EUVD-2026-52763

A flaw in Node.js HTTP/2 handling allows nghttp2sessionmemsend to be called re-entrantly while nghttp2sessionmemrecv is executing, resulting in a heap-use-after-free. This vulnerability affects Node.js 26.x, 24.x, and 22.x...

Malicious code in @nebula.js/sn-org-chart (npm)

npm/@nebula.js/sn-org-chart is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11565 Malicious code in @nebula.js/cli (npm)

npm/@nebula.js/cli is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished by t...

Malicious code in @nebula.js/sn-map (npm)

npm/@nebula.js/sn-map is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished b...

MAL-2026-11572 Malicious code in @nebula.js/sn-animator (npm)

npm/@nebula.js/sn-animator is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

CLSA-2026-1784683084 TuxCare security update for js-yaml (1 CVE)

TuxCare rebuilt js-yaml to address 1 CVE. Fixed in 3.14.1-tuxcare.2...

CLSA-2026-1784682988 TuxCare security update for js-yaml (3 CVEs)

TuxCare rebuilt js-yaml to address 3 CVEs. Fixed in 3.14.2-tuxcare.1...

CLSA-2026-1784596292 TuxCare security update for js-yaml (1 CVE)

TuxCare rebuilt js-yaml to address 1 CVE. Fixed in 4.1.0-tuxcare.2...

CLSA-2026-1784596307 TuxCare security update for js-yaml (1 CVE)

TuxCare rebuilt js-yaml to address 1 CVE. Fixed in 3.7.0-tuxcare.2...

CLSA-2026-1782781179 TuxCare security update for ua-parser-js (1 CVE)

TuxCare rebuilt ua-parser-js to address 1 CVE. Fixed in 0.7.31-tuxcare.1...

CLSA-2026-1782089812 TuxCare security update for js-cookie (1 CVE)

TuxCare rebuilt js-cookie to address 1 CVE. Fixed in 2.2.1-tuxcare.1...

CLSA-2026-1781484837 TuxCare security update for js-yaml (3 CVEs)

TuxCare rebuilt js-yaml to address 3 CVEs. Fixed in 3.14.1-tuxcare.1...

CLSA-2026-1776904629 TuxCare security update for uglify-js (2 CVEs)

TuxCare rebuilt uglify-js to address 2 CVEs. Fixed in 2.8.29-tuxcare.1...

CLSA-2026-1776904632 TuxCare security update for uglify-js (2 CVEs)

TuxCare rebuilt uglify-js to address 2 CVEs. Fixed in 3.4.10-tuxcare.1...

CLSA-2026-1774570935 TuxCare security update for js-yaml (5 CVEs)

TuxCare rebuilt js-yaml to address 5 CVEs. Fixed in 3.7.0-tuxcare.1...

CLSA-2026-1774311649 TuxCare security update for ua-parser-js (3 CVEs)

TuxCare rebuilt ua-parser-js to address 3 CVEs. Fixed in 0.7.21-tuxcare.1...

CLSA-2026-1774225182 TuxCare security update for uglify-js (2 CVEs)

TuxCare rebuilt uglify-js to address 2 CVEs. Fixed in 2.3.6-tuxcare.1...

CLSA-2026-1773965915 TuxCare security update for js-yaml (3 CVEs)

TuxCare rebuilt js-yaml to address 3 CVEs. Fixed in 3.3.1-tuxcare.1...

CLSA-2026-1773274555 TuxCare security update for uglify-js (2 CVEs)

TuxCare rebuilt uglify-js to address 2 CVEs. Fixed in 1.1.1-tuxcare.1...

CVE-2026-58044

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...