Security vulnerabilities and automated fixes for unicode normalization issues
2 posts found
CVE-2026-56852 is a high-severity Denial of Service vulnerability in `golang.org/x/text` where `norm.Iter` can enter an infinite loop when processing invalid UTF-8 input, potentially hanging any Go application that normalizes untrusted text. The fix upgrades `golang.org/x/text` from v0.34.0 to v0.39.0 in `parser/go.mod`, closing the loop condition that malformed byte sequences could exploit. Developers using any version of `golang.org/x/text` below 0.39.0 should upgrade immediately.
CVE-2026-73420 is a critical authentication bypass vulnerability in Auth.js (next-auth) where the email normalizer validates an address before applying Unicode normalization, allowing an attacker to craft an email containing a Unicode homoglyph that looks like "@" to slip past validation and impersonate another user. The fix upgrades next-auth from 4.24.13 to 4.24.15 (and 5.0.0-beta.32 for the beta line), ensuring normalization happens before validation so lookalike characters are resolved to th