Executive assessment
Today's brief leads with multer: Uncaught Exception. All 9 selected findings retain their own technical scope, action, observed status, and evidence limits.
Also today: 6 more virtualenv CVEs (CVE-2026-113719, CVE-2026-113715, CVE-2026-113723, CVE-2026-113720, CVE-2026-113718, CVE-2026-113714) in the same disclosure wave as the virtualenv card of 2026-10-22; none reported exploited; carried as a note rather than a finding.
Finding 01 — multer: Uncaught Exception
What changed: GitHub Advisory Database published GHSA-q7qp-rjg7-q26m for CVE-2026-113872 (multer): Uncaught Exception, CVSS v3.1 7.5; affected: multer >= 2.0.0 and < 2.5.0.
Technical evidence: CVE-2026-113872; CVSS v3.1 7.5; weakness CWE-248, CWE-404; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: CISA ADP reports exploitation as 'none'. ([github.com](https://github.com/expressjs/multer/security/advisories/GHSA-q7qp-rjg7-q26m), [cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-113872))
Affected: multer >= 2.0.0 and < 2.5.0 ([github.com](https://github.com/expressjs/multer/security/advisories/GHSA-q7qp-rjg7-q26m))
Fix: multer 2.5.0 ([github.com](https://github.com/expressjs/multer/security/advisories/GHSA-q7qp-rjg7-q26m))
Panel assessment: Multer upload handlers on versions 2.0.0 to 2.5.0 should be moved to 2.5.0 within the week, because any internet facing upload route is reachable without authentication and the impact is availability of the Node process rather than data loss, with no exploitation reported so far. The likely path is an attacker aborting multipart uploads so that an asynchronous fileFilter stays pending after teardown, leaving unreclaimed work that degrades or kills the worker and takes down everything else served by that process, including unrelated API routes. First inventory services pinned in the affected range and check whether their fileFilter is asynchronous, since switching to a synchronous filter removes the exposure before the upgrade lands. (priority: this week)
Action: Map CVE-2026-113872 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: github.com](https://github.com/advisories/GHSA-q7qp-rjg7-q26m)
Finding 02 — Multiple vulnerabilities in undici
What changed: undici carries 3 CVEs across 3 advisories: Uncaught Exception; Allocation of Resources Without Limits or Throttling. CVE coverage: CVE-2026-109869, CVE-2026-109924, CVE-2026-109841.
Technical evidence: CVE-2026-109869; CVSS v3.1 7.5; weakness CWE-248, CWE-459; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Action: Map CVE-2026-109869 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: fixed version or patch state unknown
[Evidence source: github.com](https://github.com/advisories/GHSA-xjj6-f33q-929c)
Finding 03 — Tokio: Race condition in tokio::time::Interval
What changed: GitHub Advisory Database published GHSA-5wjr-9356-4wc8 for CVE-2026-115567 (Tokio): Race Condition, CVSS v4.0 5.8; affected: Tokio 1.54.0.
Technical evidence: CVE-2026-115567; CVSS v4.0 5.8; weakness CWE-362; technical confidence High.
Why it matters: The Medium priority requires exposure validation and scheduled remediation through normal change control.
Observed status: Observed in-the-wild exploitation status is unknown.
Analyst note: If patching is delayed, avoid Interval on the multi-threaded runtime; Sleep and Timeout are not affected. ([rustsec.org](https://rustsec.org/advisories/RUSTSEC-2026-0384.html))
Affected: Tokio 1.54.0. ([rustsec.org](https://rustsec.org/advisories/RUSTSEC-2026-0384.html))
Fix: Tokio 1.54.1 and later. ([rustsec.org](https://rustsec.org/advisories/RUSTSEC-2026-0384.html))
Panel assessment: Tokio 1.54.0 is a single-release regression with a narrow, availability-only failure mode, so schedule the bump to 1.54.1 alongside normal dependency hygiene rather than breaking change windows for it. The realistic impact is operational rather than adversarial: a dropped timer entry on the multi-threaded runtime can silently stall whatever an Interval drives, such as heartbeats, token refreshes, retry loops or batch triggers, and the failure is quiet rather than loud, so it may surface as stale data or an expired session long before anyone suspects a dependency. Check your lockfiles first for a resolved Tokio of exactly 1.54.0, since anything earlier or later is unaffected and needs no action. (panel view at moderate confidence; priority: routine)
Action: Map CVE-2026-115567 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: github.com](https://github.com/advisories/GHSA-5wjr-9356-4wc8)
Finding 04 — chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For
What changed: GitHub Advisory Database published GHSA-j6qf-3m9c-vwj3 for CVE-2026-114437 (chi): CWE-348, CVSS v3.1 4.8; affected: Golang Chi versions before 5.4.0.
Technical evidence: CVE-2026-114437; CVSS v3.1 4.8; weakness CWE-348; technical confidence High.
Why it matters: The Medium priority requires exposure validation and scheduled remediation through normal change control.
Analyst note: If patching is not possible, restrict origin access to configured trusted-proxy CIDRs and prevent anonymous clients from connecting directly. ([github.com](https://github.com/go-chi/chi/security/advisories/GHSA-j6qf-3m9c-vwj3), [tenable.com](https://www.tenable.com/security/research/tra-2026-66))
Affected: Golang Chi versions before 5.4.0. ([tenable.com](https://www.tenable.com/security/research/tra-2026-66))
Fix: Chi version 5.4.0 or later. ([tenable.com](https://www.tenable.com/security/research/tra-2026-66))
Action: Map CVE-2026-114437 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: github.com](https://github.com/advisories/GHSA-j6qf-3m9c-vwj3)
Finding 05 — Multiple vulnerabilities in fast-uri
What changed: fast-uri carries 4 CVEs across 4 advisories: Improper Input Validation. CVE coverage: CVE-2026-110180, CVE-2026-110306, CVE-2026-110725, CVE-2026-110095.
