CVE-2023-26104
HIGHCVSS 7.5/10EPSS 1.17%
Last modified
CVE-2023-26104 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. All versions of the package lite-web-server are vulnerable to Denial of Service (DoS) when an attacker sends an HTTP request and includes control characters that the decodeURI() function is unable to parse.. EPSS estimates a 1.17% chance of exploitation in the next 30 days.
Description
All versions of the package lite-web-server are vulnerable to Denial of Service (DoS) when an attacker sends an HTTP request and includes control characters that the decodeURI() function is unable to parse.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Lite-Web-Server Project | Lite-Web-Server | All versions |
References
- https://gist.github.com/lirantal/637520812da06fffb91dd86d02ff6bdeExploit, Third Party Advisory
- https://security.snyk.io/vuln/SNYK-JS-LITEWEBSERVER-3153703Third Party Advisory
- https://gist.github.com/lirantal/637520812da06fffb91dd86d02ff6bdeExploit, Third Party Advisory
- https://security.snyk.io/vuln/SNYK-JS-LITEWEBSERVER-3153703Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-26104?
All versions of the package lite-web-server are vulnerable to Denial of Service (DoS) when an attacker sends an HTTP request and includes control characters that the decodeURI() function is unable to parse.
How severe is CVE-2023-26104?
CVE-2023-26104 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 1.17% probability of exploitation in the next 30 days.
How do I fix CVE-2023-26104?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-26099An issue was discovered in Telindus Apsal 3.14.2022.235 b. T…7.1
- CVE-2023-2610Integer Overflow or Wraparound in GitHub repository vim/vim …7.8
- CVE-2023-26100In Progress Flowmon before 12.2.0, an application endpoint f…6.1
- CVE-2023-26101In Progress Flowmon Packet Investigator before 12.1.0, a Flo…7.5
- CVE-2023-26102All versions of the package rangy are vulnerable to Prototyp…8.2
- CVE-2023-26103Versions of the package deno before 1.31.0 are vulnerable to…7.5
- CVE-2023-26105All versions of the package utilities are vulnerable to Prot…7.5
- CVE-2023-26106All versions of the package dot-lens are vulnerable to Proto…7.5
- CVE-2023-26107All versions of the package sketchsvg are vulnerable to Arbi…7.8
- CVE-2023-26108Versions of the package @nestjs/core before 9.0.5 are vulner…5.3
- CVE-2023-26109All versions of the package node-bluetooth-serial-port are v…9.8
- CVE-2023-2611Advantech R-SeeNet versions 2.4.22 is installed with a hi…9.8
Are you affected by CVE-2023-26104?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST