GHSA-QQVM-66Q4-VF5C Flowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure)

Summary Flowise introduced SSRF protections through a centralized HTTP security wrapper httpSecurity.ts that implements deny-list validation and IP pinning logic. However, multiple tool implementations directly import and invoke raw HTTP clients node-fetch, axiosInstead of using the secured...

MiracleLinux 7 : rh-nodejs14-nodejs-nodemon-2.0.20-2.el7, rh-nodejs14-nodejs-14.21.1-3.el7 (AXSA:2023-4997:01)

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-4997:01 advisory. glob-parent: Regular Expression Denial of Service CVE-2021-35065 minimist: prototype pollution CVE-2021-44906 node-fetch: exposure of sensitive...

MiracleLinux 8 : nodejs:14 nodejs-nodemon-2.0.20-2.module+el8+1579+35966ec0, nodejs-packaging-23-3.module+el8+1579+35966ec0, nodejs-14.21.1-2.module+el8+1579+35966ec0 (AXSA:2023-4653:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-4653:01 advisory. minimist: prototype pollution CVE-2021-44906 node-fetch: exposure of sensitive information to an unauthorized actor CVE-2022-0235 nodejs-minimatch:...

CVE-2026-22036 Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion

Undici is an HTTP/1.1 client for Node.js. Prior to 7.18.0 and 6.23.0, the number of links in the decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert thousands compression steps leading to high CPU usage and excessive memory allocation. This...

EUVD-2020-1335

Malware in sbrugna...

Unity Linux 20.1060a / 20.1070a Security Update: nodejs-nodemon (UTSA-2025-003048)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-003048 advisory. node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor Tenable has extracted the preceding description block directly from the Unity...

EUVD-2022-6634

Malicious code in bioql PyPI...

EUVD-2022-0683

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2020-15168

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - node-fetch before versions 2.6.1 and 3.0.0-beta.9 did not honor the size option after following a redirect, which means that when a content size was over the...

Malicious code in node-fetch-v3 (npm)

The package node-fetch-v3 was found to contain malicious code...

MAL-2025-42035 Malicious code in node-fetch-v3 (npm)

The package node-fetch-v3 was found to contain malicious code...

Linux Distros Unpatched Vulnerability : CVE-2022-2596

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Inefficient Regular Expression Complexity in GitHub repository node-fetch/node-fetch prior to 3.2.10. CVE-2022-2596 Note that Nessus relies on the presence of t...

Malicious code in whatwg-node-fetch-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a1f59eebf54f348e9ae3e94af39368c59899516438f8b029e4db2d91f075ac95 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3126 Malicious code in whatwg-node-fetch-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a1f59eebf54f348e9ae3e94af39368c59899516438f8b029e4db2d91f075ac95 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Security Bulletin: Multiple security vulnerabilities are addressed with IBM Business Automation Manager Open Editions 8.0.1

Summary In addition to updates of open source dependencies, the following security vulnerabilities are addressed with IBM Business Automation Manager Open Editions 8.0.1 Vulnerability Details CVEID:CVE-2022-21724 DESCRIPTION: PostgreSQL JDBC Driver PgJDBC could allow a remote authenticated attack...

MAL-2024-11916 Malicious code in bitmex-node-fetch (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5cc7c20df046cd10e263fa37bcda6196d91e23537ce001e8ed4b9598700ad8b8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in bitmex-node-fetch (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5cc7c20df046cd10e263fa37bcda6196d91e23537ce001e8ed4b9598700ad8b8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Security Bulletin: IBM Cognos Analytics Mobile (iOS) is affected by multiple vulnerabilities

Summary There are vulnerabilities in Open Source Software OSS libraries consumed by IBM Cognos Analytics Mobile. These issues have been addressed by upgrading or removing the vulnerable libraries. Additionally, vulnerabilites related to CORS misconfiguration and Certificate Pinning have been...

Malicious code in ndoe-fethc (npm)

The package contains a preinstall hook to execute unhook.js, which has cryptocurrency stealing functionality. --- -= Per source details. Do not edit below this line.=-...

RHEL 8 : grafana (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - nodejs-underscore: Arbitrary code execution via the template function CVE-2021-23358 - node-fetch is...