[Git][security-tracker-team/security-tracker][master] Reassociate more Node multer NFUs to packaged entry
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Mon Nov 2 16:19:30 GMT 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
bdf4d90f by Salvatore Bonaccorso at 2026-11-02T17:17:49+01:00
Reassociate more Node multer NFUs to packaged entry
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -72636,7 +72636,8 @@ CVE-2026-89021 (MikroTik RouterOS before 7.24.2 contains a path traversal vulner
CVE-2026-89020 (MikroTik RouterOS before 7.23.4 (long-term) and 7.24.2 (stable) contai ...)
NOT-FOR-US: MikroTik
CVE-2026-88932 (multer is a Node.js middleware for handling multipart/form-data upload ...)
- NOT-FOR-US: Node multer
+ - node-multer 2.4.0+~cs3.2.0-1
+ NOTE: https://github.com/expressjs/multer/security/advisories/GHSA-3pph-fpjx-jg34
CVE-2026-88819 (In Siglet current and past versions the refresh token handler do not e ...)
NOT-FOR-US: Siglet
CVE-2026-87802 (Improper verification of cryptographic signature vulnerability in Apac ...)
@@ -89849,7 +89850,8 @@ CVE-2026-82343 (A flaw was found in the file-psd plugin in GIMP. When processing
NOTE: https://gitlab.gnome.org/GNOME/gimp/-/work_items/16587
NOTE: Fixed by: https://gitlab.gnome.org/GNOME/gimp/-/commit/6b6a3e6d8ccdf2a7d6488d0df28ec033a9801a38
CVE-2026-82333 (multer is a middleware for handling multipart/form-data in Node.js. A ...)
- NOT-FOR-US: Node multer
+ - node-multer 2.4.0+~cs3.2.0-1
+ NOTE: https://github.com/expressjs/multer/security/advisories/GHSA-535w-7cp7-47q4
CVE-2026-82329 (JFrog Artifactory contains an authentication weakness that, under defa ...)
NOT-FOR-US: JFrog Artifactory
CVE-2026-82306 (StarRocks through 4.0.13 contains an information disclosure vulnerabil ...)
@@ -89968,11 +89970,14 @@ CVE-2026-77217 (PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains au
CVE-2026-77184 (In MongoDB Connector for BI, the description text of a collection's JS ...)
NOT-FOR-US: MongoDB BI Connector
CVE-2026-77078 (multer is a middleware for handling multipart/form-data in Node.js. A ...)
- NOT-FOR-US: Node multer
+ - node-multer 2.4.0+~cs3.2.0-1
+ NOTE: https://github.com/expressjs/multer/security/advisories/GHSA-wc9g-mqfw-jrwm
CVE-2026-77063 (multer is a middleware for handling multipart/form-data in Node.js. Wh ...)
- NOT-FOR-US: Node multer
+ - node-multer 2.4.0+~cs3.2.0-1
+ NOTE: https://github.com/expressjs/multer/security/advisories/GHSA-qvfw-j98x-7q72
CVE-2026-77037 (multer is a middleware for handling multipart/form-data in Node.js. In ...)
- NOT-FOR-US: Node multer
+ - node-multer 2.4.0+~cs3.2.0-1
+ NOTE: https://github.com/expressjs/multer/security/advisories/GHSA-qfvm-cv95-jqjf
CVE-2026-77012 (The \u7231\u91c7\u96c6\u6570\u636e\u91c7\u96c6\u548c\u53d1\u5e03\u63d2 ...)
NOT-FOR-US: WordPress plugin
CVE-2026-77010 (The HEL Online Classroom: AI-powered Online Classrooms WordPress plugi ...)
@@ -167882,9 +167887,11 @@ CVE-2026-5233 (Improper Control of Interaction Frequency vulnerability in MIA Te
CVE-2026-5230 (Improper Access Control, Missing Authorization vulnerability in MIA Te ...)
NOT-FOR-US: Pizzy Library
CVE-2026-5079 (Impact: multer versions 1.0.0 through 2.1.1 and 3.0.0-alpha.1 are vuln ...)
