hex

• CVE-2026-39804 - Bandit permessage-deflate decompression DoS 2026-05-02
• CVE-2026-42786 - Bandit WebSocket fragment reassembly DoS 2026-05-02