CVE-2026-16632
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
In the facil.io library up to version 0.7.4, a vulnerability was found in the websocket_on_protocol_error function in websocket_parser.h. Manipulation of the on_message argument leads to improper input validation, which can be exploited remotely. The project has not responded to the issue report.
Risk Assessment
Organizations using facil.io are at risk of remote attacks that may lead to unexpected WebSocket server behavior, potentially enabling code execution or denial of service.
Recommendation
Immediately stop using the vulnerable version of facil.io and seek an alternative solution or apply temporary mitigations until a patch is released.
Other vulnerabilities in facil.io
See all- CVE-2026-41146High
facil.io prior to commit 5128747363055201d3ecf0e29bf0a961703c9fa0 has an infinite loop vulnerability in `fio_json_parse` when encountering a nested JSON value starting with 'i' or 'I'. The process spins in user space and pegs one CPU core at ~100% instead of returning a parse error. Because `iodine` vendors the same parser code, it is also affected.
- CVE-2026-66731High
A denial-of-service vulnerability in facil.io 0.7.5 through 0.7.6 in the HTTP/1.1 chunked transfer encoding parser allows unauthenticated remote attackers to crash the server by sending a negative chunk size value, causing memory corruption and a fault.
- CVE-2026-66730High
A denial-of-service vulnerability in facil.io 0.6.0 through 0.7.6 in the multipart body parser allows unauthenticated remote attackers to permanently freeze worker processes at 100% CPU by sending a multipart/form-data request with a partial closing boundary, exhausting all workers and disabling the server until manual restart.
- CVE-2026-66729High
facil.io versions 0.6.0 through 0.7.6 contain an integer underflow vulnerability in the multipart MIME body parser that allows unauthenticated remote attackers to crash the server process by sending a crafted Content-Disposition header with an empty field name. Attackers can trigger a uint32_t wraparound in http_mime_parser.h causing an out-of-bounds memory read past the name pointer, resulting in a bus fault that crashes the handling worker with a single POST request.
- CVE-2026-16653Medium
A path traversal vulnerability exists in boazsegev facil.io up to version 0.7.58 in the http_sendfile2 function of the Public Folder Handler component. Remote exploitation is possible and the exploit has been released.
Original NVD description (English source)
A flaw has been found in boazsegev facil.io up to 0.7.4. Affected is the function websocket_on_protocol_error in the library lib/facil/http/parsers/websocket_parser.h of the component WebSocket Frame Parser. This manipulation of the argument on_message causes improper input validation. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.