<?xml version="1.0" encoding="UTF-8"?><rss xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:atom="http://www.w3.org/2005/Atom" version="2.0"><channel><title><![CDATA[iobroker Webseite http:&#x2F;&#x2F;IP:8081 funktioniert nicht mehr]]></title><description><![CDATA[<p dir="auto">Ich habe den iobroker auf einem Raspi4 unter Bookworm laufen (kein Docker). Er läuft auch und die Blockly Skripte arbeiten. Aber ich komme nicht mehr auf die Webseite. Beim Aufruf erscheint das blaue "io" Logo, das sich dreht. Leider hört es damit nicht mehr auf.<br />
Habe schon mal über Putty ein fix und update laufen lassen, das hilft aber nicht. Ich habe außer an den Blockly Skripten seit Monaten nichts mehr an dem System gemacht...</p>
<p dir="auto">Hat jemand eine Idee für mich was das sein könnte und wie ich weiter vorgehen könnte?</p>
<p dir="auto">Gruß purehunter</p>
]]></description><link>https://forum.iobroker.net/topic/84495/iobroker-webseite-http-ip-8081-funktioniert-nicht-mehr</link><generator>RSS for Node</generator><lastBuildDate>Wed, 20 May 2026 01:36:13 GMT</lastBuildDate><atom:link href="https://forum.iobroker.net/topic/84495.rss" rel="self" type="application/rss+xml"/><pubDate>Thu, 07 May 2026 15:30:44 GMT</pubDate><ttl>60</ttl><item><title><![CDATA[Reply to iobroker Webseite http:&#x2F;&#x2F;IP:8081 funktioniert nicht mehr on Thu, 07 May 2026 16:18:11 GMT]]></title><description><![CDATA[<blockquote>
<p dir="auto"><a class="plugin-mentions-user plugin-mentions-a" href="/user/purehunter" aria-label="Profile: purehunter">@<bdi>purehunter</bdi></a> <a href="/post/1338522">sagte</a>:</p>
<p dir="auto">Kann man diese Meldungen löschen?</p>
</blockquote>
<p dir="auto">Erledigt sich mit der Systempflege.</p>
]]></description><link>https://forum.iobroker.net/post/1338526</link><guid isPermaLink="true">https://forum.iobroker.net/post/1338526</guid><dc:creator><![CDATA[Thomas Braun]]></dc:creator><pubDate>Thu, 07 May 2026 16:18:11 GMT</pubDate></item><item><title><![CDATA[Reply to iobroker Webseite http:&#x2F;&#x2F;IP:8081 funktioniert nicht mehr on Thu, 07 May 2026 16:15:26 GMT]]></title><description><![CDATA[<p dir="auto">Danke für deine Hinweise!</p>
<p dir="auto">Die Fehlermeldungen zu Spannung und Temperatur müssen schon älter sein. Das System läuft stabil am original Netzteil in einem Gehäuse mit Lüfter und KK auf den Chips. Das war aber nicht immer so ;-)</p>
<p dir="auto">Kann man diese Meldungen löschen?</p>
<p dir="auto">trixie steht auf der todo Liste</p>
]]></description><link>https://forum.iobroker.net/post/1338522</link><guid isPermaLink="true">https://forum.iobroker.net/post/1338522</guid><dc:creator><![CDATA[purehunter]]></dc:creator><pubDate>Thu, 07 May 2026 16:15:26 GMT</pubDate></item><item><title><![CDATA[Reply to iobroker Webseite http:&#x2F;&#x2F;IP:8081 funktioniert nicht mehr on Thu, 07 May 2026 16:07:56 GMT]]></title><description><![CDATA[<blockquote>
<p dir="auto"><a class="plugin-mentions-user plugin-mentions-a" href="/user/purehunter" aria-label="Profile: purehunter">@<bdi>purehunter</bdi></a> <a href="/post/1338517">sagte</a>:</p>
<p dir="auto">Debian GNU/Linux 12 (bookworm)</p>
</blockquote>
<p dir="auto">Bring es in allernächster Zeit auf 13 'trixie'.</p>
<blockquote>
<p dir="auto">Previously detected issues:<br />
~ Under-voltage has occurred<br />
~ Arm frequency capping has occurred<br />
~ Throttling has occurred<br />
~ Soft temperature limit has occurred</p>
</blockquote>
<p dir="auto">Deine Stromversorgung und/oder Kühlung ist zu schwach.</p>
<blockquote>
<p dir="auto">Please check your setting:<br />
/dev/ttyUSB0</p>
</blockquote>
<p dir="auto">Trag da im Zigbee-Adapter statt /dev/ttyUSB0 besser</p>
<pre><code>/dev/serial/by-id/usb-Silicon_Labs_Sonoff_Zigbee_3.0_USB_Dongle_Plus_0001-if00-port0
</code></pre>
<p dir="auto">ein.</p>
<p dir="auto">Bring dein nodejs auf den aktuellen Stand.</p>
<p dir="auto">Das ist bei den<br />
Pending systemupdates: 63<br />
schon dabei.  System wesentlich regelmäßiger pflegen!</p>
<p dir="auto">Also:</p>
<pre><code>iob update
iob upgrade
iob stop
sudo apt update
sudo apt full-upgrade
sudo reboot
</code></pre>
<p dir="auto">Danach schauen ob es wieder funktioniert.</p>
]]></description><link>https://forum.iobroker.net/post/1338521</link><guid isPermaLink="true">https://forum.iobroker.net/post/1338521</guid><dc:creator><![CDATA[Thomas Braun]]></dc:creator><pubDate>Thu, 07 May 2026 16:07:56 GMT</pubDate></item><item><title><![CDATA[Reply to iobroker Webseite http:&#x2F;&#x2F;IP:8081 funktioniert nicht mehr on Thu, 07 May 2026 15:58:06 GMT]]></title><description><![CDATA[<p dir="auto">========== Start marking the full check here ===========</p>
<pre><code class="language-bash">Script v.2026-01-31

