CVE-2026-97031

Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and curb the memory amplification vector a...

CVE-2025-12999

A flaw was found in openvsx-server. This vulnerability allows an unauthenticated remote attacker to achieve arbitrary code execution on client machines through HTTP cache poisoning. The server generates download and verification URLs from untrusted proxy headers, such as X-Forwarded-Host, without...

AZL-106833 CVE-2026-107718 affecting package httpd 2.4.68-1

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.3 and 9.3.0, AdonisJS HTTP Server inserts route parameter values into URLs without encodeURIComponent in the shared createURL helper used by Router.makeUrl and Response.redirect.toRoute. If an...

CVE-2026-107718

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.3 and 9.3.0, AdonisJS HTTP Server inserts route parameter values into URLs without encodeURIComponent in the shared createURL helper used by Router.makeUrl and Response.redirect.toRoute. If an...

@jsprismarine/client (>=0.1.0-rc.50, <=0.14.2), @jsprismarine/prismarine (>=0.12.2-unstable-20250320195345, <=0.14.2) +2 more potentially affected by CVE-2026-107719 via fast-jwt (>=6.0.0, <=6.3.3)

fast-jwt NPM version =6.0.0, =0.1.0-rc.50, =0.12.2-unstable-20250320195345, =0.1.0-rc.50, =0.1.0-rc.50, =0.1.0-rc.52 Source cves: CVE-2026-107719 Source advisory: SNYK:JS-FASTJWT-20825051...

@jsprismarine/client (>=0.1.0-rc.50, <=0.14.2), @jsprismarine/prismarine (>=0.12.2-unstable-20250320195345, <=0.14.2) +2 more potentially affected by CVE-2026-107719 via fast-jwt (>=6.0.0, <=6.3.3)

fast-jwt NPM version =6.0.0, =0.1.0-rc.50, =0.12.2-unstable-20250320195345, =0.1.0-rc.50, =0.1.0-rc.50, =0.1.0-rc.52 Source cves: CVE-2026-107719 Source advisory: GHSA-X937-HJ6V-793P...

@jsprismarine/client (>=0.1.0-rc.50, <=0.14.2), @jsprismarine/prismarine (>=0.12.2-unstable-20250320195345, <=0.14.2) +2 more potentially affected by CVE-2026-107719 via fast-jwt (>=6.0.0, <=6.3.3)

fast-jwt NPM version =6.0.0, =0.1.0-rc.50, =0.12.2-unstable-20250320195345, =0.1.0-rc.50, =0.1.0-rc.50, =0.1.0-rc.52 Source cves: CVE-2026-107719 Source advisory: OSV:GHSA-X937-HJ6V-793P...

com.erudika:para-server (>=1.25.3, <=1.25.5), com.erudika:para-war (>=1.25.3, <=1.25.5) +24 more potentially affected by CVE-2026-107726 via com.hazelcast:hazelcast (3.8.4)

com.hazelcast:hazelcast MAVEN version 3.8.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.hazelcast:hazelcast and may be impacted: - com.erudika:para-server =1.25.3, =1.25.3, =2.2.26, =3.0.0rc1, =3.0.0rc1, =2.2.26, =3.0.0rc1, =3.0.0, =0.5.2,...

com.erudika:para-server (>=1.25.0, <=1.25.2), com.erudika:para-war (>=1.25.0, <=1.25.2) +18 more potentially affected by CVE-2026-107726 via com.hazelcast:hazelcast (3.8.3)

com.hazelcast:hazelcast MAVEN version 3.8.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.hazelcast:hazelcast and may be impacted: - com.erudika:para-server =1.25.0, =1.25.0, =0.14.0, =0.18.2 -...

com.hazelcast:hazelcast-build-utils (3.11.3), com.hazelcast:hazelcast-client (3.11.3) +43 more potentially affected by CVE-2026-107726 via com.hazelcast:hazelcast (3.11.3)

com.hazelcast:hazelcast MAVEN version 3.11.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.hazelcast:hazelcast and may be impacted: - com.hazelcast:hazelcast-build-utils 3.11.3 - com.hazelcast:hazelcast-client 3.11.3 -...

ch.mobi.mobitor:mobitor-base (>=3.1.13, <=3.1.97), ch.mobi.mobitor:mobitor-doc (3.1.13) +39 more potentially affected by CVE-2026-107726 via com.hazelcast:hazelcast (3.11.2)

com.hazelcast:hazelcast MAVEN version 3.11.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.hazelcast:hazelcast and may be impacted: - ch.mobi.mobitor:mobitor-base =3.1.13, =2.1.6, =1.1.4, =2.1.4, =2.0.9.0, =0.1.0, =0.1.1 -...

@jsprismarine/client (>=0.12.2-unstable-20250320195345, <=0.14.1), @jsprismarine/prismarine (>=0.12.2-unstable-20250320195345, <=0.14.1) +1 more potentially affected by CVE-2026-107720 via fast-jwt (>=6.0.0, <=6.2.4)

fast-jwt NPM version =6.0.0, =0.12.2-unstable-20250320195345, =0.12.2-unstable-20250320195345, =0.12.2-unstable-20250320195345, =0.14.1 Source cves: CVE-2026-107720 Source advisory: SNYK:JS-FASTJWT-20825050...

