Sources ndị enyochara ruo Ọktoba 23, 2026 (UTC) Oge mkpuchi : Julaị 25-October 23, 2026, na-elekwasị anya na ọkwa ọhụrụ na patches sochirinụ site na Septemba ruo Ọktọba. Ndị na-ege ntị: ndị injinia na ndị na-aza nche na-echekwa Node.js, Java, Python ọrụ, arịa, wuo pipeline na gburugburu mmepe.
Edemede a na-achịkọta ihe egwu nchekwa dị mkpa na nso nso a na Node.js, Java, na Python runtimes, ọba akwụkwọ ọkọlọtọ, na usoro ihe nkesa na-adabere na ya, ma na-enye oke mmetụta, ụdị edoziri, usoro mbelata nwa oge, nhọrọ patch, na ụzọ nkwenye.
Nyochaa mmetụta megide ụdị akụrụngwa, atụmatụ enyere na ebe ntinye ịnweta. Eziokwu adịghị ike sitere na ndụmọdụ gọọmentị; ụbọchị na-ezo aka na mkpughe ọhaneze belụsọ na ewepụtara ntọhapụ mbụ nke mbụ n’ụzọ doro anya. Anyị anaghị ewepụta ọnọdụ nrigbu na-akwadoghị, akara CVSS ma ọ bụ nrigbu n’ime ọhịa. Achọpụtara ndụmọdụ ntinye ọrụ dịka ntuziaka mmejuputa iwu.
TL;DR: ihe ndozigharị ụzọ
- Melite oge ọsọ ọsọ nke na-ebu ụzọ bute ọrụ ahụ. Melite ihe kwekọrọ Node.js alaka ka ọ dịkarịa ala 22.23.4 / 24.22.1 / 26.12.1 . Ọrụ iji Node 24 nwere ike kwalite ka 24.22.1 n’ime otu isi ụdị ma ọ bụ nke ọzọ nke nwere otu ndozi ahụ. S1 S2
- Mmelite Node dabere ngwa iche iche. Maka Next.js , eji 15.5.28 / 16.4.1 dị ka ntọala nkwalite; mgbe eji React Server Components n’onwe ya, lelee nke arụnyere n’ezie
react-server-dom-*ngwugwu. Naanị imelite ya Node ọnụọgụ abụọ anaghị ekpuchi adịghị ike ndị a. S8 S9 S10 S11 S12 - Java : kpuchie mmelite abụọ ahụ. Wụnye ụlọ onye na-ere ihe na-ekpuchi ma Ọktoba 20 CPU na October 21 CVE-2026-91403 akwụkwọ mberede-ndozi ntụkwasị obi. Lee ngalaba 2.2 maka Oracle JDK 11 -27 ụdị nke na-apụ apụ; nyochaa nkesa ndị ọzọ megide ngwungwu nchekwa nke ha yana ọnụọgụ ihe nrụpụta zuru oke. Melite ihe kwekọrọ Tomcat alaka ka 9.0.123 / 10.1.61 / 11.0.27 . S16 S17 S18 S20 S21 S22 S23
- Python : melite onye ntụgharị okwu, ngwugwu ngwa na ngwugwu akwụkwọ iche iche. Lee ngalaba 2.3 maka usoro ntụgharị okwu;
certifina-atụ aro ≥ 2026.10.19 ,pip≥ 26.2.2 , mgbe ejiuv≥ 0.13.4 . Ekwesịrị ịlele venv ọ bụla dị ugbu a. Makawrap_bio()Koodu emetụtara, nke ziri ezi na enweghị efuserver_hostnamea ga-ebufekwa n’ime. S29 S30 S31 S33 S35 S36 S37 - Ọ bụrụ na nkwalite ngwa ngwa agaghị ekwe omume, belata mkpughe na ntinye ntinye dị mkpa. buru ụzọ kwụsị ịkwụsị ngbanwe Brotli na-enweghị ntụkwasị obi, nhazi ihe oyiyi / paging / archiving, na ikewapụ nsogbu LDAP ma ọ bụ ntinye nyocha; idobe asambodo TLS na aha nnabata kwadoro. WAF inbound enweghị ike ikpuchi ụzọ ọpụpụ dị ka ngwa na-adọta nzaghachi mkpakọ ọjọọ. S3S11S25S27S30S32
- wughachi, dochie usoro ochie, ma nyochaa site na ụzọ ọrụ n’ezie. Chekwaa faịlụ mkpọchi na nchịkọta ihe oyiyi, wughachi ngwa na ihe oyiyi, wepụ ihe ngbanwe maka ndị ọrụ niile / JVM / akpa; lelee usoro n’ezie, osisi ndabere, ụlọ ahịa ntụkwasị obi na ule nlọghachi azụ azụmaahịa. Ụdị ahịrị iwu ọhụrụ naanị anaghị egosi na nrụzi ahụ ezuola.
- Ọ bụrụ na arụnyere ma ọ bụ na-agba ọsọ LiteLLM 1.107.0, soro usoro nzaghachi omume. oru ngo ahụ kwadoro nkwenye ntọhapụ na October 21. Wepụ ebe ndị emetụtara, nyochaa site na ebe dị ọcha, wughachi ma gbanwee nzere ekpughere. Amalitela Python/pip na ebe a na-enyo enyo maka ịlele mbụ. Lee Nkebi 9 maka nkọwapụta. S41
1. Nleba anya ihe ọghọm na nyocha ihe egwu
1.1 bute mmezigharị ụzọ site na mkpughe n’ezie
Ihe mbu mbugharị n’okpuru bụ ntuziaka mmejuputa iwu. Akara aha siri ike na-eso onye na-ere ahịa ọ bụla, gụnyere ọkwa Apache’s Important. CVSS 3.1 na 4.0 bụ usoro akara akara dị iche iche; Ejila naanị akara chịkọta nsogbu n’ofe ha.
| Ecosystem / oyi akwa | Isi okwu | Ọkwa gọọmentị ma ọ bụ akara enwetara | Nbukwa ụzọ |
|---|---|---|---|
| Node.js ndabere nwa afọ | CVE-2026-111497: Brotli ka edere ya site na oke, ma enwere ihe ize ndụ nke RCE | Node：High | Dekọọ Brotli data S1S3 na aru arịrịọ mpụga ma ọ bụ nzaghachi mpụga. |
| Node.js TLS / DNS | CVE-2026-105482, 105483, 106069: Ntughari na nkwenye njirimara anaghị ekwekọ. | High | URL iri ari, proxy, Webhook, ike lekwasịrị anya adreesị S1S5S6 |
| Node.js HTTP/2 | CVE-2026-56846, 56848: Ebe nchekwa ike gwụrụ na UAF | High | Node na-ejikwa HTTP/2 okporo ụzọ S7 na-atụkwasịghị obi. |
| React / Next.js | RSC / use cache typed arrays RCE | Critical；CVSS 4.0 9.5 | Ihe nkesa RSC, ihe nchekwa cache metụtara yana ụzọ data S9S10 |
| Next.js kacha mma onyonyo | CVE-2026-96889: SVG nhazi onyonyo RCE | Critical；CVSS 4.0 9.5 | Ihe atụ na glibc Linux nwere ike ijikwa onyonyo enweghị ntụkwasị obi S11 |
| Next.js Server Actions | Arịrịọ emepụtara nke ọma na-eme ka ike gwụ CPU | High；CVSS 4.0 8.2 | App Router na opekata mpe otu Server Action S12 |
| Java TLS Trust | CVE-2026-91403: Gaa n’ihu na-atụkwasị obi nke etiti emetụtara CA | CVSS 3.1 9.1 | TLS/API Scenario S17 iji yinye ntụkwasị obi emetụtara |
| Tomcat | JNDIRealm ngafe nyocha, HTTP/2 obe-arịọ arịrịọ mix-ups, AJP ntapu nzaghachi. | Important | kwekọrọ na ụzọ Realm / Connector / async Servlet S21S22S23 |
| Spring for GraphQL | CVE-2026-59285: mwepu iwepụta akwụkwọ RCE | High | Jackson 2 + Connection Ibe akwụkwọ + Ụzọ klaasị S25 |
| Spring Security | CVE-2026-59270: agbakwunyere LDAP njirimara njikwa amara ekpughere | Critical | Agbanyere LDAP na ọdụ ụgbọ mmiri na-ege ntị nwere ike ịnweta onye mwakpo S27 |
CPython ssl | CVE-2026-19445: SNI mgbanwe ọnọdụ arụpụta na UAF | Critical | Python na-akwụsị TLS n’onwe ya, wee zute ọnọdụ okirikiri ndụ gburugburu S29 |
CPython ssl | CVE-2026-19553: Mafee nkwenye mgbe aha nnabata na-efu | High | wrap_bio() / Oku asyncio metụtara na-efu efu aha nnabata S30 |
CPython tarfile | CVE-2026-82049: Njikọ siri ike na ngafe njikọ njikọ ihe atụ | High | Wepụ ebe nchekwa tar enweghị ntụkwasị obi na-akpaghị aka S32 |
| Django / GeoDjango | CVE-2026-15307: Ajụjụ gbasara ohere dee faịlụ, SSRF, n’okpuru ọnọdụ RCE | High | Ajụjụ gbasara ohere ma ọ bụ interface nchịkwa metụtara na-anabata ntinye atụkwasịghị ntụkwasị obi S38 |
| Ndabere akwụkwọ Python | certifi: enweghị ntụkwasị obi akwụkwọ metụtara emSign | Critical; GHSA, onweghi onye mara CVE | TLS onye ahịa na ngwa njikwa ngwugwu S36S37 ka na-eji CA bundle emetụtara. |
Mbibiri: RCE na-anọchi anya ogbugbu koodu ime, UAF na-anọchi anya iji ya emechaa, yana SSRF na-anọchi anya arịrịọ ụgha n’akụkụ sava. Ikikere kpọmkwem nke RCE na-abụkarị ikike nke usoro na-akwado ngwa a na-enweghị ike ịdakọtara na ikike mgbọrọgwụ.
Usoro akwadoro: na-ebu ụzọ aka RCE, nke a na-enweta site na mpụga ma na-ezute ọnọdụ, ngafe nyocha, mwepu data onye ọrụ na ihe nyocha akwụkwọ; n’otu oge ahụ, hazie mmelite maka ebe ntinye DoS na-eche ihu ọha. Ọ dịghị mkpa na-agba ọsọ mbuso agha ugwo na mmepụta iji gosi exploitability. Ndabere dị, ụzọ koodu nwere ike iru, na ọnọdụ ọgụ na-ezute. Ndị a bụ okwu atọ dị mkpa ka enyocha ya iche.
1.2 Oke atọ dị mfe mgbagwoju anya
- Kwalite oge ọsọ ọsọ yana dabere iche. Mmelite nche maka Node , JDK , CPython anaghị arụkwa ọrụ kwụ ọtọ nke Next.js , Spring , Django , certifi ma ọ bụ ihe ndọtị nke ala.
- Ọnụ ụzọ nzizi dị iche na usoro ntinye nke ugbu a. Ihe nkedo mbụ maka adịghị ike n’August anaghị ekwe nkwa ikpuchi okwu ọhụrụ site na September ruo October; Nkeji 2 na-eji mmelite na-esote ekwenyesiri ike dị ka ebumnuche mmejuputa.
- Chọpụta ihe adịghị ike site na nkwekọrịta n’ezie na-enyefe. Maka adịghị ike nkịtị, patches na-ewepụ ụzọ ọgụ n’ọdịnihu; mgbe ejirila ngwugwu ọjọọ eme ihe, ọ dị mkpa ka a nyochaa mmetụta nke nzere na nnọgidesi ike. Nkeji 9’s LiteLLM bụ mmemme akwadoro n’ihu ọha. S41
Ma enwere nkwenye na nrigbu n’ime ọhịa kwesịrị ịdabere na nkwupụta gọọmentị. Onye na-ere ahịa ekwughị ihe omume nrigbu na enweghị ike igosi na ọ nweghị ọgụ; ekwesịrị ime mmezi dabere na elu ọgụ ahụ n’ezie.