*** BASE SYSTEM ***
Operating System: Debian GNU/Linux 12 (bookworm)
 Static hostname: iobroker
       Icon name: computer
          Kernel: Linux 6.12.47+rpt-rpi-v8
    Architecture: arm64
OS is similar to:

Model           : Raspberry Pi 4 Model B Rev 1.5
Docker          : false
Virtualization  : none
Kernel          : aarch64
Userland        : 64 bit

Systemuptime and Load:
 17:55:56 up  3:08,  2 users,  load average: 0.95, 0.70, 0.55
CPU threads: 4


*** LIFE CYCLE STATUS ***
Debian 'bookworm' is the current oldstable version. Please upgrade to the latest stable release 'trixie' in due time!

*** RASPBERRY THROTTLING ***
Current issues:
No throttling issues detected.

Previously detected issues:
~ Under-voltage has occurred
~ Arm frequency capping has occurred
~ Throttling has occurred
~ Soft temperature limit has occurred

*** TIME AND TIMEZONES ***
               Local time: Thu 2026-05-07 17:55:57 CEST
           Universal time: Thu 2026-05-07 15:55:57 UTC
                 RTC time: n/a
                Time zone: Europe/Berlin (CEST, +0200)
System clock synchronized: yes
              NTP service: active
          RTC in local TZ: no

*** Users and Groups ***
User that called 'iob diag':
rubricappula
HOME=/home/rubricappula
GROUPS=rubricappula adm dialout cdrom sudo audio video plugdev games users input render netdev gpio i2c spi iobroker

User that is running 'js-controller':
iobroker
HOME=/home/iobroker
GROUPS=iobroker tty dialout audio video plugdev bluetooth gpio i2c rubricappula

*** DISPLAY-SERVER SETUP ***
Display-Server:         false
Unit display-manager.service could not be found.
Display-Manager:
Desktop:
Session:                tty

*** MEMORY ***
               total        used        free      shared  buff/cache   available
Mem:            4.0G        1.5G        1.3G        1.2M        1.2G        2.5G
Swap:           536M          0B        536M
Total:          4.5G        1.5G        1.8G

Active iob-Instances:   18

         3796 M total memory
         1430 M used memory
         1453 M active memory
          833 M inactive memory
         1239 M free memory
          155 M buffer memory
         1026 M swap cache
          511 M total swap
            0 M used swap
          511 M free swap

*** top - Table Of Processes  ***
top - 17:55:58 up  3:09,  2 users,  load average: 0.95, 0.70, 0.55
Tasks: 196 total,   1 running, 195 sleeping,   0 stopped,   0 zombie
%Cpu(s):  0.0 us, 20.0 sy,  0.0 ni, 80.0 id,  0.0 wa,  0.0 hi,  0.0 si,  0.0 st
MiB Mem :   3796.9 total,   1239.2 free,   1431.3 used,   1182.0 buff/cache
MiB Swap:    512.0 total,    512.0 free,      0.0 used.   2365.5 avail Mem

*** FAILED SERVICES ***

  UNIT LOAD ACTIVE SUB DESCRIPTION
0 loaded units listed.


*** DMESG CRITICAL ERRORS ***
No critical errors detected

*** FILESYSTEM ***
Filesystem     Type      Size  Used Avail Use% Mounted on
udev           devtmpfs  1.6G     0  1.6G   0% /dev
tmpfs          tmpfs     760M  1.2M  759M   1% /run
/dev/mmcblk0p2 ext4       59G  7.1G   49G  13% /
tmpfs          tmpfs     1.9G     0  1.9G   0% /dev/shm
tmpfs          tmpfs     5.0M   16K  5.0M   1% /run/lock
/dev/mmcblk0p1 vfat      510M   65M  446M  13% /boot/firmware
/dev/sda1      ext4      229G   87M  217G   1% /media/usbstick
tmpfs          tmpfs     380M  4.0K  380M   1% /run/user/1000

Messages concerning ext4 filesystem in dmesg:
[Thu May  7 14:46:58 2026] EXT4-fs (mmcblk0p2): mounted filesystem ce208fd3-38a8-424a-87a2-cd44114eb820 ro with ordered data mode. Quota mode: none.
[Thu May  7 14:46:59 2026] EXT4-fs (mmcblk0p2): re-mounted ce208fd3-38a8-424a-87a2-cd44114eb820 r/w.
[Thu May  7 14:47:03 2026] EXT4-fs (sda1): mounted filesystem f489659f-9e85-475e-acdb-bd41a376d459 r/w with ordered data mode. Quota mode: none.

