yisusvii
Go back

Security Thursdays by yisusvii — 2026-10-01

Suggest Changes

By

Table of Contents

Open Table of Contents

🚨 Cybersecurity News of the Week

1. Next.js — RCE via Node next/og ImageResponse / untrusted SVG (Sep 30)

What happened: On September 30, 2026, Vercel published GHSA-vcvr-r3jv-pc5j (Critical). The Node.js ImageResponse implementation from next/og is affected by an upstream rendering vulnerability; applications that pass attacker-controlled values into SVG content, attributes, or styles during image generation can reach remote code execution. The vendor advisory page associates CVE-2026-94545 and publishes CVSS 4.0 base metrics CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H (overall score 9.5 on the advisory UI). Edge ImageResponse paths, and apps that never inject untrusted values into SVG, are called out as not affected.

Who is affected: next ≥ 16.2.0, < 16.3.6. Patched release: v16.3.6. Upstream reference on the advisory: vercel/satori GHSA-wx4j-mvgx-mqwp.

Why it matters: OG-image and social-card routes often take title/description query params straight into JSX/SVG. That is a high-traffic, frequently internet-facing pattern — not an obscure admin panel.

Exploitation status: Not confirmed as mass in-the-wild exploitation in sources reviewed. Vendor severity is Critical with a clear RCE impact statement.

Defender actions: Upgrade to ≥ 16.3.6. Until then, do not pass request/query/body fields into SVG nodes, attributes, or styles under Node ImageResponse. Prefer static or fully server-controlled OG content. Search codebases for from 'next/og' / ImageResponse.

Primary sources: GHSA-vcvr-r3jv-pc5j, v16.3.6.

2. Fastify 5.12.2 — auth bypass via malformed URLs + validation cluster (Sep 30)

What happened: On September 30, 2026, Fastify published a coordinated set fixed in v5.12.2:

AdvisoryCVEIssue (short)
GHSA-p68q-wchp-6fh7CVE-2026-76169Malformed URL under one plugin prefix reaches a sibling plugin’s custom not-found handler, skipping that handler’s preHandler auth — unauthenticated cross-prefix data disclosure
GHSA-9q9j-q6p8-xq58CVE-2026-84428Header validation bypass via incomplete schema case normalization
GHSA-hwr6-493r-vm6hCVE-2026-84469Request validation bypass via skipped boolean false schemas
GHSA-667r-xxjv-c9mmCVE-2026-84504$async JSON Schema validation result unwrapped like sync {value,error} → request body replacement

Who is affected: Fastify 4.x / 5.x bands listed per advisory; GHSA package metadata for the auth-bypass issue marks ≥ 4.0.0, < 5.12.2 with first patched 5.12.2. CVE-2026-84504 advisory text also notes a 6.0.0 patched line for that issue.

Why it matters: Multi-tenant and “public marketing API + private admin plugin” Fastify apps often put auth only on private prefixes and lean on not-found handlers. Malformed targets that skip the normal lifecycle defeat that design.

Exploitation status: Not confirmed in the wild in sources reviewed. CVSS 3.1 on the auth-bypass GHSA: 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Body-replacement GHSA: 8.1.

Defender actions: Upgrade to ≥ 5.12.2 (or current 6.x if you are on that train and the advisory applies). Do not serve protected data from not-found handlers. Reject malformed request targets at the edge. Avoid $async request schemas until patched; put authz in onRequest/preHandler rather than trusting schema-mutated bodies.

Primary sources: linked GHSAs; v5.12.2.

3. Axios 1.20.0 — redirect SSRF guard failure, gadgets, adapter control bypass (Sep 30)

What happened: On September 30, 2026, the Axios project published a dense advisory set fixed primarily in v1.20.0 (legacy 0.x floor 0.34.0 where listed):

Who is affected: Version bands vary by issue; treat axios < 1.20.0 on the 1.x line (and < 0.34.0 on 0.28+) as the practical upgrade floor unless a specific advisory excludes your path.

Why it matters: Teams copy maxRedirects: 0 from SSRF hardening guides and assume it is adapter-universal. It is not. Fetch-first runtimes silently follow redirects to internal targets when the initial URL can bounce.

Exploitation status: Not confirmed as mass exploitation. Advisories are careful: pollution gadgets require a separate same-process pollution source; redirect issues need a redirecting first hop.

Defender actions: Upgrade to ≥ 1.20.0. For unpatched fetch-adapter use, set fetchOptions: { redirect: 'manual' } (or equivalent) where supported, or force the HTTP adapter for guard-sensitive calls. Hunt lockfiles for axios and regenerate.

Primary sources: linked GHSAs; v1.20.0, v0.34.0.