2. Nyocha ngwa ngwa nke ụdị edozi na ntinye ntinye
Ntụaka: 2.1 Node.js、React、Next.js
| akụrụngwa/alaka | Ntọala ụdị akwadoro | Ntuziaka maka ojiji |
|---|---|---|
| Node.js 22.x | 22.23.4 | Mwepụta nchekwa S1S2 na Ọktoba 21st |
| Node.js 24.x | 24.22.1 | Na-emetụta alaka 24.x; 24.22.0 enweghị nchekwa nchekwa October 21 S1S2 |
| Node.js 26.x | 26.12.1 | Ntọhapụ nchekwa na otu ogbe S1S2 |
| Node.js 20 na ngalaba na-ebugo elu | Kwaga na ngalaba na-akwado | Node 20 anaghị anabata ndozi elu a; A ga-enyocharịrị nkwado onye na-ere ihe agbatịpụrụ iche S3 |
| Next.js 15.x | 15.5.28 | Emelitere na October 14 S8 |
| Next.js 16.x | 16.4.1 | Otu dị ka n’elu S8 |
| Alaka nke RSC 19.0 / 19.1 / 19.2 / 19.3 Standalone | 19.0.9 / 19.1.10 / 19.2.9 / 19.3.1 | Lelee ngwugwu react-server-dom-* atọ dị iche iche; ọ bụghị naanị ile anya n’elu oyi akwa react S10 |
Next kwajuru sharp | ≥0.35.5 | Ọnọdụ ndozi nwa oge gọọmentị maka adịghị ike SVG; anaghị edochi patches Next.js ndị ọzọ S11 |
Node na-edepụta ngalaba nlekọta emetụtara maka adịghị ike nke Ọktọba, mana ọ naghị enye ụdị ụdị patch mbụ ewepụtara site na ihe, yabụ enweghị ike ikpebi ụdị mmalite nke adịghị ike ọ bụla dabere na ngalaba nlekọta naanị. Mgbe ị na-ebuga ya, nye ụzọ n’iji ụdị dị n’elu nke otu alaka ma ọ bụ ụdị na-esote enwetara na ọ nwere otu ndozi ahụ.
2.2 Java: October CPU gbakwunyere nwelite akwụkwọ na-apụ apụ
Tebụl a na-emetụta Oracle JDK. Kọlụm nke abụọ na-ekpuchi naanị October 20 CPU; nke atọ gụnyere ntọhapụ nke Ọktoba 21. Ụdị CPU naanị anaghị ekpuchi ihe egwu Java niile a tụlere ebe a. S16S17S18
| alaka | Ọktoba 20 CPU | Oracle ewepụtara na band na October 21 |
|---|---|---|
| 11 | 11.0.33 | 11.0.33.0.2 |
| 17 | 17.0.21 | 17.0.21.0.2 |
| 21 | 21.0.13 | 21.0.13.0.2 |
| 25 | 25.0.5 | 25.0.5.0.2 |
| 27 | 27.0.1 | 27.0.1.0.2 |
| 8 | 8u511 | Tebụlụ ntọhapụ ọha ka na-egosi 8u511; A ga-enyocharịrị nrụzi nchekwa a kapịrị ọnụ na nrụzi ntụkwasị obi, enweghị ike ikpebi dabere na ọnụọgụ ụdị dị mkpụmkpụ naanị |
**Java 8 kwesịrị ka enyocha ya megide ozi nrụpụta zuru ezu:**Oracle Mkpebi ahụ depụtara 8u511 dị ka ụdị emetụtara, na ndepụta ntọhapụ depụtara mmelite na-esote nwere otu aha dị mkpirikpi. Enweghị ike ịwapụta ọkwa patch ahụ dabere na nọmba ụdị nkenke “8u511” naanị. Ịkwesịrị ịkwado ntọala nchekwa na ndozi nke agbụ ntụkwasị obi. S17S18
Temurin , Corretto , Zulu , Microsoft Build of OpenJDK , ụdị ntọhapụ OpenJDK , wdg, lelee dị ka ọkwa ọkwa ha si dị yana ngwugwu ngwugwu / ọnụ ọgụgụ ụlọ zuru ezu. Ka ihe atụ, ndị ukara tọhapụ ndekọ nke Adoptium na-ekwu na a na-akwakọba ihe owuwu dị mkpa iji gbakwunye ya eMudhra dozie; Otu aha nke ụdị elu ahụ apụtaghị na ọdịnaya ngwugwu bụ otu. Nke .0.2 iwu suffix maka Oracle enweghị ike itinye n’ọrụ na ndị mbipụta ọzọ. S20
| Ngwa ngwa Java | Ntọala ụdị akwadoro | Okwu |
|---|---|---|
| Tomcat 9 / 10.1 / 11 | 9.0.123 / 10.1.61 / 11.0.27 | Lelee alaka site na alaka; Tomcat 10.0 akwụsịla mmezi S21S22S23 |
| Spring for GraphQL 2.0.x | 2.0.5（OSS） | Nkwado azụmahịa bụkwa 2.0.4.1 S25 |
| Spring Security 7.1 / 7.0 | 7.1.1 / 7.0.7（OSS） | Dakọtara na ụdị ndozi kacha nta ekwuputara na August; ịkwesịrị ịlele akwụkwọ akụkọ nchekwa S27S28 tupu ibunye ya. |
| Spring Security 6.5 / 6.4 / 5.8 / 5.7 | 6.5.12 / 6.4.19 / 5.8.28 / 5.7.26 | Edepụtara ọkwa ahụ dị ka nkwado nkwado azụmahịa; A na-enyocha mbugharị mgbe enweghị nkwado kwekọrọ, na enweghị ike iche na Maven Central dị maka S27 efu. |
Nkwalite Spring kwesịrị ịkwanyere ọrụ Spring Boot BOM, Java ụdị kacha nta na ahịrị ndakọrịta. Amanyela modulu Spring ozugbo ka ọ bụrụ otu ọnụọgụ naanị ka ị nweta patch.
2.3 CPython, Django na ndabere akwụkwọ
Kọlụm nke abụọ nke tebụl dị n’okpuru na-elekwasị anya na mbipụta TLS ekpughere na Septemba; E gosipụtara ọdịiche alaka ụlọ ọrụ maka tarfile na ngalaba 5.3. Mwepụta nke October 21 emelitere ngwa ọrụ asambodo bundled, yabụ kọlụm ikpeazụ gụnyere usoro mbugharị ndị ahụ mechara. S29S30S33S35
| CPython alaka | September nche ogbe kacha nta version | akwadoro usoro mbido mbugharị |
|---|---|---|
| 3.10 | 3.10.22 | Ntọhapụ ikpeazụ sitere na mgbago elu, EOL; hazie mbugharị ma ọ bụ nyochaa nkwado ndọtị ntọhapụ S34 |
| 3.11 | 3.11.17 | 3.11.17, ma melite pip/certifi na mpaghara ọ bụla n’otu n’otu. |
| 3.12 | 3.12.15 | 3.12.15, ma melite pip/certifi na mpaghara ọ bụla n’otu n’otu. |
| 3.13 | 3.13.16 | 3.13.17 |
| 3.14 | 3.14.8 | 3.14.9 |
| 3.15 | Mwepụta 3.15.0 ikpeazụ gụnyere ma TLS na-edozi S31S47 | 3.15.1 |
Enwere ike wepụta ụdị nchekwa dị elu nke 3.11 na 3.12 na koodu isi mmalite; mgbe ị na-eji ngwungwu sistemụ arụmọrụ, lelee ndụmọdụ ndụmọdụ azụ azụ nke onye na-ere ya na ụdị ngwugwu zuru ezu, ọ nweghịkwa ihe achọrọ iji ụdị ejiri aka ya dochie sistemụ Python n’ike. S33S34
| ịdabere onwe ya | Ntọala ụdị akwadoro | Nkọwa |
|---|---|---|
| Django 5.2 / 6.0 / 6.1 | 5.2.18 / 6.0.9 / 6.1.2 | Tinye mgbazi na-esote S38S39 na October 6 |
| certifi | ≥2026.10.19 | GHSA patch mbụ bụ .18; PSF na-akwado .19 iji chekwaa ndakọrịta maka asambodo emetụtaghị S36S37 |
| pip | ≥26.2.2 | Ụdị certifi arụnyere n’ime kwesịrị ka emelite ya iche S35S37 |
| uv (ọ bụrụ na ejiri ya) | ≥0.13.4 | Melite S37 dịka usoro ntinye n’ezie siri dị |
Ndị a ntọala na-ekpuchi depụtara fixes. Ọzọ ọkara-severity mbipụta na tar_filter ka e kpughere na October 22. Dị ka nke October 23, 2026, a ukara version mmezi nke nwere ihe ndozi a ka ekwenyebeghị; ya mere, 3.13.17 / 3.14.9 / 3.15.1 enweghị ike iwere na ọ kpuchiri okwu tafaịlụ niile. Lee ngalaba 5.4. S40
2.4 Na-enyocha ọdụ ụgbọ mmiri nkesa
Ụkpụrụ mmejuputa ọdabara na Ubuntu, Debian, RHEL na ngwugwu ngwanrọ ndị ọzọ:
- Dekọọ ụdị sistemụ arụmọrụ, isi mmalite nchekwa, ụdị ngwugwu zuru ezu, yana nọmba akwụkwọ ozi nchekwa onye na-ere ahịa.
- Kwenye na ndụmọdụ ahụ kpuchiri CVE akọwapụtara wee chọpụta ngwungwu edobere maka mwepụta nkesa dị mkpa.
- Tulee ọnụọgụgụ/ọbá akwụkwọ ndị a na-agba ọsọ n’ezie, ọ bụghị naanị ụdị mkpirisi elu.
- Mgbe enweghị ihe akaebe nke patch onye na-ere ahịa, hapụ ya “ka akwadoro ya” ma ewerela ya dị ka naanị nkwubi okwu na nọmba ụdị ahụ dị ka ochie ma ọ bụ ọhụrụ.
Enwere ọdịiche dị na ụdị ngwugwu apt/RPM yana atụmatụ azụ azụ nke nkesa dị iche iche. Akwụkwọ akụkọ nchekwa na ụdị ngwugwu zuru oke nke nkesa ọ bụla kwesịrị imeri.
3. Node.js / JavaScript gburugburu ebe obibi: Nyocha nke ihe kpatara na ngbanwe
3.1 CVE-2026-111497: Brotli decoder nwa afọ dee enweghị oke
ekpughere: 2026-10-21; Node ọkwa ọkwa: High. Ihe ewuru nke Node 22.x, 24.x, 26.x chọrọ ka etinyere ngalaba patch 2.1. Node Nkwupụta ahụ edepụtaghị akara akara CVSS ọnụọgụ. S1
Nsogbu a na-apụta na mgbagha ngbanwe nke ala mgbe ị na-ejizi iyi Brotli na-adịghị mma, nke nwere ike iduga na-edeghị akwụkwọ. Nkọwa ọrụ gọọmentị nke Vercel na-akwado na ngosipụta nyocha gụnyere nhazi ebe nchekwa usoro na igbu iwu. Ma onye na-awakpo ọ nwere ike iru decoder dabere ma ngwa ma ọ bụ ndabere na-ekpebi data ọ na-achịkwa. S3
Ekwesịrị ịlele ntụzịaka abụọ a n’otu oge:
- inbound: The kpuchie ma ọ bụ middleware na-akpaghị aka decompressed ahụ arịrịọ Brotli nke onye ọrụ nyefere.
- **outbound:**HTTP ndị ahịa, ndị na-ejide ihe onyonyo, wdg. nweta isi mmalite nke ndị na-awakpo na-achịkwa wee mebie ọdịnaya eweghachiri ozugbo.
Ịkwụsị mkpakọ Brotli nke nzaghachi ezigara na ihe nchọgharị anaghị ewepụ ebe ntinye ngbanwe. Nchedo WAF inbound anaghị ekpuchikwa ngwa na-ebubata na ngbanwe nzaghachi mpụga. S3
**Patch ntụzịaka:**Node Bugharịa Brotli na-edozi elu n’ime ndabere nwa amaala, wee gbakwunye ọkwa ngbanwe na-ezighi ezi na ịgbasa njehie. Mgbe ị na-edobe ụdị achịkọtara onwe gị, ị ga-eji ntọhapụ nchekwa gọọmentị ma ọ bụ patch zuru oke nke alaka dakọtara. Ị nweghị ike ịgbanwe nkwupụta ụdị nke ngwugwu JavaScript. S4
Atụnye mmejuputa nwa oge: kwụsị imezi Brotli enweghị ntụkwasị obi; lelee akpaka decompression omume nke middleware na HTTP ahịa; Ọ bụrụ na azụmahịa ahụ ga-anabatarịrị usoro a, mezue nhazi ahụ na ebe a na-akpachi anya ozugbo enwere ike. Ịgbanwe Accept-Encoding bụ naanị mkparita uka na ekwesịghị iguzo naanị ya dị ka ihe akaebe na egbochila nzaghachi ọjọọ.
