CVE-2026-128126

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Request.post does not limit the number of fields in a URL-encoded form body, and inserting many repeated keys into MultiDict takes quadratic time on the event loop. A remote attacker can send a form...

CVE-2026-128126 AIOHTTP: Too many URL-encoded form fields block the event loop

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Request.post does not limit the number of fields in a URL-encoded form body, and inserting many repeated keys into MultiDict takes quadratic time on the event loop. A remote attacker can send a form...

CVE-2026-128126

The AIOHTTP asynchronous HTTP framework for Python and asyncio is vulnerable to a Denial of Service (DoS) condition prior to version 3.14.4 . The Request.post() method fails to limit the number of fields in a URL-encoded form body, allowing an attacker to insert many repeated keys into a MultiDic...

CVE-2026-128124

The AIOHTTP asynchronous HTTP framework for Python and asyncio is vulnerable to an event loop stall in the Application.add_domain() function. Prior to version 3.14.4 , the framework converts asterisk wildcards into greedy regular-expression fragments. When a domain mask contains two or more wildc...

CVE-2026-128074 Nuxt payload URL generation has quadratic cost for repeated slashes in the request path

Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.4, payload.json URL generation and the experimental early-404 path use a trailing-slash regular expression whose work grows quadratically with a long run of slash characters. An unauthenticated request can...

CVE-2026-128074

The Nuxt web development framework (versions 4.6.0 to 4.6.3) is vulnerable to a Regular Expression Denial of Service (ReDoS) . The issue stems from a trailing-slash regular expression used in _payload.json URL generation and the experimental early-404 path, which exhibits quadratic complexity whe...

CVE-2026-128345

ExcelJS through 4.4.0 contains a regular expression denial of service vulnerability in slideFormula in lib/utils/shared-formula.js when translating shared formulas to child cells. Attackers can supply a crafted spreadsheet with very long master formulas, such as runs of hyphens, causing quadratic...

CVE-2026-128342

ExcelJS through 4.4.0 contains a denial of service vulnerability that allows attackers to block the event loop by supplying an unbounded sheetId in xl/workbook.xml. Attackers can provide a workbook with a huge sheetId, making the sparse worksheet array walk stall worksheets, getWorksheet and...

CVE-2026-128343

exceljs through 4.4.0 contains a denial of service vulnerability that allows attackers to block the event loop by supplying unbounded row r attributes parsed in row-xform.js. Attackers can craft an XLSX file with a row numbered far beyond Excel's limit, making getSheetValues, workbook writes and...

CVE-2026-128342 ExcelJS through 4.4.0 Denial of Service via Oversized Worksheet sheetId

ExcelJS through 4.4.0 contains a denial of service vulnerability that allows attackers to block the event loop by supplying an unbounded sheetId in xl/workbook.xml. Attackers can provide a workbook with a huge sheetId, making the sparse worksheet array walk stall worksheets, getWorksheet and...

EUVD-2026-125157

ExcelJS through 4.4.0 contains a denial of service vulnerability that allows attackers to block the event loop by supplying an unbounded sheetId in xl/workbook.xml. Attackers can provide a workbook with a huge sheetId, making the sparse worksheet array walk stall worksheets, getWorksheet and...

CVE-2026-128342

The ExcelJS library (versions through 4.4.0 ) is vulnerable to a Denial of Service (DoS) attack due to an unchecked input for loop conditions (CWE-606 ). An attacker can provide a workbook containing a large, unbounded sheetId in the xl/workbook.xml file. This causes the sparse worksheet array wa...

CVE-2026-128343 ExcelJS through 4.4.0 Denial of Service via Oversized Row Number

exceljs through 4.4.0 contains a denial of service vulnerability that allows attackers to block the event loop by supplying unbounded row r attributes parsed in row-xform.js. Attackers can craft an XLSX file with a row numbered far beyond Excel's limit, making getSheetValues, workbook writes and...

EUVD-2026-125156

exceljs through 4.4.0 contains a denial of service vulnerability that allows attackers to block the event loop by supplying unbounded row r attributes parsed in row-xform.js. Attackers can craft an XLSX file with a row numbered far beyond Excel's limit, making getSheetValues, workbook writes and...

CVE-2026-128345

ExcelJS versions through 4.4.0 are vulnerable to a Regular Expression Denial of Service (ReDoS) in the slideFormula function located in lib/utils/shared-formula.js. The root cause is triggered during the translation of shared formulas to child cells, where a crafted spreadsheet containing very lo...

CVE-2026-128345 ExcelJS through 4.4.0 ReDoS via slideFormula Shared Formula Translation

ExcelJS through 4.4.0 contains a regular expression denial of service vulnerability in slideFormula in lib/utils/shared-formula.js when translating shared formulas to child cells. Attackers can supply a crafted spreadsheet with very long master formulas, such as runs of hyphens, causing quadratic...

PT-2026-147155

Name of the Vulnerable Software and Affected Versions SvelteKit versions 2.42.0 through 3.1.0 Description Applications using the experimental remote functions flag and a remote form function are susceptible to a denial of service. A specially crafted request containing numerous form entries can...

PT-2026-146559

ExcelJS through 4.4.0 contains a regular expression denial of service vulnerability in slideFormula in lib/utils/shared-formula.js when translating shared formulas to child cells. Attackers can supply a crafted spreadsheet with very long master formulas, such as runs of hyphens, causing quadratic...

PT-2026-147165

Name of the Vulnerable Software and Affected Versions AIOHTTP versions prior to 3.14.4 Description The Request.post function does not limit the number of fields in a URL-encoded form body. Inserting numerous repeated keys into MultiDict results in quadratic time complexity on the event loop,...

CVE-2026-127056

PapaParse before 5.7.1 contains an inefficient algorithmic complexity vulnerability that allows remote unauthenticated attackers to cause denial of service by submitting delimiter-free quoted CSV input to Papa.parse. Attackers can supply a single-column quoted CSV with no delimiters, triggering...