11419 matches found
nodejs22 security update
1:22.23.1-4.0.1 - Add c-ares as dependency orabug 39781219...
PT-2026-106822
Name of the Vulnerable Software and Affected Versions Quasar Framework versions prior to 2.23.3 Description In the Platform.parseSSR function within ui/src/plugins/platform/Platform.js, an unbounded User-Agent request header is passed to the getMatch function. The browser-detection expressions in...
CVE-2026-106104: Inefficient Regular Expression Complexity
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.23.3, Platform.parseSSR passed an unbounded User-Agent request header to getMatch in ui/src/plugins/platform/Platform.js, whose browser-detection expressions combined greedy captures with repeated...
Linux Distros Unpatched Vulnerability : CVE-2026-102828
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until...
Linux Distros Unpatched Vulnerability : CVE-2026-102282
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm- zip applies the Unix permission bits stored in a zip...
EUVD-2026-89333
simple-git: unsafe-operations plugin bypass via git long-option abbreviation --receive-p/--exe - command execution residual of CVE-2026-28291...
EUVD-2026-88981
Socket.IO: Prototype Pollution via Unsafe Client Session Lookup...
EUVD-2026-78300
proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet...
EUVD-2026-76072
compression vulnerable to Denial of Service via memory leak on premature response close...
CVE-2023-30547
CVE-2023-30547 vm2 هو صندوق رمل sandbox يمكنه تشغيل كود غير موثوق به باستخدام وحدات Node.js المضمنة المُدرجة في القائمة البيضاء. توجد ثغرة أمنية في تعقيم الاستثناءات exception sanitization في vm2 للإصدارات حتى 3.9.16، مما يسمح للمهاجمين بإثارة استثناء مضيف غير مُعقّم داخل handleException والذي يم...
GHSA-6FW5-9HQ8-W87G GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor
Impact buildWSLegacyExecutor in @graphql-tools/executor-legacy-ws previously hardcoded rejectUnauthorized: false when creating WebSocket connections over WSS. This disabled TLS certificate validation, allowing a network-positioned attacker to perform a Man-in-the-Middle MITM attack against...
GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor
Impact buildWSLegacyExecutor in @graphql-tools/executor-legacy-ws previously hardcoded rejectUnauthorized: false when creating WebSocket connections over WSS. This disabled TLS certificate validation, allowing a network-positioned attacker to perform a Man-in-the-Middle MITM attack against...
Snowflake drivers writes sensitive information to logs
Insertion of sensitive information into log files in the Snowflake Python, Go, JDBC, Node.js, PHP PDO, and ODBC drivers allowed authentication tokens, query-result encryption keys, pre-signed cloud-storage URLs, and SAML assertions to be written to diagnostic logs in circumstances where the...
GHSA-QQJ6-54Q6-CXV6 Snowflake drivers writes sensitive information to logs
Insertion of sensitive information into log files in the Snowflake Python, Go, JDBC, Node.js, PHP PDO, and ODBC drivers allowed authentication tokens, query-result encryption keys, pre-signed cloud-storage URLs, and SAML assertions to be written to diagnostic logs in circumstances where the...
EUVD-2026-91719
Tinypool: Prototype Pollution Gadget to RCE in run options...
EUVD-2026-91056
stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk...
GHSA-GJQ8-XM47-88RC vm2: Host-returned Promise rejection can bypass vm2's unhandled-rejection hardening and terminate the host process
Summary vm2 current head v3.11.5, commit 7a1f5100b96f48d34e0fe104ab37c0acc5944f92 can still be used to terminate the host Node.js process when sandbox code calls a host-realm function that returns a rejected host Promise and then ignores the returned value. This is an incomplete-fix variant of th...
vm2: Host-returned Promise rejection can bypass vm2's unhandled-rejection hardening and terminate the host process
Summary vm2 current head v3.11.5, commit 7a1f5100b96f48d34e0fe104ab37c0acc5944f92 can still be used to terminate the host Node.js process when sandbox code calls a host-realm function that returns a rejected host Promise and then ignores the returned value. This is an incomplete-fix variant of th...