3.2 TLS / DNS atọ High: Ihe nkwenye ekwekọghị n’ezie ebumnuche.
Ekpughere ha atọ n’October 21, yana ọkwa nkwalite gọọmentị ka edobere na ngalaba 2.1. S1
| Ihe nchọpụta | Ekwenyere okwu | Alaka ndị metụtara |
|---|---|---|
| CVE-2026-105482 | dns.resolve mkpọpu aha nwere NUL | 22.x / 24.x / 26.x |
| CVE-2026-105483 | IP n’ụdị ọnụọgụ obosara zuru oke na-eme ka agafefe nkwenye aha nnabata akwụkwọ. | 24.x / 26.x |
| CVE-2026-106069 | Aha nnabata enwere ike ịtụgharị nke ọma dị ka nsonaazụ IP na ngafe nkwenye TLS | 22.x / 24.x / 26.x |
DNS bụ isi nke nsogbu ahụ bụ na eriri nke oyi akwa elu na-enyocha dị iche na aha nke oyi akwa dị ala tụgharịrị. Ihe mgbochi gọọmentị na-ajụ NUL na ntinye ntụgharị ma gbakwunye mkpuchi nlọghachi azụ. S6
TLS ihe abụọ gụnyere ịhazi aha aha, ngbanwe nke nkọwa IP yana dakọtara akwụkwọ. Mechie ka ajụ ma ọ bụ hazie ntinye IP na-abụghị ọkọlọtọ iji zere ịgbagwoju anya njedebe IP na njirimara ngalaba njirimara. S5
Ezi ntụnye nchọpụta nsogbu maka : na-ebute ụzọ n’ịlele koodu nke onye ọrụ na-anata URL, dynamic proxy target ma ọ bụ adreesị Webhook; n’otu n’otu ma kwe ka ndepụta ikpe, jụrụ NUL / akara odide, na-akwado iwu IPv4, IPv6 na internationalized ngalaba aha ka na-arụ ọrụ. Ma enwere ike ịmepụta SSRF chọrọ ntinye ihe akaebe njikọ, nke enweghị ike iwepụ ya ozugbo na aha CVE.
Ejila NODE_TLS_REJECT_UNAUTHORIZED=0 ma ọ bụ rejectUnauthorized: false wepụ njehie checksum emelitere. Ekwesịrị idozi adreesị, asambodo na nhazi azụmahịa.
3.3 July HTTP/2 High-ihe ize ndụ na ikike ụdị okwu.
Okwu ndị na-esonụ ekpughere na Julaị ka dị mkpa ka etinyere na nyocha. A na-atụ aro ka iji usoro ntọala ụdị nchekwa Ọktọba na ngalaba 2.1 mgbe ị na-ebuga ya. S7
| CVE | Ihe kpatara na mmetụta | Ụdị edozi nke mbụ |
|---|---|---|
| CVE-2026-56846 | Edebere ngọngọ HTTP/2 header adịghị etinye ya nke ọma na mmefu ego maxSessionMemory ma nwee ike ikpochapụ ebe nchekwa; Mmetụta 22.x / 24.x | 22.23.2 / 24.18.1 |
| CVE-2026-56848 | HTTP/2 na-abanyeghachi n’ụzọ izipu n’oge nchịkọta ngwugwu, na-eme ka obo UAF; mmetụta 22.x / 24.x / 26.x | 22.23.2 / 24.18.1 / 26.5.1 |
| CVE-2026-58043 | --permission Dakọtara oke prefix ụzọ dị oke oke, enwere ike ịnweta faịlụ na-abụghị ndepụta anabatara. | Otu dị ka ahịrị mmezi atọ dị n’elu |
Ha atọ bụ ndị eze High. Ihe abụọ mbụ na-ebute ụzọ ịlele ma HTTP/2 na-ahazi ya site na Node n’onwe ya; Ihe nke atọ nwere naanị ihe kwekọrọ mgbe ị na-eji ụdị ikike na ịdabere na oke a. Enweghị ike ịkọwa ihe ụdị ikike niile dị ka netwọk RCE nke na-achọghị nyocha. S7
Ịkwụsịtụ HTTP/2 nwa oge na proxy dị iche, emelitere yana ịmachi isi mmalite azụ bụ nhọrọ ntinye iji belata mkpughe; oke akụrụngwa nwere ike ijikwa nsonaazụ nke ike ọgwụgwụ akụrụngwa na enweghị ike kwachie UAF.
3.4 October React / Next.js: ihe abụọ RCE na otu ihe DoS
A. RCE na RSC / use cache na-arụ ọrụ na-eweghachi nhazi ederede.
Ụbọchị ọha: 2026-10-14; Critical, CVSS 4.0 9.5. njirimara ndụmọdụ gọọmentị:
Nke React Esemokwu dị n’elu na-agụnye ọtụtụ usoro pịnyere agbakwunyere yana ụkpụrụ ndị nwere ike ịchịkwa ọgụ na RSC nzaghachi. Atọ ahụ metụtara react-server-dom-* nsụgharị ngwugwu bụ 19.0.0 — 19.0.8 , 19.1.0 — 19.1.9 , 19.2.0 — 19.2.8 , 19.3.0 ; lee isi nkebi 2.1. Nchọgharị-akụkụ dị ọcha React , ma ọ bụ ngwa na-adịghị eji frameworks/plug-ins na-akwado RSC ma ọlị, adala n’ime oke ihe a. S10
Next.js ndepụta ọkwa ọkwa ala 16.0.0 — 16.4.0 , edegharịrị na 16.4.1 ; ihe atụ bụ App Router , Cache Components , na use cache ọrụ na-eweghachite ọtụtụ usoro ederede. Enweghị usoro ọrụ izugbe a pụrụ ịdabere na ya nke gọọmentị, yana ndị ọrụ ụdị emetụtara ka achọrọ ịkwalite n’oge. Ọ bụghị ihe kwesịrị ekwesị ịdabere na nyocha akwụkwọ ntuziaka maka “ọrụ a adịghị ka ọ dị” iji kwụsị nhazi ahụ. S9
Ntụaka: B. SVG Image Optimization RCE
CVE-2026-96889/GHSA-2464-fhr4-w9xw, 2026-10-14, Critical, CVSS 4.0 9.5. Nsogbu The na-apụta n’ọbá akwụkwọ dị elu nke ejiri maka nkwalite onyonyo. Ndị ọrụ gọọmentị rụtụrụ aka na ihe egwu RCE dị na ọnọdụ glibc Linux. S11
Oghere ụdịdị gọọmentị bụ:
>=10.0.0 <=15.5.27；>16.0.0 <=16.4.0。
Onye ọrụ gọọmentị na-eji oke ala siri ike nke >16.0.0 maka ngalaba 16.x, mana nkwupụta oke a ezughị iji gosi na 16.0.0 adịghị mma. Ebumnuche nkwalite bụ otu 15.5.28 / 16.4.1. S11
Ngwọta gọọmentị nwa oge bụ iji hụ na Next na-ebu ibu dị nkọ ≥0.35.5. Mkpọchi faịlụ, ndabere akwụ ụgwọ, na ihe oyiyi mbugharị nwere ike ka na-ejide oge ochie, yabụ na ịgbakwunye ụdị ọhụrụ nke ndabere sharp na ọkwa dị elu ezughị, a ga-enyocha ma wughachi osisi ndabere ikpeazụ. S11
C. Server Actions CPU ike gwụrụ
GHSA-p3m5-59mp-jv5r , 2026-10-14, High , CVSS 4.0 8.2 . Next na-emetụta 13.0.0 — 15.5.27 , 16.0.0 — 16.4.0 , ndozi 15.5.28 / 16.4.1 . Ọnọdụ ndị ahụ bụ App Router ma ọ dịkarịa ala otu Server Action ; obi ọjọọ nwere ike idowe CPU nọrọ ogologo oge, na-egbochi arịrịọ ndị na-esote n’otu usoro ahụ. Ngwa nwere Pages Router ma ọ bụ na-enweghị Server Actions emetụtaghị nke a. S12
Enweghị usoro ọrụ gọọmentị nwere ike dochie nkwalite ahụ. Oke ọnụego, oke nkwekọrịta na oke akụrụngwa nwere ike ibelata mmebi, mana enweghị ike iji ya dị ka nkwubi okwu maka nkwenye kwachie.
3.5 mbụ Next.js n’otu mpio nnukwu nsogbu
Ihe ndị a bụ ihe e bu n’obi iji zere mbugharị na-efu efu nke ka rapaara na nsụgharị tupu August-September; A naghị atụ aro ka ịkwaga n’elu ọnụ ụzọ ndozi ochie na tebụl ugbu a.
| Ụbọchị | Ihe nchọpụta/ọdịdị | Ndozi mbụ; omume ugbu a |
|---|---|---|
| 2026-08-25 | GHSA-2xp9-vwfh-vxw4: AVIF njikarịcha onyonyo nwa afọ RCE, Critical | 15.5.24 / 16.3.3; ugbu a 15.5.28 / 16.4.1 S13 |
| 2026-08-25 | CVE-2026-75604: RCE, Critical mgbe Pages Router na App Router na-eji otu oge na Windows, na Cache Components na-adịghị enyere; ụdị >=13.4.0 <15.5.24, >=16.0.0 <16.3.3 | 15.5.24 / 16.3.3 ; Nke a anaghị emetụta Linux / macOS Windows mbipụta S14 |
| 2026-09-22 | GHSA-vcvr-r3jv-pc5j: Node image-ọgbọ ụzọ na next/og usoro enweghị ntụkwasị obi SVG, Critical; 16.2.0—16.3.5 | 16.3.6; mmejuputa Edge bụ n’èzí nke okwu a, na 15.x abụghị ngalaba emetụtara maka RCE S15 |
4. Java gburugburu ebe obibi: ntụkwasị obi oge ojiri, arịa na frameworks na-edozi iche iche
4.1 JDK: CPU mgbe niile na CVE-2026-91403 bụ mmelite ọkwa abụọ.
Java SE ihe ize ndụ matrix maka Oracle CPU na October 20 depụtara 55 ọhụrụ nchekwa patches, 49 nke akara dị ka erigbu na netwọk na-enweghị nkwenye. Nke a apụtaghị na e nwere 55 Critical, ma ọ bụ na ọ pụtaghị na e nwere 49 kpọmkwem na-erigbu ụzọ RCE maka onye ọ bụla Java webụ ọrụ; a ghaghị ịghọta ya na ihe ndị mejupụtara, API, mmekọrịta ndị ọrụ na ọnọdụ ntinye n’ime matriks. S16
CVE-2026-91403 (CVSS 3.1 9.1) n’echi ya na-emekọ ihe n’ụdị ihe egwu ọzọ: usoro nke etiti CA metụtara mmemme eMudhra nke na-atụkwasịkwaghị obi. Ọ na-emetụta TLS nyocha ndị ọgbọ na nzikọrịta ozi / iguzosi ike n’ezi ihe na enweghị ike ịkọwa ya dị ka adịghị ike ebe nchekwa JVM. S17
Ndụmọdụ Oracle depụtara ụdị ewepụtara na Ọktoba 20 dị ka emetụtara, yabụ nwelite mmelite na-apụ na October 21st dịkwa mkpa ka etinyere ya. Hụ ngalaba 2.2 maka ụdị a kapịrị ọnụ. GraalVM nwekwara ngwaahịa emetụtara kwekọrọ, na ụdị edoziri kwesịrị ịdabere na akwụkwọ akụkọ nchekwa ya. S17S18
Tmporary ukara jikoro: ndabere mbụ, wee wepụ kpọmkwem mgbọrọgwụ akwụkwọ si onye ọ bụla n’ezie eji Truststore:
emSign ECC Root CA - G3, Oracle utu ahaemsigneccrootcag3 [jdk].AAA Certificate Services, Oracle utu ahacomodoaaaca [jdk]. S19
JDK 11 na mgbe e mesịrị, ndị ọrụ atụ bụ:
keytool -delete -cacerts -alias "emsigneccrootcag3 [jdk]"
keytool -delete -cacerts -alias "comodoaaaca [jdk]"Jiri keytool sitere na ebumnuche JDK maka iwu ndị a wee gosi na ha na-arụ ọrụ na ụlọ ahịa ntụkwasị obi nke ngwa ahụ. Java 8 na-eji ụzọ kwekọrọ na jre/lib/security/cacerts; ịhazi ụlọ ahịa ntụkwasị obi ga-edozirịrị iche, ndị mbipụta ọzọ nwere ike ịnwe utu aha dị iche iche. Iwepụ akwụkwọ mgbọrọgwụ ga-agbasawanye obosara nke ịjụ, yana regression-ule n’agbụ akwụkwọ ọrụ ziri ezi. S19
Onye ọrụ gọọmentị ahụ na-enyekwa nhọrọ iji mee ka ịlele nbibi, mana nsonaazụ ya dabere na mmejuputa TLS n’ezie, iru ọrụ mwepu na atụmatụ ọdịda. Maka mbugharị izugbe, dobe ụzọ ịwụnye mmelite ndị na-ere ahịa zuru oke ka ịzenarị ọgwụgwọ mgbanwe JVM abụọ dị ka ihe akaebe na edobere ọba akwụkwọ TLS niile.
