---
id: "CVE-2026-115473"
kind: "vulnerability"
aliases: ["CVE-2026-115473"]
title: "Mongoose: short-path check reads one byte past buffer, exposing adjacent memory"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["bare-metal", "embedded", "http-server", "mongoose", "package", "rtos"]
not_affected_if: ["handlers-unused", "no-network-exposure"]
published_at: "2026-11-04T22:17:50+00:00"
first_seen_at: "2026-11-04T23:08:47+00:00"
updated_at: "2026-11-04T23:10:04+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115473", "first_seen_at": "2026-11-04T23:08:47+00:00"}]
exploit_sources: []
---

# Mongoose: short-path check reads one byte past buffer, exposing adjacent memory

Mongoose's path sanity check reads one byte beyond a short request path, which can leak an adjacent heap byte or crash instrumented builds. An unauthenticated remote request reaching the upload or static-serve handlers with a very short path can trigger it.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Mongoose version in your project, e.g. `grep -i mongoose_version mongoose.h` or the vendored copy's header.
- Confirm whether `mg_http_upload` or `mg_http_serve_dir` is reachable from untrusted network requests.

## Fix

- Mongoose: move to `7.22` or later.

## Timeline

- 2026-11-04T23:08:47+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115473

## Documents

- [advisory] Vendor advisory: github.com https://github.com/cesanta/mongoose/security/advisories/GHSA-cjmx-764f-286c
- [fix] Patch: github.com https://github.com/cesanta/mongoose/commit/b55de8b151d1466a3e41d1f854f22eeb6faa23dc
- [fix] Release notes: github.com https://github.com/cesanta/mongoose/releases/tag/7.22

## From the sources

Mongoose is an embedded web server and network library. Prior to 7.22, mg_path_is_sane in src/util.c read path.buf[1] without first requiring path.len to be at least two and read s[2] when only two bytes remained. Unauthenticated remote requests reaching mg_http_upload or mg_http_serve_dir with the affected short path shapes could therefore trigger one-byte heap out-of-bounds reads. On bare-metal or RTOS targets without memory protection, the adjacent byte could be exposed or influence whether a path was accepted, and instrumented builds could crash. This issue is fixed in version 7.22.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_