IBM patches critical Handlebars flaws in App Connect Enterprise

IBM patches critical Handlebars flaws in App Connect Enterprise

6 November 2026: IBM has released fix packs for App Connect Enterprise after finding dozens of vulnerable Node.js modules inside the product, the worst being CVE-2026-106446 (CVSS 9.8) and CVE-2026-106445 (CVSS 9.2) in the Handlebars template library, both of which can run attacker-controlled code in the server process. IBM's bulletins list no workaround and do not mention exploitation.

Fix packs for versions 12 and 13

The bulletins, both first published on 6 November, name these targets:

• App Connect Enterprise 13.0.1.0 to 13.0.9.0: Fix Pack 13.0.9.1 (APAR IT50252 and IT50254)
• App Connect Enterprise 12.0.1.0 to 12.0.12.30: Fix Pack 12.0.12.31 (APAR IT50252)

IBM says the affected parts are the Connector Discovery and OpenAPI Editor, the Discovery Connectors and the runtime itself.

Which conditions turn the Handlebars bugs into code execution

Both flaws sit in Handlebars versions before 4.7.10, and neither fires on every use of templates.

CVE-2026-106446 affects Handlebars.compile() and Handlebars.precompile(), which accept pre-parsed syntax trees and validate only some of their values. An attacker who can supply an object instead of a template string can plant JavaScript that runs in the server process. Applications that pass only template strings are not affected, and the issue gets around the check added for an earlier bug, CVE-2026-33937.

CVE-2026-106445 needs an attacker who can render a controlled template, with allowProtoMethodsByDefault switched on and a function reachable in the template context. From there the template can walk up to the Function constructor.

Those conditions describe the library. IBM's bulletins do not say how App Connect uses Handlebars or whether either condition can be met in a default deployment, so the scores are the only guide IBM gives.

The other modules in the same bulletins

Each bulletin carries 20 CVE entries. Axios accounts for a long run of them, with CVE-2026-101909 at 8.3 and CVE-2026-101901, CVE-2026-101903 and CVE-2026-101906 at 8.2, covering HTTP/2 session handling, data URL parsing and proxy decisions. Also present are the enquirer and gRPC JavaScript libraries, and the official TypeScript SDK for the Model Context Protocol, where one flaw concerns its OAuth code and another a task store that did not check which session created a task.

Integration middleware usually holds credentials for every system it joins, which is why a code execution bug here carries more risk than the same bug in a standalone web application. Our integration software category is where teams comparing alternatives can start.

Sources

• IBM security bulletin, App Connect Enterprise Node.js modules (node 7295817), 6 November 2026
• IBM security bulletin, App Connect Enterprise Node.js modules (node 7295820), 6 November 2026
• heise online, IBM App Connect Enterprise, 10 November 2026