Node.js Patches 16 Vulnerabilities Including HTTP/2 Crashes and Memory Disclosure Flaws

Critical Pre-Auth MongoDB Flaw CVE-2026-118383 Can Crash Lagging Servers on Failover

A critical use-after-free vulnerability in MongoDB Server, tracked as CVE-2026-118383, allows an unauthenticated attacker to send two specially crafted ping requests that plant persistent waiters on a replica set member. The flaw only triggers when that lagging member later wins an election and completes its catch-up phase, causing the server to reuse freed memory and crash with a segmentation fault. MongoDB rated the issue 9.5 on CVSS 4.0 and released fixes across affected branches earlier this week, while confirming it discovered the bug internally and has seen no exploitation in the wild. The vulnerability affects replica set members, including shard and config servers in sharded clusters, but does not impact standalone mongod instances or the 8.2 branch. Researchers at Datadog Security Labs reproduced the crash in a lab environment and published a proof-of-concept that demonstrates reliable reproduction only under test-only settings. MongoDB Atlas clusters receive automatic patches during maintenance windows, while self-managed deployments must apply the fixed releases to every replica set member. The company also noted that the flaw could theoretically lead to arbitrary code execution under certain conditions, although the researchers did not achieve code execution in testing.

Critical Red Hat Quay Vulnerability Allows Attackers to Hijack Token Signing and Access Private Container Images

A critical vulnerability tracked as CVE-2026-123710 with a CVSS score of 9.8 has been identified in Red Hat Quay, an enterprise container registry used to store, manage, and distribute container images. The flaw resides in the service responsible for managing signing keys and allows an unauthenticated attacker to take over registry token signing when the key server is accessible to untrusted clients. Attackers can exploit weaknesses in the key rotation mechanism to install their own trusted signing key, generate tokens with read and write access to any repository, and expose private images along with any stored credentials or secrets. The malicious key can be set without an expiration date and persists across registry restarts, while also interfering with legitimate operations by deleting instance keys. Red Hat warns that disabling anonymous access does not mitigate the risk, as any valid account can still exploit the issue, and recommends restricting access to the key-management service, reviewing logs, and removing unauthorized keys until a fix is deployed.

N-able Issues Patches for N-central Zero-Days After Researcher Publishes Able2Shell Exploits

N-able has released patches addressing multiple zero-day vulnerabilities in its N-central platform following public disclosure by researcher Sean Bales. The flaws, collectively referred to as Able2Shell, include high-severity issues such as XXE, XSS, SSRF, and path traversal leading to remote code execution. Several CVEs with scores above 8.0 were fixed in N-central 2026.4 HF2, with hosted environments restored after temporary shutdown. Active scanning activity tied to the published proof-of-concept code has been observed by both N-able and Defused, though no hosted compromises have been confirmed. The company emphasized that unauthenticated vulnerabilities are resolved while authenticated issues will receive further hotfixes. N-able also addressed claims regarding responsible disclosure practices.