Open-source firmware report

FluidNC

ESP32 firmware for CNC machines and laser cutters.

github.com/bdring/FluidNC · 35 components read from oss-bdring__FluidNC.cdx.json (analysed 2026-10-11) · checked against today's advisories 2026-10-11

Vulnerabilities affecting this build

29reported by a scanner that checks NVD

49reported by Firmpath

20only in vendors' own advisories, or not yet in NVD for this version

3to upgrade

4to look at

3clear

25no advisory source

To upgrade

A published vulnerability affects the version this build uses.

mbedtls 3.6.5 Upgrade to 3.6.7 or later28 vulnerabilities · an NVD scanner reports 11

CVE-2026-50580 mbedtls missed by NVD scannershigh
Remote buffer overflow in TLS 1.2 ECDHE-PSK client handshake
mbed-tls.readthedocs.io · cve.org
CVE-2026-49300 mbedtls missed by NVD scannershigh
X.509 CA bit forgery via invalid basicConstraints extension
mbed-tls.readthedocs.io · cve.org
CVE-2026-50579 mbedtls missed by NVD scannershigh
Use-after-free in mbedtls_pkcs7_free() when reusing a PKCS7 context
mbed-tls.readthedocs.io · cve.org
CVE-2026-25835 mbedtls high
PSA random generator cloning
nvd.nist.gov · cve.org
CVE-2026-50713 mbedtls missed by NVD scannershigh
Heap corruption with early renegotiation after corrupted record in DTLS
mbed-tls.readthedocs.io · cve.org
CVE-2026-50584 mbedtls missed by NVD scannersmedium
ChaCha20 counter overflow can reuse keystream
mbed-tls.readthedocs.io · cve.org
CVE-2026-50587 mbedtls missed by NVD scannersmedium
Timing side-channel in RSA PKCS#1 v1.5 decryption
mbed-tls.readthedocs.io · cve.org
CVE-2026-35336 mbedtls missed by NVD scannersmedium
Possible buffer overflow in mbedtls_ecdh_calc_secret()
mbed-tls.readthedocs.io · cve.org
CVE-2026-50640 mbedtls missed by NVD scannerslow
Ignored TLS 1.3 resumption secret derivation error
mbed-tls.readthedocs.io · cve.org
CVE-2026-25833 mbedtls low
Buffer underflow in x509_inet_pton_ipv6()
nvd.nist.gov · cve.org
CVE-2026-50583 mbedtls missed by NVD scannerslow
Out-of-bounds read when parsing a zero-length ECC public key
mbed-tls.readthedocs.io · cve.org
CVE-2026-25834 mbedtls low
Signature Algorithm Injection
nvd.nist.gov · cve.org
CVE-2026-50581 mbedtls missed by NVD scannerslow
Extended master secret calculation failure ignored
mbed-tls.readthedocs.io · cve.org
CVE-2026-50586 mbedtls missed by NVD scannerslow
Information disclosure in TLS 1.2 NewSessionTicket
mbed-tls.readthedocs.io · cve.org
CVE-2026-34873 mbedtls high
Client impersonation while resuming a TLS 1.3 session
nvd.nist.gov · cve.org
CVE-2026-34875 mbedtls high
Buffer overflow in FFDH public key export
nvd.nist.gov · cve.org
CVE-2026-34876 mbedtls high
CCM multipart finish tag-length validation bypass
nvd.nist.gov · cve.org
CVE-2026-34874 mbedtls high
Null pointer dereference when setting a distinguished name
nvd.nist.gov · cve.org
CVE-2026-34872 mbedtls medium
FFDH: lack of contributory behaviour due to improper input validation
nvd.nist.gov · cve.org
CVE-2026-73096 mbedtls missed by NVD scannersmedium
TLS 1.3 early data integrity failure due to buffered plaintext across key change
mbed-tls.readthedocs.io · cve.org
CVE-2026-54435 mbedtls missed by NVD scannersmedium
Side channel leak in ECC optimized modp
mbed-tls.readthedocs.io · cve.org
CVE-2026-50585 mbedtls missed by NVD scannersmedium
Incomplete context reset in mbedtls_ssl_session_reset()
mbed-tls.readthedocs.io · cve.org
CVE-2026-54441 mbedtls missed by NVD scannerslow
Signature algorithm restrictions not enforced on certificate chain
mbed-tls.readthedocs.io · cve.org
CVE-2026-73064 mbedtls missed by NVD scannerslow
A random generator fault can compromise TLS data integrity
mbed-tls.readthedocs.io · cve.org
CVE-2025-66442 mbedtls low
Compiler-induced constant-time violations
nvd.nist.gov · cve.org
CVE-2026-34871 mbedtls low
Entropy on Linux can fall back to /dev/urandom
nvd.nist.gov · cve.org
CVE-2026-34877 mbedtls low
Risk of insufficient protection of serialized session or context data leading to potential memory safety issues
nvd.nist.gov · cve.org
CVE-2026-50588 mbedtls missed by NVD scannerslow
Out-of-bounds read in TLS 1.2 EC J-PAKE ServerKeyExchange parsing
mbed-tls.readthedocs.io · cve.org