Show mounted filesystems:
TARGET            SOURCE         FSTYPE OPTIONS
/                 /dev/mmcblk0p2 ext4   rw,noatime
|-/boot/firmware  /dev/mmcblk0p1 vfat   rw,relatime,fmask=0022,dmask=0022,codepage=437,iocharset=ascii,shortname=mixed,errors=remount-ro
`-/media/usbstick /dev/sda1      ext4   rw,relatime

Files in neuralgic directories:

/var:
1.7G    /var/
712M    /var/log
711M    /var/log/journal/3d8e106f2bf442a68272568227ba4c48
711M    /var/log/journal
262M    /var/cache

Archived and active journals take up 710.8M in the file system.

/opt/iobroker/backups:
4.0M    /opt/iobroker/backups/

/opt/iobroker/iobroker-data:
255M    /opt/iobroker/iobroker-data/
184M    /opt/iobroker/iobroker-data/files
56M     /opt/iobroker/iobroker-data/backup-objects
47M     /opt/iobroker/iobroker-data/files/admin.admin
46M     /opt/iobroker/iobroker-data/files/admin.admin/custom/assets

The five largest files in iobroker-data are:
30M     /opt/iobroker/iobroker-data/files/notification-manager.admin/build/index.js.map
11M     /opt/iobroker/iobroker-data/files/notification-manager.admin/build/index.js
9.1M    /opt/iobroker/iobroker-data/objects.jsonl
8.2M    /opt/iobroker/iobroker-data/files/modbus.admin/assets/index-6vd4TbNS.js
6.1M    /opt/iobroker/iobroker-data/states.jsonl

USB-Devices by-id:
USB-Sticks - Avoid direct links to /dev/tty* in your adapter setups,
please always prefer the links 'by-id':

/dev/serial/by-id/usb-Silicon_Labs_Sonoff_Zigbee_3.0_USB_Dongle_Plus_0001-if00-port0

*** ZigBee Settings ***

⚠ HINT:
Your zigbee.0 COM-Port is NOT matching 'by-id'.
Please check your setting:
/dev/ttyUSB0

Zigbee Network Settings on your coordinator/in nvbackup are:

zigbee.X
Extended Pan ID:
*** MASKED ***
Pan ID:
*** MASKED ***
Channel:
*** MASKED ***
Network Key:
*** MASKED ***

To unmask the settings run 'iob diag --unmask'


*** NodeJS-Installation ***

/usr/bin/nodejs         v22.21.1
/usr/bin/node           v22.21.1
/usr/bin/npm            10.9.4
/usr/bin/npx            10.9.4

✓ Node.js installation is correct

nodejs:
  Installed: 22.21.1-1nodesource1
  Candidate: 22.22.2-1nodesource1
  Version table:
     22.22.2-1nodesource1 1001
        500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages
     22.22.1-1nodesource1 1001
        500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages
     22.22.0-1nodesource1 1001
        500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages
 *** 22.21.1-1nodesource1 100
        100 /var/lib/dpkg/status
     22.21.0-1nodesource1 1001
        500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages
     22.20.0-1nodesource1 1001
        500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages
     22.19.0-1nodesource1 1001
        500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages
     22.18.0-1nodesource1 1001
        500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages
     22.17.1-1nodesource1 1001
        500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages
     22.17.0-1nodesource1 1001
        500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages
     22.16.0-1nodesource1 1001
        500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages
     22.15.1-1nodesource1 1001
        500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages
     22.15.0-1nodesource1 1001
        500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages
     22.14.0-1nodesource1 1001
        500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages
     22.13.1-1nodesource1 1001
        500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages
     22.13.0-1nodesource1 1001
        500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages
     22.12.0-1nodesource1 1001
        500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages
     22.11.0-1nodesource1 1001
        500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages
     22.10.0-1nodesource1 1001
        500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages
     22.9.0-1nodesource1 1001
        500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages
     22.8.0-1nodesource1 1001
        500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages
     22.7.0-1nodesource1 1001
        500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages
     22.6.0-1nodesource1 1001
        500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages
     22.5.1-1nodesource1 1001
        500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages
     22.5.0-1nodesource1 1001
        500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages
     22.4.1-1nodesource1 1001
        500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages
     22.4.0-1nodesource1 1001
        500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages
     22.3.0-1nodesource1 1001
        500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages
     22.2.0-1nodesource1 1001
        500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages
     22.1.0-1nodesource1 1001
        500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages
     22.0.0-1nodesource1 1001
        500 https://deb.nodesource.com/node_22.x nodistro/main arm64 Packages
     18.20.4+dfsg-1~deb12u1 500
        500 http://deb.debian.org/debian bookworm/main arm64 Packages
        500 http://deb.debian.org/debian-security bookworm-security/main arm64 Packages

Temp directories causing deletion problem: 0
No problems detected

Errors in npm tree: 0
No problems detected

Checking for nodejs vulnerability:


██████   █████  ███    ██  ██████  ███████ ███████
██   ██ ██   ██ ████   ██ ██       ██      ██   ██
██   ██ ███████ ██ ██  ██ ██   ███ █████   ███████
██   ██ ██   ██ ██  ██ ██ ██    ██ ██      ██   ██
██████  ██   ██ ██   ████  ██████  ███████ ██   ██


