EUVD-2026-110367

Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt unauthenticated event-loop DoS...

SUSE CVE-2026-116581

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON and fromCrossJSON do not validate a sequence node's done index. A crafted done index can create an iterator that never finishes when application code...

Allocation of Resources Without Limits or Throttling

Overview tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via readchunkedbody in http1connection.py, where reads of body data that has...

CVE-2026-116581

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON and fromCrossJSON do not validate a sequence node's done index. A crafted done index can create an iterator that never finishes when application code...

CVE-2026-116581

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON and fromCrossJSON do not validate a sequence node's done index. A crafted done index can create an iterator that never finishes when application code...

PT-2026-125387

Name of the Vulnerable Software and Affected Versions Seroval versions prior to 1.6.8 Description Seroval allows for the stringification of JavaScript values, including complex structures. The fromJSON and fromCrossJSON functions fail to validate the done index of a sequence node. A specially...

EUVD-2026-107555

toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse...

PT-2026-120812

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse repeatedly slices and rejoins every path prefix in lib/compiler.js while processing long dotted keys, table headers, array-of-tables headers, and inline-table keys in assign, deepRef, and setNestedKey. The resultin...

Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`

SummaryThe local web-fetch tool webfetchtool, also used as the WebFetch capability's local fallback processed responses with several steps whose running time grows quadratically with the size of certain server-controlled inputs, and ran them on the event loop: decoding the body with whichever...

EUVD-2026-97600

Open WebUI 0.11.0 before 0.11.4 compiles user-chosen grep patterns for its knowledge and chat file search tools with a regex engine that expands nested counted repetition unbounded at compile time and caches the result. Authenticated users can have the model call grepknowledgefiles with short...

CVE-2026-107297: Inefficient Algorithmic Complexity

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder reparses an incomplete array or map from the beginning whenever another chunk arrives. A remote peer can split one valid MessagePack container across many small chunks, causing completed...

EUVD-2026-88626

pbkdf2 rehashes long passwords on every iteration, enabling denial of service...

smol-toml: Quadratic-time parse() from parseKey rescanning to end of document on each key line

Summary parse has a quadratic-time path in parseKey, reachable on default options with ordinary valid input. For every key line and table-header line, parseKey dist/struct.js, lines 58 and 86 finds the dotted-key separator with ctx.s.indexOf'.', ctx.p, where ctx.s is the whole document. When a ke...

NPM: vm2: timeout Option Bypass via FinalizationRegistry Cleanup Callback (Unbounded Host Event-Loop Block)

NPM: vm2: timeout Option Bypass via FinalizationRegistry Cleanup Callback Unbounded Host Event-Loop Block vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.6...

GHSA-R4FX-V8HH-22MV vm2: timeout Option Bypass via FinalizationRegistry Cleanup Callback (Unbounded Host Event-Loop Block)

Vulnerability Summary vm2's VM timeout option is documented and relied upon as the mechanism that bounds how long sandboxed code may execute. In the current implementation, the timeout only wraps the single synchronous call to VMrun via doWithTimeout → this.runScriptscript in lib/vm.js. It does...

vm2: timeout Option Bypass via FinalizationRegistry Cleanup Callback (Unbounded Host Event-Loop Block)

Vulnerability Summary vm2's VM timeout option is documented and relied upon as the mechanism that bounds how long sandboxed code may execute. In the current implementation, the timeout only wraps the single synchronous call to VMrun via doWithTimeout → this.runScriptscript in lib/vm.js. It does...

SUSE CVE-2026-102414

pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback lib/sync.js. A password longer than the block size 64 bytes, or 128 bytes for sha384 and sha512 is passed to HMAC as the key on every iteration, and HMAC hashes such keys in...

markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds

Summary Two independent quadratic paths in the linkify: true handling. Both are in markdown-it's own code rather than in linkify-it, which stays linear on both payloads. src/rulescore/linkify.ts calls arrayReplaceAt once per linkified text token, and that rebuilds the whole children array each...

GHSA-253C-MCHW-3W2R markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds

Summary Two independent quadratic paths in the linkify: true handling. Both are in markdown-it's own code rather than in linkify-it, which stays linear on both payloads. src/rulescore/linkify.ts calls arrayReplaceAt once per linkified text token, and that rebuilds the whole children array each...

UBUNTU-CVE-2026-102414

pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback lib/sync.js. A password longer than the block size 64 bytes, or 128 bytes for sha384 and sha512 is passed to HMAC as the key on every iteration, and HMAC hashes such keys in...