nimble 1.6.0 Upgrade to 1.10.0 or later13 vulnerabilities · an NVD scanner reports 13

CVE-2026-45815 nimble high
Remote reachable assertion in ATT Read Multiple Variable Response handler
nvd.nist.gov · cve.org
CVE-2025-52435 nimble high
Invalid error handling in pause encryption procedure in NimBLE controller
nvd.nist.gov · cve.org
CVE-2025-62235 nimble high
Incorrect handling of SMP Security Request could lead to undesirable pairing
nvd.nist.gov · cve.org
CVE-2024-51569 nimble high
Lack of input sanitization leading to out-of-bound reads in Number of Completed Packets HCI event handler
nvd.nist.gov · cve.org
CVE-2026-45813 nimble high
Incorrect data validation in BASS add/modify source operation
nvd.nist.gov · cve.org
CVE-2024-24746 nimble high
Denial of service in NimBLE Bluetooth stack
nvd.nist.gov · cve.org
CVE-2026-45811 nimble high
Buffer overflow in socket HCI transport
nvd.nist.gov · cve.org
CVE-2025-53477 nimble high
NULL Pointer Dereference in NimBLE host HCI layer
nvd.nist.gov · cve.org
CVE-2026-45816 nimble high
NULL pointer dereference vulnerability in SMP LTK request
nvd.nist.gov · cve.org
CVE-2026-45812 nimble medium
OOB Read via sizeof(pointer) in Legacy Advertising Report Handler
nvd.nist.gov · cve.org
CVE-2024-47249 nimble medium
Lack of input sanitization leading to out-of-bound reads in multiple advertisement handler
nvd.nist.gov · cve.org
CVE-2026-46452 nimble medium
Mesh Proxy SAR reassembly unbounded append and unchecked failure
nvd.nist.gov · cve.org
CVE-2025-53470 nimble low
Out-of-Bounds Write Vulnerability in NimBLE HCI H4 driver
nvd.nist.gov · cve.org

esp-idf 5.5.4 Upgrade to 6.1.1 or later8 vulnerabilities · an NVD scanner reports 5

CVE-2026-45328 espressif critical
Out-of-Bounds Write in ESP-TEE Secure Service Wrappers
nvd.nist.gov · cve.org
CVE-2026-45542 espressif high
Heap buffer overflow in protocomm Security2 over Bluetooth
nvd.nist.gov · cve.org
CVE-2026-45329 espressif high
Out-of-Bounds Read in ESP-TEE Secure Service Wrappers
nvd.nist.gov · cve.org
CVE-2026-45541 espressif high
Remote Null Pointer Dereference in WebSocket Server
nvd.nist.gov · cve.org
CVE-2026-55687 espressif missed by NVD scannershigh
Stack-Based Out-of-Bounds Write in JPEG Decoder DQT Marker Parsing
github.com · cve.org
CVE-2026-81507 espressif missed by NVD scannersmedium
Bluetooth Classic L2CAP Heap Memory Disclosure Allowing Unauthorized Access to Sensitive Data
github.com · cve.org
CVE-2026-45160 espressif medium
Out-of-bounds Read in lwIP DHCP Server Option Parser
nvd.nist.gov · cve.org
CVE-2020-26142 espressif missed by NVD scannersmedium
Vulnerable Espressif WLAN device processes every single fragmented AMPDU frame as an independent and a full frame
espressif.com · cve.org

To look at

Version numbers cannot settle these: usually a vendor's fork that may already carry the fix.

lwip 2.2.0 A vendor fork: check whether it carries the fixes1 vulnerability · an NVD scanner reports 1