The current Node.js version (v22.21.1) is vulnerable to the following CVEs:

CVE-2025-55130(high): A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise.
This vulnerability affects users of the permission model on Node.js v20,  v22,  v24, and v25.
Patched versions: ^20.20.0 || ^22.22.0 || ^24.13.0 || ^25.3.0
=

CVE-2025-55131(high): A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the `vm` module with the timeout option. Under specific timing conditions, buffers allocated with `Buffer.alloc` and other `TypedArray` instances like `Uint8Array` may contain leftover data from previous operations, allowing in-process secrets like tokens or passwords to leak or causing data corruption. While exploitation typically requires precise timing or in-process code execution, it can become remotely exploitable when untrusted input influences workload and timeouts, leading to potential confidentiality and integrity impact.
Patched versions: ^20.20.0 || ^22.22.0 || ^24.13.0 || ^25.3.0
=

CVE-2025-55132(low): A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` even when the process has only read permissions. Unlike `utimes()`, `futimes()` does not apply the expected write-permission checks, which means file metadata can be modified in read-only directories. This behavior could be used to alter timestamps in ways that obscure activity, reducing the reliability of logs. This vulnerability affects users of the permission model on Node.js v20,  v22,  v24, and v25.
Patched versions: ^20.20.0 || ^22.22.0 || ^24.13.0 || ^25.3.0
=

CVE-2025-59464(medium): A memory leak in Node.js’s OpenSSL integration occurs when converting `X.509` certificate fields to UTF-8 without freeing the allocated buffer. When applications call `socket.getPeerCertificate(true)`, each certificate field leaks memory, allowing remote clients to trigger steady memory growth through repeated TLS connections. Over time this can lead to resource exhaustion and denial of service.
Patched versions: ^20.20.0 || ^22.22.0 || ^24.13.0
=

CVE-2025-59465(high): A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not attach explicit error handlers to secure sockets, for example:
</code></pre>
<p dir="auto">server.on('secureConnection', socket =&gt; {<br />
socket.on('error', err =&gt; {<br />
console.log(err)<br />
})<br />
})</p>
<pre><code>Patched versions: ^20.20.0 || ^22.22.0 || ^24.13.0 || ^25.3.0
=

CVE-2025-59466(medium): We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on('uncaughtException')`, the process terminates, making the crash unrecoverable. Applications that rely on `AsyncLocalStorage` (v22, v20) or `async_hooks.createHook()` (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.
Patched versions: ^20.20.0 || ^22.22.0 || ^24.13.0 || ^25.3.0
=

CVE-2026-21637(high): A flaw in Node.js TLS error handling leaves `SNICallback` invocations unprotected against synchronous exceptions, while the equivalent ALPN and PSK callbacks were already addressed in CVE-2026-21637. This represents an incomplete fix of that prior vulnerability.

When an `SNICallback` throws synchronously on unexpected input the exception bypasses TLS error handlers and propagates as an uncaught exception, crashing the Node.js process.

* This vulnerability affects all Node.js versions that received the CVE-2026-21637 fix, including **20.x, 22.x, 24.x, and 25.x**, on any TLS server where `SNICallback` may throw on unexpected `servername` input.
Patched versions: ^20.20.2 || ^22.22.2 || ^24.14.1 || ^25.8.2
=

CVE-2026-21710(high): A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`.

When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`.

* This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x**
Patched versions: ^20.20.2 || ^22.22.2 || ^24.14.1 || ^25.8.2
=

CVE-2026-21713(medium): A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, potentially leaking timing information proportional to the number of matching bytes. Under certain threat models where high-resolution timing measurements are possible, this behavior could be exploited as a timing oracle to infer HMAC values.

Node.js already provides timing-safe comparison primitives used elsewhere in the codebase, indicating this is an oversight rather than an intentional design decision.

This vulnerability affects **20.x, 22.x, 24.x, and 25.x**.
Patched versions: ^20.20.2 || ^22.22.2 || ^24.14.1 || ^25.8.2
=

CVE-2026-21714(medium): A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow control window to exceed the maximum value of 2³¹-1. The server correctly sends a GOAWAY frame, but the Http2Session object is never cleaned up.

This vulnerability affects HTTP2 users on Node.js 20, 22, 24 and 25.
Patched versions: ^20.20.2 || ^22.22.2 || ^24.14.1 || ^25.8.2
=

CVE-2026-21715(low): A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable filesystem functions correctly enforce them.

As a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync.native()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories.

This vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-read` is intentionally restricted.
Patched versions: ^20.20.2 || ^22.22.2 || ^24.14.1 || ^25.8.2
=

CVE-2026-21716(low): An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without the required permission checks, while their callback-based equivalents (`fs.fchmod()`, `fs.fchown()`) were correctly patched.

As a result, code running under `--permission` with restricted `--allow-fs-write` can still use promise-based `FileHandle` methods to modify file permissions and ownership on already-open file descriptors, bypassing the intended write restrictions.

This vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-write` is intentionally restricted.
Patched versions: ^20.20.2 || ^22.22.2 || ^24.14.1 || ^25.8.2
=

CVE-2026-21717(medium): A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8's internal string table, an attacker can significantly degrade performance of the Node.js process.

The most common trigger is any endpoint that calls `JSON.parse()` on attacker-controlled input, as JSON parsing automatically internalizes short strings into the affected hash table.

This vulnerability affects **20.x, 22.x, 24.x, and 25.x**.
Patched versions: ^20.20.2 || ^22.22.2 || ^24.14.1 || ^25.8.2
=

*** ioBroker-Installation ***

ioBroker Status
iobroker is running on this host.


Objects type: jsonl
States  type: jsonl

Hosts:
iobroker            iobroker (version: 7.0.7, hostname: iobroker      , alive, uptime: 9485)

Core adapters versions
js-controller:  7.0.7
admin:          7.8.23
javascript:     9.0.18

nodejs modules from github:     0

Adapter State
+ system.adapter.admin.0                  : admin                 : iobroker                                 -  enabled, port: 8081, bind: 0.0.0.0, run as: admin
  system.adapter.cloud.0                  : cloud                 : iobroker                                 - disabled
+ system.adapter.discovery.0              : discovery             : iobroker                                 -  enabled
+ system.adapter.email.0                  : email                 : iobroker                                 -  enabled
+ system.adapter.fb-checkpresence.0       : fb-checkpresence      : iobroker                                 -  enabled
+ system.adapter.fronius-wattpilot.0      : fronius-wattpilot     : iobroker                                 -  enabled
+ system.adapter.fronius.0                : fronius               : iobroker                                 -  enabled
  system.adapter.icons-mfd-svg.0          : icons-mfd-svg         : iobroker                                 -  enabled
+ system.adapter.jarvis.0                 : jarvis                : iobroker                                 -  enabled, port: 8082, bind: 0.0.0.0, run as: admin
+ system.adapter.javascript.0             : javascript            : iobroker                                 -  enabled
  system.adapter.modbus.0                 : modbus                : iobroker                                 - disabled
+ system.adapter.mqtt.0                   : mqtt                  : iobroker                                 -  enabled, port: 1883, bind: 0.0.0.0
+ system.adapter.notification-manager.0   : notification-manager  : iobroker                                 -  enabled
+ system.adapter.ping.0                   : ping                  : iobroker                                 -  enabled
+ system.adapter.sayit.0                  : sayit                 : iobroker                                 -  enabled
+ system.adapter.scenes.0                 : scenes                : iobroker                                 -  enabled
+ system.adapter.signal-cmb.0             : signal-cmb            : iobroker                                 -  enabled
+ system.adapter.sql.0                    : sql                   : iobroker                                 -  enabled
  system.adapter.tuya.0                   : tuya                  : iobroker                                 - disabled
+ system.adapter.web.0                    : web                   : iobroker                                 -  enabled, port: 8082, bind: 0.0.0.0, run as: admin
+ system.adapter.zigbee.0                 : zigbee                : iobroker                                 -  enabled, port: /dev/ttyUSB0

+ instance is alive

Enabled adapters with bindings
+ system.adapter.admin.0                  : admin                 : iobroker                                 -  enabled, port: 8081, bind: 0.0.0.0, run as: admin
+ system.adapter.jarvis.0                 : jarvis                : iobroker                                 -  enabled, port: 8082, bind: 0.0.0.0, run as: admin
+ system.adapter.mqtt.0                   : mqtt                  : iobroker                                 -  enabled, port: 1883, bind: 0.0.0.0
+ system.adapter.web.0                    : web                   : iobroker                                 -  enabled, port: 8082, bind: 0.0.0.0, run as: admin
+ system.adapter.zigbee.0                 : zigbee                : iobroker                                 -  enabled, port: /dev/ttyUSB0

ioBroker-Repositories
┌─────────┬──────────┬─────────────────────────────────────────────────────────┬──────────────┐
│ (index) │ name     │ url                                                     │ auto upgrade │
├─────────┼──────────┼─────────────────────────────────────────────────────────┼──────────────┤
│ 0       │ 'stable' │ 'http://download.iobroker.net/sources-dist.json'        │ false        │
│ 1       │ 'beta'   │ 'http://download.iobroker.net/sources-dist-latest.json' │ false        │
└─────────┴──────────┴─────────────────────────────────────────────────────────┴──────────────┘

Active repo(s): stable
Upgrade policy: none

Installed ioBroker-Adapters
Used repository: stable
Adapter    "admin"        : 7.8.23   , installed 7.8.23
Adapter    "cloud"        : 5.0.1    , installed 5.0.1
Adapter    "discovery"    : 5.0.0    , installed 5.0.0
Adapter    "email"        : 2.0.4    , installed 2.0.4
Adapter    "fb-checkpresence": 1.4.2 , installed 1.4.2
Adapter    "fronius"      : 2.2.0    , installed 2.2.0
Adapter    "fronius-wattpilot": 4.8.0, installed 4.8.0
Adapter    "icons-mfd-svg": 1.2.0    , installed 1.2.0
Adapter    "jarvis"       : 3.1.8    , installed 3.1.8
Adapter    "javascript"   : 9.0.18   , installed 9.0.18
Controller "js-controller": 7.0.7    , installed 7.0.7
Adapter    "modbus"       : 8.0.3    , installed 8.0.3
Adapter    "mqtt"         : 6.1.4    , installed 6.1.4
Adapter    "notification-manager": 1.3.0, installed 1.3.0
Adapter    "ping"         : 1.7.9    , installed 1.7.9
Adapter    "sayit"        : 5.1.0    , installed 5.1.0
Adapter    "scenes"       : 4.0.4    , installed 4.0.4
Adapter    "signal-cmb"   : 0.3.0    , installed 0.3.0
Adapter    "socketio"     : 7.0.8    , installed 6.7.1  [Updatable]
Adapter    "sql"          : 3.0.1    , installed 3.0.1
Adapter    "tuya"         : 3.17.0   , installed 3.17.0
Adapter    "web"          : 8.0.0    , installed 7.0.8  [Updatable]
Adapter    "ws"           : 4.0.0    , installed 4.0.0
Adapter    "zigbee"       : 3.3.5    , installed 3.3.5

