Server, runtime, and codec security fixes

Security traffic on 2026-10-25 centered on coordinated fixes for reverse proxies, language runtimes, and media libraries. Higher-impact items included Apache Traffic Server remote code execution, Node.js high-severity updates, and a Python ssl denylist for compromised intermediates.

Apache Traffic Server addresses fifteen vulnerabilities

Apache Traffic Server published fixes for multiple vulnerabilities affecting releases prior to 9.2.16, 10.1.5, and 10.2.1. The set includes one critical unauthenticated remote code execution path through the magick plugin. Operators of the caching proxy should upgrade to the patched lines to close the reported issues.

Python ssl module denylists compromised intermediates

Under CVE-2026-115557, the Python ssl module added a denylist of compromised intermediate certificates. The change forces rejection of those certificates independent of the caller revocation settings. Applications that rely on the standard library TLS stack gain protection against the listed intermediates even when revocation checks are disabled or unavailable.

OpenJPEG heap overflow in reversible DWT encoder

A heap buffer overflow was reported in OpenJPEG 2.4.0 through 2.5.4 and git master inside opj_dwt_encode_and_deinterleave_v for the reversible 5/3 forward DWT encoder. The flaw permits out-of-bounds read and write; a CVE has been assigned and a fix proposed but not yet merged. Projects that embed OpenJPEG for JPEG 2000 encoding need to track the pending patch.

Node.js schedules high-severity security release

Node.js announced a security release dated 2026-10-21 for the 22, 24, and 26 release lines. The updates cover high-severity items that include Brotli remote code execution, a TLS bypass, and dependency fixes, with discussion noting broader upstream brotli impact on other projects. Maintainers of Node.js services and packages that consume brotli should prepare for the coordinated drop.

Web::Simple oversized buffer from Content-Length

CVE-2026-114629 covers Web::Simple versions before 0.035 for Perl. The module allocates a buffer sized directly from the Content-Length header when parsing urlencoded body parameters. Untrusted Content-Length values on urlencoded POST bodies can produce oversized allocations, so Perl code using the module should move to 0.035 or later.

jxrlib memory bugs fixed only in a fork

An oss-security report described heap and stack memory bugs in the abandoned jxrlib library when processing damaged JPEG XR files. The issues are fixed in the mircomir/jxrlib 1.4.4 fork yet remain present in most distribution packages. Software that decodes JPEG XR should confirm its library provenance and consider switching to the maintained fork.

GPAC MP4Box null pointer on crafted MP4

CVE-2025-60493 records a null pointer dereference in GPAC MP4Box inside check_media_profile when fed crafted MP4 input. The crash produces a denial of service. Users of the multimedia toolkit should apply fixes once they appear in their distribution channels.