11445 matches found
CLEANSTART-2026-CT50806 proxy-addr is a Node
Security vulnerability affects the argo-workflows package. proxy-addr is a Node...
PT-2026-102976
Impact A denial-of-service vulnerability exists in Engine.IO / Socket.IO servers that allow transport upgrades. The Engine.IO protocol revision is negotiated during the initial handshake and stored on the session, but a newly-created transport, including a WebSocket upgrade transport, could...
PT-2026-102810
Name of the Vulnerable Software and Affected Versions simple-git versions prior to 4.0.0 Description The default blockUnsafeOperationsPlugin fails to fully reject configuration includes provided via customArgs to the git.clone function. This allows Git to load an attacker-controlled configuration...
CVE-2026-102414: Uncontrolled Resource Consumption
pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback lib/sync.js. A password longer than the block size 64 bytes, or 128 bytes for sha384 and sha512 is passed to HMAC as the key on every iteration, and HMAC hashes such keys in...
PT-2026-102812
Name of the Vulnerable Software and Affected Versions simple-git versions 3.15.0 through 4.0.0 Description The default blockUnsafeOperationsPlugin fails to classify trailer..cmd as an unsafe configuration. This allows an attacker to execute arbitrary shell commands with the operating-system...
CVE-2026-102829: Improper Neutralization of Special Elements used in an OS Command
simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 2.0.1 of the argv-parser package, parseEnv omits VISUAL from GitEnvKeys, so prepareEnv drops the value before vulnerabilityCheck can classify it a...
PT-2026-102938
Name of the Vulnerable Software and Affected Versions anchorme versions prior to 3.0.9 Description A regular expression denial of service occurs in the IPv6 host extraction regex due to catastrophic backtracking, which happens when a regex engine takes an exponential amount of time to process a...
CVE-2026-103043: Inefficient Regular Expression Complexity
anchorme through 3.0.8 contains a regular expression denial of service vulnerability in the IPv6 host extraction regex due to catastrophic backtracking. Attackers can supply specially crafted input strings with repeated patterns to cause exponential regex engine backtracking, blocking the Node.js...
CVE-2026-102600: Improper Input Validation
Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 0.1.1, @socket.io/cluster-engine uses inherited object properties when looking up attacker-controlled session IDs in clustered deployments. Special property names such as proto or constructor can resolve...
ALSA-2026:73428 Important: nodejs24 security, bug fix, and enhancement update
Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices...
Amazon Linux 2023 : nodejs22, nodejs22-devel, nodejs22-full-i18n (ALAS2023-2026-3123)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3123 advisory. undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connecti...
SUSE CVE-2026-77078
multer is a middleware for handling multipart/form-data in Node.js. A small multipart request containing two specially crafted text field names can cause an uncaught RangeError Invalid array length that terminates the Node.js process. The first field uses a very large numeric array index to...
Malicious code in hardhat-lock (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 035a099bd6a60e41f1e1cbc1b70f27fecb9bef3f12d54e016d6991b581fc880f The npm package [email protected] publishes itself as a logger/middleware but its identity and contents are inconsistent with that purpose: README...
MAL-2026-17233 Malicious code in hardhat-lock (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 035a099bd6a60e41f1e1cbc1b70f27fecb9bef3f12d54e016d6991b581fc880f The npm package [email protected] publishes itself as a logger/middleware but its identity and contents are inconsistent with that purpose: README...
MAL-2026-17236 Malicious code in mini-hardhat (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fbdfc97da008f90f11ae03963e75237c8bb746cf93f9cdc5da43ba5807ed6c1e [email protected] presents itself as a pino-like JSON logger, but its main entry exports a middleware factory that, on instantiation, spawns...
Malicious code in mini-hardhat (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fbdfc97da008f90f11ae03963e75237c8bb746cf93f9cdc5da43ba5807ed6c1e [email protected] presents itself as a pino-like JSON logger, but its main entry exports a middleware factory that, on instantiation, spawns...
MAL-2026-17235 Malicious code in items-validator (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8e49b1abd7c566b17104c5a2823251df2ca253a0fa509d7c19db1c1942ad13d On require, index.js invokes initializeDaemon at top level, which uses spawn'node', lib/check-items.js, detached: true, stdio: 'ignore' followed by...
undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression
Impact undici's WebSocket client including Node.js's bundled globalThis.WebSocket crashes the entire Node.js process when a remote WebSocket peer sends a permessage-deflate compressed message that crosses the decompressed-payload size limit and then contains a malformed DEFLATE block. In...
GHSA-3WWX-PV8P-Q78V undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression
Impact undici's WebSocket client including Node.js's bundled globalThis.WebSocket crashes the entire Node.js process when a remote WebSocket peer sends a permessage-deflate compressed message that crosses the decompressed-payload size limit and then contains a malformed DEFLATE block. In...
