Malicious code in webautomation_js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 854e679284d7396f5ac4f7248839fa3704a2c72bcec08c100267b5980cd2a0d5 index.js is packed with an obfuscator.io RC4 string-array plus self-defending debugger-check wrapper. The only exported function appends a...

MAL-2026-13991 Malicious code in webautomation_js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 854e679284d7396f5ac4f7248839fa3704a2c72bcec08c100267b5980cd2a0d5 index.js is packed with an obfuscator.io RC4 string-array plus self-defending debugger-check wrapper. The only exported function appends a...

USN-8638-1: Axios vulnerabilities

Ameer Assadi discovered that Axios did not properly handle certain hostnames when applying NOPROXY rules. An attacker could possibly use this issue to bypass proxy restrictions and access internal services, resulting in server-side request forgery. CVE-2025-62718 It was discovered that Axios did...

USN-8638-1 node-axios vulnerabilities

Ameer Assadi discovered that Axios did not properly handle certain hostnames when applying NOPROXY rules. An attacker could possibly use this issue to bypass proxy restrictions and access internal services, resulting in server-side request forgery. CVE-2025-62718 It was discovered that Axios did...

PT-2026-99948

Name of the Vulnerable Software and Affected Versions Axios versions 1.15.2 through 1.19.x Description The Node HTTP adapter in lib/adapters/http.js provides request options that lack a specific createConnection value. When a separate prototype pollution flaw is present in the same process, an...

PT-2026-99940

Name of the Vulnerable Software and Affected Versions Axios versions 1.13.0 through 1.19.x Description In the Node.js environment, the Http2Sessions component fails to implement proper error handling for ClientHttp2Session during the initialization or reuse of HTTP/2 sessions. When a request is...

PT-2026-99938

Name of the Vulnerable Software and Affected Versions Axios versions 1.13.0 through 1.19.x Description HTTP/2 request setup fails to consistently apply proxy settings and caller-supplied DNS lookup policies. When an HTTPS request is configured with httpVersion: 2 and uses config.proxy or...

PT-2026-99946

Name of the Vulnerable Software and Affected Versions Axios versions 1.16.1 through 1.19.x Description A regular expression used for RFC 2397 compliance allows slash characters on both sides of the media-type separator. When an application processes a malformed data URL containing numerous slash...

PT-2026-99947

Name of the Vulnerable Software and Affected Versions Axios versions 1.0.0 through 1.19.x Description The dispatchRequest function normalizes inherited Object.prototype.headers from a replacement request configuration. When a same-process prototype pollution flaw sets Object.prototype.headers and...

PT-2026-99949

Name of the Vulnerable Software and Affected Versions Axios versions 1.15.0 through 1.19.x Description A denial of service can occur when HTTP PROXY or HTTPS PROXY is configured, NO PROXY or no proxy is non-empty, and redirects are followed. The issue arises when a crafted redirect Location...

TencentOS Server 4: grafana (TSSA-2026:0822)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0822 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

MAL-2026-13700 Malicious code in chai-as-deployer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4da130c2818dc609c23c93511a70a6c207cf19cdf9fdd937e369e07b5f1e492 The package is published as chai-as-deployer but its tarball contains verbatim pino README/docs/type-definitions while the advertised chai plugin is ...

Malicious code in chai-jsonss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b1fff32102bc74783cae571646ec0fd68b14c614b35a63badd814a64caa3b67 On import, index.js invokes postCallers which resolves a base64-encoded URL stored in lib/const.js decoding to https://1uznbx.s.gy/7xdQmt, GETs the...

EUVD-2026-54962

A security vulnerability has been detected in adafap api-mcp up to 92b9a5d04acfec165c7d4ef852496593aa87be06. This affects the function customAxios of the file app/api/proxy/route.ts of the component Proxy API Endpoint. The manipulation of the argument url leads to server-side request forgery. The...

CVE-2026-19374

CVE-2026-19374 affects the adafap api-mcp Proxy API Endpoint, specifically the customAxios function in app/api/proxy/route.ts. The issue arises from manipulation of the url argument, causing server-side request forgery (SSRF). Exploitation is described as remote. Documents consistently note a rol...

CVE-2026-19369

A vulnerability was found in KS-GEN-AI jira-mcp-server 0.2.0. This affects the function axios.get of the file src/index.ts of the component addattachmentfrompublicurl. The manipulation of the argument imageUrl results in server-side request forgery. The attack requires a local approach. The proje...

Prototype Pollution

Axios is vulnerable to Prototype Pollution. The vulnerability is due to inherited username and password values from a polluted Object.prototype being used to construct the Authorization: Basic header, allowing an attacker to inject or replace Basic authentication credentials in outbound requests...

Uncontrolled Recursion

Axios is vulnerable to Denial Of Service. The vulnerability is due to uncontrolled recursion in formDataToJSON through buildPath when processing attacker-controlled FormData field names with deeply nested brackets, allowing an attacker to exhaust the JavaScript call stack and trigger a RangeError...

MaxBodyLength Limit Bypass

axios is vulnerable to a maxBodyLength limit bypass. The vulnerability is due to the HTTP/2 request API not enforcing the configured maxBodyLength limit and axios's byte-counting stream wrapper being conditionally applied, which allows an attacker who controls a streamed request body to transmit...

Prototype Pollution

Axios is vulnerable to Prototype Pollution. The vulnerability is due to inherited data, proxy, and paramsSerializer values being read from polluted Object.prototype, allowing attackers to alter request bodies, proxy routing, or URL serialization when affected low-level paths are used...