ESPAsyncWebServer vulnerabilities

3 known vulnerabilities in ESPAsyncWebServer from ESP32Async. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  ESPAsyncWebServer: NULL Pointer Dereference

  CVE-2026-62966Oct 30, 2026ESP32Async

  ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350. Prior to version 3.11.2, the multipart parser in `src/WebRequest.cpp` frees `_itemBuffer` and sets it to NULL when `BOUNDARY_OR_DATA` matches the clos

• 8.7 High severity

  ESPAsyncWebServer: Integer Overflow or Wraparound

  CVE-2026-54571Sep 17, 2026ESP32Async

  ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350. Prior to 3.11.1, the multipart/form-data parser in src/WebRequest.cpp stores _boundaryPosition as an 8-bit value while _parseMultipartPostByte process

• 8.7 High severity

  ESPAsyncWebServer: Improper Neutralization of CRLF Sequences

  CVE-2025-53094Jun 27, 2025ESP32Async

  ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350. In versions up to and including 3.7.8, a CRLF (Carriage Return Line Feed) injection vulnerability exists in the construction and output of HTTP header