CVE-2026-65833

CVSS 6.9 (medium) · published 2026-11-11

iopress is a native HTTP server for Node.js with platform-specific async I/O. Prior to version 1.0.5, the chunked-transfer-encoding HTTP request parser in @iopress/core reads past the end of the input buffer when a request declares a chunk size larger than the body actually received. This results in a heap-buffer-over-read. This issue has been patched in version 1.0.5.

Weakness: CWE-126

Source: NVD CVE-2026-65833

References

• https://github.com/senapati484/iopress/releases/tag/v1.0.5
• https://github.com/senapati484/iopress/security/advisories/GHSA-pvr5-58cf-rgv6

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.