HackerOne Disclosed Reports - 2026-08-28

Critical
resolved

Author → arbitrary file deletion anywhere on disk (site takeover) via `POST /wp/v2/media//finalize` poisoning `_wp_attachment_metadata`

Bug reported by Jakubk was disclosed at August 28, 2026, 4:39 pm   |   Path Traversal

A vulnerability was discovered in the WordPress media processing functionality. This vulnerability allowed an authenticated author to delete arbitrary files on the server. The vulnerability was caused by insufficient input validation in the `finalize_item()` function, which allowed an attacker to control the file paths stored in the attachment metadata. This resulted in the `wp_delete_attachment_files()` function deleting files outside of the expected upload directory. The vulnerability was present in WordPress versions 7.0.2 and trunk revisions up to 7.1-beta3-62852.

Critical
resolved

Author → stored XSS in wp-admin: unescaped sub-size filename from attachment metadata breaks out of the `src` attribute in `get_media_item()`

Bug reported by Jakubk was disclosed at August 28, 2026, 4:38 pm   |   Cross-site Scripting (XSS) - Stored

A vulnerability was discovered in the WordPress media upload and finalize endpoints. An author could upload a crafted image with a malicious filename, which was then stored verbatim by the endpoint and rendered without proper escaping in the WordPress admin media library. This could allow the execution of arbitrary JavaScript in the context of an administrator's browser session.

Low
resolved

HTTP Request Smuggling via Silent Header Truncation in Node.js HTTP Parser

Bug reported by 陳昱昇 was disclosed at August 28, 2026, 2:16 pm   |   HTTP Request Smuggling

A flaw in the Node.js HTTP client was discovered that could cause a request desynchronization for Node.js-based forwarding proxies. The issue was caused by the Node.js HTTP parser omitting headers beyond the configured limit from the visible request headers, while still using those headers internally for HTTP message framing. This vulnerability was found to affect all supported Node.js release lines.

Medium
resolved

Reachable assertion in node:zlib sync API crashes the entire process via spoofed TypedArray byteLength (all 11 *Sync functions affected)

Bug reported by vinisso was disclosed at August 28, 2026, 2:16 pm   |   Uncontrolled Resource Consumption

A flaw was discovered in the synchronous Node.js zlib APIs that allowed a spoofed TypedArray byteLength to trigger a reachable assertion, causing the entire process to crash. All 11 synchronous zlib functions were affected.

Medium
resolved

dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records

Bug reported by Cantina was disclosed at August 28, 2026, 2:16 pm   |   Uncontrolled Resource Consumption

A flaw in Node.js was discovered where the dns.resolveAny() function aborted the Node.js process when a DNS response contained more than 256 A records.

Medium
resolved

nodeqlite SQLTagStore Iterator Replay Lets Attacker Re-Execute Victim-Bound Writes Indefinitely

Bug reported by Cantina was disclosed at August 28, 2026, 2:15 pm   |   Time-of-check Time-of-use (TOCTOU) Race Condition

A flaw was discovered in the nodeqlite package for Node.js that allowed a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cached prepared statement after it had been reset and rebound with new parameters. The vulnerability was caused by the SQLTagStore feature resetting cached statements using sqlite3_reset() directly, bypassing the iterator invalidation mechanism introduced in recent releases. This issue affected Node.js versions 22.x, 24.x, and 26.x.

High
resolved

Re-entrant `nghttp2_session_mem_send()` during `nghttp2_session_mem_recv()` causes heap-use-after-free in Node.js HTTP/2

Bug reported by Eunsoo Kim was disclosed at August 28, 2026, 2:15 pm   |   Use After Free

A flaw was discovered in the Node.js HTTP/2 implementation that allowed the `nghttp2_session_mem_send()` function to be called re-entrantly while `nghttp2_session_mem_recv()` was executing, resulting in a heap-use-after-free vulnerability. This issue affected Node.js versions 26.x, 24.x, and 22.x.

High
resolved

HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion

Bug reported by leduckhuong was disclosed at August 28, 2026, 2:15 pm   |   Uncontrolled Resource Consumption

A flaw in Node.js HTTP/2 handling was discovered that could cause HTTP/2 retained header blocks to evade the maxSessionMemory setting and enable remote memory exhaustion.