Is CVE-2026-82936 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82936 being exploited in the wild.

How severe is CVE-2026-82936?

Informational severity, published 28 September 2026.

Which products and versions are affected?

F&F Filipowski mH-DEVELOPER all versions below 3.0.30.

Is there a fix for CVE-2026-82936?

A patch was published on 2026-09-28: Fixed in version 3.0.30 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-82936 attacked?

It is attacked over the network.

Am I affected by CVE-2026-82936?

Check whether you run F&F Filipowski mH-DEVELOPER at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82936: F&F Filipowski mH-DEVELOPER denial of service via uncontrolled resource consumption

CVE-2026-82936 · Severity: info · Published 2026-09-28

The F&F Filipowski mH-DEVELOPER is a smart home control module for managing heating, lighting, and electrical outlets in residential buildings. An attacker on the local network can send large HTTP requests that exhaust the device's RAM, crashing the system and causing loss of home automation control. Because authentication is missing (CVE-2026-82930), any user on the LAN can perform this attack without credentials.

Technologies: F&F Filipowski mH-DEVELOPER. Vendors: F&F Filipowski.

Quick answers

Is CVE-2026-82936 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82936 being exploited in the wild.
How severe is CVE-2026-82936?: Informational severity, published 28 September 2026.
Which products and versions are affected?: F&F Filipowski mH-DEVELOPER all versions below 3.0.30.
Is there a fix for CVE-2026-82936?: A patch was published on 2026-09-28: Fixed in version 3.0.30 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-82936 attacked?: It is attacked over the network.
Am I affected by CVE-2026-82936?: Check whether you run F&F Filipowski mH-DEVELOPER at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability stems from uncontrolled resource consumption in Express.js bodyParser middleware, which allows JSON and URL-encoded request bodies up to 250 MB without throttling. An unauthenticated attacker with LAN access can exploit this by sending large payloads that trigger out-of-memory conditions in the fh-node process. The attack's success depends on baseline memory usage, but is practical given the missing authentication (CVE-2026-82930). A patch was released in version 3.0.30.

Affected products

F&F Filipowski mH-DEVELOPER all versions below 3.0.30

Timeline

2026-09-28: disclosed
2026-09-28: patched: Fixed in version 3.0.30

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.