centrifugal centrifugo

• CVE-2026-71485 Critical 9.1 Centrifugo: Client-forgeable headers emulation lets any client spoof headers forwarded to proxy backends 0.6%
• CVE-2026-62963 High 8.7 Centrifugo: Decompression bomb DoS via permessage-deflate in unidirectional WebSocket transport 0.5%
• CVE-2026-49998 High 8.2 Centrifugo: Dynamic JWKS key cache keyed only by `kid` allows cross-issuer JWT authentication bypass 0.2%
• CVE-2026-32301 Critical 9.3 Centrifugo: SSRF via unverified JWT claims interpolated into dynamic JWKS endpoint URL 0.3%