4.2 Tomcat: ngafe nyocha na arịrịọ ikewapụ onye ọrụ.
Ihe atọ ndị a ka ebipụtara na 2026-10-20; ntinye ụdị edoziziri bụ ụbọchị October 12. Ọkwa gọọmentị nke Apache bụ Important. S21S22S23
| CVE | Ekwenyere ụdịdị emetụtara | Ihe ndapụta/arụpụta ihe dị mkpa |
|---|---|---|
| CVE-2026-101296 | 9.0.0.M1—9.0.122；10.1.0-M1—10.1.60；11.0.0-M1—11.0.26 | JNDIRealm na-ahazi usoro nyocha SASL na-abụghị GSSAPI, nkwenye nzere na-efu, na okwuntughe na-ezighi ezi nwekwara ike ịgafe. |
| CVE-2026-101356 | 9.0.118—9.0.122；10.1.55—10.1.60；11.0.22—11.0.26 | HTTP/2’s asynchronous Servlet njehie na-ejizigharị ihe na-ezighi ezi, na-eme ka agwakọta arịrịọ ma ọ bụ nzaghachi n’etiti ndị ọrụ. |
| CVE-2026-103119 | Naanị kwado 11.0.0-M25—11.0.26 | Nnukwu AJP na-edeghị akwụkwọ nwere ike ime ka agụghị ihe nchekwa, na-ekpughe data nzaghachi gara aga na arịrịọ emechaa. |
Ndozi kwekọrọ bụ 9.0.123 / 10.1.61 / 11.0.27; AJP ka edepụtara naanị dị ka Tomcat 11 dịka ọkwa ahụ siri dị, enweghị ike ịgbasa ya na alaka atọ nwere otu nsogbu ahụ. S21S22S23
Ihe ngwunye JNDIRealm na-edozi oghere nkwenye na usoro nyocha n’ezie, ebe enweghị ike iji “ntụgharị nbanye ngwa dị ka ọ dị mma” kama nkwenye. Ekwesịrị ịlele usoro nke SASL maka nhazi nke ọrụ ahụ, ule ga-adarịrị maka okwuntughe na-ezighi ezi. S24
Atụmatụ mmejuputa nwa oge: kewapụ ụzọ nyocha emetụtara; kwụsịtụ nhazi HTTP/2 nke Tomcat mgbe azụmahịa ikike; AJP nso na-abaghị uru. Naanị igbochi ịnweta ọdụ ụgbọ mmiri AJP enweghị ike igosi na ọ gaghị emetụta okporo ụzọ na-abanye na proxy n’ihu iwu. Ka emelitechara gọọmentị, arịrịọ asynchronous concurent sitere n’aka ndị ọrụ abụọ nọọrọ onwe ha kwesịrị ịnwale iji gosi na enweghị mkparịta ụka n’etiti njirimara na nzaghachi.
Ntụaka: 4.3 Spring for GraphQL：CVE-2026-59285
Ụbọchị ọha: 2026-08-20; High. emetụtara 2.0.0—2.0.4, rụziri 2.0.5 (OSS) ma ọ bụ 2.0.4.1 (nkwado azụmahịa). S25
Nke a bụ ihe egwu na-adịghị mma ịwepu n’ime ajụjụ ịde akwụkwọ. Ihe gọọmentị chọrọ bụ na a ga-emezurịrị ọnọdụ ndị a n’otu oge:
- Jiri Spring for GraphQL.
- Wepụ JSON site na iji Jackson 2.x.
- Nye mpaghara ibe njikọ na ụwa mpụga.
- Ụzọ klaasị ahụ nwere klaasị akọwapụtara nke nwere ike ịrụ mgbagha a na-atụghị anya ya n’oge ngwa ngwa ma ọ bụ deserialization.
Arịrịọ GraphQL ọjọọ nwere ike bute RCE mgbe ọnọdụ a zutere. Enweghị ike iwelata ya na “mmemme Java niile na-eji Jackson nwere ike irigbu”. S25
Gịnị kpatara 2.0.4 ezughi oke: Na June, CVE-2026-41699 enyela patch baselines dị ka 2.0.4, na n’August ọkwa ahụ gụnyere n’ụzọ doro anya 2.0.4 n’ime oke mmetụta ọhụrụ. Ya mere, a ga-emelite ndekọ nrụzi dịka ọkwa ọkwa na-esote, na enweghị ike iji opekempe nke ochie CVE. S26
Mgbe nkwalite adịghị nwa oge, enwere ike kwụsịtụ mpaghara pagination emetụtara nke ndị na-akpọghị ntụkwasị obi nwere ike ịnweta; ibelata ụdị deserializable na ụzọ klas bụ ihe dị omimi. Ndaghachi azụ kwesịrị ikpuchi cursors iwu, rịzọlt e depụtara n’akwụkwọ, yana ewepu ndenye, wee lelee ụdịdị akụrụngwa n’ime ngwa ikpeazụ JAR.
4.4 Spring Security: CVE-2026-59270 yana ihe egwu nyocha emetụtara.
CVE-2026-59270, 2026-08-20, Critical. agbakwunyere UnboundIdContainer na-edebanye aha njirimara onye nchịkwa na ndabara ma na-ege ntị na ntanetị netwọkụ niile. Mgbe etinyere akụrụngwa ma nwee ike iru ọdụ ụgbọ mmiri, onye na-awakpo nwere ike ịgụ ma ọ bụ gbanwee data ndekọ; oru na-ewebata Spring Security agaghị ekpughe LDAP ozugbo. S27
Mpaghara emetụtara:
| alaka | emetụtara | Ọwa ndozi/ nweta mbụ |
|---|---|---|
| 7.1 | 7.1.0 | 7.1.1 OSS; nakwa 7.1.0.1 azụmahịa |
| 7.0 | 7.0.0—7.0.6 | 7.0.7 OSS; nakwa 7.0.6.1 azụmahịa |
| 6.5 / 6.4 | 6.5.0—6.5.11；6.4.0—6.4.18 | 6.5.12/6.4.19, azụmahịa |
| 5.8 / 5.7 | 5.8.0—5.8.27；5.7.0—5.7.25 | 5.8.28/5.7.26, azụmahịa |
Isi mmalite: S27. Nchọpụta nsogbu spring.ldap.embedded.* nhazi akpaka na koodu nzizi ozugbo; mechie akụrụngwa mgbe ọ na-adịghị mkpa maka mmepụta, na lelee n’ezie adreesị ege ntị. Mgbe azụmahịa ahụ chọrọ ya n’ezie, buru ụzọ kpachie isi mmalite oku wee mezue nkwalite akụrụngwa.
Okwu nkwenye emetụtara: CVE-2026-47841 ( High ). WebAuthn Etinyere nkwenye onye ọrụ na REQUIRED , na mgbe nke ahụ gasịrị HTTP A na-edobe nnọkọ site na nchekwa ekesa, ntụnyere njirimara ihe na-ezighi ezi nwere ike mebie njirimara achọrọ. Mwakpo a chọkwara ka onye na-awakpo ahụ nwee ngwaọrụ nyocha nke onye ọrụ, ọ bụghị nbanye nbanye akaghị aka na-enweghị ngwaọrụ. N’ihi kwekọrọ ekwekọ emetụta nsụgharị nke 7.1 , 7.0 , 6.5 , na 6.4 , ihe ndabere nke patch kwekọrọ na alaka ndị a na tebụl dị n’elu; nkwenye kwesịrị ikpuchi nnọkọ ọnụ ụzọ ma ka na-achọ nkwenye PIN/biometric. S28
5. Python gburugburu ebe obibi: onye ntụgharị okwu, ọbá akwụkwọ ọkọlọtọ, usoro na asambodo
5.1 CVE-2026-19445: SSLContext UAF na SNI oku azụ
Ụbọchị mbipụta: 2026-09-30; Ọkwa PSF: Critical. Na Python nkesa TLS, sni_callback na-agbanye njikọ gaa na SSLContext ọzọ, yana mgbe ọnọdụ enweghị ndụ ọzọ enweghị ntụaka. Onye ahịa TLS nwere ike mebie ọrụ ahụ ma ọ bụ kpọọ ntụnye n’ime ihe ewepụtara. S29
Isi ihe bụ na ihe Python ekwekọghị n’usoro ndụ oku azụ azụ TLS dị n’okpuru. Ewepụtala ihe gbara ya gburugburu, na oyi akwa dị n’okpuru ka nwere ike ijide steeti achọrọ maka nlọghachi; ekwesịrị iji patch onye ntụgharị okwu dozie okirikiri ndụ ntụaka. S47
Scope: Python koodu nke na-eme naanị dị ka onye ahịa TLS anaghị emetụta ihe a; ọnọdụ nkịtị nke oghere ige ntị na-ejide ọnọdụ mbụ ahụ ogologo oge adịghị adaba na ụzọ ọdịda akọwapụtara nke ọma na ọkwa. Mgbe Nginx kwụsịrị TLS, ọ na-enyefe HTTP mpaghara na Python, yana Python na-ejikwa SNI n’onwe ya, nke bụ ụdị ọgụ dị iche. S29
N’ikwekọ na ụdị edozi 3.10—3.14, lee ngalaba 2.3. A rụziri ụdị ọrụ gọọmentị nke 3.15, yana 3.15.1 nwere ike họrọ n’ezie. Naanị imelite ndabere pip enweghị ike dochie mmejuputa _ssl onye ntụgharị okwu. S33S35S47
Official mbelata nwa oge: na-edobe nrụtụ aka siri ike na SSLContext niile edoberela azụghachi SNI ruo ọgwụgwụ nke okirikiri ndụ ihe nkesa. Nke a kwesịrị ikpuchi ihe okike na-agbanwe agbanwe na ụzọ ntụgharị; Omenala OpenSSL 1.1.1 wulite kwesịkwara ịlele ọnọdụ mkparita uka na njikọ ndekọ mbipụta gọọmentị wee bute ụzọ maka mmelite zuru oke. S29S47
5.2 CVE-2026-19553: Agbanyere ọkọlọtọ aha nnabata, mana aha nnabata na-efu mgbe ị na-akpọ.
Ụbọchị ọha: 2026-09-30; High. MgbeSSLContext.check_hostname=True, ọ bụrụ na agafeghị wrap_bio() na server_hostname, mmejuputa atumatu mbụ nwere ike machie nkwenye aha nnabata. Nyochaa yinye asambodo ịga nke ọma apụtaghị na aha ngalaba ebumnuche ejikọtala. S30
Ndozigharị chọrọ usoro abụọ a:
- Wụnye ntọhapụ nchekwa onye ntụgharị okwu edepụtara na ngalaba 2.3.
- Lelee ụzọ
wrap_bio(), metụtaraasyncio.create_connection()/loop.start_tls(), gafere n’ụzọ doro anya na aha nnabata a na-atụ anya ya na nke na-adịghị efu, wee tinye nkwenye asambodo agbanwuru. S30
**dị iche ndakọrịta nke enweghị ike ịhapụ:**3.10, 3.11, 3.12 bụ maka ndakọrịta, naanị DeprecationWarning ka enyere maka ụfọdụ ebe aha nnabata na-efu; 3.13 wee bulie ValueError. 3.12 backport na-egosipụtakwa nke ọma None na eriri efu: agbakwunyere ịdọ aka ná ntị ọhụrụ maka None, a ka na-akọkwa njehie maka eriri efu. Ya mere, ndị ọrụ obere ngalaba enweghị ike iche na nkwenye aha ngalaba na-efu efu eweghachila ozugbo site na ịkwalite. S31S33
N’ebe nnwale, jiri asambodo yinye ntụkwasị obi nwere aha nnabata ekwekọghị wee gosi na ngwa ahịa TLS jụrụ ya. Naanị ịgụ check_hostname uru Boolean anaghị abụ nnabata zuru oke.
