A SUID root dlopen, a VS Code JavaDoc trap, and a Coolify tenant escape

fast-uri fails to properly convert Unicode (internationalized) hostnames into their ASCII equivalents. If your Node.js app uses fast-uri to enforce host-based security policies (like blocking requests to internal addresses or validating redirects) but then hands the URL to Node's built-in URL parser or fetch for the actual request, an attacker can slip past those checks. The two parsers see different hosts for the same input, which is a classic SSRF or open-redirect vector.

Affected estate

Node.js developers and teams running apps that depend on fast-uri (versions 2.3.1 through 3.1.2, or 4.0.0) for URL validation, host filtering, or redirect checks

How to check

Run `npm ls fast-uri` in your project to check the installed version. It may also appear as a transitive dependency of other packages.

Included because

CVSS 7.5; affects URL security policy enforcement; common transitive dependency in Node.js ecosystem

Action

Upgrade to fast-uri 3.1.3 or 4.0.1 depending on your major version line.

Why it matters

Mismatched URL parsing lets attackers bypass host-based security controls, enabling SSRF or open-redirect attacks against your services.

A bug in the batman-adv kernel module (used for mesh networking) fails to properly clear the current gateway reference during teardown. This can lead to a use-after-free condition that a local attacker could exploit to escalate privileges or crash the system. Unless you're running batman-adv for mesh networking, this likely doesn't affect you.

Affected estate

Teams running Azure Linux 3.0 with kernel 6.6.141.1-1, or anyone using the batman-adv kernel module for mesh networking on Linux

How to check

Run `uname -r` to check kernel version and `lsmod | grep batman` to see if the module is loaded.

Included because

CVSS 7.8; local privilege escalation; low EPSS (0.00164) indicates limited real-world exploitation likelihood

Action

Apply the latest Azure Linux 3.0 kernel update that includes the batman-adv teardown fix.

Why it matters

A local attacker could exploit the use-after-free during module teardown to crash the system or escalate privileges.

Source

NVD

LinuxCNC's rtapi_app binary is installed SUID root and loads shared libraries via dlopen() using a user-supplied module name. There's no proper path validation, so a local unprivileged user can use path traversal to load any shared library they want, and it runs as root. That's a straightforward local privilege escalation to root on any machine running LinuxCNC before 2.9.9.

Affected estate

Anyone running LinuxCNC (linuxcnc-uspace) before version 2.9.9, typically CNC operators, makerspaces, and industrial automation shops

How to check

Run `dpkg -l linuxcnc-uspace` or `linuxcnc --version` to check the installed version. Verify SUID on rtapi_app with `ls -la $(which rtapi_app)`.

Included because

CVSS 8.4; local privilege escalation to root; trivial to exploit with no special prerequisites beyond local access

Action

Upgrade LinuxCNC to 2.9.9 or later.

Why it matters

Any local user on the machine can escalate to root by exploiting the SUID binary's lack of input validation.

Coolify doesn't scope server and project lookups to the current team. Any authenticated user can access servers and projects belonging to other teams just by guessing or enumerating their IDs. If you're running a multi-tenant Coolify instance, this means any user on the platform can view and potentially manage infrastructure they shouldn't have access to.

Affected estate

Self-hosters running Coolify versions before 4.0.0-beta.471, especially multi-tenant setups where multiple teams share one Coolify instance

How to check

Check your Coolify version in the web UI footer or settings page. Compare against 4.0.0-beta.471.

Included because

CVSS 7.7; broken access control; multi-tenant data exposure; authenticated but no special privileges required

Action

Upgrade Coolify to 4.0.0-beta.471 or later.

Why it matters

Any authenticated user can access other teams' servers and projects, breaking tenant isolation on shared instances.