Node.js, Java da Python: raunin kwanan nan da jagorar gyarawa Saukewa:

Abubuwan da aka bincika har zuwa Oktoba 23, 2026 (UTC) Saukewa: Lokacin ɗaukar nauyi: Yuli 25-Oktoba 23, 2026, yana mai da hankali kan sabbin sanarwa da faci na gaba daga Satumba zuwa Oktoba. Saukewa: Masu sauraro: injiniyoyi da masu amsa tsaro waɗanda ke kula da ayyukan Node.js, Java, Python sabis, kwantena, gina bututun mai da mahalli masu tasowa. Saukewa:

Wannan labarin yana taƙaita mahimman haɗarin tsaro na baya-bayan nan a cikin Node.js, Java, da Python runtimes, daidaitattun ɗakunan karatu, da tsarin uwar garken gama gari da abin dogaro, kuma yana ba da tasirin tasiri, ƙayyadaddun sigogi, matakan rage ɗan lokaci, zaɓi facin, da hanyoyin tabbatarwa. Saukewa:

Yi la’akari da tasiri akan nau’ikan sassa, abubuwan da aka kunna da wuraren shigarwa masu isa. Bayanan rauni sun fito ne daga shawarwarin hukuma; kwanakin suna nufin bayyanawa jama’a sai dai idan an lura da sakin facin farko a sarari. Ba ma yin la’akari da sharuɗɗan amfani da ba a tabbatar da su ba, ƙimar CVSS ko amfani a cikin daji. Ana gano shawarar turawa azaman jagorar aiwatarwa. Saukewa:

TL;DR: abubuwan fifikon gyarawa Saukewa:

Sabunta lokacin aiki wanda a zahiri ya karɓi sabis ɗin farko. Sabunta abin da ya dace Node.js reshe zuwa akalla 22.23.4 / 24.22.1 / 26.12.1 . Ayyuka masu amfani Node 24 iya haɓakawa zuwa 24.22.1 a cikin babban sigar guda ɗaya ko kuma sigar baya wanda ya ƙunshi gyare-gyare iri ɗaya. S1 S2
Sabuntawa Node abin dogara aikace-aikace daban. Domin Next.js , amfani 15.5.28 / 16.4.1 a matsayin tushen haɓakawa; lokacin amfani React Server Components da kansa, duba ainihin shigar react-server-dom-* kunshin. Sabuntawa kawai Node binary baya rufe waɗannan raunin tsarin. S8 S9 S10 S11 S12
Java : rufe duka zagaye na sabuntawa. Shigar da ginin mai siyarwa wanda ke rufe duka Oktoba 20 CPU da kuma Oktoba 21 CVE-2026-91403 takardar shaidar gaggawa-gyara amana. Duba sashe 2.2 Oracle JDK 11 - 27 daga-na-band versions; tabbatar da sauran rabawa akan fakitin tsaro nasu da cikakkun lambobin ginawa. Sabunta abin da ya dace Tomcat reshe zuwa 9.0.123 / 10.1.61 / 11.0.27 . S16 S17 S18 S20 S21 S22 S23
Python : sabunta mai fassarar, fakitin aikace-aikacen da fakitin takaddun shaida daban. Duba sashe 2.3 don tushen fassara; certifi yana ba da shawarar ≥ 2026.10.19 , pip ≥ 26.2.2 , lokacin amfani uv ≥ 0.13.4 . Ana buƙatar bincika kowane venv da ke akwai. Domin wrap_bio() lambobi masu alaƙa, daidai kuma maras amfani server_hostname dole ne kuma a shiga. S29 S30 S31 S33 S35 S36 S37
Idan haɓakawa nan take ba zai yuwu ba, rage fallasa a wuraren shigarwa masu dacewa. Ba da fifikon tsayawa mara amana Brotli yanke hukunci, abin da abin ya shafa na hoto/paging/ sarrafa kayan tarihi, da keɓe matsala LDAP ko shigarwar tantancewa; kiyayewa TLS an tabbatar da takaddun shaida da sunayen baƙi. Mai shiga WAF ba zai iya rufe hanyoyin da ke fita kamar aikace-aikacen da ke ja da matsananciyar martani ba. S3 S11 S25 S27 S30 S32
Sake ginawa, maye gurbin tsoffin matakai, da kuma tabbatar da ta hanyar hanyoyin sabis na gaske. Ajiye fayil ɗin kulle da narke hoto, sake gina aikace-aikacen da hoto, fitar da maye gurbin duk ma’aikata / JVM / kwantena; duba ainihin tsari, bishiyar dogaro, kantin dogara da gwaje-gwajen koma bayan kasuwanci. Sabon sigar layin umarni kadai baya tabbatar da cewa gyara ya cika. Saukewa:
Idan an shigar da LiteLLM 1.107.0 ko gudu, bi hanyoyin amsawa da ya faru. Aikin ya tabbatar da sulhuntawar saki a ranar 21 ga Oktoba. Ware wuraren da abin ya shafa, bincika daga yanayi mai tsabta, sake ginawa da kuma juya bayanan da aka fallasa. Kar a fara Python/pip a cikin yanayi mai cike da tuhuma don dubawa da farko. Dubi Sashe na 9 don cikakkun bayanai. Saukewa: S41 Saukewa:

1. Ra’ayin rashin lahani da kima mai haɗari Saukewa:

1.1 Ba da fifikon gyarawa ta ainihin fallasa Saukewa:

Abubuwan fifikon turawa da ke ƙasa sune jagorar aiwatarwa. Takamaimai masu tsanani suna bin kowane mai siyarwa, gami da ƙimar Apache’s Important. CVSS 3.1 da 4.0 tsarin maki daban-daban ne; kar a ba da matsayi a cikin su da maki kawai. Saukewa:

Ecosystem / Layer Saukewa:	Mahimman batutuwa Saukewa:	Maki na hukuma ko tabbataccen maki Saukewa:	Aiwatar da fifiko Saukewa:
Node.js dogaro na asali Saukewa:	CVE-2026-111497: Brotli an rubuta shi ba tare da iyaka ba, kuma akwai haɗarin RCE Saukewa:	Node：High	Yanke bayanan Brotli S1 S3 a cikin jikin buƙatun waje ko martani na waje Saukewa:
Node.js TLS / DNS	CVE-2026-105482, 105483, 106069: Fassara da tabbatarwa na ainihi ba su dace ba Saukewa:	High	URL rarrafe, wakili, Webhook, adireshin manufa mai ƙarfi S1 S5 S6 Saukewa:
Node.js HTTP/2	CVE-2026-56846, 56848: Ƙwaƙwalwar ajiya ta ƙare da UAF Saukewa:	High	Node yana sarrafa kai tsaye mara amana HTTP/2 zirga-zirga S7 Saukewa:
React / Next.js	RSC / `use cache` typed arrays RCE	Critical；CVSS 4.0 9.5	Sabar RSC, abubuwan cache masu alaƙa da hanyar bayanai S9 S10 Saukewa:
Next.js inganta hoto Saukewa:	CVE-2026-96889: SVG sarrafa hoto RCE Saukewa:	Critical；CVSS 4.0 9.5	Misalai akan glibc Linux waɗanda zasu iya ɗaukar hotuna marasa amana S11 Saukewa:
Next.js Server Actions	Buƙatun ƙera na musamman yana sa CPU ya ƙare Saukewa:	High；CVSS 4.0 8.2	App Router kuma aƙalla Server Action S12 Saukewa:
Bayanin Java TLS Saukewa:	CVE-2026-91403: Ci gaba da amincewa da matsakaicin matsakaici CA Saukewa:	CVSS 3.1 9.1	TLS/API Scenario S17 ta amfani da sarkar amana da abin ya shafa Saukewa:
Tomcat	JNDIRealm ingantacciyar hanyar wucewa, HTTP/2 cakuɗe-haɗe-haɗe-haɗe-haɗe-haɗin-buƙace,AJP yabo amsa Saukewa:	Important	Daidai da hanyar Realm / Connector / async Servlet S21 S22 S23 Saukewa:
Spring for GraphQL	CVE-2026-59285: Rushewar Rushewa RCE Saukewa:	High	Jackson 2 + Connection Rufin Rubuce-Rubuce + Hanyar Azuzuwa S25 Saukewa:
Spring Security	CVE-2026-59270: Haɗe da LDAP sanannen ganewar gudanarwa da aka fallasa Saukewa:	Critical	An kunna LDAP da aka haɗa kuma tashar sauraron tana samun isa ga maharin S27 Saukewa:
CPython `ssl`	CVE-2026-19445: SNI sakamakon mahallin musanya a cikin UAF Saukewa:	Critical	Python ya ƙare TLS da kanta, kuma ya dace da yanayin yanayin zagayowar rayuwa S29 Saukewa:
CPython `ssl`	CVE-2026-19553: Tsallake tabbatarwa lokacin da sunan mai masauki ya ɓace Saukewa:	High	`wrap_bio()` / Kiran asyncio mai alaƙa ya ɓace sunan mai masaukin da ake tsammani S30 Saukewa:
CPython `tarfile`	CVE-2026-82049: Haɗi mai wuya da haɗe-haɗe na alama Saukewa:	High	Cire tarihin kwalta mara aminci ta atomatik S32 Saukewa:
Django / GeoDjango	CVE-2026-15307: Tambayar sarari rubuta fayil, SSRF, ƙarƙashin yanayin RCE Saukewa:	High	Tambayoyin sararin samaniya ko mu’amalar gudanarwa masu alaƙa suna karɓar shigarwar da ba amintacce ba S38 Saukewa:
Python dogara da takardar shaidar Saukewa:	certifi: emSign rashin amincewa da takaddun shaida	Critical; GHSA, babu wanda aka sani CVE Saukewa:	TLS abokin ciniki da kayan aikin sarrafa fakiti S36 S37 har yanzu suna amfani da CA bundle da abin ya shafa. Saukewa:

Gagajewa: RCE yana tsaye don aiwatar da lambar nesa, UAF yana tsaye don amfani-bayan kyauta, kuma SSRF yana nufin buƙatun buƙatun gefen uwar garke. Izinin kai tsaye na RCE yawanci izini ne na tsarin ɗaukar nauyin aikace-aikacen kuma ba zai iya zama daidai da tushen izini ta atomatik ba. Saukewa:

Jeri da aka ba da shawarar: na farko yana sarrafa RCE, wanda ake iya samunsa daga waje kuma ya cika sharuɗɗan, keɓancewar tantancewa, ɗigon bayanan mai amfani da giciye da batutuwan tabbatar da takaddun shaida; a lokaci guda, tsara sabuntawa don wurin shigar da jama’a DoS. Babu buƙatar gudanar da nauyin kai hari a cikin samarwa don tabbatar da amfani. Dogaro ya wanzu, ana iya samun hanyoyin lambar, kuma an cika sharuɗɗan harin. Wadannan batutuwa guda uku ne da ya kamata a duba su daban. Saukewa:

1.2 Iyakoki masu sauƙin rikicewa uku Saukewa:

Haɓaka lokutan gudu da abubuwan dogaro daban. Sabunta tsaro don Node , JDK , CPython baya gyara tsayayyen kayan aiki na Next.js , Spring , Django , certifi ko na asali kari.
Matsakaicin gyara na ya bambanta da tushen ƙaddamarwa na yanzu. Faci na farko don rauni a watan Agusta ba shi da tabbacin rufe sabbin batutuwa daga Satumba zuwa Oktoba; Sashi na 2 yana amfani da ingantaccen sabuntawa na gaba azaman manufar aiwatarwa. Saukewa:
Neman rauni daga ainihin daidaitawar sarkar samar da kayayyaki. Don raunin gama gari, faci yana kawar da hanyoyin kai hari na gaba; lokacin da aka gudanar da fakitin ɓarna, ana buƙatar bincika tasirin takaddun shaida da dagewa. Sashe na 9 na LiteLLM shine taron da aka tabbatar a hukumance. Saukewa: S41 Saukewa:

Ko an tabbatar da cin zarafi a cikin daji yakamata a dogara da bayanan hukuma. Mai siyarwar bai ambaci ayyukan cin zarafi ba kuma ba zai iya tabbatar da cewa babu wani hari ba; gyara ya kamata a yi dangane da ainihin wurin harin. Saukewa:

2. Binciken sauri na ƙayyadaddun sigar da ƙaddamarwa Saukewa:

Madogara: 2.1 Node.js、React、Next.js

bangaren / reshe Saukewa:	Tushen sigar da aka ba da shawarar Saukewa:	Umarnin don amfani Saukewa:
Node.js 22.x	22.23.4	Sakin tsaro S1 S2 a ranar 21 ga Oktoba Saukewa:
Node.js 24.x	24.22.1	Ya shafi reshen 24.x; 24.22.0 baya ƙunshi facin tsaro na Oktoba 21 S1 S2 Saukewa:
Node.js 26.x	26.12.1	Sakin tsaro a cikin tsari guda S1 S2 Saukewa:
Node.js 20 da farkon rassan sama Saukewa:	Yi ƙaura zuwa reshe mai tallafi Saukewa:	Node 20 baya yarda da wannan gyara na sama; dole ne a tabbatar da tsawaita goyon bayan mai siyarwa daban S3 Saukewa:
Next.js 15.x	15.5.28	An sabunta shi ranar 14 ga Oktoba S8 Saukewa:
Next.js 16.x	16.4.1	Daidai da sama da S8 Saukewa:
Standalone RSC 19.0 / 19.1 / 19.2 / 19.3 reshe Saukewa:	19.0.9 / 19.1.10 / 19.2.9 / 19.3.1	Duba fakitin `react-server-dom-*` guda uku daban; ba wai kawai kalli saman saman ba `react` S10 Saukewa:
Next a zahiri ya ɗora `sharp` Saukewa:	≥0.35.5	Sharuɗɗan gyara na wucin gadi na hukuma don raunin SVG; baya maye gurbin wasu facin Next.js S11 Saukewa:

Node a hukumance ya jera rassan kulawa da abin ya shafa don raunin Oktoba, amma baya samar da abin da aka fara gabatar da facin abu da abu, don haka ba za a iya tantance ainihin sigar kowane rauni ba bisa ga kewayon reshen kulawa kaɗai. Lokacin turawa, ba da fifiko ga yin amfani da sigar da ke sama na reshe ɗaya ko sigar ta gaba da aka tabbatar tana ɗauke da gyare-gyare iri ɗaya. Saukewa:

2.2 Java: Oktoba CPU da sabunta takardar shedar waje

Wannan tebur ya shafi Oracle JDK. Shafi na biyu ya ƙunshi kawai Oktoba 20 CPU; na uku ya haɗa da sakin 21 ga Oktoba. Sigar CPU kadai ba ta rufe duk haɗarin Java da aka tattauna anan. S16 S17 S18 Saukewa:

reshe Saukewa:	Oktoba 20 CPU Saukewa:	Oracle ya fito daga band a ranar 21 ga Oktoba Saukewa:
11	11.0.33	11.0.33.0.2
17	17.0.21	17.0.21.0.2
21	21.0.13	21.0.13.0.2
25	25.0.5	25.0.5.0.2
27	27.0.1	27.0.1.0.2
8	8u511	Teburin sakin jama’a har yanzu yana nuna 8u511; Dole ne a bincika takamaiman ginin tsaro da gyaran sarkar amana, kuma ba za a iya tantance shi ba bisa gajeriyar lambar sigar ita kaɗai Saukewa:

**Java 8 yana buƙatar dubawa tare da cikakken bayanin gini:**Oracle Faɗakarwar ta lissafta 8u511 azaman sigar da abin ya shafa, kuma lissafin sakin yana lissafin sabuntawa na gaba tare da gajeriyar suna iri ɗaya. Ba za a iya bambanta matsayin faci bisa ga gajeriyar lambar sigar “8u511 kawai ba. Ya kamata ku tabbatar da takamaiman ginin tsaro da gyare-gyaren sarkar amana. Saukewa: S17 S18 Saukewa:

Temurin , Corretto , Zulu , Microsoft Build of OpenJDK , sigar saki OpenJDK , da dai sauransu, duba bisa ga sanarwarsu daban-daban da cikakken kunshin / lambobi. Misali, rikodin sakin hukuma na Adoptium ya bayyana cewa ginin da ya dace an sake shirya shi don ƙara eMudhra gyara; Sunan ɗaya na sigar sama ba yana nufin cewa abun cikin kunshin iri ɗaya bane. The .0.2 ka’idojin kari don Oracle ba za a iya amfani da injina ga sauran masu bugawa ba. S20

Abubuwan haɗin aikace-aikacen Java Saukewa:	Tushen sigar da aka ba da shawarar Saukewa:	Jawabi Saukewa:
Tomcat 9 / 10.1 / 11	9.0.123 / 10.1.61 / 11.0.27	Duba reshe ta reshe; Tomcat 10.0 ya daina kulawa S21 S22 S23 Saukewa:
Spring for GraphQL 2.0.x	2.0.5（OSS）	Tallafin kasuwanci kuma shine 2.0.4.1 S25 Saukewa:
Spring Security 7.1 / 7.0	7.1.1 / 7.0.7（OSS）	Ya yi daidai da mafi ƙarancin sigar gyara da aka sanar a watan Agusta; kuna buƙatar bincika bayanan tsaro na gaba S27 S28 kafin turawa Saukewa:
Spring Security 6.5 / 6.4 / 5.8 / 5.7	6.5.12 / 6.4.19 / 5.8.28 / 5.7.26	An jera sanarwar azaman gyaran tallafi na kasuwanci; Ana ƙididdige ƙaura lokacin da babu tallafi daidai, kuma ba za a iya ɗauka cewa Maven Central yana samuwa don S27 kyauta. Saukewa:

Ya kamata haɓaka Spring ya mutunta aikin Spring Boot BOM, Java mafi ƙarancin sigar da layin dacewa. Kar a tilastawa duk Spring kai tsaye zuwa lamba ɗaya kawai don samun faci. Saukewa:

2.3 CPython, Django da takaddun takaddun shaida Saukewa:

Shafi na biyu na teburin da ke ƙasa yana mai da hankali kan TLS batun da aka bayyana a watan Satumba; bambancin reshe don tarfile ana nunawa a sashe 5.3. Fitowar 21 ga Oktoba kuma an sabunta kayan aikin takardar shedar, don haka ginshiƙi na ƙarshe ya haɗa da waɗancan ƙa’idodin turawa daga baya. S29 S30 S33 S35

CPython reshe Saukewa:	Satumba tsaro tsari mafi karami version Saukewa:	Tushen turawa da aka ba da shawarar Saukewa:
3.10	3.10.22	Saki na ƙarshe daga sama, EOL; shirya ƙaura ko tabbatar da tallafin fadada sakin S34 Saukewa:
3.11	3.11.17	3.11.17, da sabunta pip/certifi a cikin kowane yanayi daban-daban. Saukewa:
3.12	3.12.15	3.12.15, da sabunta pip/certifi a cikin kowane yanayi daban-daban. Saukewa:
3.13	3.13.16	3.13.17
3.14	3.14.8	3.14.9
3.15	Sakin 3.15.0 na ƙarshe ya ƙunshi duka TLS gyara S31 S47 Saukewa:	3.15.1

Za a iya fitar da nau’ikan tsaro na sama na 3.11 da 3.12 a lambar tushe; lokacin amfani da fakitin tsarin aiki, duba shawarwarin baya na dillali da cikakken sigar fakitin, kuma babu wani buƙatu na tilasta maye gurbin tsarin Python tare da sigar da aka haɗa ta kanta. Saukewa: S33 S34 Saukewa:

dogaro mai zaman kansa Saukewa:	Tushen sigar da aka ba da shawarar Saukewa:	Bayani Saukewa:
Django 5.2 / 6.0 / 6.1	5.2.18 / 6.0.9 / 6.1.2	Haɗa gyara na gaba S38 S39 ranar 6 ga Oktoba
certifi	≥2026.10.19	GHSA facin farko shine .18; PSF yana ba da shawarar .19 don adana dacewa don takaddun shaida marasa tasiri S36 S37 Saukewa:
pip	≥26.2.2	Ginin kwafin certifi yana buƙatar sabunta shi daban S35 S37 Saukewa:
uv (idan an yi amfani da shi) Saukewa:	≥0.13.4	Sabunta S37 bisa ga ainihin hanyar shigarwa Saukewa:

Waɗannan ƙayyadaddun tushe sun rufe gyare-gyaren da aka jera. Wani matsakaicin matsakaici a cikin tar_filter an bayyana shi a ranar Oktoba 22. Tun daga Oktoba 23, 2026, sigar kulawa ta hukuma wacce ke dauke da wannan gyara ba a riga an tabbatar da ita ba; don haka, 3.13.17 / 3.14.9 / 3.15.1 ba za a iya la’akari da su sun rufe duk batutuwan tarfil ba. Duba Sashe 5.4. S40 Saukewa:

2.4 Tabbatar da rarraba baya Saukewa:

Ka’idojin aiwatarwa da suka dace da Ubuntu, Debian, RHEL da sauran fakitin software: Saukewa:

Yi rikodin sigar tsarin aiki, tushen ma’ajiya, cikakken sigar fakiti, da lambar bayanin tsaro na mai siyarwa. Saukewa:
Tabbatar da cewa shawarwarin ya ƙunshi takamaiman CVE kuma yana gano ƙayyadaddun fakiti don sakin rarraba mai dacewa. Saukewa:
Kwatanta binaries/dakunan karatu da aka ɗora a kan ainihin tsarin gudana, ba kawai gajeriyar sigar sama ba. Saukewa:
Lokacin da babu shaidar facin mai siyarwa, bar shi “don tabbatarwa” kuma kar a ɗauka azaman ƙarshe kawai cewa lambar sigar tana kama da tsohuwar ko sabo. Saukewa:

Akwai bambance-bambance a cikin nau’ikan fakitin apt/RPM da dabarun baya na rarraba daban-daban. Bayanan tsaro da cikakken sigar fakitin kowane rarraba yakamata su yi nasara. Saukewa:

3. Tsarin halittu na Node.js / JavaScript: Nazarin Dalilai da gyarawa. Saukewa:

3.1 CVE-2026-111497: Brotli na’urar dikodi ta asali wacce ba ta da iyaka ta rubuta Saukewa:

Bayyanawa: 2026-10-21; Node darajar hukuma: High. Gine-ginen da abin ya shafa na Node 22.x, 24.x, 26.x yana buƙatar shigar da sashin facin 2.1. Node Sanarwar ba ta jera makin CVSS na lamba ba. Saukewa: S1 Saukewa:

Matsalolin na faruwa a cikin dabarun yanke hukunci na asali lokacin da ake sarrafa gurɓataccen rafi na Brotli mara kyau, wanda zai iya haifar da rashin iyaka ya rubuta. Bayanin hukuma na Vercel ya tabbatar da cewa nunin bincike ya ƙunshi aiwatar da leak ɗin ƙwaƙwalwar ajiya da aiwatar da umarni. Ko maharin zai iya isa ga mai yankewa ya dogara da ko aikace-aikacen ko dogaro da gaske ke yanke bayanan da yake sarrafawa. Saukewa: S3 Saukewa:

Ana buƙatar duba kwatancen biyu a lokaci guda: Saukewa:

inbound: The tsarin ko middleware ta atomatik yana rage jikin buƙatar Brotli da mai amfani ya gabatar. Saukewa:
**mai fita:**HTTP Abokan ciniki, masu kama hoto, da sauransu. samun damar maɓuɓɓuka masu sarrafa mahari kuma suna rage abubuwan da aka dawo ta atomatik. Saukewa:

Kashe Brotli matsawar martanin da aka aika zuwa masu bincike baya cire madaidaicin shigarwa. Kariyar WAF mai shigowa ba ta rufe aikace-aikacen da ake ɗaukowa da yanke martani na waje. Saukewa: S3 Saukewa:

**Patch shugabanci:**Node Matsar da Brotli gyara sama a cikin dogaro na ɗan ƙasa, kuma ƙara bincika yanayin yanke hukunci ba bisa ƙa’ida ba da yada kuskure. Lokacin kiyaye sigar da aka haɗa kai, yakamata kayi amfani da sakin tsaro na hukuma ko cikakken facin reshen da ya dace. Ba za ku iya canza bayanin sigar fakitin JavaScript kawai ba. Saukewa: S4 Saukewa:

Shawarwari na aiwatarwa na wucin gadi: dakatar da ƙaddamarwa mara amfani mara amfani Brotli; duba halin lalata ta atomatik na middleware da abokin ciniki na HTTP; idan kasuwancin dole ne ya karɓi wannan tsari, kammala aiki a cikin yanayin faci da wuri-wuri. Daidaita Accept-Encoding aiki ne kawai na shawarwari kuma bai kamata ya tsaya shi kaɗai ba a matsayin shaida cewa an toshe martanin mugu.