Objects and States
Please stand by - This may take a while
Objects:        3052
States:         2570

*** OS-Repositories and Updates ***
Hit:1 http://deb.debian.org/debian bookworm InRelease
Hit:2 http://deb.debian.org/debian-security bookworm-security InRelease
Hit:3 http://archive.raspberrypi.com/debian bookworm InRelease
Hit:4 http://deb.debian.org/debian bookworm-updates InRelease
Hit:5 https://deb.nodesource.com/node_22.x nodistro InRelease
Reading package lists...
Pending systemupdates: 63

*** Listening Ports ***
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       User       Inode      PID/Program name
tcp        0      0 127.0.0.1:9000          0.0.0.0:*               LISTEN      1001       29004      4259/iobroker.js-co
tcp        0      0 127.0.0.1:9001          0.0.0.0:*               LISTEN      1001       28999      4259/iobroker.js-co
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      0          5656       541/sshd: /usr/sbin
tcp        0      0 0.0.0.0:8400            0.0.0.0:*               LISTEN      1001       27617      4547/io.jarvis.0
tcp        0      0 0.0.0.0:1883            0.0.0.0:*               LISTEN      1001       29272      4421/io.mqtt.0
tcp6       0      0 :::22                   :::*                    LISTEN      0          5658       541/sshd: /usr/sbin
tcp6       0      0 :::8081                 :::*                    LISTEN      1001       29061      4277/io.admin.0
tcp6       0      0 :::8082                 :::*                    LISTEN      1001       29464      4535/io.web.0
udp        0      0 0.0.0.0:57561           0.0.0.0:*                           104        6280       415/avahi-daemon: r
udp        0      0 0.0.0.0:5353            0.0.0.0:*                           104        6278       415/avahi-daemon: r
udp6       0      0 :::34259                :::*                                104        6281       415/avahi-daemon: r
udp6       0      0 fe80::aaa2:76d5:dd5:546 :::*                                0          5666       486/NetworkManager
udp6       0      0 :::5353                 :::*                                104        6279       415/avahi-daemon: r

*** Log File - Last 25 Lines ***

2026-05-07 17:33:51.645  - info: fronius-wattpilot.0 (4477) Creating WebSocket connection to ws://192.168.10.27/ws
2026-05-07 17:33:51.649  - info: fronius-wattpilot.0 (4477) WebSocket connection closed. Code: 1006, Reason:
2026-05-07 17:33:51.892  - info: fronius-wattpilot.0 (4477) Received HELLO, SSE token: 91100564
2026-05-07 17:33:52.159  - info: fronius-wattpilot.0 (4477) Authentication successful. Connected to Wattpilot.
2026-05-07 17:38:51.273  - info: zigbee.0 (4439) Stopping to ping 0xa4c138503ada269a TS0052 after 4 ping attempts
2026-05-07 17:38:51.645  - warn: fronius-wattpilot.0 (4477) No message received for over 2.5 minutes. Attempting to reconnect.
2026-05-07 17:38:51.647  - info: fronius-wattpilot.0 (4477) Creating WebSocket connection to ws://192.168.10.27/ws
2026-05-07 17:38:51.651  - info: fronius-wattpilot.0 (4477) WebSocket connection closed. Code: 1006, Reason:
2026-05-07 17:38:51.744  - info: fronius-wattpilot.0 (4477) Received HELLO, SSE token: 91100564
2026-05-07 17:38:52.129  - info: fronius-wattpilot.0 (4477) Authentication successful. Connected to Wattpilot.
2026-05-07 17:40:08.172  - info: admin.0 (4277) ==&gt; Connected system.user.admin from ::ffff:192.168.10.70
2026-05-07 17:40:13.021  - info: admin.0 (4277) &lt;== Disconnect system.user.admin from ::ffff:192.168.10.70
2026-05-07 17:40:18.116  - info: admin.0 (4277) ==&gt; Connected system.user.admin from ::ffff:192.168.10.70
2026-05-07 17:40:27.522  - info: host.iobroker stopInstance system.adapter.fronius-wattpilot.0 (force=false, process=true)
2026-05-07 17:40:27.531  - info: fronius-wattpilot.0 (4477) Got terminate signal TERMINATE_YOURSELF
2026-05-07 17:40:27.533  - info: fronius-wattpilot.0 (4477) Shutting down adapter...
2026-05-07 17:40:27.536  - info: fronius-wattpilot.0 (4477) Cleanup complete. Adapter stopped.
2026-05-07 17:40:27.537  - info: fronius-wattpilot.0 (4477) terminating
2026-05-07 17:40:27.538  - info: fronius-wattpilot.0 (4477) Terminated (ADAPTER_REQUESTED_TERMINATION): Without reason
2026-05-07 17:40:27.626  - info: host.iobroker stopInstance system.adapter.fronius-wattpilot.0 send kill signal
2026-05-07 17:40:28.040  - info: fronius-wattpilot.0 (4477) terminating
2026-05-07 17:40:28.136  - info: host.iobroker instance system.adapter.fronius-wattpilot.0 terminated with code 11 (ADAPTER_REQUESTED_TERMINATION)
2026-05-07 17:40:32.015  - info: host.iobroker instance system.adapter.fronius-wattpilot.0 in version "4.8.0" started with pid 9990
2026-05-07 17:40:40.187  - info: admin.0 (4277) &lt;== Disconnect system.user.admin from ::ffff:192.168.10.70
2026-05-07 17:45:00.005  - info: javascript.0 (4288) script.js.common.Produktiv.2025.Lüftung_variabel: Lüftung auf 2

