CVE-2026-82936 in mH-DEVELOPER
Summary
by MITRE • 09/28/2026
mH-DEVELOPER smart home module is vulnerable to Denial of Service due to uncontrolled resource consumption. The Express bodyParser is configured with a 250 MB limit for JSON and URL-encoded request bodies. An authenticated attacker on the LAN can send large request bodies that exhausts buffers in RAM, causing out-of-memory conditions and crashing the fh-node process, resulting in denial of service. The successful attack depends on the current memory usage of the device which is not under full control of the attacker. Critically, due to CVE-2026-82930 all endpoints can be queried unauthenticated, so any user on LAN can perform this attack.
This issue was fixed in version 3.0.30
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/28/2026
The mH-DEVELOPER smart home module contains a critical vulnerability related to resource management within its web server implementation. Specifically, the Express bodyParser middleware is configured with an excessively high limit of 250 megabytes for parsing JSON and URL-encoded request bodies. This configuration allows incoming requests containing large payloads to consume significant amounts of system memory without adequate restriction or validation relative to the device's total available RAM. The flaw represents a classic case of uncontrolled resource consumption, where the application fails to enforce limits that are appropriate for its operational environment, leading to potential instability under specific load conditions.
From an attack perspective, this vulnerability enables a Denial of Service scenario by exhausting the system buffers in random access memory. An attacker who can send requests with body sizes approaching or exceeding the available free memory will trigger out-of-memory errors within the fh-node process. This results in the crash of the node application, effectively rendering the smart home module unavailable to legitimate users. The success of this attack is contingent upon the current memory usage state of the device at the time of exploitation; if sufficient free memory exists, the request may be processed without immediate failure, but sustained or large enough attacks will inevitably lead to resource exhaustion and service interruption.
A critical aspect of this vulnerability's severity is its accessibility. Due to a separate authentication bypass issue identified as CVE-2026-82930, all endpoints on the device can be queried by unauthenticated users. This means that any user with network access to the local area network can initiate these resource-exhausting requests without needing valid credentials. The combination of low barriers to entry and high impact makes this a significant risk for devices deployed in home or small office environments where network segmentation may not be strictly enforced.
In terms of industry classification, this vulnerability aligns with CWE-400 Uncontrolled Resource Consumption, as the application does not properly limit the amount of resources consumed by user input. Furthermore, from an offensive security framework perspective, it maps to MITRE ATT&CK technique T1499 Endpoint Denial of Service, specifically under sub-techniques involving resource exhaustion via volumetric attacks or application layer flooding. The lack of authentication requirements further exacerbates the risk profile, allowing for widespread exploitation by any network participant.
The vendor has addressed this issue in version 3.0.30 of the mH-DEVELOPER software. To mitigate the risk, administrators should upgrade to this patched version immediately. Additionally, until an update can be applied or if running older versions is unavoidable, it is advisable to implement network-level controls such as rate limiting on ingress traffic and restricting access to the device's management interfaces through firewall rules or VLAN segmentation. Reducing the bodyParser size limit in custom configurations may also help reduce the attack surface for resource exhaustion attacks, although upgrading remains the primary remediation strategy.