34 matches found
NodeSecurityShield
Node Security Shield Node Security Shield NSS est un outil open source de protection d'application au moment de l'exécution RASP qui vise à combler le fossé en matière de sécurité complète de NodeJS en permettant au développeur et à l'ingénieur sécurité de déclarer les ressources auxquelles une...
CLEANSTART-2026-ZW37731 vulnerability has been identified in Node
Security vulnerability affects the apache-superset package. A vulnerability has been identified in Node...
CLEANSTART-2026-GV36005 We have identified a bug in Node
Security vulnerability affects the apache-superset package. We have identified a bug in Node...
CLEANSTART-2026-IQ33916 compression is a Node
Security vulnerability affects the argo-workflows package. compression is a Node...
Malicious code in @servicetitan/skeleton (npm)
npm/@servicetitan/skeleton is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...
Important: nodejs:24 security update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity CVE-2026-13149 tar: Node-tar: Denial of Service via malform...
Malicious code in chai-as-auth (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 12dffbf180eff9ea18e21c9fc8c514912e95e40b3439fc43c3e3124b7ed189a3 lib/initializeCaller.js contains a self-executing IIFE that POSTs the entire process.env object to a hardcoded remote endpoint and then executes the...
PT-2026-51022
Name of the Vulnerable Software and Affected Versions Node.js version 22 Node.js version 24 Node.js version 26 Description A flaw in the Node.js HTTP Agent allows a client to accept a response as valid even if it was sent before the client transmitted the request. This issue has caused real-world...
PT-2026-49249
Impact Malicious algorithms can potentially access other algorithms input and output files. Patches Todo Workarounds Verify and restrict the algorithm containers that are allowed to run on your node. See here on how to do this. References https://docs.vantage6.ai/usage/running-the-node/security F...
node-security-poc
No d...
Developing a minimally HashDoS resistant, yet quickly reversible integer hash for V8
Developing a minimally HashDoS resistant, yet quickly reversible integer hash for V8 What happens when a hashing scheme needs to be both HashDoS resistant and quickly reversible? That's the puzzle we tried to solve for addressing CVE-2026-21717 in the March 2026 Node.js security release. This led...
DEBIAN-CVE-2026-25547
@isaacs/brace-expansion is a hybrid CJS/ESM TypeScript fork of brace-expansion. Prior to version 5.0.1, @isaacs/brace-expansion is vulnerable to a denial of service DoS issue caused by unbounded brace range expansion. When an attacker provides a pattern containing repeated numeric brace ranges, t...
UNIX Symbolic Link (Symlink) Following
Overview Affected versions of this package are vulnerable to UNIX Symbolic Link Symlink Following in the fs.symlink function. An attacker can escape the allowed path and read/write sensitive files by chaining directories and symlinks, bypassing --allow-fs-read and --allow-fs-write restrictions...
EUVD-2025-200922
Malicious code in elf-stats-festive-snowglobe-440 npm...
MAL-2025-171423 Malicious code in joshuahoward (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7cce4b043163f50039cd2ef6b1fea715d095a229d5b72e3c54f2a1ce9b774f6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-147983 Malicious code in slides-callisto-pegasus-dagda (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f8c6de5893d173108562b870f2f25e12c0603035a3c2a34d595c1f62804b2df This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in fitri-rendang24-kyuki (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86aa5b8809d980f9708c015eaa2c4f03d00c4c2045c8aef0c1974154be2560aa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
CVE-2025-64436 KubeVirt Excessive Role Permissions Could Enable Unauthorized VMI Migrations Between Nodes
KubeVirt is a virtual machine management add-on for Kubernetes. In 1.5.0 and earlier, the permissions granted to the virt-handler service account, such as the ability to update VMI and patch nodes, could be abused to force a VMI migration to an attacker-controlled node. This vulnerability could...