Apache NiFi 2.12.0 fixes path traversal and memory exhaustion

NiFi Registry carried CVE-2026-87976, where trusted metadata from an authenticated user was used to build filesystem paths, allowing access outside the storage root. NiFi 2.11.0 also had CVE-2026-70469, where Content-Encoding parsing caused memory exhaustion. Both are fixed in version 2.12.0, with no confirmed in-the-wild exploitation.

• CVE-2026-87976: directory traversal via metadata in NiFi Registry
• CVE-2026-70469: memory exhaustion in Content-Encoding parsing
• Both flaws fixed in Apache NiFi 2.12.0
• No confirmed in-the-wild exploitation reported