CVE-2026-65833
iopress: buffer over-read in chunked HTTP parser
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
iopress is a native HTTP server for Node.js with platform-specific async I/O. Prior to version 1.0.5, the chunked-transfer-encoding HTTP request parser in @iopress/core reads past the end of the input buffer when a request declares a chunk size larger than the body actually received. This results in a heap-buffer-over-read. This issue has been patched in version 1.0.5.
| CWE | CWE-126 |
| Vendor | senapati484 |
| Product | iopress |
| Published | Nov 11, 2026 |
Stay Ahead of the Next One
Get instant alerts for senapati484 iopress
Be the first to know when new unknown vulnerabilities affecting senapati484 iopress are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
senapati484 / iopress
< 1.0.5