3.2 TLS / DNS guda uku High: Abun tabbatarwa bai dace da ainihin manufa ba. Saukewa:

An bayyana duka ukun a ranar 21 ga Oktoba, tare da ƙa’idar haɓakawa ta hukuma da aka saita a Sashe na 2.1. S1 Saukewa:

Mai ganowa Saukewa:	An tabbatar da batun Saukewa:	Rassan da abin ya shafa Saukewa:
CVE-2026-105482	`dns.resolve` Gyara sunaye masu ɗauke da NUL Saukewa:	22.x / 24.x / 26.x
CVE-2026-105483	IP a cikin cikakken nisa nau’in lamba yana sa a ketare tabbacin sunan mai masaukin takardar shedar Saukewa:	24.x / 26.x
CVE-2026-106069	Sunan mai watsa shiri wanda za’a iya fassara shi da sako-sako azaman sakamakon IP a cikin tabbatacciyar hanyar wucewa ta TLS Saukewa:	22.x / 24.x / 26.x

DNS ainihin matsalar ita ce kirtani da babban Layer ya duba ya bambanta da sunan da ƙaramin Layer ya faskara. Faci na hukuma ya ƙi NUL a shigarwar tantancewa kuma yana ƙara ɗaukar hoto. Saukewa: S6 Saukewa:

TLS Abubuwa biyu sun haɗa da daidaita suna, daidaiton fassarar IP da daidaiton takaddun shaida. Faci ta yadda ba daidaitaccen shigarwar IP ba a ƙi ko a sarrafa shi daidai don guje wa rikitar da ainihin ƙarshen IP tare da shaidar yanki na takaddun shaida. Saukewa: S5 Saukewa:

Haƙiƙanin shawarwarin warware matsala don : yana ba da fifiko ga duba lambar mai amfani da URL, maƙasudin wakili mai ƙarfi ko adireshin Webhook; daidaita daidaituwa da ba da izinin lissafin lissafin, ƙin NUL/haruffa masu sarrafawa, yana tabbatar da doka IPv4, IPv6 da sunayen yanki na duniya har yanzu suna aiki. Ko SSRF za a iya kara kafa yana buƙatar aikace-aikacen shaidar haɗin gwiwa, wanda ba za a iya cire shi kai tsaye daga sunan CVE ba. Saukewa:

Kar a yi amfani da NODE_TLS_REJECT_UNAUTHORIZED=0 ko rejectUnauthorized: false don kawar da kurakuran rajistan ayyukan bayan haɓakawa. Adireshin, takaddun shaida da tsarin kasuwanci ya kamata a gyara. Saukewa:

3.3 Yuli HTTP/2 High-haɗari da batutuwan ƙirar izini Saukewa:

Abubuwan da aka bayyana a watan Yuli har yanzu suna buƙatar shigar da su cikin binciken. Ana ba da shawarar yin amfani da tushen tushen tsaro na Oktoba kai tsaye a Sashe 2.1 lokacin turawa. Saukewa: S7 Saukewa:

CVE	Dalilai da tasiri Saukewa:	Na farko kafaffen sigar Saukewa:
CVE-2026-56846	Tushen HTTP/2 header da aka riƙe ba a haɗa shi da kyau a cikin kasafin kuɗi na `maxSessionMemory` kuma yana iya kawar da ƙwaƙwalwar ajiya; Tasiri 22.x / 24.x Saukewa:	22.23.2 / 24.18.1
CVE-2026-56848	HTTP/2 ya sake shiga hanyar aikawa yayin tarin fakiti, yana haifar da tulin UAF; tasiri 22.x / 24.x / 26.x Saukewa:	22.23.2 / 24.18.1 / 26.5.1
CVE-2026-58043	`--permission` Madaidaicin iyaka na gabanin hanyar yana da faɗi da yawa, kuma ana iya isa ga fayilolin da ke wajen lissafin da aka yarda. Saukewa:	Daidai da layin kulawa guda uku a sama Saukewa:

Duk ukun High ne a hukumance. Abubuwa biyu na farko suna ba da fifiko don bincika ko HTTP/2 Node kanta ce ke sarrafa shi; abu na uku kawai yana da ma’ana daidai lokacin amfani da samfurin izini kuma yana dogara ga wannan iyaka. Abubuwan samfurin izini ba za a iya siffanta su azaman hanyar sadarwa RCE wacce baya buƙatar tantancewa. Saukewa: S7 Saukewa:

Ƙarshen HTTP/2 na ɗan lokaci akan keɓantaccen wakili, sabuntawa da iyakance tushen baya shine zaɓin turawa don rage fallasa; Ƙididdigar albarkatu na iya sarrafa sakamakon gajiyar albarkatu kawai kuma ba za su iya daidaita UAF ba. Saukewa:

3.4 Oktoba React / Next.js: abubuwa biyu RCE da abu ɗaya DoS Saukewa:

A. RCE a cikin RSC / `use cache` ayyuka masu dawo da tsararraki masu rubutu Saukewa:

Kwanan jama’a: 2026-10-14; Critical, CVSS 4.0 9.5. Masu gano nasiha na hukuma:

React：GHSA-xqc2-xf4c-x3h3。
Next.js：GHSA-673q-mjm6-r5xr。S9 S10

The React Batun na sama ya ƙunshi tsararru iri-iri da aka haɗa tare da ƙima mai iya sarrafa mahari a cikin RSC amsa. Su ukun abin ya shafa react-server-dom-* nau’ikan kunshin sune 19.0.0 — 19.0.8 , 19.1.0 — 19.1.9 , 19.2.0 — 19.2.8 , 19.3.0 ; duba babi Sashe 2.1. Tsabtace mai bincike-gefen React , ko aikace-aikacen da ba sa amfani da tsarin / plug-ins masu goyan bayan RSC kwata-kwata, kar a fada cikin iyakar wannan abu. S10

Next.js lissafin sanarwa na ƙasa 16.0.0 — 16.4.0 , bita a ciki 16.4.1 ; yanayin shine App Router , Cache Components , kuma use cache ayyuka masu mayar da tsararru iri-iri. Babu wani ingantaccen tsari na gama gari na hukuma, kuma ana buƙatar masu amfani da nau’ikan da abin ya shafa su haɓaka cikin lokaci. Bai dace ba kawai a dogara da bincike na hannu don “da alama wannan aikin ba ya wanzu” don kawo ƙarshen aiki. S9

Madogara: B. SVG Image Optimization RCE

CVE-2026-96889/GHSA-2464-fhr4-w9xw, 2026-10-14, Critical, CVSS 4.0 9.5. Matsalar ta tana faruwa a cikin babban ɗakin karatu na asali da ake amfani da shi don inganta hoto. Jami’ai sun nuna cewa hadarin RCE ya kasance a cikin yanayin glibc Linux. Saukewa: S11 Saukewa:

Filayen sigar hukuma sune: Saukewa:

>=10.0.0 <=15.5.27；
>16.0.0 <=16.4.0。

Jami’in yana amfani da ƙananan iyaka na >16.0.0 don reshen 16.x, amma wannan bayanin kewayon bai isa ya tabbatar da cewa 16.0.0 ba shi da lafiya. Maƙasudin haɓakawa na ainihi iri ɗaya ne 15.5.28/16.4.1. Saukewa: S11 Saukewa:

Maganin wucin gadi na hukuma shine tabbatar da cewa Next a zahiri yana ɗaukar nauyin ≥0.35.5. Kulle fayiloli, abubuwan dogaro, da hotunan turawa na iya riƙe tsoffin al’amura, don haka ƙara sabon sigar dogaro na sharp a matakin sama bai isa ba, ya kamata a bincika da sake gina bishiyar dogaro ta ƙarshe. Saukewa: S11 Saukewa:

C. Server Actions CPU ya ƙare Saukewa:

GHSA-p3m5-59mp-jv5r , 2026-10-14, High , CVSS 4.0 8.2 . Next yana tasiri 13.0.0 — 15.5.27 , 16.0.0 — 16.4.0 , gyarawa 15.5.28 / 16.4.1 . Sharuɗɗan sune App Router kuma akalla daya Server Action ; munanan buƙatun na iya kiyayewa CPU shagaltar da shi na dogon lokaci, tare da toshe buƙatun na gaba a cikin tsari iri ɗaya. Aikace-aikace tare da Pages Router ko babu Server Actions wannan bai shafe su ba. S12

Babu wani tsari na hukuma wanda zai iya maye gurbin haɓakawa. Iyaka mai ƙima, iyakan daidaitawa da ƙimar albarkatu na iya rage lalacewa, amma ba za a iya amfani da su azaman ƙarshe don tabbatar da facin ba. Saukewa:

3.5 Tun da farko Next.js a cikin wannan taga Mummunan matsala Saukewa:

Abubuwan da ke biyowa an yi niyya ne don guje wa ɓacewar turawa waɗanda har yanzu ke makale akan juzu’in kafin Agusta-Satumba; ba a ba da shawarar kawai don matsawa zuwa tsoffin matakan gyarawa a cikin tebur yanzu ba. Saukewa:

Kwanan wata Saukewa:	Mai ganowa / labari Saukewa:	Gyaran farko; aiki na yanzu Saukewa:
2026-08-25	GHSA-2xp9-vwfh-vxw4: AVIF inganta hoton ɗakin karatu na asali RCE, Critical Saukewa:	15.5.24/16.3.3; yanzu 15.5.28/16.4.1 S13 Saukewa:
2026-08-25	CVE-2026-75604: RCE, Critical lokacin da Pages Router da App Router ana amfani da su lokaci guda akan Windows, kuma Cache Components ba a kunna ba; nau’ikan `>=13.4.0 <15.5.24`, `>=16.0.0 <16.3.3` Saukewa:	15.5.24 / 16.3.3 ; Linux/macOS wannan takamaiman bai shafe su ba Windows batun S14
2026-09-22	GHSA-vcvr-r3jv-pc5j: hanyar Node hanyar samar da hoto a cikin `next/og` tafiyar matakai marasa amana SVG, Critical; Saukewa: 16.2.0—16.3.5 Saukewa:	16.3.6; aiwatar da Edge yana waje da iyakar wannan batu, kuma 15.x ba reshe ba ne da abin ya shafa don wannan RCE S15 Saukewa:

4. Java muhalli: Amintaccen lokacin aiki, kwantena da tsarin ana sarrafa su daban Saukewa:

4.1 JDK: CPU na yau da kullun da CVE-2026-91403 sabuntawa ne mai hawa biyu

The Java SE hadarin matrix don Oracle CPU on Oktoba 20 lists Sabbin facin tsaro 55, 49 daga cikinsu ana yiwa alama a matsayin masu amfani akan hanyar sadarwar ba tare da tantancewa ba. . Wannan ba yana nufin akwai 55 ba Critical , kuma ba ya nufin cewa akwai 49 kai tsaye amfani RCE hanyoyi ga kowane Java sabis na yanar gizo; dole ne a fahimci shi tare da abubuwan haɗin gwiwa, APIs, hulɗar mai amfani da yanayin ƙaddamarwa a cikin matrix. S16

Washegari CVE-2026-91403 (CVSS 3.1 9.1) yana hulɗa da wani nau’in haɗari: saitin matsakaicin CA mai alaƙa da taron eMudhra wanda ba a yarda da shi ba. Yana rinjayar TLS amincin abokan hulɗa da sirri/mutunta na sadarwa kuma ba za a iya siffanta shi azaman raunin ɓarna na ƙwaƙwalwar ajiya na JVM ba. Saukewa: S17 Saukewa:

Shawarar ta Oracle ta lissafa sigar da aka fitar a ranar 20 ga Oktoba kamar yadda abin ya shafa, don haka sabunta fitar da bandeji a ranar 21 ga Oktoba kuma yana buƙatar shigar da shi. Duba sashe 2.2 don takamaiman sigar. Hakanan GraalVM yana da samfuran da suka dace da abin da abin ya shafa, kuma tsayayyen sigar yakamata ya kasance ƙarƙashin keɓaɓɓen bayanin tsaro. Saukewa: S17 S18 Saukewa:

Matakan hukuma na wucin gadi: Ajiye da farko, sa’an nan kuma cire ƙayyadadden takaddun shaida daga kowane kantin da aka yi amfani da shi a zahiri: Saukewa:

emSign ECC Root CA - G3, Oracle wanda aka fi sani da emsigneccrootcag3 [jdk]. Saukewa:
AAA Certificate Services, Oracle wanda aka fi sani da comodoaaaca [jdk]. Saukewa: S19 Saukewa:

JDK 11 kuma daga baya, misali na hukuma shine: Saukewa:

keytool -delete -cacerts -alias "emsigneccrootcag3 [jdk]"
keytool -delete -cacerts -alias "comodoaaaca [jdk]"

Yi amfani da keytool daga maƙasudin JDK don waɗannan umarni kuma tabbatar da cewa suna aiki akan ainihin shagon amintaccen aikace-aikacen. Java 8 yana amfani da hanyar da ta dace da jre/lib/security/cacerts; gyare-gyaren rumbun adana bayanan dole ne a sarrafa shi daban, kuma sauran masu wallafa suna iya samun laƙabi daban-daban. Cire tushen takardar shaidar zai faɗaɗa iyakar ƙin yarda, da sake gwadawa-gwajin halaltacciyar takardar shaidar sabis. Saukewa: S19 Saukewa:

Jami’in kuma yana ba da zaɓi don ba da damar bincika sokewa, amma tasirin ya dogara da ainihin aiwatar da TLS, isar da sabis na sokewa da dabarun gazawa. Don jigilar jama’a gabaɗaya, ba da fifikon shigar da cikakkun sabuntawar dillalai don guje wa jiyya biyu na JVM a matsayin shaida cewa duk ɗakunan karatu na TLS an gyara su. Saukewa:

4.2 Tomcat: Keɓewar mai amfani Saukewa:

An buga abubuwa uku masu zuwa akan 2026-10-20; shigarwar sigar da aka gyara tana kwanan wata Oktoba 12. Matsayin hukuma na Apache shine Important. S21 S22 S23 Saukewa:

CVE	An tabbatar da sifofin da abin ya shafa Saukewa:	Abubuwan da ake buƙata/sakamako Saukewa:
CVE-2026-101296	9.0.0.M1—9.0.122；10.1.0-M1—10.1.60；11.0.0-M1—11.0.26	JNDIRealm Yana Haɓaka hanyar tabbatar da ba GSSAPI SASL ba, tabbatar da takaddun shaida ya ɓace, kuma kalmomin shiga mara kyau na iya wucewa. Saukewa:
CVE-2026-101356	9.0.118—9.0.122；10.1.55—10.1.60；11.0.22—11.0.26	Kuskuren asynchronous Servlet na HTTP/2 yana sake sarrafa/sake amfani da abubuwa ba daidai ba, yana haifar da gaurayawan buƙatu ko amsa tsakanin masu amfani. Saukewa:
CVE-2026-103119	Tabbatar da kawai 11.0.0-M25-11.0.26 Saukewa:	Manyan AJP ba tare da toshe rubuce-rubucen ba na iya haifar da ƙarancin karantawa, yana fallasa bayanan amsa da suka gabata a cikin buƙatun daga baya. Saukewa:

Daidaita daidai shine 9.0.123 / 10.1.61 / 11.0.27; AJP an jera shi azaman Tomcat 11 bisa ga sanarwar, kuma ba za a iya faɗaɗa shi zuwa rassa uku masu matsala iri ɗaya ba. S21 S22 S23 Saukewa:

Faci na JNDIRealm yana gyara gibin tabbatarwa a cikin ainihin tsarin tantancewa, inda ba za a iya amfani da “hanyoyin shigar da aikace-aikacen kamar na al’ada ba” maimakon tabbatarwa. Yakamata a bincika hanyoyin daular, SASL don ainihin tsarin sabis ɗin, kuma dole ne gwaje-gwaje su gaza don kalmomin shiga da ba daidai ba. Saukewa: S24

shawarwarin aiwatarwa na wucin gadi: keɓe hanyar tabbatarwa da abin ya shafa; dakatar da HTTP/2 sarrafa Tomcat lokacin da kasuwanci ya ba da izinin; AJP mara amfani. Ƙuntatawa kai tsaye zuwa tashar jiragen ruwa na AJP ba zai iya tabbatar da cewa ba zai shafi zirga-zirgar da ke shiga ta hanyar wakili na gaba ba. Bayan sabuntawa na hukuma, ya kamata a gwada buƙatun asynchronous a lokaci guda daga masu amfani masu zaman kansu don tabbatar da cewa babu wata tattaunawa tsakanin ganowa da martani. Saukewa:

Madogara: 4.3 Spring for GraphQL：CVE-2026-59285

Kwanan jama’a: 2026-08-20; High. ya shafi 2.0.0—2.0.4, gyara 2.0.5 (OSS) ko 2.0.4.1 (tallafin kasuwanci). Saukewa: S25 Saukewa:

Wannan haɗari ne mara aminci ga ɓarna a cikin tambayoyin bugu. Abin da ake bukata a hukumance shi ne cewa dole ne a cika waɗannan sharuɗɗa a lokaci guda: Saukewa:

Yi amfani da Spring for GraphQL. Saukewa:
Kashe JSON ta amfani da Jackson 2.x. Saukewa:
Bayar da filin haɗin gwiwa zuwa duniyar waje. Saukewa:
Hanyar aji tana ƙunshe da takamaiman azuzuwan waɗanda za su iya aiwatar da dabaru na bazata yayin tsinkayar su. Saukewa:

Buƙatar GraphQL mai ƙeta na iya haifar da RCE lokacin da aka cika sharuɗɗan. Ba za a iya rage shi zuwa “duk shirye-shiryen Java ta amfani da Jackson za a iya amfani da su”. Saukewa: S25 Saukewa:

Me yasa 2.0.4 bai isa ba: A watan Yuni, CVE-2026-41699 ya ba da facin tushe kamar 2.0.4, kuma a cikin Agusta sanarwar ta haɗa da 2.0.4 a cikin sabon ikon yin tasiri. Don haka, dole ne a sabunta rikodin gyara bisa ga sanarwar da ta biyo baya, kuma ba za a iya amfani da ƙaramin sigar tsohuwar CVE ba. Saukewa: S26 Saukewa:

Lokacin da babu haɓakawa na ɗan lokaci, ana iya dakatar da filayen fagin ɗin da abin ya shafa wanda ke samun dama ga masu kira marasa amana; ƙunsar nau’ikan nau’ikan nau’ikan da ba za a iya cire su ba da kuma hanyoyin aji wani ma’auni ne mai zurfi. Regressions ya kamata rufe siginan kwamfuta na shari’a, sakamakon da aka rubuta, da keɓance kin shigar da bayanai, da duba ainihin sigar abubuwan da ke cikin aikace-aikacen ƙarshe na JAR. Saukewa:

4.4 Spring Security: CVE-2026-59270 da hatsarori masu alaƙa Saukewa:

CVE-2026-59270, 2026-08-20, Critical. da aka saka UnboundIdContainer yana yin rajistar sanannun takaddun shaidar gudanarwa ta tsohuwa kuma yana sauraron duk mu’amalar hanyar sadarwa. Lokacin da aka kunna ɓangaren kuma ana iya isa tashar tashar jiragen ruwa, mai hari zai iya karantawa ko canza bayanan shugabanci; ayyukan da gabaɗaya gabatar da Spring Security ba za su fallasa LDAP ta atomatik ba. Saukewa: S27 Saukewa:

Yankin da abin ya shafa: Saukewa:

reshe Saukewa:	abin ya shafa Saukewa:	Tashar gyara/saye ta farko Saukewa:
7.1	7.1.0	7.1.1 OSS; kasuwanci kuma 7.1.0.1 Saukewa:
7.0	7.0.0—7.0.6	7.0.7 OSS; kasuwanci kuma 7.0.6.1 Saukewa:
6.5 / 6.4	6.5.0—6.5.11；6.4.0—6.4.18	6.5.12/6.4.19, kasuwanci Saukewa:
5.8 / 5.7	5.8.0—5.8.27；5.7.0—5.7.25	5.8.28/5.7.26, kasuwanci Saukewa:

Tushen: S27. Shirya matsala spring.ldap.embedded.* saitin atomatik da lambar gaggawar kai tsaye; rufe sashin lokacin da ba a buƙata don samarwa, kuma duba ainihin adireshin sauraron. Lokacin da kasuwancin ke buƙatar gaske, da farko iyakance hanyoyin kiran sa’an nan kuma kammala haɓaka kayan aikin. Saukewa:

Batun tabbatarwa mai alaƙa: CVE-2026-47841 ( High ). WebAuthn An saita amincin mai amfani zuwa REQUIRED , da kuma bayan HTTP An jera zaman ta rarrabawar ma’ajiya, kwatancen ainihin abin da ba daidai ba na iya ɓata buƙatar tabbatarwa. Har ila yau, harin yana buƙatar maharin ya mallaki na’urar tantance mai amfani, ba ta hanyar shiga tsakani ba tare da na’ura ba. Don daidaitattun sigogin da suka shafi 7.1 , 7.0 , 6.5 , kuma 6.4 S28

5. Python muhalli: mai fassara, daidaitaccen ɗakin karatu, tsarin da takaddun shaida

5.1 CVE-2026-19445: SSLContext UAF a cikin SNI kira baya Saukewa:

Kwanan Bugawa: 2026-09-30; Matakin PSF: Critical. A cikin uwar garken Python TLS, sni_callback yana canza hanyar haɗi zuwa wani SSLContext, kuma lokacin da ainihin mahallin da ba a iya tsira ba shi da ma’ana. Abokin ciniki na TLS na iya lalata sabis ɗin ko kiran mai nuni a cikin abin da aka saki. Saukewa: S29 Saukewa:

Babban abu shine cewa Python abu bai dace ba tare da tushen sake zagayowar rayuwa ta TLS. An fito da ainihin mahallin, kuma Layer ɗin da ke ƙasa na iya riƙe yanayin da ake buƙata don sake kiran; ana buƙatar amfani da faci na asali don gyara yanayin rayuwa. Saukewa: S47 Saukewa:

Scope: Python code wanda kawai ke aiki azaman abokin ciniki na TLS wannan abu bai shafe shi ba; Yanayin al’ada na soket na sauraron da ke riƙe da ainihin mahallin na dogon lokaci ba ya fada cikin takamaiman hanyar gazawar da aka bayyana a cikin sanarwar. Bayan Nginx ya ƙare TLS, kawai yana mikawa HTTP na gida zuwa Python, kuma Python yana ɗaukar SNI kai tsaye da kanta, wanda shine wani wuri daban daban. Saukewa: S29 Saukewa:

Daidai da ƙayyadaddun sigar 3.10—3.14, duba sashe 2.3. An gyara sigar hukuma ta 3.15, kuma za a iya zaɓar 3.15.1. Sabunta dogaro da pip kawai ba zai iya maye gurbin aiwatar da _ssl mai fassarar ba. S33 S35 S47 Saukewa:

Haɓaka rangwame na wucin gadi: yana riƙe ƙaƙƙarfan nassoshi ga duk SSLContext waɗanda suka saita kiran SNI har zuwa ƙarshen zagayowar rayuwar uwar garke. Wannan yana buƙatar rufe ainihin ƙirƙira mai ƙarfi da canza hanyoyin; al’ada OpenSSL 1.1.1 ginawa ya kamata kuma duba yanayin sake tattaunawa tare da rikodin fitowar hukuma kuma ba da fifiko don kammala sabuntawa. Saukewa: S29 S47 Saukewa:

5.2 CVE-2026-19553: Ana kunna tutar sunan mai masauki, amma sunan mai masaukin ya ɓace lokacin kira. Saukewa:

Kwanan jama’a: 2026-09-30; Saukewa: High. Lokacin daSSLContext.check_hostname=True, idan ba a wuce wrap_bio() a cikin server_hostname ba, aiwatarwar asali na iya yin shuru ta tsallake tabbatarwar sunan mai masauki. Nasarar tabbacin sarkar takardar shaida baya nufin cewa an daidaita sunan yankin da ake nufi. Saukewa: S30 Saukewa:

Gyara yana buƙatar matakai biyu: Saukewa:

Sanya sakin tsaro na fassarar da aka jera a sashe 2.3. Saukewa:
Bincika hanyoyin wrap_bio(), masu alaƙa asyncio.create_connection()/loop.start_tls() hanyoyin, wuce a sarari a cikin sunan mai masaukin da ake tsammani da mara komai, sannan a kunna tabbatar da takaddun shaida. Saukewa: S30 Saukewa:

**Bambance-bambancen jituwa waɗanda ba za a iya tsallake su ba:**3.10, 3.11, 3.12 don dacewa ne, DeprecationWarning kawai aka bayar don wasu lokuta inda sunan mai masauki ya ɓace; 3.13 kuma daga baya tada ValueError. 3.12 backport shima yana bambanta None a sarari daga igiyoyi marasa komai: ana ƙara sabon faɗakarwa don None, kuma har yanzu ana ba da rahoton kuskure don kirtani mara komai. Saboda haka, ƙananan masu amfani da reshe ba za su iya ɗauka cewa an dawo da tabbatar da sunan yankin da ya ɓace ta atomatik ta haɓakawa kawai. Saukewa: S31 S33 Saukewa:

A cikin yanayin gwaji, yi amfani da amintaccen takardar shaidar sarkar tare da sunan mai masauki mara daidaituwa kuma tabbatar da cewa ainihin abokin ciniki na TLS ya ƙi shi. Karanta ƙimar Boolean kawai check_hostname ba ta zama cikakkiyar yarda ba. Saukewa:

5.3 CVE-2026-82049: Haɗin haɗin haɗin gwiwa a cikin tace tarfile Saukewa:

Kwanan jama’a: 2026-09-14; High . A ciki CPython 3.13 da aiwatar da aiwatarwa a baya, haɗe-haɗe masu wuya da alaƙa na alama a cikin kwalta mara amana na iya ƙetare ta data / tar tacewa cirewa, fallasa abubuwan da ke cikin fayiloli a waje da kundin ajiyar kaya a cikin bishiyar da aka kwashe, ko canza izininsu da lokutan gyarawa. S32

Tabbatattun tasirin wannan raunin sun haɗa da bayyanar abun ciki na fayil da gyare-gyaren metadata; waɗannan tasirin kawai ba su isa ba don nuna sabani na sake rubuta abun ciki na fayil na waje ko aiwatar da RCE ba tare da wani sharadi ba. Saukewa:

Domin daidaitattun facin tushe na 3.10 — 3.13 , duba Sashe 2.3. Python 3.14 an keɓe shi daga wannan takamaiman batun saboda os.link() hali ya canza tun 3.14.0b1 , don haka abin ya shafa ikon yinsa 3.10 — 3.13 reshe na sama baya aiki. S33

Matakai na wucin gadi da zurfi: sun dakatar da hakar ta atomatik na rumbun adana bayanai marasa amana; yi amfani da keɓantaccen matakai na ma’aikata masu ƙarancin gata da sabbin kundayen adireshi na keɓaɓɓen lokacin da kasuwancin dole ne a sarrafa shi, ƙin hanyoyin haɗin gwiwa, hanyoyin haɗin kai da shigarwar na’urar ta kasuwanci, da iyakance adadin fayiloli da albarkatun ragewa. Waɗannan shawarwarin turawa ne. Saukewa:

filter="data" ya fi dacewa da ɗakunan ajiya na yau da kullun waɗanda ba a amince da su ba fiye da cikakkiyar dabarar amana, amma tacewa kanta akan tsohuwar sigar ita ma tana da wannan raunin, kuma ƙara wannan siga shi kaɗai ba zai iya maye gurbin sabuntawar ba. Tace kuma ba cikakken tsarin fayil bane. Saukewa: S32 S45 Saukewa:

5.4 Ƙarin haɗari: CVE-2026-114583 (Medium) da matsayi na saki Saukewa:

An bayyana PSF a cikin 2026-10-22 cewa tarfile.tar_filter ana iya ƙetare wasu takamaiman sunaye na hanyar haɗin yanar gizo, yana barin membobin da ke gaba su rubuta a waje da kundin ajiyar kaya, tare da matakin matakin. Medium. An haɗa gyara na hukuma PR a wannan rana; Ya zuwa ranar 23 ga Oktoba, 2026, ba a tabbatar da sakin kulawa a hukumance mai ɗauke da wannan alƙawarin ba. Saukewa: S40 Saukewa:

Saboda haka: Saukewa:

An jera wannan abu daban azaman Medium. Saukewa:
Ba za a iya ɗaukar nau’ikan fassarar da aka fitar a ranar 21 ga Oktoba da cewa sun haɗa da wannan gyara ba. Saukewa:
Tsarin da har yanzu yana amfani da filter="tar" don sarrafa bayanan da ba a amince da su ba yakamata ya bi diddigin sakin baya; ware ko dakatar da wannan hanyar sarrafa na ɗan lokaci kaɗan. Lokacin canzawa zuwa data da ƙin hanyoyin haɗin gwiwa, dole ne ku kuma tabbatar da cewa ya dace da buƙatun kasuwanci, kuma ba za a iya siffanta matattar a matsayin akwatin yashi mara iyaka ba. Saukewa:

5.5 GeoDjango: CVE-2026-15307 da gyare-gyare na gaba a cikin Oktoba Saukewa:

2026-08-04, Django jami’in High. tambayar sararin samaniya yana wuce wasu kirtani/kamus zuwa GDALRaster, kuma direba na iya rubuta buƙatun bayanai ko a ciki; Za a iya ƙirƙirar RCE lokacin da akwai takamaiman hanyoyi da yanayin aiwatarwa na gaba. Ma’aikatan da ke da izinin kallon ƙirar filin sararin samaniya kuma suna iya samun dama ga wannan hanyar ta jerin masu canji. Saukewa: S38 Saukewa:

Gyaran farko shine 5.2.17/6.0.8, wanda ke iyakance nau’ikan shigarwar da aka karɓa ta hanyar duba sararin samaniya. Wannan canji na iya rinjayar ainihin kasuwancin yin amfani da kirtani/ ƙamus don bayyana raster; kawai kunsa shigarwar da ba a amince da ita ba cikin GDALRaster baya nufin tabbatarwa. Saukewa: S38 Saukewa:

A ranar 6 ga Oktoba, an gyara CVE-2026-87890 (Matsakaici): VRT da aka bayyana a cikin bytes na iya yin la’akari da albarkatun waje kuma har yanzu yana haifar da buƙatun hanyar sadarwa; a wannan rana, an kuma ƙarfafa kariyar ƙirar DoS na CVE-2026-15830. Ba za a iya haɓaka na ƙarshe na biyu don bayyana sabon babban haɗarin RCE ba, amma suna nuna cewa tushen ƙaddamarwa yakamata ya zama 5.2.18 / 6.0.9 / 6.1.2. Saukewa: S39 Saukewa:

Ayyukan aiwatarwa suna bincika wuraren shigarwa guda biyu na API da keɓancewar gudanarwa, yana taƙaita binciken sararin samaniya mara amana, izinin rubuta fayil da shiga waje; bayan an ɗaukaka, koma-baya-gwajin ingantattun tambayoyin sarari da ƙin shigarwar da aka haramta. Aikace-aikacen Django na yau da kullun waɗanda ba sa amfani da GeoDjango bai kamata su yi amfani da wannan ƙarshe na RCE kai tsaye ba. Saukewa:

5.6 certifi / pip: Amintaccen takaddun shaida dole ne ya rufe kowane kwafin

GHSA-6q48-6c7w-9gw2 , 2026-10-20, Critical , sani CVE ba a lissafta ba. Wannan shine sabuntawar rashin amincewa da takaddun shaida da ya haifar eMudhra tsaka-tsaki CA lamarin. Ba za a iya taƙaita shi azaman tsarin ɓoyewa na HTTPS ba ko kuma an fashe duk takaddun takaddun tushe. S36

Nasihar certifi ta asali an jera 2026.10.18 azaman faci; PSF daga baya a sarari ya ba da shawarar 2026.10.19 don adana dacewa tare da takaddun shaida mara tasiri. Tushen aiki shine .19. Saukewa: S36 S37 Saukewa:

Bukatar rarrabe: Saukewa:

Amintaccen wurin abu Saukewa:	Me yasa kuke buƙatar bincika daban Saukewa:
Kunshin tsarin aiki CA Saukewa:	Kayan amintaccen tsari don hoton ko mai masaukin baki Saukewa:
certifi a cikin venv Saukewa:	CA bundle ana amfani da shi ta aikace-aikace ko Buƙatun da dai sauransu. Saukewa:
pip ginannen certifi Saukewa:	Kofi daban ne da na waje da aka shigar certifi Saukewa:
uv / Sauran kayan aikin marufi Saukewa:	Bi sabbin kayan aikin da amintattun kafofin Saukewa:
Fayilolin CA na musamman, fakitin ɗaukar hoto Saukewa:	Yana iya ci gaba da soke amintattun tushen tushen tsarin ko fakiti Saukewa:

Abin da ke sama jerin abubuwan dubawa ne dangane da wurare daban-daban na marufi. PSF yana buƙatar sabunta kayan aikin da ke da alaƙa, mahalli na yau da kullun da sake gina hoton; kawai sabunta mai masaukin CA ko sake shigar da fassarar ba zai iya tabbatar da cewa an sabunta duk kwafin. Saukewa: S35 S37 Saukewa:

Lokacin haɓakawa daga tsohon pip amintaccen takalmin takalmin, PSF yana ba da umarni don dabaran fixed da SHA-256, duba ƙarin S37. Kar a kashe tabbacin TLS ko ƙara --trusted-host don keɓance batutuwan takaddun shaida. Saukewa:

6. Tsarin gyara na yau da kullun Saukewa:

Umurnai masu zuwa don ingantattun wurare ne. Lokacin aiwatarwa, yakamata a haɗa mai sarrafa fakitin data kasance, fayil ɗin kulle da tsarin tura aikin don gujewa haɗa npm/pnpm/yarn ko pip/uv/Shaya don samar da fayilolin kulle masu cin karo da juna. Saukewa:

Karfafa keɓantawa da farko: Idan kun yi zargin cewa mahallin ya gudanar da fakitin da aka daidaita a Sashe na 9, keɓe shi da farko kuma bincika faifai, kulle fayil da rikodin hoto daga wuri mai tsabta; kar a fara aiwatar da umarnin Python/pip mai zuwa. Saukewa: S41 Saukewa:

6.1 Kafa littatafai wanda zai iya dacewa da zirga-zirga na gaske Saukewa:

Kowane sabis yana yin rikodin aƙalla: Saukewa:

Wurin shigarwa na waje, wakili na baya, hanyar haɗin kai kai tsaye zuwa wurin asali, da jerin jerin ayyuka da aka tsara. Saukewa:
Ainihin umarnin farawa, asusu mai gudana, hanyar binary, tsari ko ainihin akwati. Saukewa:
Cikakken juzu’i na lokacin gudu, mai wallafa/majiya, cikakken fakiti, ko narkar da hoto. Saukewa:
Tsarin tsari da abubuwan dogaro masu jujjuyawa, fayilolin kulle, ɗakunan karatu na asali, da amintattun hanyoyin ajiya. Saukewa:
Daidai da ko akwai yanayin rashin ƙarfi, maƙasudin faci, ikon sake farawa, mutum mai alhakin da sakamakon tabbatarwa. Saukewa:

Hakanan ya kamata a duba injunan haɓakawa, masu tseren CI, ginin kwantena, da ayyukan baya bisa ga hanyoyinsu zuwa abubuwan da ba a yarda da su ba; kar kawai sabunta kwandon gidan yanar gizon da ke fuskantar jama’a. Saukewa:

6.2 Node.js: Ƙayyade lokacin aiki da farko, sannan sabunta abubuwan dogaro da aikace-aikacen Saukewa:

Duba cikin ainihin yanayin sabis:

node -p 'JSON.stringify({execPath:process.execPath,node:process.version,openssl:process.versions.openssl,brotli:process.versions.brotli},null,2)'
npm ls next react react-dom react-server-dom-webpack react-server-dom-parcel react-server-dom-turbopack sharp --all
npm audit --omit=dev

node -p yakamata a kashe ta ta amfani da ainihin aiwatar da sabis ko cikin ainihin akwati; yana bincika sabbin hanyoyin da aka ƙaddamar kuma baya tabbatar da cewa an maye gurbin tsohon ma’aikacin. Node na iya ƙara facin zuwa ginannen Brotli yayin da yake riƙe da asalin sigar ɗakin karatu. Don haka, kar a dogara kawai ga process.versions.brotli don sanin ko an gyara shi. Ya kamata ku haɗa shi da sigar tsaro ta Node ko shaidar bayan dillali. Saukewa: S2 S4 Saukewa:

Ana amfani da npm ls don ganin ainihin itacen dogaro; ɓatattun fakitin ko rikice-rikice na tsara na iya haifar da lambobin fita marasa sifili, don haka ya kamata ku karanta takamaiman fitarwa. Ana amfani da npm audit azaman taimakon duba abin dogaro kuma ba zai iya maye gurbin Node binary da duba ɗakin karatu na asali ba. Saukewa:

Yi amfani da mise don sarrafa yanayin Node 24, wanda za’a iya sabuntawa kamar haka: Saukewa:

mise use -g [email protected]
mise exec [email protected] -- node -p 'process.version + " " + process.execPath'

mise use -g yana daidaita sigar duniya; Har yanzu ana buƙatar duba tsarin aikin gida daban. Idan sabis ɗin ya gyara tsohuwar cikakkiyar hanya, hoton gindin kwantena, ko muhallin wani asusu na daban, dole ne a sabunta tsarin da ya dace kuma dole ne a sake kunna sabis ɗin. Umurnin da kansa baya maye gurbin tsohon tsari mai gudana. Saukewa: S43 Saukewa:

A cikin aikin Next, aiwatar da umarnin da ya dace bisa ga reshen da aka zaɓa. Don Next 15: Saukewa:

# Next 15 分支
npm install --save-exact [email protected]

Don Next 16: Saukewa:

# Next 16 分支
npm install --save-exact [email protected]

Bincika abubuwan dogaro masu jituwa na React/RSC, kulle fayiloli da misali mai kaifi na ƙarshe, sannan gina bisa ga tsarin aikin. Yi amfani da fayil ɗin kulle da aka sabunta a cikin CI don shigarwa mai sakewa, kuma duba sigar a cikin hoton da ke gudana bayan gini. Kar a yi amfani da gyara atomatik mara sarrafawa a cikin manyan juzu’i azaman tsohuwar mafita don wannan gaggawar. Saukewa:

6.3 Java: Tabbatar da mawallafi, ainihin JVM da abubuwan da aka haɗa Saukewa:

Ƙididdigar farko: Saukewa:

java -XshowSettings:properties -version

java.home, java.runtime.version da mai bugawa a cikin fitarwa yakamata su daidaita tare da ainihin JVM da sabis ɗin ke amfani dashi. Don JVM tare da haɗe-haɗe izini, jcmd na JDK za a iya amfani da su duba manufa tsari, ba kawai shiga harsashi. Saukewa:

Bincika dogaro a cikin amintattun ayyuka kuma zaɓi bisa ainihin kayan aikin gini: Saukewa:

./mvnw dependency:tree '-Dincludes=org.apache.tomcat.embed:*,org.springframework.security:*,org.springframework.graphql:*'

./gradlew dependencyInsight --dependency tomcat-embed-core --configuration runtimeClasspath
./gradlew dependencyInsight --dependency spring-security-core --configuration runtimeClasspath
./gradlew dependencyInsight --dependency spring-graphql --configuration runtimeClasspath

Waɗannan umarnin ginawa na iya aiwatar da plug-ins da warware abubuwan dogaro akan layi, kuma kawai suna gudana akan amintattun ayyuka. Bincika JAR/WAR na ƙarshe ko ainihin JAR a cikin hoton kuma kar a musanya sanarwar ginin fayil don kayan tarihi na ƙarshe. Spring Boot saka Tomcat yana buƙatar sake gina aikace-aikacen; sabunta wani daban Tomcat shigarwa a cikin tsarin ba zai canza kwafin a cikin kunshin aikace-aikacen ba. Saukewa:

Bayan an sabunta lokacin aiki, duba javax.net.ssl.trustStore na musamman, KeyStore mai ɗaukar nauyin aikace-aikacen, lokacin aikin jlink, GraalVM/hoton ɗan ƙasa da sauran sifofin isarwa abu da abu. Aikace-aikacen da suka riga sun keɓanta kayan amana ba za su iya ƙare rajistan kawai saboda kundin adireshin JDK ya zama sababbi. Saukewa:

6.4 Python: Mai fassara-da-fassarawa da sarrafa mahallin kama-da-wane Saukewa:

A cikin ainihin venv/kwantena da aka tabbatar za a amince da su: Saukewa:

python - <<'PY'
import sys
import ssl
import importlib.metadata as metadata

print("executable:", sys.executable)
print("version:", sys.version)
print("openssl:", ssl.OPENSSL_VERSION)
print("verify_paths:", ssl.get_default_verify_paths())
for name in ("pip", "certifi", "Django", "urllib3", "Brotli", "litellm"):
    try:
        print(name + ":", metadata.version(name))
    except metadata.PackageNotFoundError:
        print(name + ": not installed")
PY

python -m pip --version
python -m pip check

Wannan rubutun yana tattara bayanai kawai kuma baya yin ƙayyadaddun cancantar sigar. ssl.get_default_verify_paths() shine tsohuwar bayanin hanyar kuma ba zai iya tabbatar da cewa duk abokan ciniki na ɓangare na uku suna amfani da kantin amintattu iri ɗaya ba; ya kamata a tabbatar da shi bisa tsarin tsarin aikace-aikacen. Saukewa:

Bayan kammala amintaccen haɓakar taya pip na appendix S37, sabunta abubuwan dogaro da takaddun shaida bisa ga iyakokin aikin, misali: Saukewa:

python -m pip install --upgrade 'certifi>=2026.10.19'

# 仅适用于当前就选择 Django 5.2 的项目
python -m pip install --upgrade 'Django>=5.2.18,<5.3'

python -m pip check

Ana buƙatar sabunta buƙatun / fayil ɗin kulle aikin a lokaci guda, in ba haka ba za a iya komawa tsohuwar sigar. Lokacin amfani da uv, Waƙa, ko ma’ajiyar fakitin kasuwanci, yi amfani da tsarin kulle-kulle da bugu na yanzu; kar a canza fakiti da hannu kawai a cikin kwandon samarwa.

Za a iya amfani da kwararar ayyukan pip-audit na aikin don bincika sanannen raunin dogaro a cikin amintaccen muhalli; ba na’urar daukar hotan takardu ba ce kuma baya rufe duk mai fassara, ɗakin karatu na tsarin da haɗarin kantin dogara. Saukewa: S44 Saukewa:

Ba a ba da shawarar tilasta tsarin /usr/bin/python3 don nuna sabon sigar da aka haɗa ba. Yi amfani da sabuntawar tsaro na saki ko lokacin keɓewar aikin don guje wa karya kayan aikin gudanarwa waɗanda suka dogara da tsarin Python. Wannan zaɓin aiwatarwa ne kuma ba ƙarin buƙatun gyara ba don wannan raunin. Saukewa:

6.5 Sake ginawa da maye gurbin misali mai gudana Saukewa:

Ana ba da shawarar cewa a ɗauki waɗannan matakan a matsayin cikakkiyar canji: Saukewa:

Sami facin daga asalin amintaccen tushen kuma adana sigar/hash da kulle abin dogaro. Saukewa:
Mayar da ayyuka masu mahimmanci a cikin yanayin samarwa na kusa kuma tabbatar da cewa haɓakawa na asali sun dace da JVM/tsari. Saukewa:
Sabunta lokacin aiki, abubuwan dogaro da aikace-aikacen da ainihin kantin dogara; sabunta hoton tushe da tsarin CA don akwati, kar a sake amfani da tsohon Layer kawai. Saukewa:
Sake gina aikace-aikace da hotuna, da maye gurbin sabis, ma’aikaci, mabukaci da jerin gwano, da al’amuran ɗawainiya da aka tsara akai-akai. Saukewa:
Sake duba sigar da daidaitawa a cikin sabon misali mai gudana kuma tabbatar da cewa duk tsoffin kwafin sun fita. Saukewa:
Kula da rates kuskure, latency, CPU/memories, TLS gazawar musafiha, da aiwatar da hadarurruka. Saukewa:

Rollback ya kamata ya ba da fifiko ga riƙe amintaccen lokacin gudu da faci, da jujjuya tsarin aikace-aikacen baya ko canje-canjen kasuwanci. Idan dole ne ku koma tsohon samfur tare da lahani, yakamata a dawo da iyakokin shigarwa masu dacewa a lokaci guda, kuma mai alhakin da mafi ƙarancin lokacin dawowa ya kamata a bayyana a sarari. Saukewa:

7. Zaɓin Ragewa na ɗan lokaci da Faci Saukewa:

7.1 Maɗaukakin iyaka na matakan wucin gadi Saukewa:

Masu zuwa shawarwarin aiwatarwa ne dangane da sanar da yanayin amfani. Sai dai idan an lura da shirin na hukuma, mai siyar baya bada garantin cewa duk bambance-bambancen za a iya toshe gaba ɗaya. Saukewa:

kasada Saukewa:	Matakan wucin gadi da za a iya ɗauka Saukewa:	Bangaren da ba za a iya ɗauka an kammala shi bisa wannan ba Saukewa:
Saukewa: Brotli Saukewa:	Dakatar da ƙaddamar da shigar da ba amintacce ba; duba mai shigowa da fita ta atomatik decompression Saukewa:	Mai shigowa WAF ko kashe matsawar martani baya rufe duk shigarwar yankewa S3 Saukewa:
Next.js typed arrays RCE	Haɓaka kai tsaye; keɓe ayyukan da abin ya shafa na ɗan lokaci idan ya cancanta Saukewa:	Babu wani aiki na abin dogaro na duniya na S9 Saukewa:
Next.js SVG RCE	Tsarin hukuma: Tabbatar da ainihin kaifi ≥0.35.5; dakatar da wuraren shigarwa masu dacewa lokacin da kasuwanci ya ba da izini Saukewa:	Ba ya rufe wasu batutuwan Next/RSC S11 Saukewa:
Tomcat Masarautar / HTTP/2 / AJP Saukewa:	Ware hanyar da ta dace kuma ku rufe masu haɗin da ba dole ba Saukewa:	Har yanzu kuna buƙatar fakitin gyaran reshe daidai S21 S22 S23 Saukewa:
Saukewa: GraphQL Saukewa:	Dakatar da filayen Haɗin da abin ya shafa; hana masu kira mara amana Saukewa:	Iyakar tsayin buƙatar kawai ba zai iya gyara nau’in / matsalar lalata S25 Saukewa:
Spring embedded LDAP	Kashe lokacin da ba a buƙata ba; iyakance isa ga ainihin tashar tashar sauraro Saukewa:	Tsohuwar shaidar gudanarwa da amincin kundin adireshi har yanzu ana buƙatar bincika S27 Saukewa:
CPython SNI UAF	Tsarin hukuma: Kiyaye madaidaicin SSLContext mai ƙarfi har zuwa ƙarshen sabis ɗin Saukewa:	Duk hanyoyin ƙirƙira/canzawa dole ne a rufe su S29 Saukewa:
Python tsallake sunan masauki Saukewa:	Magani na hukuma: Wuce sunan uwar garken da ake tsammani daidai	Ba za a iya bincika tutar check_hostname kawai ko yin watsi da gargaɗin S30 S31 Saukewa:
Kwalta mara amana Saukewa:	Kashe/keɓe cirewa, ƙin hanyoyin da ba su da mahimmanci da shigarwar na’ura Saukewa:	Babu masu tacewa ko ƙayyadaddun kayan aiki sune akwatunan yashi na duniya S32 S40 S45 Saukewa:
Taron amincewa da takaddun shaida Saukewa:	Sabunta madaidaicin CA abu; Za a iya iyakance amana Java bisa ga ragewar hukuma Saukewa:	Kashe tabbacin TLS yana ƙara haɗari S19 S37 Saukewa:

7.2 Zaɓi facin bisa hanyar isarwa Saukewa:

Hanyar bayarwa Saukewa:	Ba da fifikon hanyoyin gyarawa Saukewa:	Shaidar da yakamata a riƙe Saukewa:
Lokacin gudu-gudu da aka sarrafa Saukewa:	Daidaita sabunta tsaro na masana’anta Saukewa:	Cikakken sigar fakitin, sanarwa, tushen ma’ajiya Saukewa:
Babban Manajan Binary/Runtime Saukewa:	An saki jami’an tsaro daga reshe daya Saukewa:	Siga, tushe da narkewa, ainihin hanyar aiwatarwa Saukewa:
Node / CPython Saukewa:	Sakin tushen reshen da ya dace da hukuma ko kuma cikakken saitin facin mai siyarwa Saukewa:	Aikata saiti, gina sigogi, dakunan karatu masu dogaro da sakamakon koma baya Saukewa:
Spring / Next / Django	Mai jituwa tare da sabuntawa a cikin reshe, sake gina maƙallan dogaro da aikace-aikace na ƙarshe Saukewa:	Bishiyar dogaro ta ƙarshe, ainihin sigar a cikin JAR/kunshi/hoto Saukewa:
Shagon amincewa na al’ada Saukewa:	Shirin janyewa na hukuma ko sabunta mai siyarwa yana tabbatar da janyewar Saukewa:	Haƙiƙanin hanyar amfani, canjin abu, nasarar TLS da gwajin ƙi Saukewa:
Muhalli mai rikitarwa Saukewa:	Sake ginawa daga samfura masu tsabta da aminci da gudanar da bincike daban-daban Saukewa:	Kunshin tarihi/narkewar hoto, rikodin shigarwa, rikodin jujjuyawar shaida Saukewa:

