Security Digest: April 22, 2026 - 9 Critical Vulnerabilities

Today, we have identified nine critical vulnerabilities across various platforms including Rust, Node.js, and Keycloak. Immediate action is recommended to mitigate potential exploitation risks.

· 5 min read

Urgent Security Alert: April 22, 2026

Executive Summary

Today, we have identified nine critical vulnerabilities across various platforms including Rust, Node.js, and Keycloak. Immediate action is recommended to mitigate potential exploitation risks. Key issues involve unauthorized access, SQL injection, and service disruption capabilities.

Critical Vulnerabilities

CVE-2026-33471: Rust Nimiq SkipBlockProof Bypass

  • Impact: Allows a malicious validator to pass block proof verification with insufficient signatures.
  • Affected Systems: Rust Nimiq-block
  • Immediate Action: Update to version 1.3.0 immediately.
  • Mitigation: No workarounds; patch is essential.

CVE-2026-41683: Node.js i18next HTTP Middleware CRLF Injection

  • Impact: HTTP response splitting and potential denial of service.
  • Affected Systems: i18next-http-middleware < 3.9.3
  • Immediate Action: Upgrade to version 3.9.3.
  • Mitigation: No workarounds; use a web application firewall for partial mitigation.

CVE-2026-41422: SQL Injection in Daptin

  • Impact: Unauthorized data extraction via SQL injection.
  • Affected Systems: Go Daptin
  • Immediate Action: Upgrade to version 0.11.4.
  • Mitigation: Implement schema-based validation and safe constructors.

CVE-2026-40937: RustFS Admin Authorization Bypass

  • Impact: Cross-user event interception and audit evasion.
  • Affected Systems: Rust RustFS
  • Immediate Action: Update to version 1.0.0-alpha.94.
  • Mitigation: None; patch required.

CVE-2026-41640: SQL Injection in NocoBase Database

  • Impact: Arbitrary SQL execution and data exfiltration.
  • Affected Systems: @nocobase/database <= 2.0.32
  • Immediate Action: Implement parameterized queries.
  • Mitigation: Validate primary key values at creation.

CVE-2026-34065: Panic in Rust Nimiq Primitives

  • Impact: Node panic leading to potential denial of service.
  • Affected Systems: Rust Nimiq-primitives
  • Immediate Action: Update to version 1.3.0.
  • Mitigation: No workarounds available.

CVE-2026-41135: Memory Leak in Free5GC PCF

  • Impact: Denial of Service due to uncontrolled memory growth.
  • Affected Systems: Free5GC PCF
  • Immediate Action: Apply the recommended fix in server initialization.
  • Mitigation: Restrict access to the PCF OAM interface.

CVE-2026-41641: SQL Injection via NocoBase Plugin

  • Impact: Arbitrary SQL execution bypassing validation.
  • Affected Systems: @nocobase/plugin-collection-sql <= 2.0.32
  • Immediate Action: Add checkSQL() to update actions.
  • Mitigation: Strengthen blocklist and centralize validation.

CVE-2026-41166: Unauthorized Role Assignment in Keycloak

  • Impact: Potential privilege escalation to Keycloak master realm administrator.
  • Affected Systems: Maven io.openremote:openremote-manager
  • Immediate Action: Implement realm-specific authorization checks.
  • Mitigation: Restrict write:admin roles carefully.

Previously Alerted

What to Do Now

  1. Prioritize patching systems as indicated.
  2. Verify patch implementations and conduct security audits.
  3. Monitor system logs for any unusual activities post-update.

Related Resources

  • Vendor advisories are available for further details.
  • Stay tuned for internal blog posts providing deeper insights.

Keep reading