CVE-2026-73259

This vulnerability in Mongoose's directory listing (MG_ENABLE_DIRLIST) is a case study in how API convenience creates security traps. When you enable directory listing, Mongoose transfers responsibility for output encoding to your application — but never tells you. You get file indexes; the library assumes you'll handle XSS protection for paths you never explicitly generate. The vulnerability surfaces when attackers inject percent-encoded payloads that render as executable HTML, a scenario developers don't test because they type real paths and see clean output. The fix in Mongoose 7.22 adds HTML context encoding to the directory listing output. Apply it immediately. But the deeper lesson is architectural: feature flags that modify output behavior should carry implicit security boundaries, and Mongoose's doesn't communicate that enabling directory listing requires you to reason about output encoding for every path the library might render. The supply chain dimension compounds the risk. Mongoose embeds into IoT firmware, industrial control dashboards, networking equipment — compiled artifacts inside products with 6-18 month update cycles, maintained by vendors who may never see this CVE. Your scanning tools may report the vulnerability, but the devices running the vulnerable code can't be patched through your normal deployment pipeline. If you ship an embedded product using Mongoose with directory listing enabled, treat this as a supply chain notification requirement for your customers, not just a version bump. The feature flag sediment problem is worth anticipating: MG_ENABLE_DIRLIST was enabled during active development and then sat in compiled binaries while the library moved on. The fix addresses this specific flag, but every feature flag in your dependency tree represents a boundary where security responsibility transferred to the caller. Review which flags your integration enables — some may have slipped into production without active maintenance, and the reasoning behind their original enablement may already be lost to institutional forgetting.

Reviewed through automated stages and approved by a human before publication.