GHSA-4528-X5FX-H6HG joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service

Summary Joi.string.email multiple: true takes quadratic time to split a value that contains a long run of whitespace. One request with 100 KB of spaces blocks the Node.js event loop for several seconds, which causes a denial of service. Details When the multiple option is set, the email rule spli...

joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service

Summary Joi.string.email multiple: true takes quadratic time to split a value that contains a long run of whitespace. One request with 100 KB of spaces blocks the Node.js event loop for several seconds, which causes a denial of service. Details When the multiple option is set, the email rule spli...

EUVD-2026-113373

@hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service...

@hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service

Summary Content.disposition takes quadratic time when a Content-Disposition parameter contains a long token without =. One unauthenticated multipart request can block the Node.js event loop for several minutes. Details Content.disposition reads the parameters with a global regular expression in...

GHSA-7WCH-P9PX-956X Forge: Regular expression denial of service in PEM decoding (pem.decode)

Summary pem.decode, which every node-forge API that parses PEM input uses, split messages with a regular expression that takes polynomial time on input without a matching END line, and parsed encapsulated headers with regular expressions that take quadratic time on long header lines. A remote...

Forge: Regular expression denial of service in PEM decoding (pem.decode)

Summary pem.decode, which every node-forge API that parses PEM input uses, split messages with a regular expression that takes polynomial time on input without a matching END line, and parsed encapsulated headers with regular expressions that take quadratic time on long header lines. A remote...

CVE-2026-63341 Aedes has Uncaught Exception and Uncontrolled Resource Consumption

Aedes is an MQTT broker that can run on any stream server. Prior to 1.1.1, the MQTT broker does not bound topic depth or structural complexity before passing topics through mqemitter into qlobber. A PUBLISH, SUBSCRIBE, or registered Will message containing an excessively deep topic can reach...

CVE-2026-118664

A flaw was found in decode-uri-component. A remote attacker can trigger a Denial of Service DoS by sending crafted input containing numerous malformed percent-encoded sequences. When processing this input, an inefficient fallback decoding routine consumes excessive processor resources and blocks...

CVE-2026-63341: moscajs aedes: Aedes is an MQTT broker that can run on any stream server

Aedes is an MQTT broker that can run on any stream server. Prior to 1.1.1, the MQTT broker does not bound topic depth or structural complexity before passing topics through mqemitter into qlobber. A PUBLISH, SUBSCRIBE, or registered Will message containing an excessively deep topic can reach...

CVE-2026-119202

@hapi/content provides HTTP Content- header parsing. From 3.0.6 until 6.0.3, Content.disposition uses an unanchored parameter-name expression in a global regular-expression scan, causing repeated failed matching over the remaining input when a Content-Disposition parameter contains a long token...

CVE-2026-119202 @hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service

@hapi/content provides HTTP Content- header parsing. From 3.0.6 until 6.0.3, Content.disposition uses an unanchored parameter-name expression in a global regular-expression scan, causing repeated failed matching over the remaining input when a Content-Disposition parameter contains a long token...

CVE-2026-119202 @hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service

@hapi/content provides HTTP Content- header parsing. From 3.0.6 until 6.0.3, Content.disposition uses an unanchored parameter-name expression in a global regular-expression scan, causing repeated failed matching over the remaining input when a Content-Disposition parameter contains a long token...

CVE-2026-119202

The @hapi/content library (versions 3.0.6 through 6.0.3) is vulnerable to a Denial of Service (DoS) attack due to quadratic-time parsing in the Content.disposition() function. The root cause is an unanchored parameter-name expression used in a global regular-expression scan, which triggers repeat...

CVE-2026-118772

joi is a schema description language and data validator for JavaScript. From 17.1.1 until 17.13.9 and 18.3.1, the Joi.string.email multiple: true rule uses a separator regular expression whose leading whitespace quantifier is retried at every position in a long whitespace run that contains no...

CVE-2026-118781 Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used BigInteger.prototype.modInverse, bnModInverse, lib/jsbn.js, RSA public exponent e to process the relevant input or security decision. node-forge's...

CVE-2026-118781 Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used BigInteger.prototype.modInverse, bnModInverse, lib/jsbn.js, RSA public exponent e to process the relevant input or security decision. node-forge's...

CVE-2026-118781

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used BigInteger.prototype.modInverse, bnModInverse, lib/jsbn.js, RSA public exponent e to process the relevant input or security decision. node-forge's...

CVE-2026-118781

The node-forge (Forge) JavaScript TLS implementation is vulnerable to a Denial of Service (DoS) attack due to an infinite loop in its bundled jsbn implementation. The issue occurs when BigInteger.prototype.modInverse() receives a negative value or modulus, specifically when processing the RSA pub...

CVE-2026-118772 joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service

joi is a schema description language and data validator for JavaScript. From 17.1.1 until 17.13.9 and 18.3.1, the Joi.string.email multiple: true rule uses a separator regular expression whose leading whitespace quantifier is retried at every position in a long whitespace run that contains no...

CVE-2026-118772 joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service

joi is a schema description language and data validator for JavaScript. From 17.1.1 until 17.13.9 and 18.3.1, the Joi.string.email multiple: true rule uses a separator regular expression whose leading whitespace quantifier is retried at every position in a long whitespace run that contains no...