Technical evidence: CVE-2026-110180; CVSS v3.1 4.8; weakness CWE-20, CWE-436; technical confidence High.
Why it matters: The Medium priority requires exposure validation and scheduled remediation through normal change control.
Observed status: Observed in-the-wild exploitation status is unknown.
Action: Map CVE-2026-110180 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: fixed version or patch state unknown
[Evidence source: github.com](https://github.com/advisories/GHSA-wjr9-j795-jxcr)
Finding 06 — SvelteKit: URL redirection to untrusted site via enhanced form submission
What changed: GitHub Advisory Database published GHSA-pfhg-q3qv-9q6r for CVE-2026-114060 (SvelteKit): Open Redirect, CVSS v4.0 2.1; affected: @sveltejs/kit versions >= 0 and < 3.0.0.
Technical evidence: CVE-2026-114060; CVSS v4.0 2.1; weakness CWE-601; technical confidence High.
Why it matters: The cited reporting affects widely deployed technology, so exposure validation and source verification need explicit ownership.
Analyst note: Reject requests whose parsed URL pathname begins with // before route resolution at a reverse proxy or SvelteKit handle hook. Alternatively, disable navigation for non-redirect enhanced form results with a custom submission callback. CISA ADP reports no exploitation. ([api.osv.dev](https://api.osv.dev/v1/vulns/GHSA-pfhg-q3qv-9q6r), [cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-114060), [vulncheck.com](https://www.vulncheck.com/advisories/sveltekit-before-3.0.0-open-redirect-via-enhanced-form-actions))
Affected: @sveltejs/kit versions >= 0 and < 3.0.0. ([vulncheck.com](https://www.vulncheck.com/advisories/sveltekit-before-3.0.0-open-redirect-via-enhanced-form-actions))
Fix: @sveltejs/kit 3.0.0 or later. ([api.osv.dev](https://api.osv.dev/v1/vulns/GHSA-pfhg-q3qv-9q6r))
Panel assessment: SvelteKit applications below 3.0.0 can be patched on the routine cycle, since the recorded assessment is partial impact, no automation and no reported exploitation, and the worst outcome is a user being sent elsewhere rather than the server being compromised. The practical attack path is a crafted enhanced form result whose pathname begins with two slashes, which navigates the victim's browser to an attacker controlled site, so the real loss is credential phishing or session token capture on a page that carries your brand's trust, not direct access to data or build pipelines. If SvelteKit is in use, first check whether a reverse proxy or handle hook already rejects pathnames beginning with double slashes, because that control blunts the issue ahead of the upgrade to 3.0.0. (priority: routine)
Action: Map CVE-2026-114060 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: github.com](https://github.com/advisories/GHSA-pfhg-q3qv-9q6r)
Finding 07 — Serialize JavaScript: Cross-site Scripting
What changed: GitHub Advisory Database published GHSA-m5mm-p8h7-m29v for CVE-2026-115897 (Serialize JavaScript): Cross-site Scripting, CVSS v4.0 2.1; affected: Versions earlier than 7.1.3.
Technical evidence: CVE-2026-115897; CVSS v4.0 2.1; weakness CWE-79; technical confidence High.
Why it matters: The cited reporting affects widely deployed technology, so exposure validation and source verification need explicit ownership.
Analyst note: Do not serialize function values whose source text or toString() can be influenced by an attacker. CISA ADP reports exploitation as 'none'. ([api.osv.dev](https://api.osv.dev/v1/vulns/GHSA-m5mm-p8h7-m29v), [cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-115897))
Affected: Versions earlier than 7.1.3. ([cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-115897))
Fix: Version 7.1.3. ([api.osv.dev](https://api.osv.dev/v1/vulns/GHSA-m5mm-p8h7-m29v))
Action: Map CVE-2026-115897 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: github.com](https://github.com/advisories/GHSA-m5mm-p8h7-m29v)
Finding 08 — Microsoft .NET: emergency patches for the Brotli flaw
Coverage status: Follows our 2026-10-24 card 'Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data'.
What changed: Microsoft released emergency .NET security updates to patch a critical vulnerability known as Broccoli2Shell, also tracked as Node2Shell and HTTP2Shell.
Why it matters: The cited reporting affects widely deployed technology, so exposure validation and source verification need explicit ownership.
Observed status: Observed in-the-wild exploitation status is unknown.
Action: Review the cited source, validate exposure of the affected technology in owned environments, apply available vendor guidance, and retain evidence of the exposure decision.
Evidence limits: grounded severity unavailable
patch released; fixed build numbers not stated by the source
[Evidence source: bleepingcomputer.com](https://www.bleepingcomputer.com/news/microsoft/microsoft-releases-emergency-net-patches-for-critical-brotli-flaw/)
Finding 09 — Still active: Popular AI tool LiteLLM says unrevoked key allowed hackers to target users
Coverage status: First reported 2026-10-22; ongoing coverage.
What changed: LiteLLM on Friday revealed that an Agent Platform master key accidentally published to a public GitHub repository in late May 2026 ultimately allowed the threat actor to push a malicious version of the popular Python package.
Why it matters: The cited reporting affects widely deployed technology, so exposure validation and source verification need explicit ownership.
Observed status: The cited source reports an active supply-chain compromise; exposure depends on use of the affected packages rather than exploitation of a single vulnerability.
Action: Review the cited source, validate exposure of the affected technology in owned environments, apply available vendor guidance, and retain evidence of the exposure decision.
Evidence limits: grounded severity unavailable
fixed version or patch state unknown
[Evidence source: therecord.media](https://therecord.media/litellm-hackers-ai-malware)