Denial of service

7 articles

Every Citrix NetScaler needs this week's update. 28 bugs let strangers crash the remote-work login page (CVE-2026-120868)

How to fix CVE-2026-120868: upgrade NetScaler ADC and Gateway to 14.1-73.58 or 13.1-64.39. Citrix fixed 28 bugs on Nov 12, and this one hits every NetScaler in its default setup with no workaround. Boxes patched in October are exposed again. No attacks reported yet.

HOL GuardNov 12, 2026

BreakingCVE

Node.js fixes 16 bugs that let strangers crash servers or read other users' data (CVE-2026-123864)

How to fix CVE-2026-123864: upgrade Node.js to 22.23.5, 24.22.3 or 26.13.1 and restart. The Nov 11 security release fixes 16 bugs, mostly in Node's own HTTPS and HTTP/2 servers: one leaks other connections' memory, including TLS keys, and several let anyone crash the server. Apps on plain HTTP behind a proxy are not exposed to most of them.

HOL GuardNov 11, 2026

CVECisco

Attackers are rebooting Cisco ASA and FTD firewalls through the SSL VPN login. CVE-2026-76418 is on CISA KEV, due Nov 1

How to fix CVE-2026-76418: upgrade Cisco ASA to 9.20.4.50, 9.22.3.200 or the fixed release on your train, and FTD to 7.4.9, 7.6.7 or later. Exploited as a zero-day, added to CISA KEV on Oct 29. It reloads firewalls with secondary VPN auth; it does not run code.

HOL GuardOct 29, 2026

CVENextjs

Next.js 16.4.1 and 15.5.28 security update: two RCEs fixed, check sharp too (CVE-2026-96889, CVE-2026-126187)

How to fix CVE-2026-96889 and CVE-2026-126187: upgrade next to 16.4.1 (or 15.5.28) and confirm sharp is 0.35.5. The October 14 Next.js and React releases close two unauthenticated RCEs and a Server Actions DoS.

HOL GuardOct 14, 2026

CVECompression

CVE-2026-87776: Express compression leaks native memory until the process dies

How to fix CVE-2026-87776: upgrade compression to 1.8.2

HOL GuardSep 11, 2026

CVEUndici

CVE-2026-85024: undici WebSocket deflate bug can crash the Node process

How to fix CVE-2026-85024: upgrade undici to 8.10.2 (or 7.29.1 / 6.28.1 on older trains)

HOL GuardSep 4, 2026

BreakingCVE

CVE-2026-18549 - @fastify/multipart Aborted Upload DoS

CVE-2026-18549 lets unauthenticated clients leak temp files and hang request handlers in @fastify/multipart <10.1.1, causing disk and event-loop exhaustion. Upgrade to 10.1.1.

HOL GuardAug 16, 2026