</code></pre>
<p dir="auto">============ Mark until here for C&amp;P =============</p>
<p dir="auto">iob diag has finished.</p>
]]></description><link>https://forum.iobroker.net/post/1338517</link><guid isPermaLink="true">https://forum.iobroker.net/post/1338517</guid><dc:creator><![CDATA[purehunter]]></dc:creator><pubDate>Thu, 07 May 2026 15:58:06 GMT</pubDate></item><item><title><![CDATA[Reply to iobroker Webseite http:&#x2F;&#x2F;IP:8081 funktioniert nicht mehr on Thu, 07 May 2026 15:56:02 GMT]]></title><description><![CDATA[<blockquote>
<p dir="auto"><a class="plugin-mentions-user plugin-mentions-a" href="/user/purehunter" aria-label="Profile: purehunter">@<bdi>purehunter</bdi></a> <a href="/post/1338514">sagte</a>:</p>
<p dir="auto">Danke für den Hinweis! Die Diagnose vorhin hatte mich auch darauf hingewiesen, aber das "Enddatum" war mir nicht klar.</p>
</blockquote>
<p dir="auto">Dann zeig den Output mal. Das EOL ist wohl auch noch nicht ganz fix terminiert, bislang steht der 10.06.2026 im Plan.</p>
]]></description><link>https://forum.iobroker.net/post/1338516</link><guid isPermaLink="true">https://forum.iobroker.net/post/1338516</guid><dc:creator><![CDATA[Thomas Braun]]></dc:creator><pubDate>Thu, 07 May 2026 15:56:02 GMT</pubDate></item><item><title><![CDATA[Reply to iobroker Webseite http:&#x2F;&#x2F;IP:8081 funktioniert nicht mehr on Thu, 07 May 2026 15:55:42 GMT]]></title><description><![CDATA[<blockquote>
<p dir="auto"><a class="plugin-mentions-user plugin-mentions-a" href="/user/thomas-braun" aria-label="Profile: Thomas-Braun">@<bdi>Thomas-Braun</bdi></a> <a href="/post/1338509">sagte</a>:</p>
<p dir="auto"><a class="plugin-mentions-user plugin-mentions-a" href="/user/purehunter" aria-label="Profile: purehunter">@<bdi>purehunter</bdi></a></p>
<p dir="auto">Und dein Debian 12 'Bookworm' wirst du auch langsam mal auf das aktuelle Release hieven müssen, im Sommer ist Schluss mit dem Bücherwurm.</p>
</blockquote>
<p dir="auto">Danke für den Hinweis! Die Diagnose vorhin hatte mich auch darauf hingewiesen, aber das "Enddatum" war mir nicht klar.<br />
Da gab es den von mir beachteten Hinweis, dass einiges nicht auf dem neuesten Stand ist...</p>
]]></description><link>https://forum.iobroker.net/post/1338514</link><guid isPermaLink="true">https://forum.iobroker.net/post/1338514</guid><dc:creator><![CDATA[purehunter]]></dc:creator><pubDate>Thu, 07 May 2026 15:55:42 GMT</pubDate></item><item><title><![CDATA[Reply to iobroker Webseite http:&#x2F;&#x2F;IP:8081 funktioniert nicht mehr on Thu, 07 May 2026 15:51:36 GMT]]></title><description><![CDATA[<p dir="auto"><a class="plugin-mentions-user plugin-mentions-a" href="/user/purehunter" aria-label="Profile: purehunter">@<bdi>purehunter</bdi></a></p>
<p dir="auto">Zeig mal die Ausgabe von</p>
<pre><code>iob diag
</code></pre>
]]></description><link>https://forum.iobroker.net/post/1338513</link><guid isPermaLink="true">https://forum.iobroker.net/post/1338513</guid><dc:creator><![CDATA[Thomas Braun]]></dc:creator><pubDate>Thu, 07 May 2026 15:51:36 GMT</pubDate></item><item><title><![CDATA[Reply to iobroker Webseite http:&#x2F;&#x2F;IP:8081 funktioniert nicht mehr on Thu, 07 May 2026 15:49:23 GMT]]></title><description><![CDATA[<blockquote>
<p dir="auto"><a class="plugin-mentions-user plugin-mentions-a" href="/user/thomas-braun" aria-label="Profile: Thomas-Braun">@<bdi>Thomas-Braun</bdi></a> <a href="/post/1338508">sagte</a>:</p>
<p dir="auto"><a class="plugin-mentions-user plugin-mentions-a" href="/user/purehunter" aria-label="Profile: purehunter">@<bdi>purehunter</bdi></a></p>
<p dir="auto">Der Firefox 150.0.1 (64-Bit) funktioniert im Übrigen hier einwandfrei.</p>
</blockquote>
