Security Advisories#
This page records our assessment of selected published security vulnerabilities and their relevance to Mobile2b. Each entry links to the original advisory and states the current status and last update.
Vulnerability assessments#
Assessments cover the customer product in our managed cloud production and account-management environments, including supporting infrastructure.
| Vulnerability | Status | Last updated | Assessment and next step |
|---|---|---|---|
| CVE-2026-111497 | Fixed | 2026-10-26 | Two backend services of our customer product, chat and PDF printing, ran Node.js release lines that receive no fix for this Brotli decompression vulnerability. We updated both to Node.js 24.22.1 in production on 2026-10-26 and verified the running version. The other customer product services, including the frontend, do not include Node.js. |
| CVE-2026-89078 CVE-2026-93577 CVE-2026-97229 CVE-2026-110264 |
Not affected | 2026-10-23 | Our customer product services do not use the Ruby runtime affected by these regular expression vulnerabilities. No remediation is required for these services. |
| CVE-2026-109618 CVE-2026-109619 |
Not affected | 2026-10-22 | These vulnerabilities are also known as PHP2Shell. Our customer product services do not use PHP. The affected component is absent; no remediation is required for these services. |
| CVE-2026-93479 CVE-2026-95101 CVE-2026-97629 |
Not affected | 2026-10-23 | Our product frontend runs patched NGINX 1.30.6. The checked cloud ingress versions are outside the affected ranges. No action is required for these deployments. |
| CVE-2026-15176 CVE-2026-97205 |
Not affected | 2026-10-23 | Our product frontend runs patched NGINX 1.30.6. The checked cloud ingress configurations do not use the alias or server-side include features required to trigger these vulnerabilities. No action is required for these deployments. |
| GHSA-673q-mjm6-r5xr GHSA-p3m5-59mp-jv5r |
Not affected | 2026-10-23 | Our customer product does not use Next.js. The affected framework is absent; no remediation is required for these two framework-specific advisories. |
| CVE-2026-94300 | Not affected | 2026-10-23 | Our managed cloud production and account-management clusters use kube-dns with dnsmasq. The affected BIND 9 server is absent from these cluster DNS services; no remediation is required. |
What the statuses mean#
- Under investigation: We have not yet established whether the vulnerability affects the stated scope.
- Not affected: Our review found that the vulnerability does not affect the stated services, versions, or configuration. The entry explains why.
- Affected: We confirmed an affected component in the stated scope. The entry describes the action needed and any available mitigation.
- Fixed: We verified that a fix has been applied within the stated scope. The entry identifies the fixed version or deployment and verification date.
These statuses follow the Vulnerability Exploitability eXchange (VEX) approach. A mitigation that reduces exposure does not by itself mean that a vulnerability is fixed.
Scope and customer action#
Assessments apply to the scope above and the date shown. Any service or version limits appear in the entry. This page is a selected advisory register, not a complete vulnerability inventory. A missing entry does not establish that a system is unaffected. Updates to deployed software or vendor guidance can require a new assessment.
Customer-managed infrastructure and additional software require a separate review. Consult the vendor advisory linked in each entry for affected versions, available updates, and any action required for your deployment.
For questions about your deployment, contact the Mobile2b Support Desk. See Patch Management for our patch process, or return to the Trust Center.