{"vulnerability": "cve-2026-4234", "sightings": [{"uuid": "0ce556ea-bb1f-456c-ad5d-7d987646ddeb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42345", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mleutwfvsi2z", "content": "\ud83d\udfe0 CVE-2026-42345 - High (7.7)\n\nFastGPT is an AI Agent building platform. In versions 4.14.11 and prior, FastGPT's isInternalAddr...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-42345/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-05-08T23:24:47.564562Z"}, {"uuid": "f3cb6b9b-50ef-4482-86d2-5a1842fda430", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42342", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mndiistrbd2h", "content": "\ud83d\udfe0 CVE-2026-42342 - High (7.5)\n\nReact Router is a router for React. In versions 7.0.0 through 7.14.x of react-router and versions...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-42342/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-06-02T21:01:32.463397Z"}, {"uuid": "da2280e3-d125-43de-8843-cc16a8352cf1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42342", "type": "seen", "source": "https://gist.github.com/alon710/7cf799e784cb7e5d54b5d97af1f62323", "content": "# CVE-2026-42342: CVE-2026-42342: Uncontrolled Resource Consumption and Denial of Service in React Router and Remix\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-06-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-42342\n\n## Summary\nAn Uncontrolled Resource Consumption vulnerability (CWE-400) affects React Router in Framework Mode and Remix server runtimes. A remote, unauthenticated attacker can trigger unbounded recursive path expansion in the manifest resolution component, leading to 100% CPU exhaustion and complete Denial of Service. The vulnerability arises because the server does not enforce depth limits when parsing deeply nested path segments in requests directed to the dynamic manifest evaluation endpoints. This blocks the single-threaded Node.js event loop, preventing the processing of subsequent client requests. The issue is resolved in react-router v7.15.0 and @remix-run/server-runtime v2.17.5. Applications using React Router in client-side-only Declarative or Data modes are unaffected.\n\n## TL;DR\nA high-severity Denial of Service vulnerability in React Router (v7 Framework Mode) and Remix (v2) allows unauthenticated remote attackers to exhaust server resources and freeze the Node.js event loop via unbounded path expansion requests to the manifest resolution engine. Upgrade to react-router v7.15.0 or @remix-run/server-runtime v2.17.5 to resolve.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-400\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 7.5\n- **EPSS Score**: 0.00051 (16.30% percentile)\n- **Exploit Status**: Theoretical / Proof of Concept Only\n- **CISA KEV Status**: Not Listed\n- **Impact**: Denial of Service (DoS) via CPU Exhaustion\n\n## Affected Systems\n\n- React Router Framework Mode applications\n- Remix server-side web applications\n- **react-router**: >= 7.0.0, < 7.15.0 (Fixed in: `7.15.0`)\n- **@remix-run/server-runtime**: >= 2.10.0, < 2.17.5 (Fixed in: `2.17.5`)\n\n## Mitigation\n\n- Upgrade react-router to version 7.15.0 or higher\n- Upgrade @remix-run/server-runtime to version 2.17.5 or higher\n- Configure reverse proxy or WAF block lists based on request path segment count and length\n\n**Remediation Steps:**\n1. Identify vulnerable packages using npm list react-router or yarn licenses list.\n2. Update dependencies in package.json to the fixed versions (react-router 7.15.0 or remix-run 2.17.5).\n3. Run npm install or yarn install to update package-lock.json or yarn.lock.\n4. Implement Nginx URI character limits or path-depth boundaries for temporary protection.