<p dir="auto">Oh. Den verwende ich auch. Und an dem habe ich auch nichts gemacht, außer die automatischen Updates. Seltsam.</p>
]]></description><link>https://forum.iobroker.net/post/1338511</link><guid isPermaLink="true">https://forum.iobroker.net/post/1338511</guid><dc:creator><![CDATA[purehunter]]></dc:creator><pubDate>Thu, 07 May 2026 15:49:23 GMT</pubDate></item><item><title><![CDATA[Reply to iobroker Webseite http:&#x2F;&#x2F;IP:8081 funktioniert nicht mehr on Thu, 07 May 2026 15:48:38 GMT]]></title><description><![CDATA[<p dir="auto"><a class="plugin-mentions-user plugin-mentions-a" href="/user/purehunter" aria-label="Profile: purehunter">@<bdi>purehunter</bdi></a></p>
<p dir="auto">Und dein Debian 12 'Bookworm' wirst du auch langsam mal auf das aktuelle Release hieven müssen, im Sommer ist Schluss mit dem Bücherwurm.</p>
]]></description><link>https://forum.iobroker.net/post/1338509</link><guid isPermaLink="true">https://forum.iobroker.net/post/1338509</guid><dc:creator><![CDATA[Thomas Braun]]></dc:creator><pubDate>Thu, 07 May 2026 15:48:38 GMT</pubDate></item><item><title><![CDATA[Reply to iobroker Webseite http:&#x2F;&#x2F;IP:8081 funktioniert nicht mehr on Thu, 07 May 2026 15:46:19 GMT]]></title><description><![CDATA[<p dir="auto"><a class="plugin-mentions-user plugin-mentions-a" href="/user/purehunter" aria-label="Profile: purehunter">@<bdi>purehunter</bdi></a></p>
<p dir="auto">Falscher Ansatz.<br />
Der Firefox 150.0.1 (64-Bit) funktioniert im Übrigen hier einwandfrei.</p>
]]></description><link>https://forum.iobroker.net/post/1338508</link><guid isPermaLink="true">https://forum.iobroker.net/post/1338508</guid><dc:creator><![CDATA[Thomas Braun]]></dc:creator><pubDate>Thu, 07 May 2026 15:46:19 GMT</pubDate></item><item><title><![CDATA[Reply to iobroker Webseite http:&#x2F;&#x2F;IP:8081 funktioniert nicht mehr on Thu, 07 May 2026 15:43:50 GMT]]></title><description><![CDATA[<blockquote>
<p dir="auto">purehunter <a href="/post/1338502">sagte</a>:</p>
<p dir="auto">Es liegt offenbar an Firefox. Muss an einem Update liegen.</p>
</blockquote>
<p dir="auto">Genau aus diesem Grund bin ich mit Updates eher sparsam...</p>
]]></description><link>https://forum.iobroker.net/post/1338506</link><guid isPermaLink="true">https://forum.iobroker.net/post/1338506</guid><dc:creator><![CDATA[purehunter]]></dc:creator><pubDate>Thu, 07 May 2026 15:43:50 GMT</pubDate></item><item><title><![CDATA[Reply to iobroker Webseite http:&#x2F;&#x2F;IP:8081 funktioniert nicht mehr on Thu, 07 May 2026 15:40:46 GMT]]></title><description><![CDATA[<blockquote>
<p dir="auto"><a class="plugin-mentions-user plugin-mentions-a" href="/user/purehunter" aria-label="Profile: purehunter">@<bdi>purehunter</bdi></a> <a href="/post/1338499">sagte</a>:</p>
<p dir="auto">seit Monaten nichts mehr an dem System gemacht...</p>
</blockquote>
<p dir="auto">Solltest du aber. Updates müssen regelmäßig eingespielt werden, nicht 'alle paar Monate'.</p>
]]></description><link>https://forum.iobroker.net/post/1338504</link><guid isPermaLink="true">https://forum.iobroker.net/post/1338504</guid><dc:creator><![CDATA[Thomas Braun]]></dc:creator><pubDate>Thu, 07 May 2026 15:40:46 GMT</pubDate></item><item><title><![CDATA[Reply to iobroker Webseite http:&#x2F;&#x2F;IP:8081 funktioniert nicht mehr on Thu, 07 May 2026 15:34:56 GMT]]></title><description><![CDATA[<p dir="auto">Da habe ich zu schnell geschossen. Es liegt offenbar an Firefox. Muss an einem Update liegen. Mit dem sonst nicht von mir verwendeten Edge funktioniert es.</p>
]]></description><link>https://forum.iobroker.net/post/1338502</link><guid isPermaLink="true">https://forum.iobroker.net/post/1338502</guid><dc:creator><![CDATA[purehunter]]></dc:creator><pubDate>Thu, 07 May 2026 15:34:56 GMT</pubDate></item></channel></rss>