Fathom Lite EUVD-2026-48311

No vendor-released patch version is independently confirmed from the available references; operators should monitor the Fathom Lite upstream repository and apply any fix immediately upon release, referencing the VulnCheck advisory at https://www.vulncheck.com/advisories/fathom-lite-stored-xss-via-collect-endpoint for patch guidance. As a compensating control, deploy a WAF or reverse-proxy rule that rejects requests to the /collect endpoint where the hostname parameter contains a javascript: scheme prefix or embedded newline characters (note: overly broad rules may produce false positives for unusual but legitimate hostnames, so test against production traffic before enforcing in blocking mode). Alternatively, restrict network-level access to /collect to known trusted IP ranges, accepting the trade-off that analytics collection from general internet visitors will be disabled. Operators should also audit the existing Top Pages database table for stored entries containing javascript: in the hostname column and purge any poisoned records directly. Adding a Content Security Policy header with script-src directives that exclude unsafe-inline on the dashboard route would limit javascript: URI execution as a defense-in-depth measure, but this requires application-level changes.