mongoose: Mongoose is an embedded web server and network library
CVE-2026-73259 is fixed in mongoose on 1 platform by DEBIAN-CVE-2026-73259 (version 7.22+ds-1), released August 21, 2026. It is not reported as exploited. Patch Radar priority: Routine.
Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can send a crafted percent-encoded request path to a deployment using MG_ENABLE_DIRLIST and persuade a user to visit it. The mg_http_serve_dir() and listdir() path in src/http.c places the decoded request URI into the title and h1 elements without HTML entity encoding. The resulting reflected cross-site scripting executes in the Mongoose origin and can expose session data or perform actions as the victim. This issue is fixed in version 7.22.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| mongoose · Debian 14 | 7.22+ds-1 | DEBIAN-CVE-2026-73259 | Aug 21, 2026 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.