bypass handling