# CVE-2026-82936: F&F Filipowski mH-DEVELOPER denial of service via uncontrolled resource consumption

Source: https://junglewise.ai/threats/cve-2026-82936-mh-developer-smart-home-module-is-vulnerable-to-denial-of-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-28. Updated: 2026-09-28  
License: CC BY 4.0 with a link back

CVE-2026-82936 · Severity: info · Published 2026-09-28

The F&F Filipowski mH-DEVELOPER is a smart home control module for managing heating, lighting, and electrical outlets in residential buildings. An attacker on the local network can send large HTTP requests that exhaust the device's RAM, crashing the system and causing loss of home automation control. Because authentication is missing (CVE-2026-82930), any user on the LAN can perform this attack without credentials.

Technologies: [F&F Filipowski mH-DEVELOPER](https://junglewise.ai/threats/technologies/mh-developer). Vendors: [F&F Filipowski](https://junglewise.ai/threats/vendors/f-f-filipowski).

## Quick answers

**Is CVE-2026-82936 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82936 being exploited in the wild.

**How severe is CVE-2026-82936?** Informational severity, published 28 September 2026.

**Which products and versions are affected?** F&F Filipowski mH-DEVELOPER all versions below 3.0.30.

**Is there a fix for CVE-2026-82936?** A patch was published on 2026-09-28: Fixed in version 3.0.30 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-82936 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-82936?** Check whether you run F&F Filipowski mH-DEVELOPER at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability stems from uncontrolled resource consumption in Express.js bodyParser middleware, which allows JSON and URL-encoded request bodies up to 250 MB without throttling. An unauthenticated attacker with LAN access can exploit this by sending large payloads that trigger out-of-memory conditions in the fh-node process. The attack's success depends on baseline memory usage, but is practical given the missing authentication (CVE-2026-82930). A patch was released in version 3.0.30.

## Affected products

- F&F Filipowski mH-DEVELOPER all versions below 3.0.30

## Timeline

- 2026-09-28: disclosed
- 2026-09-28: patched: Fixed in version 3.0.30

## References

- [https://cert.pl/posts/2026/09/CVE-2026-82928/](https://cert.pl/posts/2026/09/CVE-2026-82928/)
- [https://www.fif.com.pl/pl/strona-glowna/1367-mh-developer.html](https://www.fif.com.pl/pl/strona-glowna/1367-mh-developer.html)

## Related threats

- [F&F Filipowski mH-DEVELOPER use of unmaintained third-party components](https://junglewise.ai/threats/cve-2026-82935-mh-developer-smart-home-module-ships-with-an-end-of-life)
- [F&F Filipowski mH-DEVELOPER cleartext HTTP transmission](https://junglewise.ai/threats/cve-2026-82933-mh-developer-smart-home-module-sends-its-web-interface-and-api)
- [F&F Filipowski mH-DEVELOPER missing firewall initialization](https://junglewise.ai/threats/cve-2026-82932-mh-developer-smart-home-module-does-not-load-any-firewall-rules)
- [F&F Filipowski mH-DEVELOPER missing authentication in API](https://junglewise.ai/threats/cve-2026-82930-mh-developer-smart-home-module-does-not-verify-tokens-in-its)
- [F&F Filipowski mH-DEVELOPER hard-coded SSH host keys](https://junglewise.ai/threats/cve-2026-82929-mh-developer-smart-home-module-uses-the-same-hard-coded-ssh-host)