5.3 CVE-2026-82049: Njikọ njikọ gafere na tarfile
Ụbọchị ọha: 2026-09-14; High . N’ime CPython 3.13 na mmejuputa iwu metụtara na mbụ, nchikota nke njikọ siri ike na njikọ ihe atụ na tar na-enweghị ntụkwasị obi nwere ike gafere nke ahụ data / tar ihe nzacha mmịpụta, ikpughe ọdịnaya nke faịlụ na mpụga akwụkwọ ndekọ aha na-ebupu n’osisi a na-ebupụ, ma ọ bụ gbanwee ikike ha na oge mgbanwe. S32
Mmetụta ekwenyere na adịghị ike a gụnyere ikpughe ọdịnaya faịlụ yana mgbanwe metadata; naanị mmetụta ndị a ezughị oke iji gosipụta idegharị ọdịnaya nke faịlụ mpụga ma ọ bụ mmejuputa iwu na-enweghị usoro nke RCE.
N’ihi na kwekọrọ ekwekọ patch baselines nke 3.10 — 3.13 , lee Nkebi 2.3. Python 3.14 ahapụla ya n’okwu a kapịrị ọnụ n’ihi os.link() omume na-agbanwe kemgbe 3.14.0b1 , ya mere emetụta oke nke 3.10 — 3.13 Alaka dị n’elu anaghị etinye. S33
Usoro nwa oge na nke dị omimi: kwụsịtụ mmịpụta akpaka nke ebe nchekwa na-enweghị ntụkwasị obi; jiri usoro ndị ọrụ dịpụrụ adịpụ dịpụrụ adịpụ yana akwụkwọ ndekọ aha pụrụ iche mgbe a ga-ahazi azụmahịa, jụ njikọ ihe atụ, njikọ siri ike na ntinye ngwaọrụ site na azụmahịa, ma kpachie ọnụ ọgụgụ faịlụ na akụrụngwa decompression. Ndị a bụ ntụnye mbugharị.
filter="data" dabara adaba maka nchekwa nchekwa ọha na-enweghị ntụkwasị obi karịa atụmatụ ntụkwasị obi zuru oke, mana nzacha n’onwe ya na ụdị ochie nwekwara adịghị ike a, yana ịgbakwunye oke a naanị enweghị ike dochie mmelite ahụ. Ihe nzacha ahụ abụghịkwa igbe nchekwa faịlụ zuru oke. S32S45
5.4 Ihe egwu mgbakwunye: CVE-2026-114583 (Medium) na ọkwa ntọhapụ
PSF kpughere na 2026-10-22 na tarfile.tar_filter nhazi aha njikọ aha nwere ike gafere, na-ekwe ka ndị so na-esote dee na-abụghị akwụkwọ ndekọ aha, na ọkwa nke. Medium. Official fix PR jikọtara ụbọchị ahụ; Dị ka Ọktoba 23, 2026, ọ nweghị ntọhapụ mmezi nwere nkwenye a akwadoro. S40
Ya mere:
- Edepụtara ihe a iche dị ka Medium.
- Ụdị ntụgharị okwu ewepụtara na Ọktọba 21st enweghị ike iche na etinyere ndozi a.
- Usoro nke ka na-eji
filter="tar"ijikwa ebe nchekwa na-enweghị ntụkwasị obi kwesịrị soro ntọhapụ azụ azụ; kewapụ ma ọ bụ kwụsịtụ ụzọ nhazi a maka obere oge. Mgbe ị na-agbanye nadatama na-ajụ njikọ, ị ga-ekwenyekwa na ọ na-emezu ihe azụmahịa chọrọ, na ịgbanwe nzacha enweghị ike ịkọwa dị ka igbe ájá na-enweghị atụ.
5.5 GeoDjango: CVE-2026-15307 na mmezi ndị ọzọ na October
2026-08-04, Django onye ọrụ High. ajụjụ gbasara ohere na-enyefe ụfọdụ eriri / akwụkwọ ọkọwa okwu n’ezoghị ọnụ na GDALRaster, onye ọkwọ ụgbọ ala nwere ike dee faịlụ netwọk ma ọ bụ na; Enwere ike ịmepụta RCE mgbe enwere ụzọ dị iche iche na ọnọdụ mmezu na-esote. Ndị ọrụ nwere ikike nlele ihe nlere oghere oghere nwekwara ike ịnweta ụzọ a site na listi mgbanwe nchịkwa. S38
Ndozi mbụ bụ 5.2.17/6.0.8, nke na-amachibido ụdị ntinye anabatara site na nlele oghere. Mgbanwe a nwere ike imetụta azụmahịa izizi nke iji eriri/akwụkwọ ọkọwa okwu iji kwupụta raster; Naanị itinye ntinye atụkwasịghị obi na GDALRaster apụtaghị igosipụta ya. S38
N’October 6, a rụziri CVE-2026-87890 (Moderate): VRT egosipụtara na bytes nwere ike ịtu aka na akụrụngwa mpụga ma ka na-akpalite arịrịọ netwọk; N’otu ụbọchị ahụ, a na-ewusikwa geometry akwu DoS nchebe nke CVE-2026-15830. Enweghị ike ịkwalite nke abụọ nke ikpeazụ iji kọwaa RCE ọhụrụ nwere nnukwu ihe ize ndụ, mana gosi na usoro mbugharị kwesịrị ịbụ 5.2.18 / 6.0.9 / 6.1.2. S39
Mmejuputa a na-enyocha isi ihe ntinye abụọ nke API na interface nchịkwa, na-amachibido nyocha oghere na-atụkwasịghị obi, ikike ide faịlụ na ịnweta ọpụpụ; ka emelitechara, nlọghachi-nnwale ajụjụ gbasara oghere dị irè yana ịjụ ntinye amachibidoro. Ngwa Django nkịtị na-adịghị eji GeoDjango ekwesịghị itinye nkwubi okwu RCE ozugbo.
5.6 certifi / pip: ntụkwasị obi asambodo ga-ekpuchirịrị nnomi ọ bụla
GHSA-6q48-6c7w-9gw2 , 2026-10-20, Critical , mara CVE edepụtaghị ya. Nke a bụ mmelite enweghị ntụkwasị obi asambodo nke ihe a kpatara eMudhra etiti CA merenụ. Enweghị ike ịchịkọta ya dị ka usoro nzuzo nke HTTPS ma ọ bụ na agbajiela asambodo mgbọrọgwụ niile. S36
Ndụmọdụ certifi bụ nke e depụtara na mbụ 2026.10.18 dị ka patch; PSF mechara akwadoro 2026.10.19 iji chekwaa ndakọrịta yana asambodo mgbọrọgwụ emetụtaghị. Usoro izizi ọrụ bụ .19. S36S37
Mkpa ịmata ọdịiche:
| ntụkwasị obi ebe ihe onwunwe | Ihe mere ị ga-eji lelee iche |
|---|---|
| Sistemụ arụmọrụ CA ngwugwu | Ihe ntụkwasị obi sistemụ maka onyonyo ma ọ bụ onye ọbịa |
| certifi na venv | CA bundle na-eji ngwa ma ọ bụ arịrịọ wdg. |
| pip arụnyere n’ime certifi | Ọ dị iche karịa certifi arụnyere na mpụga |
| uv / Ngwa nkwakọ ngwaahịa ndị ọzọ | Soro mmelite nke akụrụngwa yana isi mmalite ntụkwasị obi |
| Faịlụ CA ahaziri ahazi, foto ngwungwu | Nwere ike ịga n’ihu na-akagbu isi mmalite ntụkwasị obi maka sistemụ ma ọ bụ ngwugwu |
Ihe dị n’elu bụ ndepụta nlele dabere na ebe nkwakọ ngwaahịa dị iche iche. PSF chọrọ imelite ngwaọrụ ndị metụtara ya, gburugburu mebere dị adị na iwughachi onyonyo a; naanị imelite onye ọbịa CA ma ọ bụ ịwụnye onye ntụgharị enweghị ike igosi na eweghachila nnomi niile ume. S35S37
Mgbe ị na-ebulite site na ochie pip bootstrap echedoro, PSF na-enye iwu maka wheel fixed wheel na SHA-256, lee ihe mgbakwunye S37. Agbanyụla TLS nkwenye ma ọ bụ tinye --trusted-host ka agabiga okwu akwụkwọ.
6. Usoro mgbazigharị nkịtị
Iwu ndị a bụ maka gburugburu atụkwasịkwara obi. Mgbe ị na-eme ihe, onye njikwa ngwugwu dị ugbu a, faịlụ mkpọchi na usoro ntinye nke ọrụ ahụ kwesịrị ijikọta iji zere ịgwakọta npm/pnpm/ yarn ma ọ bụ pip/uv/Poetry iji mepụta faịlụ mkpọchi na-emegiderịta onwe ya.
Jikwaa ihe dị iche na mbụ: Ọ bụrụ na ị na-eche na gburugburu ebe obibi agbaala ngwugwu ahụ mebiri emebi na Nkebi nke 9, kewapụ ya na mbụ wee lelee diski, faịlụ mkpọchi na ndekọ ihe oyiyi site na ebe dị ọcha; agbala iwu Python/pip na-esote mbụ. S41
6.1 Mepụta akwụkwọ ndekọ ego nke nwere ike ịdekọrịta na ezigbo okporo ụzọ
Ọrụ ọ bụla na-edekọ opekata mpe:
- Ebe ntinye nke mpụga, proxy reverse, ụzọ njikọ kpọmkwem na saịtị mmalite, yana ọrụ kwụ n’ahịrị/ahaziri.
- Iwu mmalite mmalite, akaụntụ na-agba ọsọ, ụzọ ọnụọgụ abụọ, usoro ma ọ bụ njirimara akpa.
- Ụdị oge ojiri gaa, onye mbipụta/ebe nchekwa, ụdị ngwugwu zuru oke, ma ọ bụ mgbari onyonyo.
- Framework na ndabere mgbanwe, faịlụ mkpọchi, ọba akwụkwọ obodo, yana ụzọ ụlọ ahịa ntụkwasị obi.
- N’ikwekọ ma ọnọdụ adịghị ike ahụ ọ dị, mgbachi echere, mmalite mmalite, onye nwere ọrụ na nsonaazụ nkwenye.
A ga-enyochakwa igwe mmepe, ndị na-agba ọsọ CI, na-ewu arịa, na ọrụ ndabere dịka ụzọ ha si dị na ọdịnaya enweghị ntụkwasị obi; emelitela akpa webụ ahụ na-eche ihu ọha.
6.2 Node.js: Kpebie oge ịgba ọsọ nke mbụ, wee melite dabere ngwa.
Lelee na gburugburu ọrụ:
node -p 'JSON.stringify({execPath:process.execPath,node:process.version,openssl:process.versions.openssl,brotli:process.versions.brotli},null,2)'
npm ls next react react-dom react-server-dom-webpack react-server-dom-parcel react-server-dom-turbopack sharp --all
npm audit --omit=devEkwesịrị igbu node -p site na iji ọrụ arụrụ arụ ọrụ ma ọ bụ n’ime akpa n’ezie; ọ na-enyocha usoro ewepụtara ọhụrụ ma ọ bụghị n’onwe ya na-egosi na edochila onye ọrụ ochie ahụ. Node nwere ike ịgbakwunye patch ahụ na Brotli arụnyere n’ime ya ka ọ na-ejigide eriri ụdị ọba akwụkwọ mbụ. Ya mere, adaberela naanị na process.versions.brotli iji chọpụta ma edoziwo ya. Ị ga-ejikọta ya na ụdị nchekwa Node ma ọ bụ ihe akaebe azụ azụ nke onye na-ere ahịa. S2S4
A na-eji npm ls hụ osisi ndabere n’ezie; ngwugwu efu ma ọ bụ esemokwu ndị ọgbọ nwekwara ike iwepụta koodu ọpụpụ na-abụghị efu, yabụ ị ga-agụpụta nsonaazụ ya. A na-eji npm audit dị ka ihe enyemaka nlele dabere na enweghị ike dochie ọnụọgụ abụọ Node na nlele ọba akwụkwọ ala.