4. PyJWT 2.14.0 advisories — algorithm-confusion guard bypasses published (Sep 29)

What happened: On September 29, 2026, GitHub Advisory Database published a cluster of PyJWT issues whose verified fixes shipped earlier in PyJWT 2.14.0 (maintainer notes date the release 2026-09-11). Do not treat these as brand-new code drops this week — treat them as newly published coordinated advisories that many scanners and humans will only now surface:

AdvisoryCVEClass
GHSA-ffc3-869f-jxw9CVE-2026-102268Critical CVSS 3.1 9.1 — whitespace/line-ending mutated PEM skips is_pem_format → public key used as HMAC secret when allow-list mixes HS + asymmetric
GHSA-p4g4-x82p-q773CVE-2026-102271DER public keys/certs bypass the PEM/SSH marker guard (CVE-2022-29217 family residual)
GHSA-9j54-fg26-wv3rCVE-2026-102266PyJWK accepts empty HMAC keys
GHSA-w2cx-738m-mc7w / GHSA-r6x4-923q-g947 / GHSA-9v7f-9g4p-ffgjCVE-2026-102273 / 102272 / 102267Public JWK-as-HMAC, BOM bypass, JWKS redirect following

Who is affected: Callers on PyJWT ≤ 2.13.0 (bands vary slightly by issue; DER issue from ≥ 2.4.0). First patched release stated across the set: 2.14.0. Preconditions for the Critical issue: mixed HMAC+asymmetric algorithms allow-list and a non-canonical PEM (or DER) verification key on the non-PyJWK path.

Why it matters: Algorithm confusion is a recurring JWT footgun. Incomplete format guards mean “we already patched CVE-2022-29217” is not a complete answer if config still mixes algorithm families.

Exploitation status: Not confirmed in the wild in sources reviewed. Impact when preconditions hold is universal token forgery.

Defender actions: Upgrade to ≥ 2.14.0. Never pass both HS* and asymmetric algs in one algorithms list. Prefer PyJWK / single-algorithm binding. Normalize PEM keys before load; reject unexpected encodings.

Primary sources: linked GHSAs; 2.14.0 release.

5. Podman host-env leak, ZITADEL MFA/Actions, undici TLS drop, webpack-dev path traversal (Sep 24–29)

Additional high-signal items from the window:

🛡️ CVEs That Deserve Attention

CVEProductSeverityExploitation statusPrimary riskRecommended action
CVE-2026-94545 (GHSA-vcvr-r3jv-pc5j)Next.js next/ogCritical (CVSS 4.0 9.5 on vendor advisory)Not confirmed in wildRCE via untrusted SVG in Node ImageResponse≥ 16.3.6; stop untrusted SVG injection
CVE-2026-76169FastifyHigh (CVSS 3.1 7.5)Not confirmedUnauth cross-prefix not-found auth bypass≥ 5.12.2
CVE-2026-102268PyJWTCritical (CVSS 3.1 9.1)Not confirmedJWT alg confusion / universal forgery (preconditions)≥ 2.14.0; single alg family
CVE-2026-101907AxiosHigh (GHSA; CVSS N/A on record)Not confirmedmaxRedirects:0 ignored on fetch adapter≥ 1.20.0; manual redirect mode
CVE-2026-57231PodmanHigh (CVSS 3.1 7.5)Not confirmedHost env leak into container from image Env≥ 5.8.4 / 6.0.0; inspect images
CVE-2026-85056ZITADEL Login V2High (CVSS 3.1 8.2)Not confirmedMFA bypass via session reuse≥ 4.16.1; or Force MFA workaround
CVE-2026-84961undici BalancedPoolHigh (CVSS 3.1 7.4)Not confirmedCustom TLS identity check dropped≥ 7.29.1 / 8.10.2

CVE-2026-94545 — Next.js Node ImageResponse RCE

CVE-2026-76169 — Fastify malformed-URL not-found auth bypass

CVE-2026-102268 — PyJWT PEM mutation algorithm confusion

CVE-2026-101907 — Axios fetch adapter maxRedirects bypass

CVE-2026-57231 — Podman image Env host variable leak

CVE-2026-85056 — ZITADEL Login V2 MFA session reuse

CVE-2026-84961 — undici BalancedPool TLS option drop

🔧 Basic Security Tool of the Week

Grype v0.119.0 — container, filesystem, and SBOM vulnerability scanner

What it does: Grype (Anchore) matches installed packages in container images, directories, and SBOMs against known vulnerability data. It is a focused vulnerability scanner (not a full misconfig/secret suite). Recent builds emphasize risk signals such as EPSS and KEV-oriented prioritization in result interpretation docs.

Who it is for: Developers, DevOps/SRE, and platform engineers who need a second opinion beside “deploy and hope,” especially after a week heavy on npm/PyPI transitive risk (axios, fastify, next, undici, PyJWT).

