PT-2026-99965

uri-js through 4.4.1 contains a denial of service vulnerability in the removeDotSegments function that loops infinitely when a path segment begins with Unicode line or paragraph separators. Attackers can trigger this by calling removeDotSegments directly or through normalize/resolve functions wit...

PT-2026-95431

Name of the Vulnerable Software and Affected Versions braces versions prior to 3.0.4 Description A stack overflow occurs in the recursive AST Abstract Syntax Tree walkers due to a lack of depth guards. An attacker can provide deeply nested brace patterns that remain within the character limit to...

PT-2026-99971

braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError...

PT-2026-95434

Name of the Vulnerable Software and Affected Versions uri-js versions prior to 4.4.2 Description A denial of service issue exists in the removeDotSegments function. The function enters an infinite loop when a path segment starts with Unicode line or paragraph separators. This can be triggered by...

PT-2026-105542

braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError...

n8n Node.js Package < 1.123.76 / 2.0.x < 2.37.7 / 2.38.x < 2.38.2 Multiple Vulnerabilities

The version of the n8n Node.js Package installed on the remote host is less than 1.123.76, or is 2.0.x prior to 2.37.7, or is 2.38.x prior to 2.38.2. It is, therefore, affected by multiple vulnerabilities: - n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2...

CVE-2026-77301: Memory Allocation with Excessive Size Value

adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, getData in zipEntry.js trusts an entry's central-directory uncompressed size and allocates output memory before validating that value against the actual compressed data and decompression result. A...

Uncontrolled Recursion

Overview ioredis is a Redis client for Node.js. Affected versions of this package are vulnerable to Uncontrolled Recursion in the RESP protocol parser in lib/parser.js. An attacker can crash the Node.js client process by sending crafted RESP byte streams with repeated nested array headers. The...

CVE-2026-93435

redis-parser through 3.0.0 contains a denial of service vulnerability in the RESP protocol parser that allows malicious Redis endpoints to crash the client process through unbounded recursion on nested arrays. Attackers can send crafted RESP byte streams with repeated array headers that exhaust t...

CVE-2026-93435 redis-parser through 3.0.0 Denial of Service via Unbounded Recursion

redis-parser through 3.0.0 contains a denial of service vulnerability in the RESP protocol parser that allows malicious Redis endpoints to crash the client process through unbounded recursion on nested arrays. Attackers can send crafted RESP byte streams with repeated array headers that exhaust t...

CVE-2026-93435 redis-parser through 3.0.0 Denial of Service via Unbounded Recursion

redis-parser through 3.0.0 contains a denial of service vulnerability in the RESP protocol parser that allows malicious Redis endpoints to crash the client process through unbounded recursion on nested arrays. Attackers can send crafted RESP byte streams with repeated array headers that exhaust t...

CVE-2026-93435 redis-parser through 3.0.0 Denial of Service via Unbounded Recursion

redis-parser through 3.0.0 contains a denial of service vulnerability in the RESP protocol parser that allows malicious Redis endpoints to crash the client process through unbounded recursion on nested arrays. Attackers can send crafted RESP byte streams with repeated array headers that exhaust t...

Security Bulletin: fast-uri-3.1.5.tgz (Publicly disclosed vulnerability found by Scanner)

Summary The project currently pins fast-uri at 3.1.5 via the overrides block in package.json. All four CVEs reported in PSIRT PVR0856800 affect the 3.0.0 – 3.1.6 range. Versions 3.1.6 and 4.1.3 are the confirmed fixed releases. Vulnerability Details CVEID:CVE-2026-75899 DESCRIPTION: fast-uri is...

CVE-2026-47683

A flaw was found in vm2, an open-source virtual machine VM sandbox for Node.js. This vulnerability allows malicious code running within the sandbox to bypass the configured memory allocation limit. By crafting specific calls to Buffer.concat or Buffer.from with attacker-controlled lengths, the...

SUSE CVE-2026-86472

fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv. In versions before 2.4.7, from 3.0.0 through 3.1.7, and from 4.0.0 through 4.1.4, fast-uri folds the host to lowercase before it percent-decodes the host, so a percent-encoded uppercase octet such as %41 decod...

SUSE CVE-2026-86818

fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv, that added a mailto scheme parser in version 4.1.3. In versions 4.1.3 and 4.1.4, the mailto parser compares each query field name to the reserved names to, subject, and body while the name is still...

GHSA-PJ96-35FP-CFCC ExifReader: DoS via Crafted HEIC/AVIF iloc Box - Memory Exhaustion

Summary ExifReader 4.41.0 is vulnerable to denial of service through a crafted HEIC or AVIF file with a malicious iloc box. When offsetSize, lengthSize, and baseOffsetSize are set to zero in the iloc header, the extent-parsing loop allocates an unbounded number of JavaScript objects - up to...

ExifReader: DoS via Crafted HEIC/AVIF iloc Box - Memory Exhaustion

Summary ExifReader 4.41.0 is vulnerable to denial of service through a crafted HEIC or AVIF file with a malicious iloc box. When offsetSize, lengthSize, and baseOffsetSize are set to zero in the iloc header, the extent-parsing loop allocates an unbounded number of JavaScript objects - up to...

CVE-2026-85715

ExifReader is a JavaScript Exif information parser. Prior to 4.41.1, ExifReader parses attacker-controlled HEIC or AVIF ISO-BMFF files in getItems within src/image-header-iso-bmff-iloc.js and trusts iloc itemCount and extentCount values while allocating an extent object for every nested-loop...

CVE-2026-92958

A flaw was found in vm2, a sandbox for Node.js. When the NodeVM embedder uses a builtin wildcard with negative entries to deny specific modules, such as 'fs' for file system access, the denylist mechanism fails to block subpaths like 'fs/promises'. This allows sandboxed code to bypass the intende...