Jiri mise jikwaa gburugburu Node 24, nke enwere ike imelite dịka ndị a:
mise use -g [email protected]
mise exec [email protected] -- node -p 'process.version + " " + process.execPath'mise use -g na-ahazi ụdị zuru ụwa ọnụ; A ka kwesịrị ịlele nhazi mpaghara ọrụ ahụ iche iche. Ọ bụrụ na ọrụ ahụ edozila ụzọ ochie zuru oke, onyonyo ntọala akpa, ma ọ bụ gburugburu nke akaụntụ dị iche, nhazi ahụ kwekọrọ na ya ga-emeliterịrị ma malitegharịa ọrụ ahụ. Iwu ahụ n’onwe ya anaghị edochi usoro ịgba ọsọ ochie. S43
N’ime ọrụ Next, mebie iwu kwekọrọ dịka alaka ụlọ ọrụ ahọpụtara siri dị. Maka Next 15:
# Next 15 分支
npm install --save-exact [email protected]Maka Next 16:
# Next 16 分支
npm install --save-exact [email protected]Lelee React/RSC ndakọrịta dakọtara, faịlụ mkpọchi na ihe atụ ikpeazụ dị nkọ, wee wuo dịka usoro ọrụ siri dị. Jiri faịlụ mkpọchi emelitere na CI maka nrụnye enwere ike imepụtagharị, wee lelee ụdị dị na onyonyo na-agba ọsọ mgbe ị rụchara. Ejila nrụzi akpaka anaghị achịkwa n’ofe ụdị dị iche iche dị ka ihe ngwọta maka ihe mberede a.
6.3 Java: Nyochaa onye mbipụta, n’ezie JVM yana ihe agbakwunyere
Ndepụta mbido:
java -XshowSettings:properties -versionjava.home, java.runtime.version na onye mbipụta na mmepụta ga-adakọrịrị na JVM nke ọrụ ahụ ji n’ezie. Maka JVM nwere ikike mgbakwunye, jcmd nke JDK nwere ike iji lelee usoro ebumnuche, ọ bụghị naanị shei nbanye.
Lelee ndabere na ọrụ ntụkwasị obi wee họrọ dabere na ngwa nrụpụta n’ezie:
./mvnw dependency:tree '-Dincludes=org.apache.tomcat.embed:*,org.springframework.security:*,org.springframework.graphql:*'
./gradlew dependencyInsight --dependency tomcat-embed-core --configuration runtimeClasspath
./gradlew dependencyInsight --dependency spring-security-core --configuration runtimeClasspath
./gradlew dependencyInsight --dependency spring-graphql --configuration runtimeClasspathIwu iwu ụlọ ndị a nwere ike mebe nkwụnye ma dozie ndabere na ntanetị, ma na-arụ ọrụ naanị na ntụkwasị obi. Lelee JAR/WAR ikpeazụ ma ọ bụ JAR n’ezie dị na onyonyo a ma dochie nkwupụta faịlụ wuo maka arịa ikpeazụ. Spring Boot agbakwunyere Tomcat chọrọ iwughachi ngwa ahụ; imelite nrụnye Tomcat dị iche na sistemụ agaghị agbanwe otu ngwungwu ngwa.
Mgbe emelitechara oge ojiri gaa, lelee javax.net.ssl.trustStore ahaziri ahazi, ngwa KeyStore bufere onwe ya, jlink runtime, GraalVM/ihe onyonyo ala na ụdị nnyefe ndị ọzọ ihe site na ihe. Ngwa nwerelarị ihe ntụkwasị obi ahaziri ahazi enweghị ike ịkwụsị nlele ahụ naanị n’ihi na akwụkwọ ndekọ aha JDK ghọrọ ọhụrụ.
6.4 Python: Onye ntụgharị okwu na nhazi gburugburu ebe obibi mebere.
N’ime ezigbo venv/akpa ekwenyere na a ga-atụkwasị ya obi:
python - <<'PY'
import sys
import ssl
import importlib.metadata as metadata
print("executable:", sys.executable)
print("version:", sys.version)
print("openssl:", ssl.OPENSSL_VERSION)
print("verify_paths:", ssl.get_default_verify_paths())
for name in ("pip", "certifi", "Django", "urllib3", "Brotli", "litellm"):
try:
print(name + ":", metadata.version(name))
except metadata.PackageNotFoundError:
print(name + ": not installed")
PY
python -m pip --version
python -m pip checkEdemede a na-anakọta naanị ozi ma ọ naghị eme mkpebi ntozu ụdị. ssl.get_default_verify_paths() bụ ozi ụzọ ndabara na enweghị ike igosipụta na ndị ahịa ndị ọzọ na-eji otu ụlọ ahịa ntụkwasị obi; ekwesịrị ịkwado ya dabere na nhazi ngwa.
Mgbe ịmechara nkwalite buut pip ntụkwasị obi nke ihe mgbakwunye S37, melite ndabere asambodo dịka mmachi ọrụ siri dị, dịka ọmụmaatụ:
python -m pip install --upgrade 'certifi>=2026.10.19'
# 仅适用于当前就选择 Django 5.2 的项目
python -m pip install --upgrade 'Django>=5.2.18,<5.3'
python -m pip checkỌ dị mkpa ka emelite ihe achọrọ/faịlụ mkpọchi a n’otu oge, ma ọ bụghị ya, ntinye ọzọ nwere ike ịlaghachi na ụdị ochie. Mgbe ị na-eji uv, uri, ma ọ bụ ụlọ ọrụ ngwungwu ụlọ ọrụ, jiri usoro mkpochi na mbipụta ha dị ugbu a; ejikwala aka gbanwee ngwugwu naanị n’ime akpa mmepụta.
Enwere ike iji usoro ọrụ pip-audit dị ugbu a iji lelee adịghị ike ndabere amaara na gburugburu ebe ntụkwasị obi; ọ bụghị nyocha koodu ọjọọ ma ọ naghị ekpuchi onye ntụgharị okwu niile, ọbá akwụkwọ sistemụ yana ihe egwu ụlọ ahịa ntụkwasị obi. S44
A naghị atụ aro ịmanye sistemu ahụ /usr/bin/python3 ka ọ rụtụ aka na ụdị agbakọtara ọhụrụ. Jiri mmelite nche ntọhapụ ma ọ bụ oge iche iche ọrụ iji zere imebi ngwaọrụ njikwa na-adabere na sistemụ Python. Nke a bụ nhọrọ mmejuputa iwu na ọ bụghị ihe ndozi ọzọ achọrọ maka adịghị ike a.
6.5 wughachi ma dochie ihe atụ na-agba ọsọ
A na-atụ aro ka eme usoro ndị a dị ka mgbanwe zuru oke:
- Nweta patch site na isi mmalite ntụkwasị obi wee chekwaa ụdị/hash na mkpọchi ndabere.
- Weghachite ọrụ igodo na gburugburu nso nso a na-emepụta ma gosi na ndọtị nke ala dakọtara na JVM/framework.
- Melite oge ịgba ọsọ, ndabere ngwa na ụlọ ahịa ntụkwasị obi n’ezie; weghachi onyonyo isi na sistemu CA maka akpa ahụ, ọ bụghị naanị iji oyi akwa ochie.
- Wulite ngwa na onyonyo, ma dochie ọrụ, onye ọrụ, ndị na-azụ ahịa kwụ n’ahịrị, na ihe omume ahaziri n’usoro n’usoro.
- Lelee ụdị na nhazi ya na ihe atụ ọsọ ọhụrụ wee gosi na mbipụta ochie apụọla.
- Lelee ọnụego mperi, latency, CPU/memory, TLS ọdịda aka aka, yana usoro mkpọka.
Ndaghachi azụ kwesịrị ibute ụzọ maka idowe oge ojiri mara mma na nkwado ndabere, na ịtụgharị nhazi ngwa ma ọ bụ mgbanwe azụmaahịa. Ọ bụrụ na ị ga-alaghachi na ngwaahịa ochie nke nwere adịghị ike, a ga-eweghachi ihe mgbochi ntinye kwekọrọ n’otu oge, na onye ọrụ ahụ na oge mgbake kacha nta kwesịrị ịkọwa nke ọma.
7. Mbelata nwa oge na nhọrọ patch
7.1 Mkpuchi oke nke usoro nwa oge
Ndị a bụ aro mmejuputa iwu dabere na ọnọdụ ojiji ekwuputara. Ọ gwụla ma achọpụtara atụmatụ gọọmentị, onye na-ere ahịa anaghị ekwe nkwa na enwere ike igbochi ụdị niile dị iche iche.
