sep 6, 2026
10 links from the engineering internet.
workerd v1.20260906.1 is a version bump and nothing else
the sunday cut of the workers runtime carries one commit on top of v1.20260905.1, the automated release bump, so the compare view between the two tags is empty. worth knowing if you track workerd daily and expected a delta.
llama.cpp b10822 embeds the webui assets straight from cmake
the build drops its build-time c++ helper and the external gzip dependency, generating the embedded ui assets in cmake instead. cross-compiling the server gets simpler and the generated c++ stays readable in templates.
llama.cpp b10823 adds --log-jsonl for structured logs
the flag emits one json object per line instead of free text, so runs are greppable and can be shipped straight to a log pipeline. the same build renames the unknown log level to none.
h3 servestatic reads files outside the static root
cve-2026-86253, cvss 8.2: event.url.pathname is never normalized, so percent-encoded dot segments survive the check and decodeuri turns them back into ../. unauthenticated file read on node deployments, fixed in 1.15.6 and 2.0.1-rc.15.
h3 hangs on a cookie that claims a huge chunk count
cve-2026-86250, cvss 8.7: setchunkedcookie and deletechunkedcookie trust the chunk count parsed out of a user-supplied cookie, and the cleanup loop is quadratic, so a single header stalls the process. patched in 2.0.1-rc.18.
nbviewer compares path prefixes as strings and leaks sibling dirs
cve-2026-86258, cvss 8.2: localfilehandler.can_show does a string-prefix comparison instead of resolving the path, so any directory whose name merely starts with the configured root is servable. notebooks and credentials through 1.0.1.
bifrost loads a go plugin from any url you post to it
cve-2026-86242, cvss 8.1: management auth is off by default, so an unauthenticated post to /api/plugins takes an http path, downloads it to a .so and hands it to plugin.open, running init on load. rce on dynamically linked builds, fixed in 2.0.0.
misp's uibeta collection view queries events the controller filtered out
cve-2026-86283, cvss 7.1: the controller enforces access control when fetching collection events, then the view layer runs its own unfiltered query. any authenticated user who can see a collection reads full details of events they cannot open.
openmaic turns off ssrf validation in non-production builds
cve-2026-86259, cvss 9.0: builds not marked production skip the ssrf check entirely, so an unauthenticated x-base-url header or baseurl parameter aims the provider fetch at cloud instance metadata. fixed in 1.0.1.
pocketmine-mp crashes on nan coordinates in moveplayerpacket
cve-2021-48007, cvss 7.1: position and rotation fields are used without checking for nan or inf, so any joined player can send movement math that crashes the server or breaks rendering for everyone else. fixed in 3.18.1.