CVE-2026-59782: JavaScript preprocessing memory disclosure
Published Oct 5, 2026
·Updated
The JavaScript preprocessing (Duktape) engine on Zabbix server has a vulnerability where a limited administrator is able to read raw heap data potentially resulting in leaked data from other running preprocessors not available to said administrator.
Affected Software
1 affected component
Zabbix Zabbix server
Event History
Oct 5, 2026
CVE Published
via MITRE·10:27 AM
Data Sourced
via MITRE·10:27 AM
RemedyDescriptionWeakness
Data Sourced
via NVD·11:16 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What level of access is required to exploit this issue?
An attacker needs limited administrator access to the Zabbix server. The provided information does not indicate that unauthenticated or ordinary user access is sufficient.
2
What information could be exposed?
A limited administrator may be able to read raw Duktape heap data. This can potentially leak data belonging to other running preprocessors that the administrator would not normally be authorized to access.