CVE-2026-65833 · Package
NO FIX YET · SEE WHAT TO DO
iopress is a native HTTP server for Node.js. Its chunked-transfer request parser in @iopress/core reads past the end of the input buffer when a chunk size exceeds the received body, a heap-buffer-over-read.
first public Jul 3, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that run iopress as an HTTP server and accept chunked-transfer request bodies from clients are exposed, since the flaw is in the request parser. Projects that do not use iopress, or that run it only behind a trusted proxy that rejects malformed chunked requests, are less exposed; the sources do not say how the proxy case behaves.
Not affected if fixed-version, not-using-iopress
Who cares http-server, iopress, node.js
@iopress/core version with npm ls @iopress/coreiopress or @iopress/core in package.json and the lockfile@iopress/core to 1.0.5 or lateriopress is a native HTTP server for Node.js with platform-specific async I/O. Prior to version 1.0.5, the chunked-transfer-encoding HTTP request parser in @iopress/core reads past the end of the input buffer when a request declares a chunk size larger than the body actually received. This results in a heap-buffer-over-read. This issue has been patched in version 1.0.5.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.