“Exposing patches before CVEs since 2025”
Wednesday, August 12, 2026
Feb 13, 2026, 05:21 PM — nodejs/node
Commit: 37ff1ea989af13e47052be2571c3781bc45977d4
Author: Martin Slota
A race condition in HTTP keep-alive socket reuse allowed responseKeepAlive() to be called twice, corrupting socket state and causing the agent to hand an already-assigned socket to multiple requests. This could cause requests to hang, timeout, or potentially leak data between requests sharing the same corrupted socket.
if (req.shouldKeepAlive && req._ended) responseKeepAlive(req);
const http = require('http');
const agent = new http.Agent({ keepAlive: true, maxSockets: 1 });
// Send multiple POST requests with Expect: 100-continue header
// The server responds quickly while client delays req.end() slightly
// This triggers the race where responseOnEnd() and requestOnFinish()
// both call responseKeepAlive(), corrupting the socket and causing
// subsequent requests to hang or timeout due to stripped listeners
for (let i = 0; i < 10; i++) {
const req = http.request({
method: 'POST',
agent,
headers: { 'Expect': '100-continue' }
});
setTimeout(() => req.end(), 0); // Delay to hit race window
}
Feb 13, 2026, 04:30 PM — nodejs/node
Commit: b92c9b5ff5032ba890cb53b8ae70f1eb0e0ca63a
Author: giulioAZ
A Time-of-Check Time-of-Use race condition in worker thread process.cwd() caching allowed workers to cache stale directory values. The counter was incremented before the directory change completed, creating a race window where workers could read the old directory but cache it with the new counter value.
process.chdir = function(path) {
AtomicsAdd(cwdCounter, 0, 1);
originalChdir(path);
};
const { Worker } = require('worker_threads');
const worker = new Worker(`
setInterval(() => {
const cwd = process.cwd();
console.log('Worker sees:', cwd);
}, 1);
`, { eval: true });
// Rapidly change directories
setInterval(() => {
process.chdir('..');
process.chdir('./some-dir');
}, 10);
// Workers will intermittently report incorrect directory paths due to caching stale values with updated counter
Feb 11, 2026, 12:01 PM — grafana/grafana
📈 Patch landed 21 hours 29 minutes before CVE published
Commit: 8dfa6446942873d76cd94c63a2d6b71a25e880da
Author: Mariell Hoversholm
The code was vulnerable to Cross-Site Scripting (XSS) by directly rendering user-controlled data via dangerouslySetInnerHTML without sanitization. Malicious trace data could inject JavaScript that would execute in users' browsers. The patch fixes this by sanitizing HTML content with DOMPurify before rendering.
const jsonTable = <div className={styles.jsonTable} dangerouslySetInnerHTML={markup} />;
where markup could contain:
__html: `<span style="white-space: pre-wrap;">${row.value}</span>`
A malicious trace with a KeyValuePair containing: {"key": "malicious", "value": "</span><script>alert('XSS');</script><span>", "type": "text"} would result in script execution when viewing the trace details in Grafana's TraceView component.
Feb 11, 2026, 12:01 PM — grafana/grafana
📈 Patch landed 21 hours 29 minutes before CVE published
Commit: e97fa5f587c80fc3956faf56e29aa5c717f1bc43
Author: Mariell Hoversholm
The vulnerability allows attackers to bypass time range restrictions on public dashboards when time selection is disabled. By manipulating request time parameters, attackers can access annotations outside the intended dashboard time range, potentially exposing sensitive data from unauthorized time periods.
annoQuery := &annotations.ItemQuery{
From: reqDTO.From,
To: reqDTO.To,
OrgID: dash.OrgID,
DashboardID: dash.ID,
POST /api/public/dashboards/{uid}/annotations with body: {"from": 0, "to": 9999999999999} - This would bypass dashboard time restrictions and retrieve all annotations across the entire time range, even when time selection is disabled and should be restricted to the dashboard's configured time window.
Feb 11, 2026, 12:36 AM — grafana/grafana
Commit: f073f6486c6c21f237add3b8ff4117f6a4b3ba15
Author: Jocelyn Collado-Kuri
The code forwards arbitrary HTTP headers from incoming requests to outgoing gRPC calls without proper validation or sanitization. An attacker can inject malicious headers that could be used to bypass security controls, manipulate downstream services, or perform request smuggling attacks.
for key, value := range req.Headers {
ctx = metadata.AppendToOutgoingContext(ctx, key, url.PathEscape(value))
}
Send a streaming request with malicious headers like 'Authorization: Bearer stolen-token' or 'X-Forwarded-For: 127.0.0.1' in the Headers map of backend.RunStreamRequest. These headers would be forwarded to the Tempo backend, potentially allowing privilege escalation or IP spoofing attacks against the downstream service.