CVE
CVE-2026-85184, CVE-2026-82392, CVE-2026-82393, CVE-2026-82455, CVE-2026-83619
CWE
CWE-94, CWE-436, CWE-22, CWE-59, CWE-400
Affected Surface
- Magento Open Source stores and Adobe Commerce deployments exposed to the StyleSmuggler GraphQL-to-email chain, especially internet-facing storefronts that must keep GraphQL enabled
- Fastify applications that rely on `@fastify/middie` path-scoped middleware for auth or rate limiting
- Developer workstations, CI runners, and build containers that run vulnerable `pnpm`, RubyGems, or `@xmldom/xmldom` versions on untrusted inputs
Welcome to Corgea’s weekly briefing. The briefing covers the most important security findings and research from the week.
This edition covers research published from Tuesday, 1 September through Tuesday, 8 September 2026, excluding items already covered in the 1 September briefing and the interim 5 September briefing.
Top Article
StyleSmuggler: Magento zero-day chains GraphQL style input into failed-payment email RCE
Sansec deserves first public disclosure credit for StyleSmuggler, and Disrex deserves credit for the follow-up incident-response detail that helped clarify post-exploitation behavior on compromised stores. It is the top story this week because the chain is already being exploited, it starts from an unauthenticated internet-facing path, and Adobe had not published a patch or CVE when our article went live. The public reporting points to a sequence that defenders can act on right now: hostile styles[...] input through GraphQL, poisoned Magento-managed files, execution during the built-in failed-payment email flow, and then a persistent Linux implant disguised as [kworker/u:8:0].
If you are triaging internet-facing control planes this week, read this with CVE-2026-85184 in @fastify/middie, CVE-2026-48710 in Starlette, and CVE-2026-59822 in LiteLLM. The stacks are different, but each bug turns a trusted edge or control-plane assumption into an exposure path that application teams often discover too late.
More news
CVE-2026-85184: @fastify/middie can skip path-scoped auth on absolute-form request targets
The public advisory and fix credit here stay with the Fastify and OpenJS maintainers, because the cited sources do not name an outside finder. The bug matters because many Fastify applications treat app.use('/private', auth) as the auth boundary. In the vulnerable range, middie matched middleware against the raw absolute-form request target while Fastify still routed the normalized path, so a request like GET http://evil.example/private/secrets could miss the middleware and still hit the protected handler. That makes this a clean companion piece to Starlette’s Host-header path confusion and a good reminder that parser drift between framework layers is often an auth bypass, not a harmless URL oddity.
CVE-2026-82392 and CVE-2026-82393: pnpm path traversals turn install into arbitrary file write
The public advisory and patch credit for both pnpm issues stay with the pnpm maintainers. No outside finder is named in the sources we cite. What pushes this pair into the week’s main picks is the blast radius around ordinary pnpm install flows. CVE-2026-82392 lets an attacker shape install paths through hostile lockfile keys, while CVE-2026-82393 lets a tarball manifest name escape node_modules and overwrite arbitrary files even under --ignore-scripts. That makes the article worth reading alongside CVE-2026-82455 in RubyGems, the arrayref build-time backdoor, and the @7nohe worm path. The packaging ecosystems change. The containment question does not.
Other news:
- CVE-2026-82455: RubyGems symlink resolution bug lets gem extraction escape its target directory - The sources do not name an outside researcher, so the clearest public credit stays with the RubyGems maintainers and the upstream fix. The issue is easy to underestimate because it does not need a malicious gem path with obvious
..traversal. A pre-existing symlink in a reused workspace or shared cache is enough to make extraction write outsidedestination_dir. It fits naturally beside this week’s pnpm article and the older StubMaker RubyGems campaign. - CVE-2026-83619: @xmldom/xmldom malformed end tags trigger quadratic parser DoS - The upstream advisory and patch work carry the public credit here. The bug is “only” a denial of service issue, but the exploit shape is clean: malformed XML drives quadratic backtracking in a default parser path until Node.js workers stall. Read it with CVE-2026-85184 in Fastify middie for another example of a small parsing mistake turning into a production security boundary problem.
From research to remediation
Check whether this pattern exists in your codebase
Turn this research into a remediation workflow. Scan dependencies and package manifests for similar supply-chain risk, then prioritize fixes with reachability context.