Wrapped SNICallback in try/catch and added timing‑safe HMAC/KMAC comparisons, null‑prototype header objects, and permission checks for pipe, realpath.native, and fs/promises to address several high‑severity CVEs
No matching updates in this bucket.
Redis updates in 2026-w13
Fix multiple high‑ and medium‑severity CVEs (e.g., null‑prototype headers, SNICallback try/catch, array index hash collision, timing‑safe crypto comparisons, NGHTTP2 flow‑control handling, URL format crash, permission checks for fs.promi...
Wrap SNICallback invocation in a try/catch to mitigate crashes (CVE‑2026‑21637).
Fixed multiple CVE‑related vulnerabilities including array index hash collisions, timing‑side‑channel issues in Web Crypto HMAC/KMAC, and unsafe header prototypes
Fixed multiple bugs including potential use‑after‑free, crashes during command processing and ACL checks, and memory‑leak issues