Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution

Summary The ESM compiler in [email protected] does not validate imported local binding aliases before interpolating them into generated JavaScript. As a result, an invalid ESM import alias can be transformed into a valid JavaScript destructuring default initializer and executed. This appears to b...

GHSA-834V-8H66-3H79 Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution

Summary The ESM compiler in [email protected] does not validate imported local binding aliases before interpolating them into generated JavaScript. As a result, an invalid ESM import alias can be transformed into a valid JavaScript destructuring default initializer and executed. This appears to b...

CVE-2026-115892

A flaw was found in Wasmtime. A malicious WebAssembly guest can cause a Denial of Service DoS by triggering an unhandled host runtime panic. When handling asynchronous streams or futures exchanged between the host and guest, Wasmtime fails to properly validate payload data types upon their return...

EUVD-2026-104813

fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization...

GHSA-WJR9-J795-JXCR fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization

Impact fast-uri versions = 2.4.2, = 3.1.3, = 4.0.1, = 4.2.2 can silently rewrite the host of an HTTP-family URL http, https, ws, wss, or any scheme with domainHost: true. For those schemes canonicalizeHost passes the parsed host to the WHATWG URL parser and adopts its .hostname without checking...

npm: fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization

npm: fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization vulnerability discovered by ? in WordPress npm fast-uri versions = 2.4.2, 2.4.8...

fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization

Impact fast-uri versions = 2.4.2, = 3.1.3, = 4.0.1, = 4.2.2 can silently rewrite the host of an HTTP-family URL http, https, ws, wss, or any scheme with domainHost: true. For those schemes canonicalizeHost passes the parsed host to the WHATWG URL parser and adopts its .hostname without checking...

CVE-2026-115895 Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. From 17.0.0 until 21.0.4, packages/happy-dom/src/module/ECMAScriptModuleCompiler.ts accepts a named ESM import alias without validating that it is a JavaScript binding identifier before inserting it in...

CVE-2026-115895 Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. From 17.0.0 until 21.0.4, packages/happy-dom/src/module/ECMAScriptModuleCompiler.ts accepts a named ESM import alias without validating that it is a JavaScript binding identifier before inserting it in...

CVE-2026-115895

The happy-dom library (versions 17.0.0 through 21.0.4 ) is vulnerable to host code execution due to an incomplete fix for CVE-2026-33943. The flaw exists in packages/happy-dom/src/module/ECMAScriptModuleCompiler.ts, where the compiler fails to validate named ESM import aliases before inserting th...

MAL-2026-18282 Malicious code in @greenlake/common-context (npm)

@greenlake/common-context is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version 99.0.1, 3.0.0 has a postinstall script that runs node beacon.cjs on npm...

Malicious code in @greenlake/common-context (npm)

@greenlake/common-context is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version 99.0.1, 3.0.0 has a postinstall script that runs node beacon.cjs on npm...

Security Bulletin: vulnerability in fast-uri URI parser for Node.js.

Summary Vulnerability in fast-uri URI parser for Node.js. Vulnerability Details CVEID:CVE-2026-75899 DESCRIPTION: fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a...

CVE-2026-115892

Wasmtime is a runtime for WebAssembly. From 46.0.0 until 48.0.7 and 49.0.4, lowering a host-created component-model stream or future into a guest can omit a required payload-type check after the value passes through guest code and returns through StreamAny, FutureAny, Val::Stream, Val::Future, or...

CVE-2026-115892

Wasmtime is a runtime for WebAssembly. From 46.0.0 until 48.0.7 and 49.0.4, lowering a host-created component-model stream or future into a guest can omit a required payload-type check after the value passes through guest code and returns through StreamAny, FutureAny, Val::Stream, Val::Future, or...

EUVD-2026-109187

Wasmtime is a runtime for WebAssembly. From 46.0.0 until 48.0.7 and 49.0.4, lowering a host-created component-model stream or future into a guest can omit a required payload-type check after the value passes through guest code and returns through StreamAny, FutureAny, Val::Stream, Val::Future, or...

CVE-2026-58202

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.0.0, the account-confirmation link in emails is built from the request Host header, with no allowlist. The unauthenticated POST /api/auth/resend-confirmation rotates a...

CVE-2026-113951

If an attacker can write to the filesystem of a container k8s cluster container, they can plant an exec credential plugin in /etc/kubernetes/admin.conf. kubectl will run that plugin as the macOS host user the next time someone pulls the cluster's kubeconfig onto the host with container k8s...

CVE-2026-113951

If an attacker can write to the filesystem of a container k8s cluster container, they can plant an exec credential plugin in /etc/kubernetes/admin.conf. kubectl will run that plugin as the macOS host user the next time someone pulls the cluster's kubeconfig onto the host with container k8s...

EUVD-2026-109181

If an attacker can write to the filesystem of a container k8s cluster container, they can plant an exec credential plugin in /etc/kubernetes/admin.conf. kubectl will run that plugin as the macOS host user the next time someone pulls the cluster's kubeconfig onto the host with container k8s...