Denial of Service Vulnerability in mH-DEVELOPER Smart Home Module by mH-DEVELOPER

CVE-2026-82936

What is CVE-2026-82936?

The mH-DEVELOPER Smart Home Module suffers from a vulnerability that allows authenticated attackers on the local area network (LAN) to exploit uncontrolled resource consumption. This weakness arises from the Express bodyParser's excessive limit of 250 MB for JSON and URL-encoded request bodies. By sending large requests, an attacker can deplete RAM resources, leading to out-of-memory conditions that crash the fh-node process, ultimately resulting in a Denial of Service. Attackers can exploit this issue due to the prior vulnerabilities allowing unauthenticated access to all endpoints, enabling any local user to initiate this attack.

References