\n\n## References\n\n- [GitHub Security Advisory GHSA-8x6r-g9mw-2r78](https://github.com/remix-run/react-router/security/advisories/GHSA-8x6r-g9mw-2r78)\n- [NVD - CVE-2026-42342 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-42342)\n- [React Router GitHub Repository](https://github.com/remix-run/react-router)\n- [CVE-2026-42342 on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-42342)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-42342) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-06-03T21:41:07.000000Z"}, {"uuid": "a6b26b1a-9a93-49e2-97ff-4f5065a9fbd7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42341", "type": "seen", "source": "https://bsky.app/profile/malwareobserver.bsky.social/post/3mpz22a66p72b", "content": "\ud83d\udc1b VULNERABILITIES CVE Notify: \ud83d\udea8 [CVE-2026-42341](https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-5493-9m76-2q...\nhttps://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-5493-9m76-2qrr #CVE #ZeroDay #PatchManagement", "creation_timestamp": "2026-07-06T21:31:47.537304Z"}, {"uuid": "118d4ca0-db70-427e-832d-8ef8dece5484", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42341", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mpz26dcbit2x", "content": "CVE-2026-42341 - fossbilling\nFOSSBilling's payment system has a weakness that allows an attacker to trick the system into paying invoices without actually paying. This can happen if the Custom payment adapter is\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#fossbilling #CVE #infosec", "creation_timestamp": "2026-07-06T21:34:05.199117Z"}, {"uuid": "53377d18-d472-4cfb-9b3c-1183ff3a09b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42345", "type": "seen", "source": "https://t.me/shimiscyberworld/1328", "content": "\ud83d\udee1\ufe0f SCW \u2502 Daily Vulnerability Digest\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\ud83d\udcc5 2026-05-09\n\n\ud83d\udcca 23 vulnerabilities detected today \u2014 7 \ud83d\udd34 Critical, 16 \ud83d\udd34 High\n\n\ud83d\udd34 CRITICAL\n  \u2022 CVE-2026-42298 (10) \u2014 CVE-2026-42298: Critical RCE in Postiz AI Scheduling Tool\n  \u2022 CVE-2026-42454 (9.9) \u2014 Termix RCE via Container ID Injection (CVE-2026-42454)\n  \u2022 CVE-2026-42302 (9.8) \u2014 CVE-2026-42302: FastGPT Agent Sandbox RCE\n  \u2022 CVE-2026-42193 (9.1) \u2014 CVE-2026-42193: Plunk Email Platform Critical\u2026\n  \u2022 CVE-2026-42354 (9.1) \u2014 Sentry SAML SSO Critical Vulnerability Allows Account\u2026\n  \u2022 CVE-2026-44313 (9.1) \u2014 Linkwarden SSRF Vulnerability (CVE-2026-44313) Allows\u2026\n  \u2022 CVE-2026-42560 (9.1) \u2014 CVE-2026-42560: Critical Patreon OAuth Flaw Merges User\u2026\n\n\ud83d\udd34 HIGH\n  \u2022 CVE-2026-42556 (8.9) \u2014 CVE-2026-42556: Postiz AI Tool Vulnerability Allows Stored\u2026\n  \u2022 CVE-2026-42205 (8.8) \u2014 CVE-2026-42205: Avo Framework Privilege Escalation in Ruby\u2026\n  \u2022 CVE-2026-42352 (8.6) \u2014 pygeoapi RCE: OGC API Vulnerability Exposes Internal\u2026\n  \u2022 CVE-2026-41705 (8.6) \u2014 CVE-2026-41705: Spring AI MilvusVectorStore Vulnerable to\u2026\n  \u2022 CVE-2026-42452 (8.1) \u2014 Termix CVE-2026-42452 Bypasses 2FA with Temporary JWT\n  \u2022 CVE-2026-6665 (8.1) \u2014 PgBouncer SCRAM Vulnerability (CVE-2026-6665) Allows Stack\u2026\n  \u2022 CVE-2026-42296 (8.1) \u2014 CVE-2026-42296: Argo Workflows Bypass Grants Host Network\u2026\n  \u2022 CVE-2026-41520 (7.9) \u2014 CVE-2026-41520: Cilium Bugtool Leaks Sensitive WireGuard\u2026\n  \u2022 CVE-2026-42301 (7.8) \u2014 CVE-2026-42301: Malicious Code Execution Via pyp2spec RPM\u2026\n  \u2022 CVE-2026-42345 (7.7) \u2014 FastGPT Vulnerability: Cloud Metadata Bypass via URL\u2026\n  \u2026 and 6 more\n\n\ud83d\udcd6 View all vulnerabilities \u2192\n\n\ud83c\udfaf Need SIEM rules for these threats?\nGenerate detection rules for Splunk, Sentinel, QRadar & more \u2014 tailored per breach\nOpen /detect in Intel Bot \u2192\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\ud83c\udf10 @shimiscyberworld \u00b7 shimiscyberworld.com", "creation_timestamp": "2026-09-12T10:00:11.430759Z"}]}