CVE-2026-115892

Wasmtime is a runtime for WebAssembly. From 46.0.0 until 48.0.7 and 49.0.4, lowering a host-created component-model stream or future into a guest can omit a required payload-type check after the value passes through guest code and returns through StreamAny, FutureAny, Val::Stream, Val::Future, or...

CVE-2026-115892

Wasmtime is a runtime for WebAssembly. From 46.0.0 until 48.0.7 and 49.0.4, lowering a host-created component-model stream or future into a guest can omit a required payload-type check after the value passes through guest code and returns through StreamAny, FutureAny, Val::Stream, Val::Future, or...

Heartbleed

The Heartbleed test server. With caching by Mozilla. Install the SAMPLE.aws-config.json as /.aws-config.json or /etc/aws-config.json or in a path specified by the GODYNAMOCONFFILE env var. Usage: HBserver --redir-host= --listen= --expiry= HBserver -h | --help HBserver --version Options:...

Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution

Summary The ESM compiler in [email protected] does not validate imported local binding aliases before interpolating them into generated JavaScript. As a result, an invalid ESM import alias can be transformed into a valid JavaScript destructuring default initializer and executed. This appears to b...

GHSA-834V-8H66-3H79 Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution

Summary The ESM compiler in [email protected] does not validate imported local binding aliases before interpolating them into generated JavaScript. As a result, an invalid ESM import alias can be transformed into a valid JavaScript destructuring default initializer and executed. This appears to b...

npm: Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution

npm: Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution vulnerability discovered by ? in WordPress npm happy-dom versions = 17.0.0, = 21.0.3...

CVE-2026-115892

A flaw was found in Wasmtime. A malicious WebAssembly guest can cause a Denial of Service DoS by triggering an unhandled host runtime panic. When handling asynchronous streams or futures exchanged between the host and guest, Wasmtime fails to properly validate payload data types upon their return...

EUVD-2026-104813

fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization...

fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization

Impact fast-uri versions = 2.4.2, = 3.1.3, = 4.0.1, = 4.2.2 can silently rewrite the host of an HTTP-family URL http, https, ws, wss, or any scheme with domainHost: true. For those schemes canonicalizeHost passes the parsed host to the WHATWG URL parser and adopts its .hostname without checking...

GHSA-WJR9-J795-JXCR fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization

Impact fast-uri versions = 2.4.2, = 3.1.3, = 4.0.1, = 4.2.2 can silently rewrite the host of an HTTP-family URL http, https, ws, wss, or any scheme with domainHost: true. For those schemes canonicalizeHost passes the parsed host to the WHATWG URL parser and adopts its .hostname without checking...

npm: fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization

npm: fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization vulnerability discovered by ? in WordPress npm fast-uri versions = 2.4.2, 2.4.8...

CVE-2026-115895

The happy-dom library (versions 17.0.0 through 21.0.4 ) is vulnerable to host code execution due to an incomplete fix for CVE-2026-33943. The flaw exists in packages/happy-dom/src/module/ECMAScriptModuleCompiler.ts, where the compiler fails to validate named ESM import aliases before inserting th...

CVE-2026-115895 Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. From 17.0.0 until 21.0.4, packages/happy-dom/src/module/ECMAScriptModuleCompiler.ts accepts a named ESM import alias without validating that it is a JavaScript binding identifier before inserting it in...

CVE-2026-115895 Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. From 17.0.0 until 21.0.4, packages/happy-dom/src/module/ECMAScriptModuleCompiler.ts accepts a named ESM import alias without validating that it is a JavaScript binding identifier before inserting it in...

MAL-2026-18282 Malicious code in @greenlake/common-context (npm)

@greenlake/common-context is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version 99.0.1, 3.0.0 has a postinstall script that runs node beacon.cjs on npm...

Malicious code in @greenlake/common-context (npm)

@greenlake/common-context is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version 99.0.1, 3.0.0 has a postinstall script that runs node beacon.cjs on npm...

Security Bulletin: vulnerability in fast-uri URI parser for Node.js.

Summary Vulnerability in fast-uri URI parser for Node.js. Vulnerability Details CVEID:CVE-2026-75899 DESCRIPTION: fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a...

CVE-2026-115892

Wasmtime is a runtime for WebAssembly. From 46.0.0 until 48.0.7 and 49.0.4, lowering a host-created component-model stream or future into a guest can omit a required payload-type check after the value passes through guest code and returns through StreamAny, FutureAny, Val::Stream, Val::Future, or...

CVE-2026-115892

Wasmtime is a runtime for WebAssembly. From 46.0.0 until 48.0.7 and 49.0.4, lowering a host-created component-model stream or future into a guest can omit a required payload-type check after the value passes through guest code and returns through StreamAny, FutureAny, Val::Stream, Val::Future, or...

EUVD-2026-109187

Wasmtime is a runtime for WebAssembly. From 46.0.0 until 48.0.7 and 49.0.4, lowering a host-created component-model stream or future into a guest can omit a required payload-type check after the value passes through guest code and returns through StreamAny, FutureAny, Val::Stream, Val::Future, or...