7.3 Maɓallin facin maɓalli da mayar da hankali kan bita Saukewa:

Brotli: yana mai da hankali kan ko bincika kan iyaka da dawo da kuskuren matsayin ƙaddamarwa na asali ya cika kafin shigar da ginin; kawai maye gurbin kunshin JavaScript ba zai iya canza lambar da aka haɗa ta a tsaye zuwa Node. Saukewa: S4 Saukewa:
Node DNS / TLS : yana mai da hankali kan kin shigar da bayanai, daidaita adireshi, banbance tsakanin IP SAN da DNS gane, da DNS Kira baya/Alkawari Hanyar tantancewa da TLS gwajin wasan sunan masauki. S5 S6
Tomcat JNDIRealm: yana mai da hankali kan ko tsarin tantancewa yana tabbatar da takaddun shaida, maimakon kawai samun mahallin adireshi; fifita sigar hukuma kuma ba a kula da madadin fayil guda ɗaya azaman cikakken facin binary. Saukewa: S24 Saukewa:
CPython ssl: yana mai da hankali kan ikon mallakar Python da kuma yanayin rayuwa na tushen SSLContext; wrap_bio() baya baya yayin samun bambance-bambancen dacewa reshe, kuma dole ne ku karanta ainihin aiwatar da reshen da aka yi amfani da shi. Saukewa: S31 S47 Saukewa:
Certificate rashin amana: Irin waɗannan sabuntawa na iya bayyana azaman amintaccen abu ko ƙin sauye-sauyen jeri maimakon fayyace canje-canjen API. Wannan rukunin na Node kuma ya haɗa da tsarin kin amincewa da matsakaicin CA da abin ya shafa; Har yanzu ana buƙatar tabbatar da tushen amintattun hanyoyin Java da Python daban. S19 S37 S46

Mai zaman kansa Brotli ya kamata kuma a duba daurin. An saki Google upstream 1.0.10 / 1.1.1 / 1.2.1 a rana guda don gyarawa CVE-2026-111497 . Python kari na asali ko kayan tarihi na JNI waɗanda suka haɗa aiwatar da aikin C iri ɗaya da abin ya shafa suna buƙatar sabuntawa/sake gina kansu; ba za a iya gane cewa duk mai tsarki ne Java decoders sun shafi, kuma ba za a iya ɗauka cewa haɓakawa ba Node ta atomatik maye gurbin kwafi a cikin wasu harsuna. S42

8. Tabbatarwa da bin diddigi Saukewa:

8.1 mafi ƙarancin tantancewa Saukewa:

Duba abubuwa Saukewa:	Ana buƙatar shaida Saukewa:
lokacin gudu Saukewa:	Cikakkun siga ko shaida na baya na mai siyarwa daidai a cikin tsari/kwantena na gaske Saukewa:
abin dogara aikace-aikace Saukewa:	Next/RSC/kaifi, Tomcat/Spring, da Django/certifi a cikin samfuran ƙaddamarwa na ƙarshe sun kai daidai ƙofa. Saukewa:
Kewayon sauyawa Saukewa:	Duk ma’aikaci/JVM/kwafin kwantena da ayyuka na baya an maye gurbinsu da sababbi, kuma tsoffin al’amuran sun fita. Saukewa:
TLS	Takaddun shaida na yanki sun yi nasara; sunayen da ba su dace ba da kuma sarƙoƙin da ba su dace ba sun gaza bisa manufa; an haɗa shagunan amintattu na al’ada Saukewa:
eMudhra rashin amana Saukewa:	Sarkar takardar shedar da matsakaicin CA ya shafa an ƙi shi a lokacin ainihin lokacin aiki, ko kuma akwai shaidar cewa takamaiman ginin tsaro na mai siyarwa an tura shi; Ba za a iya rufe shari’ar ba dangane da gwajin TLS na gabaɗaya ko lambar gajeriyar sigar Java 8. Saukewa:
Node yanke hukunci da hotuna Saukewa:	Amsa matsa lamba na yau da kullun, aikawa, haɓaka hoto da ayyukan RSC suna samuwa; manufofin tushen rashin amana yana aiki Saukewa:
Java Tabbatarwa da Warewa Saukewa:	An ƙi kalmar sirri mara kuskure; mai amfani mai zaman kansa buƙatun asynchronous lokaci guda ba tare da haɗawa da ainihi/amsa ba; LDAP sauraro kamar yadda aka zata Saukewa:
Python SNI Saukewa:	Sunan yanki mai yawa na al’ada TLS kasuwancin yana da ƙarfi; adanawa yana ƙin bin hanyar da aka hana shi, kuma fayilolin da ke wajen littafin ba a canza su ba Saukewa:
Bayanai da koma bayan aiki Saukewa:	Rubutun rubutu, tambayar sarari, bincika izini da ayyukan baya sun wuce gwajin da ake yi na aikin Saukewa:
Albarkatu da Dubawa Saukewa:	Babu karuwa mara kyau a cikin CPU, ƙwaƙwalwar ajiya, ƙimar kuskure, latency da kurakurai TLS. Saukewa:
Abun iya ganowa Saukewa:	Ajiye lokacin haɓakawa, kunshin/narkewar hoto, sauye-sauyen tsari, sakamakon tabbatarwa da abubuwan da ba a warware ba Saukewa:

Waɗannan shawarwarin yarda ne na aiwatarwa kuma baya buƙatar samar da rubutun hari don kowane CVE. Tabbatar da hadarurruka, gajiyar albarkatu, da adana bayanan da ba a iya amfani da su ba yakamata a yi amfani da gwajin juzu’i ko bayanan gwajin sarrafa aikin a keɓe wuri. Saukewa:

8.2 Faci da binciken kutsawa ayyuka daban-daban Saukewa:

Bincika rajistan ayyukan da ake da su don kurakurai na yanke hukunci, ma’aikaci/JVM ya yi karo, rubutattun fayil ɗin da ake tuhuma, canje-canjen bayanan adireshi, keɓancewar tantancewa, buƙatun waje, da kuma bayanan amfani na sahihanci. Wadannan alamun suna buƙatar yin hukunci a cikin mahallin: haɗari ko OOM ba hujja ba ne na cin nasara; rashin faɗakarwa baya tabbatar da cewa tsarin bai shafi ba. Saukewa:

Lokacin da aka gano gyare-gyare mara izini, ƙayyadaddun takaddun shaida, ko tabbatar da abubuwan dogaro da ƙeta, ya kamata a adana shaida, a ware abubuwan da suka dace, takaddun shaidar da abin ya shafa ya juya daga wani amintaccen muhalli, sannan a sake gina tsarin. Facin ba zai soke alamun da maharin ya samu ba ko dawo da bayanan da aka gyara. Saukewa:

9. Matsalar tsaro ta sarkar kaya: daidaitawa LiteLLM 1.107.0

**Kwanan tabbacin hukuma: 2026-10-21.**LiteLLM ya ruwaito cewa an lalata bututun fitar da shi. PyPI’s litellm==1.107.0 da wasu samfuran Docker/GHCR na lokaci guda sun ƙunshi sata na sirri da lambar ɓoyayyiyar nesa, kuma an cire samfuran da ke da alaƙa. Saukewa: S41 Saukewa:

Don ƙayyade tasirin, ya kamata ku duba bayanan shigarwa na tarihi da narkar da hoto; Alamomi irin su latest, main-latest, da main-stable yanzu suna nuna hotuna masu tsabta, wanda ba ya tabbatar da cewa samfuran da aka ja a lokacin abin da ya faru sun kasance masu tsabta. Shawarar hukuma a wancan lokacin ita ce a ɗan ɗan lokaci a saka 1.106.2; wannan shawarar ta dogara ne akan wannan lamarin, kuma har yanzu ana buƙatar bincika sauran sanarwar tsaro yayin turawa. Saukewa: S41 Saukewa:

Don wuraren da aka shigar ko gudanar da samfuran masu alaƙa: Saukewa:

Ware da adana bayanan shigarwa, hotuna, da rajistan ayyukan, da duba su daga wuri mai tsabta. Saukewa:
Kada a fara Python/pip a cikin yanayi mai cike da tuhuma tukuna; Za a iya sake aiwatar da .pth/sitecustomize.py mai cutarwa bayan farawa. Saukewa:
Sake gina runduna, venvs/kwantena daga amintattun tushe; ba zai iya cirewa ko rage fakitin kawai ba. Saukewa:
Murke/juya bayanan gajimare, maɓallan masu bada LLM, maɓallan LiteLLM da bayanan bayanan bayanan da suka dogara da ainihin dama da kuma sake duba rashin amfani. Saukewa: S41 Saukewa:

Wannan lamari ne da aka tabbatar da sarkar samar da kayayyaki kuma yana buƙatar la’akari da aiwatar da mugunyar lambar, ɓarnar shaida, da hatsarin dagewa yayin mu’amala da shi. Tun daga ranar 23 ga Oktoba, 2026, jami’ai na ci gaba da binciken kutsen na farko. Saukewa:

Karin bayani: Abubuwan da aka kawo da kuma hanyoyin haɗin gwiwa Saukewa:

Kwanan tabbatar da tushe mai zuwa shine 2026-10-23, gami da sanarwar tsaro na aikin, ma’ajiyar lambar hukuma da umarnin mai siyarwa. Babban rubutun [Sx] yayi daidai da wannan kari; lokacin yin sabuntawa, ya kamata ku bincika ko mai siyarwa ya fitar da bita-da-kullin na gaba. Saukewa:

S1 - Node.js: Sanarwa ta Tsaro 2026-10-21 Saukewa:

Manufar: Lokacin gudu huɗu High, yana shafar rassan, sakin tsaro na Oktoba. Saukewa:
Madogara: Official Security Bulletin Saukewa:

S2 - Node.js: umarnin sakin hukuma don layin kulawa guda uku Saukewa:

Manufar: Bincika 22.23.4, 24.22.1, 26.12.1 da ainihin facin da aka haɗa. Saukewa:
Madogara: Node.js 22.23.4 Saukewa:
Madogara: Node.js 24.22.1 Saukewa:
Madogara: Node.js 26.12.1 Saukewa:

S3 — Vercel: Node.js Brotli RCE shawarwarin tsaro Saukewa:

Manufa: Sharuɗɗan ƙaddamarwa mai shigowa/mai fita, iyakar ɗaukar hoto WAF, matsayi Node 20. Saukewa:
Madogara: Node.js security advisory: Brotli decoder RCE Saukewa:

S4 - Node.js: Brotli ƙaddamar da facin hukuma Saukewa:

Manufa: Tushen aiwatarwa don bincikar yanke hukunci na asali da yada kuskure. Saukewa:
Madogara: Brotli Patch commit 49dff6f57a Saukewa:

S5 — Node.js: TLS adireshi daidaita facin Saukewa:

Manufa: Tabbacin shaidar shaidar cikakken lambobi da marasa daidaitattun IP. Saukewa:
Madogara: IP normalization regression Patch Saukewa:
Madogara: rejects the patching of non-standard IP address Saukewa:

S6 - Node.js: facin tabbatarwa DNS NUL Saukewa:

Maƙasudi: Ƙin shigarwar da ɗaukar hoto. Saukewa:
Madogara: dns.resolve Input verification patch Saukewa:

S7 - Node.js: 2026-07-29 Sanarwa Tsaro Saukewa:

Manufa: HTTP/2 gajiyar ƙwaƙwalwar ajiya, UAF da raunin ƙirar ƙira. Saukewa:
Madogara: July 2026 Security Releases Saukewa:

S8 - Next.js: 2026-10-14 sabunta tsaro Saukewa:

