CVE-2026-65833: iopress: buffer over-read in chunked HTTP parser
iopress is a native HTTP server for Node.js with platform-specific async I/O. Prior to version 1.0.5, the chunked-transfer-encoding HTTP request parser in @iopress/core reads past the end of the input buffer when a request declares a chunk size larger than the body actually received. This results in a heap-buffer-over-read. This issue has been patched in version 1.0.5.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@iopress/coreto a version that resolves this vulnerability.Fixed in 1.0.5
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments using @iopress/core before version 1.0.5 are affected when they accept HTTP requests with chunked transfer encoding. The issue is in the native HTTP server's chunked request parser.
What does an attacker need to send?
An attacker can trigger the flaw remotely by sending a chunked HTTP request that declares a chunk size larger than the request body actually received. No privileges or user interaction are indicated by the provided severity vector.
Is there a fixed version?
Yes. The issue is patched in version 1.0.5.
How can I identify potentially vulnerable traffic or exposure?
Review whether the application uses @iopress/core before 1.0.5 and accepts inbound HTTP requests using chunked transfer encoding. Requests whose declared chunk size exceeds the body data received are the relevant malformed pattern.