@jsprismarine/client (>=0.12.2-unstable-20250320195345, <=0.14.1), @jsprismarine/prismarine (>=0.12.2-unstable-20250320195345, <=0.14.1) +1 more potentially affected by CVE-2026-107720 via fast-jwt (>=6.0.0, <=6.2.4)

fast-jwt NPM version =6.0.0, =0.12.2-unstable-20250320195345, =0.12.2-unstable-20250320195345, =0.12.2-unstable-20250320195345, =0.14.1 Source cves: CVE-2026-107720 Source advisory: OSV:GHSA-8WPC-H4Q6-8FXV...

@jsprismarine/client (>=0.13.5-unstable-20260512190500, <=0.14.1), @jsprismarine/prismarine (>=0.13.5-unstable-20260512190500, <=0.14.1) +1 more potentially affected by CVE-2026-107722 via fast-jwt (6.2.4)

fast-jwt NPM version 6.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on fast-jwt and may be impacted: - @jsprismarine/client =0.13.5-unstable-20260512190500, =0.13.5-unstable-20260512190500, =0.13.5-unstable-20260512190500, =0.14.1 Source cves:...

@jsprismarine/client (>=0.13.5-unstable-20260512190500, <=0.14.1), @jsprismarine/prismarine (>=0.13.5-unstable-20260512190500, <=0.14.1) +1 more potentially affected by CVE-2026-107722 +1 more via fast-jwt (6.2.4)

fast-jwt NPM version 6.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on fast-jwt and may be impacted: - @jsprismarine/client =0.13.5-unstable-20260512190500, =0.13.5-unstable-20260512190500, =0.13.5-unstable-20260512190500, =0.14.1 Source cves:...

@jsprismarine/client (>=0.12.2-unstable-20250320195345, <=0.14.1), @jsprismarine/prismarine (>=0.12.2-unstable-20250320195345, <=0.14.1) +1 more potentially affected by CVE-2026-107721 via fast-jwt (>=6.0.0, <=6.2.4)

fast-jwt NPM version =6.0.0, =0.12.2-unstable-20250320195345, =0.12.2-unstable-20250320195345, =0.12.2-unstable-20250320195345, =0.14.1 Source cves: CVE-2026-107721 Source advisory: SNYK:JS-FASTJWT-20825053...

@jsprismarine/client (>=0.12.2-unstable-20250320195345, <=0.14.1), @jsprismarine/prismarine (>=0.12.2-unstable-20250320195345, <=0.14.1) +1 more potentially affected by CVE-2026-107721 via fast-jwt (>=6.0.0, <=6.2.4)

fast-jwt NPM version =6.0.0, =0.12.2-unstable-20250320195345, =0.12.2-unstable-20250320195345, =0.12.2-unstable-20250320195345, =0.14.1 Source cves: CVE-2026-107721 Source advisory: GHSA-687G-22H4-J4W4...

@jsprismarine/client (>=0.12.2-unstable-20250320195345, <=0.14.1), @jsprismarine/prismarine (>=0.12.2-unstable-20250320195345, <=0.14.1) +1 more potentially affected by CVE-2026-107723 via fast-jwt (>=6.0.0, <=6.2.4)

fast-jwt NPM version =6.0.0, =0.12.2-unstable-20250320195345, =0.12.2-unstable-20250320195345, =0.12.2-unstable-20250320195345, =0.14.1 Source cves: CVE-2026-107723 Source advisory: OSV:GHSA-5HJW-83FP-PHQ9...

@jsprismarine/client (>=0.12.2-unstable-20250320195345, <=0.14.1), @jsprismarine/prismarine (>=0.12.2-unstable-20250320195345, <=0.14.1) +1 more potentially affected by CVE-2025-30144 +1 more via fast-jwt (>=6.0.0, <=6.2.4)

fast-jwt NPM version =6.0.0, =0.12.2-unstable-20250320195345, =0.12.2-unstable-20250320195345, =0.12.2-unstable-20250320195345, =0.14.1 Source cves: CVE-2025-30144, CVE-2026-107723 Source advisory: GHSA-5HJW-83FP-PHQ9...

@jsprismarine/client (>=0.12.2-unstable-20250320195345, <=0.14.1), @jsprismarine/prismarine (>=0.12.2-unstable-20250320195345, <=0.14.1) +1 more potentially affected by CVE-2026-107723 via fast-jwt (>=6.0.0, <=6.2.4)

fast-jwt NPM version =6.0.0, =0.12.2-unstable-20250320195345, =0.12.2-unstable-20250320195345, =0.12.2-unstable-20250320195345, =0.14.1 Source cves: CVE-2026-107723 Source advisory: SNYK:JS-FASTJWT-20825052...