A malicious (or compromised) relay remote can send a "buffer_closed" event with an array, causing a use-after-free (read and write) followed by a double free, in the relay plugin.
Note: if the remote is a trusted WeeChat, the problem does not happen, as WeeChat itself never sends an array in the "buffer_closed" event.
Mitigation
Always connect to a trusted WeeChat remote.
Credit
The issue was discovered by Mohammed Arib (arib06).
WSA-2026-13: [IRC] Use-after-free in the irc plugin when a batched message disconnects the server.
When a batch message is received and one of the messages causes a disconnection from the server, the remaining messages are reading data that is already freed.
When writing a log file, a specific char used internally as separator may be used to forge a new path that can be outside the path configured by the option logger.file.path.
Mitigation
There is no known mitigation.
The upgrade to the latest stable version is highly recommended.
Credit
The issue was discovered by Mohammed Arib (arib06).
WSA-2026-10: [Relay] Authentication bypass in Relay plugin, protocols "api" and "weechat".
When receiving a DCC file, the filename built contains the remote nick (the option xfer.file.use_nick_in_filename is on by default).
If the nick contains special characters, the file could be written outside of the configured download path.
Xfer never overwrites existing files, so if a file exists with the same name, a suffix like ".1" is appended to the filename.
Mitigation
Turn off option to include nick in filename: /set xfer.file.use_nick_in_filename off.
Credit
The issue was discovered by aizu-m.
WSA-2026-5: [IRC] Buffer overflow when receiving a DCC file.
When receiving part of websocket frame, HTTP message or HTTP body, the Relay plugin builds a partial buffer until the end of data is found.
There is no limit for the allocated buffer.
A malicious client sending large amount of data without end of websocket frame or HTTP message/body can lead to memory exhaustion and the WeeChat process can be killed by the OOM killer.
Mitigation
There are multiple ways to mitigate this issue:
Remove all relays, see: /help relay
Unload relay plugin with command: /plugin unload relay and see: /help weechat.plugin.autoload
Secure relay to allow only trusted IP addresses, see: /help relay.network.allowed_ips
WSA-2026-3: [IRC] Missing size limit for the unterminated IRC message or isupport value (message 005).
When receiving data on the socket, the IRC plugin builds a partial message until "\r\n" is found.
There is no limit for the allocated message.
A malicious server sending large amount of data without end of message ("\r\n") can lead to memory exhaustion and the WeeChat process can be killed by the OOM killer.
Mitigation
There is no known mitigation.
The upgrade to the latest stable version is highly recommended.
WSA-2026-2: [API, Relay] Non-constant time password/hash comparison.
WeeChat uses non-constant time password/hash comparison in the Relay plugin and in TOTP validation.
This could allow an attacker to guess a password, a hash or a TOTP and bypass relay authentication.
Mitigation
There are multiple ways to mitigate this issue:
Remove all relays, see: /help relay
Unload relay plugin with command: /plugin unload relay and see: /help weechat.plugin.autoload
Secure relay to allow only trusted IP addresses, see: /help relay.network.allowed_ips
Credit
The issue was discovered by Tristan Madani (TristanInSec).
WSA-2026-1: [Relay] Missing size limit for the decompressed websocket frame in relay plugin, protocol "api".
When decompressing a websocket frame received from a Relay client with "api" protocol and permessage-deflate enabled, WeeChat allocates memory without upper limit.
In case of highly compressed frame, this can lead to memory exhaustion and the WeeChat process can be killed by the OOM killer.