CVE-2020-22283 silabs high
Buffer overflow vulnerability via a crafted ICMPv6 message may lead to accessing sensitive information
nvd.nist.gov · cve.org

openthread version not stated A vendor fork with no release version. Check the vendor's notes on these advisories.8 vulnerabilities · an NVD scanner reports 1

CVE-2023-41095 silabs high
Keys Stored in Plaintext on Secure Vault High for Silabs Ember ZNet and OpenThread devices
raw.githubusercontent.com · cve.org
CVE-2023-2626 openthread missed by NVD scannershigh
Missing Key ID Mode validation when processing 6LoWPAN frames
github.com · cve.org
CVE-2023-41096 silabs missed by NVD scannershigh
Keys Stored in Plaintext on Secure Vault High for Silabs Ember ZNet and OpenThread devices
raw.githubusercontent.com · cve.org
A-00000463 silabs missed by NVD scannershigh
OpenThread Vulnerability - Key ID Mode 2 Security
raw.githubusercontent.com
CVE-2023-45199 silabs missed by NVD scannersmedium
Due to a buffer overflow in TLS handshake processing, a malicious peer may be able to gain remote code execution by sending overly long packets
raw.githubusercontent.com · cve.org
CVE-2023-41097 silabs missed by NVD scannersmedium
Due to a padding oracle, attackers with access to precise time measurement may be able to learn confidential information protected by AES-CBC or RSA OAEP without requiring key information
raw.githubusercontent.com · cve.org
CVE-2025-2329 silabs missed by NVD scannersmedium
Heavy traffic environment results in denial of service
raw.githubusercontent.com · cve.org
A-00000492 silabs missed by NVD scannersmedium
A bug in TLS MAC length calculation may cause a buffer overread
raw.githubusercontent.com

espasyncwebserver version not stated No version given. Add the exact release to your SBOM.3 vulnerabilities · an NVD scanner reports 0

CVE-2026-54571 espasyncwebserver missed by NVD scannershigh
Integer overflow in multipart boundary parser causes denial of service
github.com · cve.org
CVE-2026-62966 espasyncwebserver missed by NVD scannershigh
Null-pointer write in ESPAsyncWebServer multipart parser
github.com · cve.org
CVE-2025-53094 espasyncwebserver missed by NVD scannerslow
CRLF Injection in AsyncWebHeader.cpp
github.com · cve.org

coex-lib version not stated Bundled in an SDK with no version of its own. Check the advisories.1 vulnerability · an NVD scanner reports 0

CVE-2021-26706 silabs missed by NVD scannersmedium
Update to “BadAlloc” Security Vulnerability in Micrium OS Dynamic Memory Pool Allocations
raw.githubusercontent.com · cve.org

No advisory source

No vendor advisory, NVD or OSV record has ever named these. That is not the same as safe: nobody is publishing about them.

arduino-emulator 0.2.0..0.2.1
arduinobearssl 1.7.6
asynctcp
cmock v2.5.2-2-geeecc49ce8af
esp-ble-mesh-lib
esp-phy-lib
esp-thread-lib
esp32-bt-lib
esp32-wifi-lib
esp32c2-bt-lib
esp32c3-bt-lib
esp32c5-bt-lib
esp32c6-bt-lib
esp32h2-bt-lib
esp8266-and-esp32-oled-driver-for-ssd1306-displays 4.4.1
googletest
json-streaming-parser
mqtt
posixasynctcp
spiffs 0.2-255-g0dbb3f71c5f6
tlsf
tmcstepper
unity v2.6.0-RC1
usb-host-cdc-acm 7c6e0ce3ad6bf8f51735367ad605bd210f95ce35
usb-host-vcp 1.0.0..1.0.0

How this was made, and what it is not

We read the project's build description (manifests, submodules, the SDK it pins), took each SDK release apart into the libraries it bundles, and compared every version with the ranges in vendors' own advisories, NVD and OSV. Every verdict is computed from versions; each finding links to the document it came from. Missed by NVD scanners means a scanner keyed on NVD's CPE records would not report it for this version: no CVE, no NVD record, or NVD files it under another product. The comparison counts only vulnerabilities affecting the version this build uses.

It describes the repository's default build, not any particular binary, and a project may configure out the affected code. It is not an audit. It is recomputed daily as advisories are published. Also as JSON.