PT-2026-28543 · Unknown · Elixir-Nodejs

CVE-2026-33872 · Publicado 2026-03-26 · Atualizado 2026-03-28

Positive Technologies (AI Summary)

CVSS v4.0

7.1

Alta

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions elixir-nodejs versions prior to 3.1.4

Description elixir-nodejs is an Elixir API for calling Node.js functions. A flaw exists due to a race condition in the worker protocol, leading to Cross-User Data Leakage or Information Disclosure. The absence of request-response correlation results in a "stale response" issue where the worker may return data intended for a different user. In high-throughput scenarios processing sensitive data like PII or authentication tokens, timeouts or high concurrency can cause a user to receive data belonging to another user. This can lead to unauthorized disclosure of information without triggering errors, potentially providing incorrect data to the wrong session.

Recommendations Update to version 3.1.4 or later.

Exploit

Correção

Race Condition

Enumeração de Fraquezas

CWE-362

Identificadores relacionados

CVE-2026-33872

GHSA-RWCR-RPCC-3G9M

Produtos afetados

Elixir-Nodejs

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33872.json · Exploit
• https://github.com/revelrylabs/elixir-nodejs/releases/tag/v3.1.4 · Nota
• https://github.com/revelrylabs/elixir-nodejs/issues/100 · Nota
• https://github.com/revelrylabs/elixir-nodejs · Nota
• https://github.com/revelrylabs/elixir-nodejs/security/advisories/GHSA-rwcr-rpcc-3g9m · Nota
• https://github.com/revelrylabs/elixir-nodejs/pull/105 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-33872 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-rwcr-rpcc-3g9m · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2037719402653839866 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-33872 · Aviso do Fabricante