- NOT-FOR-US: Node multer
+ - node-multer <not-affected> (Fixed with initial upload to Debian)
+ NOTE: https://github.com/expressjs/multer/security/advisories/GHSA-72gw-mp4g-v24j
CVE-2026-5038 (Impact: multer versions 2.0.0-alpha.1 through 2.1.1 and 3.0.0-alpha.1 ...)
- NOT-FOR-US: Node multer
+ - node-multer <not-affected> (Fixed with initial upload to Debian)
+ NOTE: https://github.com/expressjs/multer/security/advisories/GHSA-3p4h-7m6x-2hcm
CVE-2026-52704 (Improper Control of Generation of Code ('Code Injection') vulnerabilit ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-50100 (Multiple printer drivers provided by Ricoh Company, Ltd. and KONICA MI ...)
@@ -232227,7 +232234,9 @@ CVE-2026-3536 (Integer overflow in ANGLE in Google Chrome prior to 145.0.7632.15
[bullseye] - wpewebkit <end-of-life> (see #1035997)
NOTE: https://webkitgtk.org/security/WSA-2026-0006.html
CVE-2026-3520 (Multer is a node.js middleware for handling `multipart/form-data`. A v ...)
- NOT-FOR-US: Node multer
+ - node-multer <not-affected> (Fixed before initial upload to Debian)
+ NOTE: https://github.com/expressjs/multer/security/advisories/GHSA-5528-5vmv-3xc2
+ NOTE: Fixed by: https://github.com/expressjs/multer/commit/7e66481f8b2e6c54b982b34c152479e096ce2752 (v2.1.1)
CVE-2026-3439 (A post-authentication Stack-based Buffer Overflow vulnerability in Son ...)
NOT-FOR-US: SonicWall
CVE-2026-3125 (A Server-Side Request Forgery (SSRF) vulnerability was identified in t ...)
@@ -233612,7 +233621,9 @@ CVE-2018-25160 (HTTP::Session2 versions through 1.09 for Perl does not validate
CVE-2026-3327 (Authenticated Iframe Injection in Dato CMS Web Previews plugin. This v ...)
NOT-FOR-US: Dato CMS Web Previews plugin
CVE-2026-3304 (Multer is a node.js middleware for handling `multipart/form-data`. A v ...)
- NOT-FOR-US: Node multer
+ - node-multer <not-affected> (Fixed before initial upload to Debian)
+ NOTE: https://github.com/expressjs/multer/security/advisories/GHSA-xf7r-hgr6-v32p
+ NOTE: Fixed by: https://github.com/expressjs/multer/commit/739919097dde3921ec31b930e4b9025036fa74ee (v2.1.0)
CVE-2026-3277 (The OpenID Connect (OIDC) authentication configuration in PowerShell ...)
NOT-FOR-US: Devolutions
CVE-2026-3223 (Arbitrary file write & potential privilege escalation exploiting zip s ...)
@@ -233632,7 +233643,9 @@ CVE-2026-2383 (The Simple Download Monitor plugin for WordPress is vulnerable to
CVE-2026-2362 (The WP Accessibility plugin for WordPress is vulnerable to Stored DOM- ...)
NOT-FOR-US: WordPress plugin
CVE-2026-2359 (Multer is a node.js middleware for handling `multipart/form-data`. A v ...)
- NOT-FOR-US: Node multer
+ - node-multer <not-affected> (Fixed before initial upload to Debian)
+ NOTE: https://github.com/expressjs/multer/security/advisories/GHSA-v52c-386h-88mc
+ NOTE: Fixed by: https://github.com/expressjs/multer/commit/cccf0fe0e64150c4f42ccf6654165c0d66b9adab (v2.1.0)
CVE-2026-2293 (A NestJS application using @nestjs/platform-fastify can allow bypass o ...)
NOT-FOR-US: NestJS nest
CVE-2026-2252 (An XML External Entity (XXE) vulnerability allows malicious user to pe ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/bdf4d90fdc23796661f6f97b0af38c7d9fd61691
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/bdf4d90fdc23796661f6f97b0af38c7d9fd61691
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261102/4ec0cd3d/attachment.htm>
More information about the debian-security-tracker-commits
mailing list