EUVD-2026-49383

Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, Next.js applications using App Router, Server Actions use server or use cache endpoints can be disclosed bypassing any authentication on the pages where these...

CVE-2026-64645 Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a rewrites or redirects rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the...

CVE-2026-55968 Apache Thrift: Node.js quadratic-time DoS in server receive transports

Inefficient Algorithmic Complexity, Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Node.js bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

CVE-2026-55968

Inefficient Algorithmic Complexity, Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Node.js bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

CVE-2026-55968 Apache Thrift: Node.js quadratic-time DoS in server receive transports

Inefficient Algorithmic Complexity, Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Node.js bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

Malicious Package

Overview tinymask-js is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Malicious Package

Overview 16bit-js-vm-model is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

EUVD-2026-48285

brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash...

NPM: js-yaml: Exponential parsing time in flow collections leads to denial of service

NPM: js-yaml: Exponential parsing time in flow collections leads to denial of service vulnerability discovered by ? in WordPress Npm js-yaml versions = 5.0.0, = 5.2.1...

@adobe/aem-cli (>=16.21.1, <=16.21.6), @adobe/helix-docx2md (>=1.9.29, <=1.9.31) +103 more potentially affected by unknown CVE via js-yaml (>=5.0.0, <=5.2.1)

js-yaml NPM version =5.0.0, =16.21.1, =1.9.29, =6.29.8, =3.4.141, =7.1.20, =2.2.62, =1.5.3, =0.0.1-alpha.0, =1.0.8, =0.1.2, =0.11.0, =5.7.5, =7.0.3 - @davidsneighbour/markdownlint-config 2026.0.5 - @depup/nestjsswagger 11.4.6-depup.1 and more Source cves: unknown CVE Source advisory:...

js-yaml: Exponential parsing time in flow collections leads to denial of service

Summary Parsing a small YAML document can take exponential time. An application that calls load or loadAll on untrusted input can be hung by a payload under 200 bytes. Details When an entry in a flow sequence turns out to be a key: value pair, the parser rewinds and parses that entry a second tim...

@adobe/aem-cli (>=16.21.1, <=16.21.6), @adobe/helix-docx2md (>=1.9.29, <=1.9.31) +103 more potentially affected by CVE-2026-73643 via js-yaml (>=5.0.0, <=5.2.1)

js-yaml NPM version =5.0.0, =16.21.1, =1.9.29, =6.29.8, =3.4.141, =7.1.20, =2.2.62, =1.5.3, =0.0.1-alpha.0, =1.0.8, =0.1.2, =0.11.0, =5.7.5, =7.0.3 - @davidsneighbour/markdownlint-config 2026.0.5 - @depup/nestjsswagger 11.4.6-depup.1 and more Source cves: CVE-2026-73643 Source advisory:...

GHSA-PM4M-PH32-GHV5 js-yaml: Exponential parsing time in flow collections leads to denial of service

Summary Parsing a small YAML document can take exponential time. An application that calls load or loadAll on untrusted input can be hung by a payload under 200 bytes. Details When an entry in a flow sequence turns out to be a key: value pair, the parser rewinds and parses that entry a second tim...

js-x-ray @nodesecure/[email protected]

!slsa...

PT-2026-71720

Name of the Vulnerable Software and Affected Versions js-yaml versions 5.0.0 through 5.2.1 Description Parsing a small YAML document can lead to exponential time consumption when an application calls the load or loadAll functions on untrusted input. In the src/parser/parser.ts file, the...

CVE-2025-71389

Cal.com (calcom/cal.diy) versions before 5.9.9 are vulnerable to unauthenticated remote code execution via Next.js React Server Components (RSC) request handling that deserializes attacker-controlled input. A remote attacker can send a crafted RSC request to the server to execute arbitrary code d...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to multiple Node.js modules

Summary IBM App Connect Enterprise runtime, IBM App Connect Enterprise Discovery Connectors and IBM App Connect Enterprise Connector Discovery and OpenAPI Editor are vulnerable to multiple vulnerabilities due to Node.js modules multer, form-data, protobufjs and tar. Vulnerability Details...

Exploit for Deserialization of Untrusted Data in Facebook React

CVE-2025-55182 — React2Shell CVSS 10.0 CRITICAL | Pre-Auth...

danger allows local OS command injection through crafted file paths

A vulnerability was identified in danger danger-js up to 13.0.7. Impacted is the function danger.git.diffForFile of the file source/platforms/git/localGetFileAtSHA.ts of the component CLI. Such manipulation of the argument File leads to os command injection. The attack needs to be performed...

EUVD-2026-47833

A vulnerability was identified in danger danger-js up to 13.0.7. Impacted is the function danger.git.diffForFile of the file source/platforms/git/localGetFileAtSHA.ts of the component CLI. Such manipulation of the argument File leads to os command injection. The attack needs to be performed...