| ihe ize ndụ | Usoro nwa oge enwere ike ịme | Akụkụ na-enweghị ike iche na emechara dabere na nke a |
|---|---|---|
| Ndozi Brotli | Kwụsị ntinye ntinye enweghị ntụkwasị obi; lelee inbound na ọpụpụ akpaka decompression | Inbound WAF ma ọ bụ gbanyụọ mkpakọ nzaghachi anaghị ekpuchi ndenye ngbanwe niile S3 |
| Next.js typed arrays RCE | Kwalite ozugbo; kewapụ ọrụ emetụtara nwa oge ma ọ dị mkpa | Ọ nweghị ọrụ a pụrụ ịdabere na ya zuru ụwa ọnụ S9 |
| Next.js SVG RCE | Atụmatụ gọọmentị: Gbaa mbọ hụ na ≥0.35.5 dị nkọ; kwụsịtụ ntinye njikarịcha dị mkpa mgbe azụmahịa nyere ikike | Ọ naghị ekpuchi okwu Next/RSC S11 |
| Tomcat Mpaghara / HTTP/2 / AJP | Kewapụ ụzọ kwekọrọ ma mechie njikọ ndị na-adịghị mkpa | Ka chọrọ ngwugwu nrụzi alaka ụlọ ọrụ kwekọrọ S21S22S23 |
| Mwepu GraphQL | Kwụsịtụ mpaghara Njikọ emetụtara; machibido ndị ọkpụkpọ na-atụkwasịghị obi | Naanị oke ogologo ịrịọ arịrịọ enweghị ike idozi nsogbu ụdị / ntọhapụ S25 |
| Spring embedded LDAP | Gbanyụọ mgbe ọ dịghị mkpa; kpachapụ anya nke ọdụ ụgbọ mmiri na-ege ntị n’ezie | A ka ga-enyocha njirimara nchịkwa na ndekọ aha ya S27 |
| CPython SNI UAF | Atụmatụ gọọmentị: Debe ntụaka dị mkpa SSLContext ruo ọgwụgwụ nke ọrụ | Ụzọ niile ịmepụta/mgbanwe ga-ekpuchirịrị S29 |
| Python aha nnabata mafere | Ngwọta gọọmentị: Nyefee aha server_hostname a tụrụ anya ya nke ọma | Enweghị ike ịlele ọkọlọtọ check_hostname ma ọ bụ leghara ịdọ aka ná ntị S30S31 |
| tar na-enweghị ntụkwasị obi | Gbanyụọ/kpọpụ iche, jụ njikọ na ndenye ngwaọrụ na-adịghị mkpa | Ma ihe nzacha ma ọ bụ oke akụrụngwa bụ igbe ájá zuru ụwa ọnụ S32S40S45 |
| Mmemme ntụkwasị obi asambodo | Melite ihe CA ziri ezi; Enwere ike igbochi ntụkwasị obi Java dịka mbelata gọọmentị siri dị | Ịkwụsị nkwenye TLS na-abawanye ihe egwu S19S37 |
7.2 Họrọ patch dabere na usoro nnyefe
| Usoro nnyefe | Nye ụzọ nrụzi ụzọ | Ihe akaebe kwesịrị idowe |
|---|---|---|
| Oge ojiri mara nkesa | Mmelite nche kwekọrọ ekwekọ nke onye nrụpụta | Ụdị ngwugwu zuru ezu, ọkwa ọkwa, ebe nchekwa |
| Onye njikwa ọnụọgụ abụọ/Oge ọrịre | Ntọhapụ nchekwa gọọmentị sitere n’otu alaka ahụ | Versiondị, isi mmalite na mgbari, ụzọ ogbugbu n’ezie |
| Node / CPython chịkọtara onwe ya | Mwepụta isi mmalite nke alaka ụlọ ọrụ dabara adaba ma ọ bụ ihe ngwugwu zuru oke nke onye na-ere ya | Kpebisie ike, wuo paramita, ọba akwụkwọ dabere na nsonaazụ nlọghachi |
| Spring / Next / Django | Dakọtara na mmelite n’ime ngalaba, wughachi mkpọchi ndabere yana ngwa ikpeazụ | Osisi ndabere ikpeazụ, ụdị n’ezie na JAR/ngwugwu/onyinyo |
| Ụlọ ahịa ntụkwasị obi omenala | Atụmatụ ndọrọ ndọrọ ọchịchị ma ọ bụ nwelite onye na-ere ahịa na-akwado nwepụ ahụ | Ụzọ ojiji n’ezie, mgbanwe ihe, ihe ịga nke ọma TLS na ule ịjụ |
| Ebe emebiela | wughachi site na ngwaahịa dị ọcha na ntụkwasị obi wee mee nyocha ihe merenụ dị iche iche | Ngwungwu akụkọ ihe mere eme/nchịkọta onyonyo, ndekọ nrụnye, ndekọ ntụgharị nzere |
7.3 Usoro nchichi igodo na nleba anya nyocha
- Brotli: na-elebara anya ma nlele ókèala na nloghachi njehie nke ọnọdụ ngbanwe nke nwa afọ ezuola tupu ịbanye n’ime ụlọ ahụ; naanị dochie ngwugwu JavaScript enweghị ike ịgbanwe koodu a chịkọtara nke ọma na Node. S4
- Node DNS / TLS : na-elekwasị anya n’ajụjụ ntinye, nhazi adreesị, ọdịiche dị n’etiti IP SAN na DNS njirimara, na DNS akpọghachite/Nkwa Nkwa ụzọ ntule na TLS ule egwuregwu aha nnabata. S5 S6
- Tomcat JNDIRealm: na-elekwasị anya ma usoro nyocha n’ezie na-enyocha nzere, kama ịnweta naanị ndekọ ndekọ; na-ebute ụdịdị gọọmentị ụzọ na-adịghị emeso otu isi iyi faịlụ nnọchi dị ka patch ọnụọgụ abụọ zuru oke. S24
- CPython ssl: na-elekwasị anya na Python ntinye aka na usoro ndụ nke SSLContext dị n’okpuru;
wrap_bio()backports mgbe ị na-enwe ọdịiche ndakọrịta alaka ụlọ ọrụ, ma ị ga-agụrịrị mmejuputa nke alaka ụlọ ọrụ eji. S31S47 - Akwụsịghị ntụkwasị obi akwụkwọ: Mmelite ndị dị otú ahụ nwere ike ịpụta dị ka ihe ntụkwasị obi ma ọ bụ jụ mgbanwe ndepụta karịa mgbanwe API doro anya. Otu ogbe nke Node tinyekwara usoro njụta nke etiti etiti CA emetụtara; Ebe ntụkwasị obi nke Java na Python ka kwesịrị ka enyocha ya iche. S19S37S46
Nnwere onwe Brotli Ekwesịrị ịlele njide. E wepụtara Google upstream 1.0.10 / 1.1.1 / 1.2.1 n’otu ụbọchị ahụ iji dozie CVE-2026-111497 . Python ihe ndọtị nke ala ma ọ bụ ihe nka JNI nke tinyere otu mmejuputa iwu C metụtara kwesịrị ka emelite ya na onwe ya; a pụghị ikwu na ha niile dị ọcha Java emetụta decoders, ma ọ bụ enweghị ike iche na nkwalite Node na-edochi anya oyiri n’asụsụ ndị ọzọ na-akpaghị aka. S42
8. Nyochaa nyocha na nyocha
8.1 ndepụta nyocha kacha nta
| Lelee ihe | Achọrọ ihe akaebe |
|---|---|
| oge ojiri gaa | Ụdị zuru ezu ma ọ bụ onye na-ere ihe n’azụ ihe akaebe ziri ezi na ezigbo usoro/akpa |
| dabere ngwa | Next/RSC/ nkọ, Tomcat/Spring, na Django/certifi na ikpeazụ ntinye ngwaahịa abanyela kwekọrọ ekwekọ |
| Oke nnọchi | Ndị ọrụ niile/JVM/container oyiri na ọrụ ndabere ka ejiri nke ọhụrụ dochie ya, ma oge ochie apụọla. |
| TLS | Asambodo ngalaba dabara adaba; aha nnabata ekwekọghị ekwekọ na agbụ na-ezighi ezi na-ada dịka amụma siri dị; agụnyere ụlọ ahịa ntụkwasị obi omenala |
| eMudhra enweghị ntụkwasị obi | Ajụrụ yinye akwụkwọ ikike nke etiti etiti CA emetụtara n’oge oge ojiri gaa, ma ọ bụ enwere ihe akaebe na etinyela ndepụta njụta nke onye na-ere ahịa kpọmkwem; Enweghị ike imechi ikpe ahụ dabere na ule TLS izugbe ma ọ bụ nọmba ụdị nkenke Java 8. |
| Node ngbanwe na onyonyo | Nzaghachi abịakọrọ nkịtị, bulite, njikarịcha onyonyo yana ọrụ RSC dị; amụma isi iyi enweghị ntụkwasị obi na-arụ ọrụ |
| Nyocha na ikewapụ Java | Ajụjụ okwuntughe na-ezighi ezi; onye ọrụ nọọrọ onwe ya na-arịọ arịrịọ asynchronous na-enweghị njirimara/agwakọta nzaghachi; LDAP na-ege ntị ka a tụrụ anya ya |
| Python SNI / ebe nchekwa | Azụmahịa ọtụtụ ngalaba aha TLS kwụsiri ike; idebe akwụkwọ na-ajụ ịgafe ụzọ yana njikọ anabataghị, yana faịlụ ndị na-abụghị akwụkwọ ndekọ aha agbanwebeghị |
| Data na nrụghachi ọrụ | Ibe akwụkwọ, ajụjụ gbasara ohere, nlele ikike na ọrụ ndabere gafere ule dị adị nke ọrụ ahụ |
| Akụrụngwa na Nlebanya | Enweghị mmụba na-adịghị mma na CPU, ebe nchekwa, ọnụego njehie, nkwụsịtụ na njehie TLS. |
| Nchọgharị | Chekwa oge nkwalite, ngwungwu/ngwugwu onyonyo, mgbanwe nhazi, nsonaazụ nkwenye na ihe edozibeghị |
Ndị a bụ ndụmọdụ nnabata mmejuputa iwu na achọghị ka ewepụtara edemede ọgụ maka CVE ọ bụla. Nkwenye metụtara mkpọka, ike ọgwụgwụ akụrụngwa, na ebe a na-edebe ihe ochie kwesịrị iji nnwale nlọghachi azụ ma ọ bụ data nyocha nke na-achịkwa ọrụ na gburugburu dịpụrụ adịpụ.
8.2 Patching na intrusion nyocha bụ ọrụ dị iche iche
Lelee ndekọ dị ugbu a maka njehie ndozi koodu na-adịghị ahụkebe, onye ọrụ/JVM mkpọka, faịlụ enyo enyo na-ede, mgbanwe data ndekọ, ewepụrụ nyocha, arịrịọ ọpụpụ na ndekọ ojiji nzere. Ihe ịrịba ama ndị a kwesịrị ikpe ikpe n’ọnọdụ ya: okuku ma ọ bụ OOM abụghị ihe akaebe nke nrigbu na-aga nke ọma; enweghị ọkwa ọkwa adịghị egosi na emetụtaghị sistemụ arụmọrụ.
Mgbe achọpụtara mgbanwe na-enweghị ikike, nzere mebie, ma ọ bụ nkwenye obi ọjọọ, ekwesịrị idobe ihe akaebe, kewapụrụ ihe ndị dị mkpa, nzere emetụtara tụgharịrị site na gburugburu ebe ntụkwasị obi, wee wughachi sistemụ ahụ. Ihe mgbochi ahụ agaghị ewepụ akara ndị onye mwakpo nwetara ma ọ bụ weghachi data emezigharịrị.
9. Nchekwa n’agbụ ọkọnọ: nkwenye LiteLLM 1.107.0
**Official ụbọchị nkwenye: 2026-10-21.**LiteLLM kọrọ na a mebiri pipeline ewepụtara ya. PyPI’s litellm==1.107.0 yana ụfọdụ ngwaahịa Docker/GHCR nke otu oge nwere izu ohi nzuzo yana koodu ọjọọ njikwa anya, na ewepụrụ ngwaahịa ndị metụtara ya. S41
Iji chọpụta mmetụta ahụ, ị ga-elele ndekọ ndekọ ntinye akụkọ ihe mere eme na mgbaze ihe oyiyi; akara dị ka latest, main-latest, na main-stable ugbu a na-arụtụ aka na ihe oyiyi dị ọcha, nke na-egosighi na ngwaahịa ndị a dọtara n’oge ihe ahụ mere dị ọcha. Ndụmọdụ gọọmentị n’oge ahụ bụ ka a tụnye 1.106.2 nwa oge; ndụmọdụ a dabere na ihe omume a, yana ọkwa nchekwa ndị ọzọ ka kwesịrị ịlele n’oge mbugharị. S41
Maka gburugburu ebe etinyere ma ọ bụ rụọ ọrụ metụtara ngwaahịa:
- Kewapụ ma chekwaa ndekọ nrụnye, onyonyo na ndekọ, wee lelee ha site na gburugburu ebe dị ọcha.
- Abu ụzọ malite Python/pip na ebe a na-enyo enyo; Enwere ike igbu
.pth/sitecustomize.pyọjọọ ọzọ ka ịmalitechara. - wughachi ndị ọbịa, venvs / akpa sitere na isi mmalite ndị tụkwasịrị obi; enweghị ike iwepụ ma ọ bụ wetuo ngwugwu.
- Wepụ/gbanwee nzere igwe ojii, igodo ndị na-eweta LLM, igodo LiteLLM na nzere nchekwa data dabere na nnweta n’ezie yana nyochaa ojiji na-adịghị mma. S41
Nke a bụ ihe mere n’agbụ ọkọnọ enwetara ma na-achọ nleba anya maka mkpochapụ koodu ọjọọ, ntapu nzere, na ihe egwu nnọgidesi ike mgbe ị na-eme ya. Ka ọnwa Ọktoba 23, 2026, ndị ọrụ gọọmentị ka na-enyocha ntinye mbụ ahụ.
Ihe mgbakwunye: isi mmalite na njikọ ndị edepụtara
Ụbọchị nkwenye isi mmalite na-esote bụ 2026-10-23, gụnyere ọkwa nchekwa ọrụ nke ọrụ ahụ, ebe nchekwa koodu gọọmentị na ntuziaka onye na-ere ahịa. Isi ederede [Sx] dabara na mgbakwunye a; mgbe ị na-eme mmelite, ị kwesịrị ịlele ma onye na-ebubata ya ewepụtala nlegharị anya na-esote.
S1 — Node.js: 2026-10-21 Ozi Nchekwa
- Ebumnuche: Oge ịgba ọsọ anọ High, na-emetụta alaka, mwepụta nchekwa October.
- Ntụaka: Official Security Bulletin
S2 - Node.js: ntuziaka mwepụta gọọmentị maka ahịrị mmezi atọ
- Ebumnuche: Lelee 22.23.4, 24.22.1, 26.12.1 na ezigbo patches jikọtara ọnụ.
- Ntụaka: Node.js 22.23.4
- Ntụaka: Node.js 24.22.1
- Ntụaka: Node.js 26.12.1
S3 — Vercel: Node.js Brotli RCE ndụmọdụ nchekwa
- Ebumnuche: Ọnọdụ ngbanwe mbata/ọpụpụ, oke mkpuchi WAF, ọkwa Node 20.
- Ntụaka: Node.js security advisory: Brotli decoder RCE
S4 — Node.js: Brotli ikike nrubeisi patch
- Nzube: Ndabere mmejuputa maka ịlele ngbanwe nke ala na mgbasa ozi.
- Ntụaka: Brotli Patch commit 49dff6f57a
S5 — Node.js: TLS adreesị normalization patch
- Ebumnuche: Nnwale njirimara asambodo nke ọnụọgụ zuru oke yana IP na-abụghị ọkọlọtọ.
