255318 matches found
PT-2026-66604
Name of the Vulnerable Software and Affected Versions re2 versions prior to 1.25.2 Description The software validates lastIndex against the UTF-8 byte length of a subject but incorrectly uses it as a UTF-16 code-unit offset in the exec, test, match, replace, and split functions. When a non-ASCII...
Linux Distros Unpatched Vulnerability : CVE-2026-58042
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw in Node.js can cause dns.resolveAny Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records. Repeated triggering of this conditio...
nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw
A flaw in the Node.js Permission Model allows attackers to bypass --permission restrictions, enabling unauthorized read or write access to files and directories...
nodejs: Information disclosure due to improper permission enforcement
A flaw was found in Node.js. The permission model enforcement, specifically related to process.report functionality, allows an attacker to write or overwrite files in locations outside of the intended secure paths. This vulnerability can lead to the disclosure of sensitive information or bypass t...
nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw
A flaw in the Node.js Permission Model allows attackers to bypass --permission restrictions, enabling unauthorized read or write access to files and directories...
axios: axios: Information disclosure via Prototype Pollution in Node HTTP adapter
A flaw was found in axios when used in a Node.js deployment with the HTTP adapter. This vulnerability, known as Prototype Pollution, occurs because request interceptors can revert hardened request configurations, allowing an attacker to manipulate the Object.prototype.proxy property. If...
MAL-2026-11172 Malicious code in @ai-agent-node/createnode (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 88461b4fe3bc4e6e16f6dbabec2dd4acdf4eb2df6390170776629e5f955f13f4 @ai-agent-node/createnode ships a 12-line main module that, on require, fetches https://api.github.com/gists/198a0bbec7a6018e9250615d26e37b90 owner:...
Malicious code in @ai-agent-node/createnode (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 88461b4fe3bc4e6e16f6dbabec2dd4acdf4eb2df6390170776629e5f955f13f4 @ai-agent-node/createnode ships a 12-line main module that, on require, fetches https://api.github.com/gists/198a0bbec7a6018e9250615d26e37b90 owner:...
CVE-2026-56852 affecting package prometheus-node-exporter for versions less than 1.7.0-5
CVE-2026-56852 affecting package prometheus-node-exporter for versions less than 1.7.0-5. A patched version of the package is available...
tar: node-tar: Denial of Service via crafted gzip bomb
A flaw was found in node-tar, a tar archive manipulation library for Node.js. This vulnerability allows a remote attacker to craft a small gzip bomb, which, when processed, can lead to the exhaustion of disk space and CPU resources. This occurs because node-tar does not enforce strict limits on t...
tar: Node-tar: Denial of Service via malformed tar archive header
A flaw was found in node-tar, a tar archive manipulation library for Node.js. A remote attacker could exploit this vulnerability by providing a specially crafted tar archive with a negative entry size in its header. This malformed header causes the archive scanner to enter an infinite loop,...
tar: node-tar: Denial of Service via crafted gzip bomb
A flaw was found in node-tar, a tar archive manipulation library for Node.js. This vulnerability allows a remote attacker to craft a small gzip bomb, which, when processed, can lead to the exhaustion of disk space and CPU resources. This occurs because node-tar does not enforce strict limits on t...
tar: Node-tar: Denial of Service via malformed tar archive header
A flaw was found in node-tar, a tar archive manipulation library for Node.js. A remote attacker could exploit this vulnerability by providing a specially crafted tar archive with a negative entry size in its header. This malformed header causes the archive scanner to enter an infinite loop,...
MAL-2026-11178 Malicious code in @peptide-unit/peptide-modify (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 057496c38e2475722f55b10253b62536011c6e82e3552f53450fe80441e40c65 No static or behavioral indicators of supply-chain attack were identified in this package version. No lifecycle scripts fetching or executing remote...
MAL-2026-11177 Malicious code in @peptide-unit/js-unimode (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4d2db0b951057e42b31006e9bfd3752cde6db494df5959f44e0243f802d7a32 index.js is a repackaged copy of the legitimate emptyport/unimod peptide-modification lookup library with an obfuscator.io RC4 string-array IIFE...
ROOT-APP-NPM-CVE-2026-44489 CVE-2026-44489 in @rootio/axios - Patched by Root
Root has patched CVE-2026-44489 in the @rootio/axios package for Root:npm. Multiple fixed versions available...
CVE-2026-64466
A flaw was found in the Linux kernel's Rust Binder component. This vulnerability occurs when a freeze listener is not properly cleared upon node removal, leading to a reference count cycle. This can result in a memory leak, potentially impacting system stability and performance over time...
Malicious code in test2221 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6113dcb20ef051691e0cc0034132b94421604bd16a085229f75aae5c612a3d9 package.json declares preinstall and postinstall lifecycle scripts that run curl against http://54.37.234.136/voicemail over plain HTTP, sending the...
MAL-2026-11176 Malicious code in @bowozzz/baileys (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4722e281a0d76eb608340d11a90f25453d5804124aebdd842b462fb03986891f Package is a fork of the Baileys WhatsApp Web library. A single static pattern fired on lib/Utils/generics.js where the tokens 'ping' and 'GET' appea...
Two Compromised joyfill npm Packages Run RAT When Imported Into Node.js
Beta release versions of two npm packages in the @joyfill namespace have been compromised to deliver a remote access trojan RAT associated with the DEVPOPPER malware family. The list of affected packages is as follows - @joyfill/[email protected] @joyfill/[email protected]...