CVE-2026-67201 V 0.5.2 SSRF Bypass via Parser Differential in net.urllib and net.http

V through 0.5.2, fixed in commit 85859f0, contains a server-side request forgery SSRF bypass vulnerability that allows attackers to circumvent host-based allowlists by exploiting a parser differential between net.urllib and net.http. Attackers can craft a URL containing a backslash in the authori...

EUVD-2026-50446

V through 0.5.2, fixed in commit 85859f0, contains a server-side request forgery SSRF bypass vulnerability that allows attackers to circumvent host-based allowlists by exploiting a parser differential between net.urllib and net.http. Attackers can craft a URL containing a backslash in the authori...

PT-2026-65870

V through 0.5.2, fixed in commit 85859f0, contains a server-side request forgery SSRF bypass vulnerability that allows attackers to circumvent host-based allowlists by exploiting a parser differential between net.urllib and net.http. Attackers can craft a URL containing a backslash in the authori...

CVE-2026-54658 @hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution

Hypequery is a TypeScript semantic layer for ClickHouse. Prior to 2.0.2, escapeValue in packages/clickhouse/src/core/utils.ts did not escape backslashes before single quotes during parameter substitution, allowing attacker controlled query parameters with a trailing backslash to escape the closin...

CVE-2026-53669

CVE-2026-53669 (React Router) affects React Router versions 6.0.0 through 7.17.0. The vulnerability is an Open Redirect caused by using backslashes in and useNavigate, permitting unexpected external navigations. This is a follow-up to CVE-2025-68470. The issue is fixed in version 7.18.0. If expl...

CVE-2026-53669 React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)

React Router is a router for React. Versions 6.0.0 through 7.17.0 are vulnerable to Open Redirtect through use of backslashes in and useNavigate. This issue is a follow up to CVE-2025-68470 and has been fixed in version 7.18.0...

CVE-2026-59730

Astro is a web framework for content-driven websites. In versions 8.1.0 through 11.0.1, when trailingSlash: 'always' is configured, the @astrojs/node standalone server's static file handler appends a trailing slash to request paths and issues a 301 redirect. Paths beginning with /\ slash-backslas...

CVE-2026-59730

CVE-2026-59730 affects the Astro ecosystem via the @astrojs/node standalone server. In versions 8.1.0–11.0.1, with trailingSlash: 'always', the static file handler could mishandle paths starting with a backslash (/), echoing the raw path in the Location header of a 301 redirect. Because browsers ...

CVE-2026-59730 @astrojs/node: Backslash-prefixed paths not recognized as internal by trailing-slash redirect

Astro is a web framework for content-driven websites. In versions 8.1.0 through 11.0.1, when trailingSlash: 'always' is configured, the @astrojs/node standalone server's static file handler appends a trailing slash to request paths and issues a 301 redirect. Paths beginning with /\ slash-backslas...

React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)

This is a follow up to CVE-2025-68470. React Router was alerted to certain scenarios in which the fix there was incomplete so there still existed some scenarios where attacker supplied paths passed to navigation mechanisms could result in unexpected external navigations...

Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect via the navigation mechanisms when attacker-supplied paths containing a backslash are processed. An attacker can redirect users to unintended external sites by crafting malicious links or inputs. Remediation Upgrade...

GHSA-WRJC-X8RR-H8H6 React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)

This is a follow up to CVE-2025-68470. React Router was alerted to certain scenarios in which the fix there was incomplete so there still existed some scenarios where attacker supplied paths passed to navigation mechanisms could result in unexpected external navigations...

NPM: React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)

NPM: React Router: Open redirect via backslash in and useNavigate CVE-2025-68470 bypass vulnerability discovered by ? in WordPress Npm react-router versions = 6.0.0, 7.18.0...

GO-2026-6026 File Browser: Archive builder turns backslash filenames into path traversal (zip-slip) in github.com/filebrowser/filebrowser

File Browser: Archive builder turns backslash filenames into path traversal zip-slip in github.com/filebrowser/filebrowser...

EUVD-2026-45551

fast-uri vulnerable to host confusion via literal backslash authority delimiter...

GHSA-V2HH-GCRM-F6HX fast-uri vulnerable to host confusion via literal backslash authority delimiter

Impact fast-uri v4.1.0 and earlier do not treat a literal backslash U+005C as an authority delimiter. Node's native WHATWG URL used by fetch, undici, and Node's http/https clients normalizes \ to / for special schemes http, https, ws, wss, ftp, file, so the two parsers extract different hosts fro...

Directory Traversal

Overview @hono/node-server is a Node.js Adapter for Hono Affected versions of this package are vulnerable to Directory Traversal in the serve-static on Windows hosts when an encoded backslash %5C in the request path is decoded to , which the Windows path resolver treats as a separator. This allow...

GHSA-FRVP-7C67-39W9 Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)

The same as the hono core Path traversal in serve-static on Windows via encoded backslash %5C. Summary On Windows hosts, an encoded backslash %5C in the request path decodes to , which the Windows path resolver treats as a separator. serve-static then resolves a single URL segment such as...

@astrojs/node: Backslash-prefixed paths not recognized as internal by trailing-slash redirect

Impact With trailingSlash: 'always' configured, the @astrojs/node standalone server's static file handler appends a trailing slash to request paths and issues a 301 redirect. Paths beginning with /\ slash-backslash were not recognized as internal paths, so the handler would echo the raw path back...

GHSA-R557-WFFQ-WVRC @astrojs/node: Backslash-prefixed paths not recognized as internal by trailing-slash redirect

Impact With trailingSlash: 'always' configured, the @astrojs/node standalone server's static file handler appends a trailing slash to request paths and issues a 301 redirect. Paths beginning with /\ slash-backslash were not recognized as internal paths, so the handler would echo the raw path back...