NSD RCE fixes, TLS Name Constraints bypasses, and PQC signing plans

Security traffic on 2026-10-15 centered on high-severity memory-safety fixes in DNS and graphics stacks, cross-library X.509 constraint bypasses, and a NIST plan update for FN-DSA. Several projects also posted advisories or release notices covering packet-processing, runtime, and image-library flaws.

NSD 4.15.3 patches four high-severity stack overflows

NLnet Labs released NSD 4.15.3 to address four high-severity remote code execution stack overflows in base64, SVCB/HTTPS, HIP, and TXT resource-record parsing. The flaws affect the authoritative DNS server’s handling of crafted records. Operators running NSD should treat the update as urgent because successful exploitation can yield remote code execution.

Godot 4 binary resource loader heap out-of-bounds write

A heap out-of-bounds write was reported in the Godot 4.x binary resource loader when processing untrusted .res files that supply a negative string length. The issue is reachable during resource loading. Projects that accept external Godot resources need to assess exposure and apply vendor fixes once available.

X.509 Name Constraints bypasses across multiple TLS libraries

Researchers disclosed Name Constraints enforcement bypasses affecting several TLS libraries, tracked as CVE-2026-34073, CVE-2026-3833, CVE-2026-5263, and CVE-2026-33810, with corresponding CERT/CC vulnerability notes. Early fixes are already appearing. Certificate validation that relies on Name Constraints for isolation or policy enforcement may be weaker than assumed until libraries are updated.

NIST revises FN-DSA plan for FIPS 206

NIST posted an updated plan for FN-DSA (FIPS 206) that would mandate fixed-point signing together with KAT-exact validation. The pqc-forum thread seeks community input on the revised approach. Implementers of post-quantum signatures should track the discussion because it will shape conformance and test-vector requirements.

DPDK vhost-related memory-safety advisories

The DPDK project issued a security advisory covering multiple vulnerabilities in the vhost, vhost-crypto, vDPA, and GSO libraries, including one issue rated CVSS 8.8. Fixes landed in recent LTS releases. Users of DPDK for virtualized networking or crypto offload should upgrade to the patched LTS lines.

Godot 4 Radiance HDR loader heap out-of-bounds write

A separate heap out-of-bounds write was reported in Godot 4’s Radiance HDR image loader, reachable from crafted files during import or at runtime. The report indicates the issue remains unpatched at disclosure. Studios and applications that load untrusted HDR assets face a direct memory-corruption risk.

Node.js high-severity security release scheduled

The Node.js project pre-announced a high-severity security release for the v22, v24, and v26 lines on 2026-10-21. Details of the fixes were not included in the notice. Operators should plan for the coordinated update window.

libpng 1.6.59 fixes use-after-free in sequential reader

libpng 1.6.59 addresses a medium-severity use-after-free (CVE-2026-46675) in the sequential reader. Discussion on the thread also noted delayed availability of the release tarball. Image-processing stacks that embed libpng should move to 1.6.59 once the tarball is confirmed.