Daily archive for Mar 24, 2026: product-level counts, tags, and every published update from this date.
Wrapped SNICallback in try/catch and added timing‑safe HMAC/KMAC comparisons, null‑prototype header objects, and permission checks for pipe, realpath.native, and fs/promises to address several high‑severity CVEs
Community ratings: 0 Useful, 0 Noise, 0 Risky, 0 Broke, 0 Try.
Fix multiple high‑ and medium‑severity CVEs (e.g., null‑prototype headers, SNICallback try/catch, array index hash collision, timing‑safe crypto comparisons, NGHTTP2 flow‑control handling, URL format crash, permission checks for fs.promi...
Community ratings: 0 Useful, 0 Noise, 0 Risky, 0 Broke, 0 Try.
Wrap SNICallback invocation in a try/catch to mitigate crashes (CVE‑2026‑21637).
Community ratings: 0 Useful, 0 Noise, 0 Risky, 0 Broke, 0 Try.
Fixed multiple CVE‑related vulnerabilities including array index hash collisions, timing‑side‑channel issues in Web Crypto HMAC/KMAC, and unsafe header prototypes
Community ratings: 0 Useful, 0 Noise, 0 Risky, 0 Broke, 0 Try.
Fixed multiple bugs including potential use‑after‑free, crashes during command processing and ACL checks, and memory‑leak issues
Community ratings: 0 Useful, 0 Noise, 0 Risky, 0 Broke, 0 Try.
Agents are now built with Go 1.25.8.
Community ratings: 0 Useful, 0 Noise, 0 Risky, 0 Broke, 0 Try.