CVE-2026-82936: Denial of Service in mH-DEVELOPER
mH-DEVELOPER smart home module is vulnerable to Denial of Service due to uncontrolled resource consumption. The Express bodyParser is configured with a 250 MB limit for JSON and URL-encoded request bodies. An authenticated attacker on the LAN can send large request bodies that exhausts buffers in RAM, causing out-of-memory conditions and crashing the fh-node process, resulting in denial of service. The successful attack depends on the current memory usage of the device which is not under full control of the attacker. Critically, due to CVE-2026-82930 all endpoints can be queried unauthenticated, so any user on LAN can perform this attack.
This issue was fixed in version 3.0.30
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
mH-DEVELOPERto a version that resolves this vulnerability.Fixed in 3.0.30
Event History
Frequently Asked Questions
Who can exploit this issue in practice?
Any user on the local network can perform the attack because CVE-2026-82930 allows endpoints to be queried without authentication. The issue is therefore not limited to authenticated users in affected deployments.
What conditions affect whether an attack succeeds?
An attacker can submit large JSON or URL-encoded request bodies, up to the configured 250 MB limit, to consume RAM and crash the fh-node process. Success depends on the device's current memory usage, which the attacker does not fully control.
Are default request-size settings affected?
The affected configuration uses Express bodyParser with a 250 MB limit for both JSON and URL-encoded bodies. This limit permits request sizes large enough to exhaust available RAM under suitable memory conditions.
What version fixes the issue?
The issue was fixed in version 3.0.30.