CVE-2026-118772 joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service

joi is a schema description language and data validator for JavaScript. From 17.1.1 until 17.13.9 and 18.3.1, the Joi.string.email multiple: true rule uses a separator regular expression whose leading whitespace quantifier is retried at every position in a long whitespace run that contains no...

CVE-2026-119051

flat through 6.0.1 contains an uncontrolled resource allocation vulnerability in unflatten that allows attackers to create huge sparse arrays via unbounded numeric keys. Attackers can supply flattened keys such as a.4294967294, causing iteration with forEach, spread or JSON.stringify to block the...

CVE-2026-119051

The flat library (versions through 6.0.1 ) contains an uncontrolled resource allocation vulnerability within the unflatten() function. The root cause is the processing of unbounded numeric keys, which allows an attacker to create massive sparse arrays. This can result in a Denial of Service (DoS)...

EUVD-2026-112817

flat through 6.0.1 contains an uncontrolled resource allocation vulnerability in unflatten that allows attackers to create huge sparse arrays via unbounded numeric keys. Attackers can supply flattened keys such as a.4294967294, causing iteration with forEach, spread or JSON.stringify to block the...

CVE-2026-119202: hapijs content: @hapi/content provides HTTP Content-* header parsing

@hapi/content provides HTTP Content- header parsing. From 3.0.6 until 6.0.3, Content.disposition uses an unanchored parameter-name expression in a global regular-expression scan, causing repeated failed matching over the remaining input when a Content-Disposition parameter contains a long token...

PT-2026-132771

Name of the Vulnerable Software and Affected Versions joi versions 17.1.1 through 17.13.8 joi versions 18.0.0 through 18.3.0 Description The Joi.string.email multiple: true rule uses a separator regular expression that causes quadratic work during String.prototype.split when processing long...

Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks

Summary When Tornado reads an HTTP/1.1 body that uses chunked transfer encoding, it processes all chunks that have already arrived without yielding to the event loop. A client can send a body made of millions of 1-byte chunks, which blocks the event loop and therefore every other connection serve...

GHSA-R4J5-9XPP-3985 Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks

Summary When Tornado reads an HTTP/1.1 body that uses chunked transfer encoding, it processes all chunks that have already arrived without yielding to the event loop. A client can send a body made of millions of 1-byte chunks, which blocks the event loop and therefore every other connection serve...

EUVD-2026-110077

Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks...

EUVD-2026-110367

Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt unauthenticated event-loop DoS...

npm: Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS)

npm: Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt unauthenticated event-loop DoS vulnerability discovered by ? in WordPress npm seroval versions = 1.6.7...

CVE-2026-118664

decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js falls back to customDecodeURIComponent after native decoding throws, and the fallback collects every distinct percent-encoded run before performing a full-string...

EUVD-2026-109185

graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service...

CVE-2026-118664 decode-uri-component: Denial of service via quadratic replacement of percent-encoded runs

decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js falls back to customDecodeURIComponent after native decoding throws, and the fallback collects every distinct percent-encoded run before performing a full-string...

CVE-2026-118664 decode-uri-component: Denial of service via quadratic replacement of percent-encoded runs

decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js falls back to customDecodeURIComponent after native decoding throws, and the fallback collects every distinct percent-encoded run before performing a full-string...

CVE-2026-118664

decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js falls back to customDecodeURIComponent after native decoding throws, and the fallback collects every distinct percent-encoded run before performing a full-string...

CVE-2026-118646

n8n before 1.123.85, 2.43.5, and 2.44.1 contains a regular expression denial of service vulnerability that allows authenticated members to block the event loop via crafted glob patterns. Attackers who can create and run workflows can submit a wildcard-heavy Files Selector pattern causing...

CVE-2026-118646 n8n before 1.123.85, 2.43.5, and 2.44.1 ReDoS via Read/Write Files Node

n8n before 1.123.85, 2.43.5, and 2.44.1 contains a regular expression denial of service vulnerability that allows authenticated members to block the event loop via crafted glob patterns. Attackers who can create and run workflows can submit a wildcard-heavy Files Selector pattern causing...

EUVD-2026-112377

n8n before 1.123.85, 2.43.5, and 2.44.1 contains a regular expression denial of service vulnerability that allows authenticated members to block the event loop via crafted glob patterns. Attackers who can create and run workflows can submit a wildcard-heavy Files Selector pattern causing...

CVE-2026-118646 n8n before 1.123.85, 2.43.5, and 2.44.1 ReDoS via Read/Write Files Node

n8n before 1.123.85, 2.43.5, and 2.44.1 contains a regular expression denial of service vulnerability that allows authenticated members to block the event loop via crafted glob patterns. Attackers who can create and run workflows can submit a wildcard-heavy Files Selector pattern causing...