Security vulnerabilities and automated fixes for unicode issues
5 posts found
CVE-2026-13676 is a high-severity vulnerability in the `fast-uri` npm package where improper Unicode hostname canonicalization allowed attackers to bypass security policies by crafting hostnames that appeared safe but resolved differently after normalization. The fix upgrades `fast-uri` from version 3.1.2 to 4.1.2 and pins the version using an npm `overrides` directive in `package.json` to ensure no transitive dependency pulls in the vulnerable version.
A high-severity vulnerability (CVE-2026-13676) in the fast-uri npm package allowed attackers to bypass security policies through improper Unicode hostname canonicalization. The fix upgrades fast-uri from version 3.1.2 to 4.1.2 using npm overrides to ensure the patched version is used throughout the dependency tree of the cc-viewer project.
CVE-2026-56852 is a high-severity Denial of Service vulnerability in the `golang.org/x/text` package where a `norm.Iter` iterator can enter an infinite loop when processing certain invalid UTF-8 input sequences. Applications using `golang.org/x/text` v0.37.0 or earlier that accept untrusted text input are at risk of complete service disruption. The fix is a one-line dependency bump in `go.mod` from v0.37.0 to v0.39.0.
CVE-2026-56852 is a high-severity vulnerability in golang.org/x/text that allows the Unicode normalization iterator to enter an infinite loop when processing specially crafted input. This fix upgrades the dependency from v0.37.0 to v0.39.0, tightening input validation and preventing denial-of-service attacks in applications that process untrusted Unicode text.
A medium-severity vulnerability in node-tar (CVE-2026-24842) allowed attackers to create arbitrary files outside intended directories by exploiting Unicode path collisions in hardlink security checks. This race condition could enable malicious tar archives to overwrite critical system files, potentially leading to remote code execution or privilege escalation.