Why this week: Different category mix from last week’s Trivy (all-in-one vuln+misconfig+secret), earlier Checkov (IaC), TruffleHog (secrets), OSV-Scanner (OSV SCA frontend), and gosec (Go SAST). Grype pairs cleanly with Syft SBOMs and is useful for verifying whether patched floors actually landed in the image you ship. Latest GitHub release tag observed at research time: v0.119.0 (published 2026-09-17; active train with v0.118.x / v0.117.x also present).

Install (authorized machine only, pick one):

# Quick install script (review script before use in production)
curl -sSfL https://get.anchore.io/grype | sh -s -- -b /usr/local/bin

# Homebrew
brew install grype

# Docker (no host install)
docker pull anchore/grype:v0.119.0

Safe basic example — scan only images or trees you own or are authorized to assess:

# Scan a local authorized project directory (e.g. after bumping axios/fastify/next)
grype dir:. --only-fixed

# Scan an authorized container image from your registry or local build cache
grype your-registry.example/your-app:1.2.3

# Dockerized scan of the current authorized repo
docker run --rm -v "$PWD":/work -w /work anchore/grype:v0.119.0 dir:. --only-fixed

# Optional: generate an SBOM with Syft, then scan it (faster repeat scans)
# syft dir:. -o json > sbom.json && grype sbom:./sbom.json

How to read results: Sort by severity, then prefer findings with a fixed version you can actually deploy. Confirm matches for this week’s packages (next, fastify, axios, pyjwt, undici) by name and version, not by CVSS alone. Use --only-fixed when you want a patch-oriented backlog. Export JSON/SARIF into CI once noise is tuned.

Limitations: Database freshness needs network or an air-gap DB update workflow. Matching quality depends on correct package inventory (distroless/scratch images and vendored copies can hide deps — pair with Syft and lockfile SCA). Does not prove exploitability. Never scan third-party registries, customer clusters, or hosts without explicit authorization. Pin the Grype version in CI.

Links: Repository · Docs · Releases · v0.119.0

💡 Security Tip of the Day

Today’s tip: For every JWT verify call, allow exactly one algorithm family (only HS256 or only RS256/ES256/… — never both), and prefer key objects that bind algorithm identity (PyJWK / JWK) over raw PEM/DER bytes.

Why it matters: This week’s PyJWT Critical advisory (and the DER sibling) only become universal forgery when verification still accepts HMAC and asymmetric algorithms against key material the attacker can obtain (the public key). Format-guard bugs are the bypass; mixed allow-lists are the root design mistake.

How to apply it (≈5–10 minutes):

  1. rg -n "jwt\\.decode\\(|algorithms\\s*=" across backend repos (adjust for your JWT library).
  2. Replace lists like ["RS256", "HS256"] with a single expected alg.
  3. Upgrade PyJWT to ≥ 2.14.0 (or your stack’s equivalent library floor).
  4. Load verification keys via JWK/JWKS paths that bind alg/kty when available.
  5. Add a unit test that a token headed alg=HS256 is rejected when the service is RS/ES-only.

Verify: Forged HS256 tokens signed with the public key fail verification; legitimate single-alg tokens still pass; CI fails if someone reintroduces a mixed algorithms list.

✅ Security Actions for This Week

  1. Emergency/High: Upgrade Next.js → ≥ 16.3.6 on any 16.2.x app using Node next/og / ImageResponse; remove untrusted SVG interpolation as a temporary control.
  2. High: Upgrade Fastify → ≥ 5.12.2 and axios → ≥ 1.20.0 (0.x → 0.34.0); re-test SSRF redirect assumptions under the fetch adapter.
  3. High: Upgrade PyJWT → ≥ 2.14.0 and eliminate mixed HS/asymmetric verify allow-lists; patch ZITADEL → ≥ 4.16.1 (Login V2 / Actions) if you run it.
  4. High/Medium by estate: Podman ≥ 5.8.4, undici ≥ 7.29.1 / 8.10.2, webpack-dev-middleware ≥ 8.3.0 (or trailing-slash publicPath + private dev servers), Tornado ≥ 6.5.9, virtualenv ≥ 21.7.12, Electron floors if you ship desktop apps; finish last week’s mcp-atlassian / KubeEdge / OpenBao items if still open.
  5. Hygiene: Run Grype on one authorized image or repo looking for this week’s package floors; apply the JWT algorithm allow-list tip.

Sources

Suggest Changes
Share this post on:
Share this post via WhatsAppShare this post on FacebookShare this post on XShare this post via TelegramShare this post on PinterestShare this post via email

Related articles

Previous Post
Security Checklist for Your Home Linux Workstation Exposed to the Internet
Next Post
DevOps & SRE Weekly Digest — 2026-09-30