Heap Buffer Over-Read Vulnerability in iopress HTTP Server
CVE-2026-65833

6.9MEDIUM

Key Information:

Vendor

Senapati484

Status
Iopress
Vendor
CVE Published:
11 November 2026

What is CVE-2026-65833?

The iopress HTTP server for Node.js contains a vulnerability in its chunked-transfer-encoding HTTP request parser. This issue occurs when a request specifies a chunk size that exceeds the actual body size received. As a result, the parser reads beyond the available input buffer, leading to a heap-buffer-over-read condition. This vulnerability has been addressed in version 1.0.5, which includes a patch to mitigate the risk. Users are advised to upgrade to the latest version to ensure their systems are secure.

Affected Version(s)

iopress < 1.0.5

References

https://github.com/senapati484/iopress/security/advisorie...
x_refsource_CONFIRM
https://github.com/senapati484/iopress/releases/tag/v1.0.5
x_refsource_MISC

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.