2692 matches found
Effect `AsyncLocalStorage` context lost/contaminated inside Effect fibers under concurrent load with RPC
Versions - effect: 3.19.15 - @effect/rpc: 0.72.1 - @effect/platform: 0.94.2 - Node.js: v22.20.0 - Vercel runtime with Fluid compute - Next.js: 16 App Router - @clerk/nextjs: 6.x Root cause Effect's MixedScheduler batches fiber continuations and drains them inside a single microtask or timer...
Race Condition
Overview effect is a node package that allows you to add effects on images. Affected versions of this package are vulnerable to Race Condition in the MixedScheduler class, where the AsyncLocalStorage context is not properly isolated between concurrent fiber executions. An attacker can access or...
Race Condition
Overview org.webjars.npm:effect is a node package that allows you to add effects on images. Affected versions of this package are vulnerable to Race Condition in the MixedScheduler class, where the AsyncLocalStorage context is not properly isolated between concurrent fiber executions. An attacker...
Denial Of Service (DoS)
Node.js is vulnerable to Denial of Service DoS. The vulnerability is due to improper error handling when asynchooks.createHook is enabled, where "Maximum call stack size exceeded" errors become uncatchable and terminate the process instead of reaching uncaughtException, allowing attackers to...
jackson-core -- StreamReadConstraints can be bypassed
The Jackson project reports: Enforce maxNameLength incrementally in ReaderBasedJsonParser Fail parsing from DataInput if StreamReadConstraints.getMaxDocumentLength set Fix maxDocumentLength bypass in async parser single feedInput case Enforce StreamReadConstraints.maxNumberLength for non-blocking...
UBUNTU-CVE-2026-23265
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on node footer in read,writeendio ----------- cut here ------------ kernel BUG at fs/f2fs/data.c:358! Call Trace: blkupdaterequest+0x5eb/0xe70 block/blk-mq.c:987 blkmqendrequest+0x3e/0x70...
Malicious code in chain-promised-async (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9260393814045a3ce0ce9a27ff97fffcbaad7b38ad91f54d8cad995c3deb43af The package chain-promised-async was found to contain malicious code...
MAL-2026-1689 Malicious code in chain-promised-async (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9260393814045a3ce0ce9a27ff97fffcbaad7b38ad91f54d8cad995c3deb43af The package chain-promised-async was found to contain malicious code...
Malicious code in chai-promised-async (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5884b19c92ddf330516683f9cc004dabf1dd94e8fe15d4c809d59ecb63dc55c0 The package chai-promised-async was found to contain malicious code...
MAL-2026-1679 Malicious code in chai-promised-async (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5884b19c92ddf330516683f9cc004dabf1dd94e8fe15d4c809d59ecb63dc55c0 The package chai-promised-async was found to contain malicious code...
Malicious code in chai-cli-async (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d9f4be84db26d0ce71d5bcfda424b1af08abddc37c23d3a2ef2b4263534fde2 The package chai-cli-async was found to contain malicious code...
MAL-2026-1677 Malicious code in chai-cli-async (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d9f4be84db26d0ce71d5bcfda424b1af08abddc37c23d3a2ef2b4263534fde2 The package chai-cli-async was found to contain malicious code...
Malicious code in async-substrate-interface-sub (PyPI)
--- -= Per source details. Do not edit below this line.=-...
EulerOS 2.0 SP12 : libwebsockets (EulerOS-SA-2026-1373)
According to the versions of the libwebsockets package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Stack-based Buffer Overflow in lwsadnsparselabel in warmcat libwebsockets allows, when the LWSWITHSYSASYNCDNS flag is enabled during...
MAL-2026-1558 Malicious code in syntax-async-generators (npm)
The package 'syntax-async-generators' is part of the PhantomRaven supply chain attack campaign Wave 3. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server...
Malicious code in syntax-async-generators (npm)
The package 'syntax-async-generators' is part of the PhantomRaven supply chain attack campaign Wave 3. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server...
Malicious Package
Overview syntax-async-generators is a malicious package. This package was recognized as part of the 'PhantomRaven' supply chain campaign, which involves credential-stealing malware. The package impersonates well-known ecosystem plugins to deceive developers into installing it. Malicious Behavior...
EUVD-2026-11367
StudioCMS S3 Storage Manager Authorization Bypass via Missing await on Async Auth Check...
GHSA-MM78-FGQ8-6PGR StudioCMS S3 Storage Manager Authorization Bypass via Missing `await` on Async Auth Check
Summary The S3 storage manager's isAuthorized function is declared async returns Promise but is called without await in both the POST and PUT handlers. Since a Promise object is always truthy in JavaScript, !isAuthorizedtype always evaluates to false, completely bypassing the authorization check...
