sign-alex (1.0.1) potentially affected by CVE-2026-70592 via ghost (1.26.2)

ghost NPM version 1.26.2 is affected by a known vulnerability. The following packages have a transitive dependency on ghost and may be impacted: - sign-alex 1.0.1 Source cves: CVE-2026-70592 Source advisory: OSV:GHSA-CJ62-HVV2-2Q5H...

CVE-2026-58039

A flaw was found in Node.js. The permission model enforcement, specifically related to process.report functionality, allows an attacker to write or overwrite files in locations outside of the intended secure paths. This vulnerability can lead to the disclosure of sensitive information or bypass t...

Arbitrary Code Injection

Overview flowise is a Flowiseai Server Affected versions of this package are vulnerable to Arbitrary Code Injection via the run method in the CSVAgents class. An attacker can execute arbitrary code in the context of the server process by sending crafted prompts to a chatflow using the CSV Agent...

ALPINE-CVE-2026-56848

A flaw in Node.js HTTP/2 handling allows nghttp2sessionmemsend to be called re-entrantly while nghttp2sessionmemrecv is executing, resulting in a heap-use-after-free. This vulnerability affects Node.js 26.x, 24.x, and 22.x...

CVE-2026-56848

A flaw in Node.js HTTP/2 handling allows nghttp2sessionmemsend to be called re-entrantly while nghttp2sessionmemrecv is executing, resulting in a heap-use-after-free. This vulnerability affects Node.js 26.x, 24.x, and 22.x...

CVE-2026-56848

A flaw in Node.js HTTP/2 handling allows nghttp2sessionmemsend to be called re-entrantly while nghttp2sessionmemrecv is executing, resulting in a heap-use-after-free. This vulnerability affects Node.js 26.x, 24.x, and 22.x...

CVE-2026-56848

A flaw in Node.js HTTP/2 handling allows nghttp2sessionmemsend to be called re-entrantly while nghttp2sessionmemrecv is executing, resulting in a heap-use-after-free. This vulnerability affects Node.js 26.x, 24.x, and 22.x...

CVE-2026-56848

A flaw in Node.js HTTP/2 handling allows nghttp2sessionmemsend to be called re-entrantly while nghttp2sessionmemrecv is executing, resulting in a heap-use-after-free. This vulnerability affects Node.js 26.x, 24.x, and 22.x...

CVE-2026-56848

CVE-2026-56848 affects Node.js 22.x/24.x/26.x. The vulnerability arises from a heap-use-after-free caused by re-entrant nghttp2_session_mem_send() during nghttp2_session_mem_recv(). OSV/OpenSUSE entries show fixes: nodejs26-26.5.1-1.1 and corepack24-24.18.1-1.1 in GA media, with additional OSV De...

CVE-2026-56848

A flaw in Node.js HTTP/2 handling allows "nghttp2sessionmemsend" to be called re-entrantly while "nghttp2sessionmemrecv" is executing, resulting in a heap-use-after-free. This vulnerability affects Node.js 26.x, 24.x, and 22.x...

Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified

UPDATE 2026-05-20: Full RCE as root VERIFIED This is not theoretical — a Meterpreter reverse shell session as root has been established on Flowise 3.1.2. Verified Exploit Chain 1. Python code injection via base64string = "$base64String" CSVAgent.ts line 161 2. Pyodide js bridge provides access to...

K000162755: Node.js CVE-2026-48937

Security Advisory Description A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a GOAWAY frame. This vulnerability affects two supported release lines: Node.js 22 and Node.js 24. CVE-2026-48937 Impact There is no impact; F5 products are not affected b...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling in the HTTP client when forwarding proxies rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. An attacker can manipulate HTTP request...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the HTTP/2 header block handling. An attacker can cause excessive memory consumption by sending specially crafted HTTP/2 requests that bypass memory limits. Remediation A fix was...

ALPINE-CVE-2026-58042

A flaw in Node.js can cause dns.resolveAny Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records. Repeated triggering of this condition can lead to denial of service. This vulnerability affects Node.js 26.x, 24.x, and 22.x...

ALPINE-CVE-2026-58044

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...

CVE-2026-58042

A flaw in Node.js can cause dns.resolveAny Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records. Repeated triggering of this condition can lead to denial of service. This vulnerability affects Node.js 26.x, 24.x, and 22.x...

ALPINE-CVE-2026-58041

A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSynccreateTagStore to continue executing a cached prepared statement after it has been reset and rebound with new parameters. SQLTagStore resets cached statements using sqlite3reset directly, bypassing the...

CVE-2026-58041

A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSynccreateTagStore to continue executing a cached prepared statement after it has been reset and rebound with new parameters. SQLTagStore resets cached statements using sqlite3reset directly, bypassing the...

CVE-2026-58044

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...