Manufa: Haɓaka tushen haɓakawa da haɗari guda uku. Saukewa:
Madogara: Next.js Security Update for Upstream Vulnerabilities

Madogara: S9 — Next.js：typed arrays / use cache RCE

Manufar: GHSA-673q-mjm6-r5xr; yana rinjayar tazara, yanayi, maki da matsayi. Saukewa:
Madogara: Next.js Official Security Bulletin Saukewa:

Madogara: S10 — React：React Server Components RCE

Manufar: GHSA-xqc2-xf4c-x3h3; abin da abin ya shafa da tsayayyen nau’ikan fakitin RSC guda uku. Saukewa:
Madogara: React Official Security Bulletin Saukewa:

Madogara: S11 — Next.js：SVG Image Optimization RCE

Manufar: CVE-2026-96889 / GHSA-2464-fhr4-w9xw; glibc, kaifi da iyakoki na asali. Saukewa:
Madogara: SVG Image Optimization Official Security Bulletin Saukewa:

Madogara: S12 — Next.js：Server Actions DoS

Manufar: GHSA-p3m5-59mp-jv5r; yana rinjayar yanayi, sigogi da ƙididdiga. Saukewa:
Madogara: Server Actions DoS Official Security Bulletin Saukewa:

S13 — Next.js: AVIF inganta hoto RCE Saukewa:

Manufar: 2026-08-25, GHSA-2xp9-vwfh-vxw4. Saukewa:
Madogara: AVIF Official Security Bulletin Saukewa:

Madogara: S14 — Next.js：Windows RCE

Manufar: 2026-08-25, CVE-2026-75604/GHSA-p293-qw3h-jr36. Saukewa:
Madogara: Windows RCE Official Security Bulletin Saukewa:

Madogara: S15 — Next.js：next/og ImageResponse RCE

Manufar: 2026-09-22, GHSA-vcvr-r3jv-pc5j; Bambanci tsakanin Node da Edge. Saukewa:
Madogara: ImageResponse Official Security Bulletin Saukewa:
Madogara: September 22 release notes Saukewa:

Madogara: S16 — Oracle: October 2026 CPU

Manufa: Java SE hadarin matrix, faci yawa da kuma dacewa yanayi. Saukewa:
Madogara: Oracle Critical Patch Update – October 2026 Saukewa:
Madogara: Oracle Java SE CPU Version list Saukewa:

S17 — Oracle: CVE-2026-91403 ƙararrawa mara waya Saukewa:

Manufa: 2026-10-21, JSSE takardar shaidar dogara hadarin, shafi kayayyakin da CVSS 3.1 9.1. Saukewa:
Madogara: Oracle Security Alert Saukewa:

S18 — Oracle: JDK sigar hukuma da zazzagewa Saukewa:

Manufa: Bambance tsakanin CPU akan Oktoba 20th da kuma sigar da ba ta da iyaka a ranar 21 ga Oktoba; bambanta iyakoki na gajeren sigar Java 8. Saukewa:
Madogara: JDK release list Saukewa:
Madogara: Oracle Java Download page Saukewa:

S19 — Oracle: eMudhra shirin janyewar wucin gadi Saukewa:

Manufar: An sabunta 2026-10-22; biyu tushen takaddun shaida, keytool, al’ada truststore, da sokewa dubawa. Saukewa:
Madogara: Distrusting eMudhra Intermediate Certificates in Oracle JDK Saukewa:

S20 — Eclipse Adoptium: Saki rikodin ginawa Saukewa:

Maƙasudi: Temurin an sake yin fakiti saboda abin da ya faru na takardar shaidar; Ba za a iya amfani da suffix ɗin sigar Oracle da injina ba. Saukewa:
Madogara: Adoptium Release Scorecards Saukewa:

S21-Apache Tomcat 9 Sanarwa Tsaro Saukewa:

Manufa: Matsakaicin tazarar da abin ya shafa reshe 9 tare da gyara 9.0.123. Saukewa:
Madogara: Tomcat 9 vulnerabilities Saukewa:

S22-Apache Tomcat 10 Sanarwa Tsaro Saukewa:

Manufar: 10.1 daidaitaccen tazara na reshe da gyara 10.1.61; 10.0 EOL. Saukewa:
Madogara: Tomcat 10 vulnerabilities Saukewa:

S23-Apache Tomcat 11 Sanarwa Tsaro Saukewa:

Manufa: Abubuwa uku Important, 11.0.27, AJP iyakacin aiki da ranar bayyanawa/saki. Saukewa:
Madogara: Tomcat 11 vulnerabilities Saukewa:

S24 — Apache Tomcat: facin facin JNDIRealm Saukewa:

Manufa: Babban tushe don gyara gibin tabbatar da takaddun shaida. Saukewa:
Madogara: JNDIRealm Patch commit Saukewa:

Madogara: S25 — Spring：GraphQL CVE-2026-59285

Manufa: 2026-08-20, Ana Bukata, 2.0.5 OSS / 2.0.4.1 Gyaran Kasuwanci. Saukewa:
Madogara: Spring for GraphQL Unsafe Deserialization Saukewa:

Madogara: S26 — Spring：GraphQL CVE-2026-41699

Manufa: Ƙofar gyarawa a baya, don kawai bayyana dalilin da yasa ba za ku iya zama a tsohon tushen ba. Saukewa:
Madogara: 6 Month GraphQL Security Bulletin Saukewa:

Madogara: S27 — Spring Security：CVE-2026-59270

Manufa: Saka UnboundID LDAP, sanannen gudanarwa da kuma bambanta OSS/ sigar kasuwanci. Saukewa:
Madogara: Spring embedded LDAP Security Bulletin Saukewa:

Madogara: S28 — Spring Security：CVE-2026-47841

Manufa: WebAuthn mai amfani tabbacin, serialization zaman da kuma harin wuri. Saukewa:
Madogara: WebAuthn Security Bulletin Saukewa:

S29 — PSF: CVE-2026-19445 Shawarar Tsaro Mai Zaman Kanta Saukewa:

Manufar: 2026-09-30, Critical, SNI Yanayi da matakan wucin gadi da aka ambata ta SSLContext. Saukewa:
Madogara: SSLContext UAF Official announcement Saukewa:

S30 — PSF: CVE-2026-19553 Shawarar Tsaro Mai Zaman Kanta Saukewa:

Manufa: 2026-09-30, High, rasa sunan mai masauki da taƙaitaccen siga. Saukewa:
Madogara: wrap_bio Official announcement of hostname verification

S31 - CPython: wrap_bio official patch da 3.12 baya Saukewa:

Manufa: 3.10—3.12 manufar dacewa da faɗakarwa, bambanci tsakanin None da kirtani mara komai. Saukewa:
Madogara: Main Patch PR #158503 Saukewa:
Madogara: 3.12 Backfill PR #158513 Saukewa:
Madogara: 3.15 Backfill PR #158511 Saukewa:

S32 — PSF: CVE-2026-82049 Shawarar Tsaro Mai Zaman Kanta Saukewa:

Manufa: 2026-09-14, High, haɗin haɗin gwiwa, gyare-gyaren metadata da bayyanar abun ciki. Saukewa:
Madogara: tarfile link bypasses the official announcement Saukewa:

S33 — CPython: Sakin tsaro na hukuma a ƙarshen Satumba/farkon Oktoba Saukewa:

Manufa: Mafi ƙarancin sigar gyara, hanyar rarraba lambar tushe da keɓancewar 3.14 don takamaiman batutuwan tarfi. Saukewa:
Madogara: Python Cross-branch security release instructions Saukewa:
Madogara: Python 3.11.17 Saukewa:
Madogara: Python 3.12.15 Saukewa:
Madogara: Python 3.13.16 Saukewa:
Madogara: Python 3.14.8 Saukewa:

S34 — CPython: 3.10 amintaccen saki na ƙarshe Saukewa:

Manufar: 3.10.22 da ƙarshen zagayowar rayuwa. Saukewa:
Madogara: Python 3.10.22 Saukewa:

S35 - CPython: 2026-10-21 sigar kula da gaggawa Saukewa:

Manufar: 3.13.17 / 3.14.9 / 3.15.1, ginanniyar pip da certifi sabuntawa, abubuwan buƙatun venv na yanzu. Saukewa:
Madogara: Python 3.13.17 Saukewa:
Madogara: Python 3.14.9 Saukewa:
Madogara: Python 3.15.1 Saukewa:

S36 — certifi: emSign takardar shaidar rashin amana sanarwa Saukewa:

Manufar: 2026-10-20, GHSA-6q48-6c7w-9gw2, Critical, ba a sani ba CVE. Saukewa:
Madogara: certifi Official Security Bulletin Saukewa:

S37 — PSF: Tasirin eMudhra / emSign akan masu amfani da Python Saukewa:

Manufa: Shawarar certifi .19, pip/uv tushe, amintaccen umarnin haɓakawa na taya tare da SHA-256. Saukewa:
Madogara: PSF Official event and upgrade instructions Saukewa:

Umurnin haɓakawa na taya pip da aka bayar ta hanyar umarnin hukuma da aka ambata ta S37 shine kamar haka. Yi amfani da shi kawai a cikin Python mahallin da aka tabbatar da aminci; idan akwai zargin guba a Sashe na 9, da farko ware kuma a sake ginawa bisa ga tsarin abin da ya faru. Yana gyara zantan abun cikin dabaran kuma daga baya yana sabunta wasu abubuwan dogaro bisa ga tsarin aikin. Saukewa:

python -m pip install "pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70"

S38 - Django: 2026-08-04 amintaccen saki Saukewa:

Amfani: CVE-2026-15307, GeoDjango Yanayin amfani, gyare-gyaren farko da canje-canje masu dacewa. Saukewa:
Madogara: Django 6.0.8 / 5.2.17 Saukewa:

S39 - Django: 2026-10-06 amintaccen saki Saukewa:

Manufa: CVE-2026-87890, lissafi na DoS na gaba na ƙarfafawa tare da tushen da aka zaɓa a halin yanzu. Saukewa:
Madogara: Django 6.1.2 / 6.0.9 / 5.2.18 Saukewa:

S40 — PSF / CPython: Bayanin gefen tar_filter na ƙarshe Saukewa:

Manufar: 2026-10-22, CVE-2026-114583 (Medium); Haɗin PR baya nufin an fito da sigar kulawa ta hukuma. Saukewa:
Madogara: PSF Independent Announcement Saukewa:
Madogara: CPython Patch PR #160098 Saukewa:

S41 — LiteLLM: Rahotan Abubuwan Da Ya faru na Sarkar Kaya, Oktoba 21 Saukewa:

Manufa: 1.107.0 gurɓataccen samfur, narkewar tarihi, sake gina keɓewa da zubar da shaidar. Saukewa:
Madogara: Contained: LiteLLM v1.107.0 Compromised Saukewa:

S42 - Google Brotli: ingantaccen sigar hukuma Saukewa:

Manufa: Brotli 1.0.10 / 1.1.1 / 1.2.1 mai zaman kanta da tushen tabbatar da kwafin harshe na giciye. Saukewa:
Madogara: Brotli releases Saukewa:

S43 — mise: yi amfani da takaddun hukuma Saukewa:

Manufa: Ƙayyade sigar kayan aiki da fassarar umarni na daidaitawar duniya. Saukewa:
Madogara: mise use Saukewa:

S44 - PyPA: pip-aikin aikin tantancewa Saukewa:

Manufa: Python Manufar da iyakan iyakoki na tantance raunin abin dogaro.
Madogara: pip-audit Saukewa:

S45 - Python: daftarin tace tarfile Saukewa:

Manufa: dabarun bayanai, canje-canjen ɗabi’a na asali, da ƙuntatawa waɗanda ba za su iya maye gurbin sandbox ba. Saukewa:
Madogara: tarfile extraction filters Saukewa:

S46 — Node.js: Tsarin kin amincewa da Matsakaicin CA Saukewa:

Manufa: Wannan eMudhra mai alaƙa da sarrafa sarkar amana ba ta yi daidai da ɓarna bayanan sirri na duk takaddun takaddun tushe. Saukewa:
Madogara: Node.js PR #66871 Saukewa:

S47 — CPython: SNI UAF bayanan fasaha da gyarawa Saukewa:

Manufa: tunani sake zagayowar rayuwa, na musamman gini yanayi da reshe ja da baya. Saukewa:
Madogara: official issue #156293 Saukewa:
Madogara: official patch PR #158504 Saukewa:
Madogara: 3.15 Backfill PR #158514 Saukewa: