CLEANSTART-2026-QD20140 Tinypool is a minimal Node

Security vulnerability affects the qdrant package. Tinypool is a minimal Node...

CLEANSTART-2026-CU25546 Tinypool is a minimal Node

Security vulnerability affects the qdrant package. Tinypool is a minimal Node...

CLEANSTART-2026-BS82547 Sequelize is a Node

Security vulnerability affects the sqlpad package. Sequelize is a Node...

CLEANSTART-2026-ZM48155 on-headers is a node

Security vulnerability affects the argo-workflows package. on-headers is a node...

CLEANSTART-2026-KF31657 http-proxy-middleware is node

Security vulnerability affects the argo-workflows package. http-proxy-middleware is node...

CLEANSTART-2026-IY58316 flaw in Node

Security vulnerability affects the nodejs package. A flaw in Node...

CLEANSTART-2026-RS73097 flaw in the Node

Security vulnerability affects the nodejs package. A flaw in the Node...

CLEANSTART-2026-YQ27190 Node

Security vulnerability affects the nodejs-24 package. The Node...

CLEANSTART-2026-OM41061 Improper Certificate Validation in Node

Security vulnerability affects the nodejs-24 package. Improper Certificate Validation in Node...

CLEANSTART-2026-MI22504 flaw in Node

Security vulnerability affects the apache-superset package. A flaw in Node...

CVE-2026-19351

A vulnerability was found in dresende node-sql-query 0.1.25/0.1.26/0.1.27/0.1.28. Affected by this vulnerability is the function SelectQuery.from/SelectQuery.build in the library lib/Select.js of the component Request Parameter Handler. Performing a manipulation results in sql injection. It is...

node-re2: Out-of-bounds heap read in `replace`/`split` via a `Buffer` ending in a truncated multi-byte UTF-8 character → adjacent heap memory disclosed to JavaScript

Summary re2 infers a character's byte length from its UTF-8 lead byte alone, with no bound on the bytes actually remaining in the input. Buffer arguments reach the native layer verbatim — only strings are re-encoded into well-formed UTF-8 — so a Buffer whose last byte is a multi-byte lead promise...

EUVD-2026-42306

node-tar: Negative tar entry size causes infinite loop in archive replace...

MAL-2026-10286 Malicious code in backup2-asd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6fe96add7d70ce5933988f1c78b934187e279d88618bd3f211de3d719177168 The tarball published as [email protected] is a Vite-built browser application branded 'Lucide' rather than a Node library. package.json declares mai...

lib/parse.js Component DoS

The vulnerability of the lib/parse.js component, a library for analyzing and transforming string queries in Node QS, is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause service failures...

GO-2026-5291 nuts-node has JWT type confusion in v1 access token introspection that allows VP replay as access token in github.com/nuts-foundation/nuts-node

nuts-node has JWT type confusion in v1 access token introspection that allows VP replay as access token in github.com/nuts-foundation/nuts-node...

Malicious code in nottuff23 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 41d429b099904a530f5dc4dfdd4724b7b6160c1de1330e0b103e8b8e3c737dfd The package is one of approximately 100 identically-named-pattern publishes from an automated bulk-publish operation. The tarball ships...

Malicious code in twilio-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 737fede3d5b2007849cab0503cec191ce127c33c0b28f3b3285f347a064966e1 Package name twilio-sdk impersonates the official Twilio Node SDK twilio but ships an empty API module.exports = . The only real behavior runs in...

CVE-2026-40931

Compressing is a compressing and uncompressing lib for node. Prior to 2.1.1 and 1.10.5, the patch for CVE-2026-24884 relies on a purely logical string validation within the isPathWithinParent utility. This check verifies if a resolved path string starts with the destination directory string but...

CVE-2026-44232

The CVE-2026-44232 entry concerns the Node.js library dssrf . The vulnerability, described across the CVE and related records, is that prior to version 1.3.0 every IPv6 category bypasses the is_url_safe check, enabling potential SSRF bypasses. The issue affects the dssrf functionality that guards...