CVE-2026-65833
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Nov 11, 2026
Vendor
unknown
Description
iopress is a native HTTP server for Node.js with platform-specific async I/O. Prior to version 1.0.5, the chunked-transfer-encoding HTTP request parser in @iopress/core reads past the end of the input buffer when a request declares a chunk size larger than the body actually received. This results in a heap-buffer-over-read. This issue has been patched in version 1.0.5.