- Ntụaka: IP normalization regression Patch
- Ntụaka: rejects the patching of non-standard IP address
S6 — Node.js: DNS NUL patch nkwenye
- Ebumnuche: Ọjụjụ ntinye na mkpuchi nlọghachi azụ.
- Ntụaka: dns.resolve Input verification patch
S7 — Node.js: 2026-07-29 Ozi Nchekwa
- Ebumnuche: HTTP/2 ike ọgwụgwụ ebe nchekwa, UAF na adịghị ike ụdị ikike.
- Ntụaka: July 2026 Security Releases
S8 - Next.js: 2026-10-14 nwelite nche.
- Ebumnuche: Mekọrịta ntọala nkwalite yana ihe egwu atọ dị mkpa.
- Ntụaka: Next.js Security Update for Upstream Vulnerabilities
Ntụaka: S9 — Next.js：typed arrays / use cache RCE
- Ebumnuche: GHSA-673q-mjm6-r5xr; na-emetụta etiti oge, ọnọdụ, akara na ọnọdụ ọrụ.
- Ntụaka: Next.js Official Security Bulletin
Ntụaka: S10 — React：React Server Components RCE
- Ebumnuche: GHSA-xqc2-xf4c-x3h3; Ụdị emetụtara na nke edoziziri nke ngwugwu RSC atọ.
- Ntụaka: React Official Security Bulletin
Ntụaka: S11 — Next.js：SVG Image Optimization RCE
- Ebumnuche: CVE-2026-96889 / GHSA-2464-fhr4-w9xw; glibc, nkọ na oke ụdịdị mbụ.
- Ntụaka: SVG Image Optimization Official Security Bulletin
Ntụaka: S12 — Next.js：Server Actions DoS
- Ebumnuche: GHSA-p3m5-59mp-jv5r; na-emetụta ọnọdụ, ụdị na ọkwa.
- Ntụaka: Server Actions DoS Official Security Bulletin
S13 — Next.js: AVIF njikarịcha onyonyo RCE
- Ebumnuche: 2026-08-25, GHSA-2xp9-vwfh-vxw4.
- Ntụaka: AVIF Official Security Bulletin
Ntụaka: S14 — Next.js：Windows RCE
- Ebumnuche: 2026-08-25, CVE-2026-75604/GHSA-p293-qw3h-jr36.
- Ntụaka: Windows RCE Official Security Bulletin
Ntụaka: S15 — Next.js：next/og ImageResponse RCE
- Ebumnuche: 2026-09-22, GHSA-vcvr-r3jv-pc5j; Ọdịiche dị n’etiti Node na Edge.
- Ntụaka: ImageResponse Official Security Bulletin
- Ntụaka: September 22 release notes
Ntụaka: S16 — Oracle: October 2026 CPU
- Nzube: Java SE matriks ihe ize ndụ, ọnụọgụ patch na ọnọdụ ọdabara.
- Ntụaka: Oracle Critical Patch Update – October 2026
- Ntụaka: Oracle Java SE CPU Version list
S17 — Oracle: CVE-2026-91403 mkpu na-apụ apụ
- Ebumnuche: 2026-10-21, JSSE akwụkwọ ntụkwasị obi ize ndụ, emetụta ngwaahịa na CVSS 3.1 9.1.
- Ntụaka: Oracle Security Alert
S18 — Oracle: JDK ụdị na nbudata gọọmentị
- Ebumnuche: Chọpụta ọdịiche dị n’etiti CPU na October 20th na ụdị nke na-apụ apụ na October 21st; ịmata oke oke nke ụdị dị mkpụmkpụ nke Java 8.
- Ntụaka: JDK release list
- Ntụaka: Oracle Java Download page
S19 — Oracle: eMudhra atụmatụ iwepụ nwa oge
- Ebumnuche: emelitere 2026-10-22; Asambodo mgbọrọgwụ abụọ, keytool, truststore omenala, na nlele mwepu.
- Ntụaka: Distrusting eMudhra Intermediate Certificates in Oracle JDK
S20 — Eclipse Adoptium: Wepụta ndekọ wuo
- Nzube: Temurin ka eweghachitere n’ihi ihe mere akwụkwọ; enweghị ike itinye suffix ụdị Oracle n’ọrụ.
- Ntụaka: Adoptium Release Scorecards
S21 — Apache Tomcat 9 ọkwa nchekwa
- Ebumnuche: nkeji oge emetụtara alaka 9 yana ndozi 9.0.123.
- Ntụaka: Tomcat 9 vulnerabilities
S22 — Apache Tomcat 10 ọkwa nchekwa
- Nzube: 10.1 alaka ụlọ ọrụ kpọmkwem etiti oge na 10.1.61 mmezi; 10.0 EOL.
- Ntụaka: Tomcat 10 vulnerabilities
S23 — Apache Tomcat 11 ọkwa nchekwa
- Ebumnuche: Ihe atọ Important, 11.0.27, AJP nwere ike ọdabara na ogo na ụbọchị mkpughe/mwepụta.
- Ntụaka: Tomcat 11 vulnerabilities
S24 — Apache Tomcat: JNDIRealm kwachie nkwa.
- Ebumnuche: Ndabere maka ịrụzi oghere nkwenye asambodo.
- Ntụaka: JNDIRealm Patch commit
Ntụaka: S25 — Spring：GraphQL CVE-2026-59285
- Ebumnuche: 2026-08-20, achọrọ, 2.0.5 OSS / 2.0.4.1 Mmezi azụmahịa.
- Ntụaka: Spring for GraphQL Unsafe Deserialization
Ntụaka: S26 — Spring：GraphQL CVE-2026-41699
- Nzube: Ndozi ụzọ na mbụ, naanị iji kọwaa ihe kpatara na ị nweghị ike ịnọ na ntọala ochie.
- Ntụaka: 6 Month GraphQL Security Bulletin
Ntụaka: S27 — Spring Security：CVE-2026-59270
- Ebumnuche: Embed UnboundID LDAP, njirimara njikwa ama ama yana ọdịiche OSS/ụdị azụmahịa.
- Ntụaka: Spring embedded LDAP Security Bulletin
Ntụaka: S28 — Spring Security：CVE-2026-47841
- Ebumnuche: Nyocha onye ọrụ WebAuthn, nhazi oge na ebe mbuso agha.
- Ntụaka: WebAuthn Security Bulletin
S29 — PSF: CVE-2026-19445 Ndụmọdụ nchekwa nọọrọ onwe ya
- Ebumnuche: 2026-09-30, Critical, SNI Ọnọdụ na usoro nwa oge nke SSLContext zoro aka na ya.
- Ntụaka: SSLContext UAF Official announcement
S30 — PSF: CVE-2026-19553 Ndụmọdụ nchekwa nọọrọ onwe ya
- Ebumnuche: 2026-09-30, High, aha nnabata na-efu efu yana mbelata oke nrụzi.
- Ntụaka: wrap_bio Official announcement of hostname verification
S31 - CPython: wrap_bio ukara patch na azụ azụ 3.12
- Ebumnuche: 3.10—3.12 amụma ndakọrịta ịdọ aka ná ntị, ọdịiche dị n’etiti None na eriri efu.
- Ntụaka: Main Patch PR #158503
- Ntụaka: 3.12 Backfill PR #158513
- Ntụaka: 3.15 Backfill PR #158511
S32 — PSF: CVE-2026-82049 Ndụmọdụ nchekwa nọọrọ onwe ya
- Ebumnuche: 2026-09-14, High, njikọ njikọ, mgbanwe metadata na mkpughe ọdịnaya.
- Ntụaka: tarfile link bypasses the official announcement
S33 - CPython: Mwepụta nchekwa gọọmentị na njedebe nke Septemba / mbido October
- Ebumnuche: ụdị ndozi kacha nta, usoro nkesa koodu isi iyi yana ahapụ 3.14 maka nsogbu tarfile.
- Ntụaka: Python Cross-branch security release instructions
- Ntụaka: Python 3.11.17
- Ntụaka: Python 3.12.15
- Ntụaka: Python 3.13.16
- Ntụaka: Python 3.14.8
S34 — CPython: 3.10 ntọhapụ nchekwa ikpeazụ
- Ebumnuche: 3.10.22 na njedebe nke usoro ndụ elu.
- Ntụaka: Python 3.10.22
S35 — CPython: 2026-10-21 ụdị mmezi ihe mberede
- Ebumnuche: mmelite 3.13.17 / 3.14.9 / 3.15.1, arụnyere n’ime pip yana certifi mmelite, chọrọ venv dị adị.
- Ntụaka: Python 3.13.17
- Ntụaka: Python 3.14.9
- Ntụaka: Python 3.15.1
S36 — certifi: emSign akwụkwọ ọkwa ọkwa enweghị ntụkwasị obi
- Ebumnuche: 2026-10-20, GHSA-6q48-6c7w-9gw2, Critical, amaghị CVE.
- Ntụaka: certifi Official Security Bulletin
S37 — PSF: Mmetụta nke eMudhra / emSign na ndị ọrụ Python
- Ebumnuche: ntụnye certifi .19, pip/uv ndabere, iwu nkwalite buut ntụkwasị obi nwere SHA-256.
- Ntụaka: PSF Official event and upgrade instructions
Iwu nkwalite buut pip nyere site na ntuziaka gọọmentị nke S37 zoro aka na ya bụ nke a. A ga-eji naanị na gburugburu Python nke ekwenyela na ọ bụ ntụkwasị obi; ọ bụrụ na enwere enyo nke nsị na Nkeji 9, buru ụzọ kewapụ ma wughachi ya dịka usoro ihe omume ahụ siri dị. Ọ na-edozi hash ọdịnaya wheel wee mechaa melite ndabere ndị ọzọ dịka usoro ọrụ siri dị.
python -m pip install "pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70"S38 — Django: 2026-08-04 mma ntọhapụ
- Ojiji: CVE-2026-15307, GeoDjango ọnọdụ nrigbu, ndozi mbụ na mgbanwe ndakọrịta.
- Ntụaka: Django 6.0.8 / 5.2.17
S39 — Django: 2026-10-06 mma ntọhapụ
- Ebumnuche: CVE-2026-87890, geometry DoS na-esote nkwado ya na usoro ntọala ahọpụtara ugbu a.
- Ntụaka: Django 6.1.2 / 6.0.9 / 5.2.18
S40 — PSF / CPython: ndetu akụkụ tar_filter kacha ọhụrụ
- Ebumnuche: 2026-10-22, CVE-2026-114583 (Medium); Njikọ PR apụtaghị na ewepụtala ụdị mmezi ọrụ.
- Ntụaka: PSF Independent Announcement
- Ntụaka: CPython Patch PR #160098
S41 — LiteLLM: mkpesa mbubata ihe mberede, Ọktoba 21
- Nzube: 1.107.0 ngwaahịa emetọọ, mgbari akụkọ ihe mere eme, mwube iche na mkpofu nzere.
- Ntụaka: Contained: LiteLLM v1.107.0 Compromised
S42 — Google Brotli: ụdị echedoro gọọmentị
- Ebumnuche: Brotli 1.0.10 / 1.1.1 / 1.2.1 nọọrọ onwe yana ndabere nkwenye agbakwunyere n’asụsụ obe.
- Ntụaka: Brotli releases
S43 — mise: jiri akwụkwọ gọọmentị nyere iwu
- Nzube: Ezipụta ụdị ngwá ọrụ na iwu semantics nke nhazi ụwa.
- Ntụaka: mise use
S44 — PyPA: pip-audit ọrụ oru ngo.
- Ebumnuche: Python Ebumnuche na oke ikike nke nyocha adabereghị na ya.
- Ntụaka: pip-audit
S45 - Python: akwụkwọ nzacha tarfile
- Ebumnuche: atụmatụ data, mgbanwe omume ndabara, yana mmachi na-enweghị ike dochie igbe ájá.
- Ntụaka: tarfile extraction filters
S46 — Node.js: Usoro njụta CA etiti
- Ebumnuche: Nhazi usoro ntụkwasị obi metụtara eMudhra a abụghị ihe nbibi nke asambodo mgbọrọgwụ niile.
- Ntụaka: Node.js PR #66871
S47 — CPython: SNI UAF ndetu teknụzụ na ndozi.
- Nzube: ntụaka okirikiri ndụ, pụrụ iche ewu ọnọdụ na alaka backtracking.
- Ntụaka: official issue #156293
- Ntụaka: official patch PR #158504
- Ntụaka: 3.15 Backfill PR #158514