Read the docs
TI-2026-57218 Aliases CVE-2026-82936GHSA-289h-w85v-v5r6

Denial of Service in mH-DEVELOPER

Priority LOW 26CWE-770Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-770.

Summary

mH-DEVELOPER smart home module is vulnerable to Denial of Service due to uncontrolled resource consumption. The Express bodyParser is configured with a 250 MB limit for JSON and URL-encoded request bodies. An authenticated attacker on the LAN can send large request bodies that exhausts buffers in RAM, causing out-of-memory conditions and crashing the fh-node process, resulting in denial of service. The successful attack depends on the current memory usage of the device which is not under full control of the attacker. Critically, due to CVE-2026-82930 all endpoints can be queried unauthenticated, so any user on LAN can perform this attack. This issue was fixed in version 3.0.30

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00173 6th percentileScored 2026-11-07
Fix Fixed mH-DEVELOPER (F&F Filipowski): 3.0.30

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
F&F FilipowskimH-DEVELOPERbefore 3.0.303.0.30Patch availableCNA
  • mH-DEVELOPER VendorF&F Filipowski Affected before 3.0.30 Fixed in 3.0.30 Patch available CNA

Remediation

  • Fix · CNA mH-DEVELOPER (F&F Filipowski) Fixed in 3.0.30

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    F&F Filipowski mH-DEVELOPER 3.0.30

    7 records Highest priority Priority LOW 7 LOW

    Other records, highest priority first

    • TI-2026-57217 Use of End-of-Life components in mH-DEVELOPERPriority LOW 37
    • TI-2026-57212 Undocumented access path in mH-DEVELOPERPriority LOW 35
    • TI-2026-57214 Missing Authentication in mH-DEVELOPERPriority LOW 28
    Show all 7 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-82936
  2. 2026-10-03 Alias added: GHSA-289h-w85v-v5r6

References

Advisory 1

Other 1

  • TI-2026-57217 Use of End-of-Life components in mH-DEVELOPER CVSS 4.0MEDIUM 6.9
  • TI-2026-57212 Undocumented access path in mH-DEVELOPER CVSS 4.0HIGH 7.7
  • TI-2026-57214 Missing Authentication in mH-DEVELOPER CVSS 4.0MEDIUM 6.4
  • TI-2026-57213 Use of Shared Cryptographic Key in mH-DEVELOPER CVSS 4.0MEDIUM 6.3
  • TI-2026-57216 Cleartext Transmission of Sensitive Information in mH-DEVELOPER CVSS 4.0MEDIUM 6.0
  • TI-2026-57215 Missing Firewall Configuration in mH-DEVELOPER CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences