CVE-2026-102360

A missing bounds check in the binary decoder in lib0, versions 0.2.1-0.2.117 and earlier and 1.0.0-rc.32 and earlier, lets any unauthenticated remote peer read adjacent process memory and receive it back. `readUint8Array` never compares the wire-supplied length against the decoder's own view, so one over-long length prefix returns whatever the host process allocated next: other tenants' document content, personal data, and live bearer session tokens**, recovered in full and at will. An attacker who can supply bytes to a lib0 decoder which means any peer that can open a socket, including before authentication reads adjacent process memory and, where the consumer echoes, stores or re-serves the decoded value, receives it back. This is patched in version 0.2.118 and 1.0.0-rc.33.

• CWE-125

• https://github.com/dmonad/lib0/commit/425f28dc82c8df1b6f7e1ab20ea1a0a15a3c355f
• https://github.com/dmonad/lib0/commit/c4c9db0b41346a33aff31a51f1f09c3a17757f10
• https://github.com/dmonad/lib0/security/advisories/GHSA-r5c8-rf4w-qrq8
• https://github.com/dmonad/lib0/security/advisories/GHSA-r5c8-rf4w-qrq8

Published

Sep 29, 2026

Last Modified

Sep 29, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-102333httpdbg before 2.2.1 fails to validate URL schemes in record…6.1
• CVE-2026-102334Nginx Proxy Manager through 2.16.0 lacks rate-limiting on au…7.4
• CVE-2026-102335Nginx Proxy Manager through 2.16.0 fails to restrict the adv…7.1
• CVE-2026-10234A vulnerability was detected in Mettle sendportal up to 3.0.…3.5
• CVE-2026-10235A flaw has been found in CodeAstro Ingredients Stock Managem…6.3
• CVE-2026-10236A vulnerability has been found in SourceCodester Water Billi…7.3
• CVE-2026-102361mall4j through 4.0 contains a missing authentication vulnera…9.1
• CVE-2026-102362mall4j through 4.0 fails to implement authentication control…5.3
• CVE-2026-102363mall4j through 4.0 contains a missing authentication vulnera…3.7
• CVE-2026-102364mall4j through 4.0 fails to validate the sysType field in sa…5.4
• CVE-2026-102365mall4j through 4.0 fails to enforce authorization checks on …6.5
• CVE-2026-102366mall4j through 4.0 contains an unrestricted file upload vuln…4.4