96 matches found
CVE-2026-31949
LibreChat is a ChatGPT clone with additional features. Prior to 0.8.3-rc1, a Denial of Service DoS vulnerability exists in the DELETE /api/convos endpoint that allows an authenticated attacker to crash the Node.js server process by sending malformed requests. The DELETE /api/convos route handler...
CVE-2026-3966
CVE-2026-3966 affects the 648540858 wvp-GB28181-pro package up to version 2.7.4-20260107. The issue lies in the getDownloadFilePath function of ABLMediaNodeServerService.java under the IP Address Handler; manipulating the MediaServer.streamIp argument triggers server-side request forgery (SSRF). ...
CVE-2026-29087
@hono/node-server allows running the Hono application on Node.js. Prior to version 1.19.10, when using @hono/node-server's static file serving together with route-based middleware protections e.g. protecting /admin/, inconsistent URL decoding can allow protected static resources to be accessed...
CVE-2026-29087
@hono/node-server allows running the Hono application on Node.js. Prior to version 1.19.10, when using @hono/node-server's static file serving together with route-based middleware protections e.g. protecting /admin/, inconsistent URL decoding can allow protected static resources to be accessed...
CVE-2026-29087
@hono/node-server allows running the Hono application on Node.js. Prior to version 1.19.10, when using @hono/node-server's static file serving together with route-based middleware protections e.g. protecting /admin/, inconsistent URL decoding can allow protected static resources to be accessed...
CVE-2026-29087
The connected IBM bulletin confirms CVE-2026-29087 affects the Node.js module hono used by IBM App Connect Enterprise Certified Container. The vulnerability arises from inconsistent URL decoding when static file serving and route-middleware protections are used together, allowing access to protec...
CVE-2026-29087 @hono/node-server: Authorization bypass for protected static paths via encoded slashes in Serve Static Middleware
@hono/node-server allows running the Hono application on Node.js. Prior to version 1.19.10, when using @hono/node-server's static file serving together with route-based middleware protections e.g. protecting /admin/, inconsistent URL decoding can allow protected static resources to be accessed...
CVE-2026-29087 @hono/node-server: Authorization bypass for protected static paths via encoded slashes in Serve Static Middleware
@hono/node-server allows running the Hono application on Node.js. Prior to version 1.19.10, when using @hono/node-server's static file serving together with route-based middleware protections e.g. protecting /admin/, inconsistent URL decoding can allow protected static resources to be accessed...
CVE-2026-29087 @hono/node-server: Authorization bypass for protected static paths via encoded slashes in Serve Static Middleware
@hono/node-server allows running the Hono application on Node.js. Prior to version 1.19.10, when using @hono/node-server's static file serving together with route-based middleware protections e.g. protecting /admin/, inconsistent URL decoding can allow protected static resources to be accessed...
Improper Handling of URL Encoding (Hex Encoding)
Overview @hono/node-server is a Node.js Adapter for Hono Affected versions of this package are vulnerable to Improper Handling of URL Encoding Hex Encoding via inconsistent URL decoding between the serveStatic process and route-based middleware protections. An attacker can access protected static...
@hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware
Summary When using @hono/node-server's static file serving together with route-based middleware protections e.g. protecting /admin/, inconsistent URL decoding can allow protected static resources to be accessed without authorization. In particular, paths containing encoded slashes %2F may be...
@aikotools/repo-maintenance (>=1.0.2 <=1.3.4), @alstar/studio (=0.0.0-beta.20) +94 more potentially affected by CVE-2026-29087 via @hono/node-server (>=0.2.4 <=1.19.1)
@hono/node-server NPM version =0.2.4, =1.0.2, =1.0.25-beta.0, =0.0.1, =0.29.3, =0.0.1-experimental.1, =0.0.3, =1.3.2, =0.2.305, =0.21.2-4.1, =0.0.0-beta-20241019152753, =0.0.0-beta-20241008010229, =4.0.0-alpha.1, =1.3.3, =2.8.13 and more Source cves: CVE-2026-29087 Source advisory:...
@aikotools/repo-maintenance (>=1.0.2 <=1.3.4), @alstar/studio (=0.0.0-beta.20) +87 more potentially affected by CVE-2026-29087 via @hono/node-server (>=1.0.2 <=1.19.1)
@hono/node-server NPM version =1.0.2, =1.0.2, =1.0.25-beta.0, =0.0.1, =0.0.1-experimental.1, =0.0.3, =1.3.2, =0.2.305, =0.21.2-4.1, =0.0.0-beta-20241019152753, =0.0.0-beta-20241008010229, =4.0.0-alpha.1, =1.3.3, =0.14.2, =0.14.4 and more Source cves: CVE-2026-29087 Source advisory:...
GHSA-WC8C-QW6V-H7F6 @hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware
Summary When using @hono/node-server's static file serving together with route-based middleware protections e.g. protecting /admin/, inconsistent URL decoding can allow protected static resources to be accessed without authorization. In particular, paths containing encoded slashes %2F may be...
CVE-2026-24040 jsPDF has a Shared State Race Condition in addJS Plugin
jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, the addJS method in the jspdf Node.js build utilizes a shared module-scoped variable text to store JavaScript content. When used in a concurrent environment e.g., a Node.js web server, this variable is shared across all requests. ...
Malicious code in @actbase/node-server (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a0017bb31e0f352229b8a7afc7305701c64b60033a69ccfec390385c507c6d85 The package @actbase/node-server was found to contain malicious code. Source: ghsa-malware...
EUVD-2025-198723
Malicious code in @actbase/node-server npm...
MAL-2025-190707 Malicious code in @actbase/node-server (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a0017bb31e0f352229b8a7afc7305701c64b60033a69ccfec390385c507c6d85 The package @actbase/node-server was found to contain malicious code. Source: ghsa-malware...
Denial-of-service (DoS)
@plone/volto is vulnerable to a denial-of-service DoS. The vulnerability is due to improper handling of a specific URL request, which allows an attacker to crash the NodeJS server component by simply visiting that crafted URL...