AZL-107835 CVE-2026-78659 affecting package prometheus-node-exporter 1.7.0-5

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...

AZL-107823 CVE-2026-78660 affecting package prometheus-node-exporter 1.7.0-5

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a...

CVE-2026-107703

@enmaso/node-convert through 1.0.0 contains an OS command injection vulnerability in convert.js that allows attackers to execute shell commands via unsanitized filepath and convertTo arguments. Attackers can inject shell metacharacters or a single quote into the ImageMagick command run by...

EUVD-2026-95148

@enmaso/node-convert through 1.0.0 contains an OS command injection vulnerability in convert.js that allows attackers to execute shell commands via unsanitized filepath and convertTo arguments. Attackers can inject shell metacharacters or a single quote into the ImageMagick command run by...

CVE-2026-107703

The @enmaso/node-convert library (versions through 1.0.0) contains an OS command injection vulnerability in the convert.js component. The root cause is the use of unsanitized filepath and convertTo arguments when executing ImageMagick commands via child_process.exec() . Attackers can inject shell...

CVE-2026-107703 @enmaso/node-convert through 1.0.0 OS Command Injection via filepath and convertTo

@enmaso/node-convert through 1.0.0 contains an OS command injection vulnerability in convert.js that allows attackers to execute shell commands via unsanitized filepath and convertTo arguments. Attackers can inject shell metacharacters or a single quote into the ImageMagick command run by...

CVE-2026-107703

@enmaso/node-convert through 1.0.0 contains an OS command injection vulnerability in convert.js that allows attackers to execute shell commands via unsanitized filepath and convertTo arguments. Attackers can inject shell metacharacters or a single quote into the ImageMagick command run by...

CVE-2026-104077

Obsidian Desktop before 1.14.0 contains a remote code execution vulnerability that allows attackers to craft malicious Markdown notes exploiting insufficient sanitization of the data-background-iframe attribute, which bypasses DOMPurify and is processed by the bundled Reveal.js 4.3.1 within the...

ROOT-APP-NPM-AIKIDO-2026-10991 AIKIDO-2026-10991 in @workos-inc/node - Patched by Root

Root has patched AIKIDO-2026-10991 in the @workos-inc/node package for Root:npm. Multiple fixed versions available...

CVE-2026-104077

Obsidian Desktop versions before 1.14.0 are vulnerable to Remote Code Execution (RCE) via the Slides core plugin . The root cause is insufficient sanitization of the data-background-iframe attribute in Markdown notes, which allows attackers to bypass DOMPurify . This vulnerability is exploited wh...

ROOT-APP-NPM-CVE-2026-44902 CVE-2026-44902 in @opentelemetry/auto-instrumentations-node - Patched by Root

Root has patched CVE-2026-44902 in the @opentelemetry/auto-instrumentations-node package for Root:npm. Multiple fixed versions available...

MAL-2026-17684 Malicious code in node-gyp-runtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bcec19492c8bdcd8c866d1aad1a2b8a253d7d9bbc8184ff182af71a75ce56589 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17683 Malicious code in node-fetch-lite (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3e96b428b5de9465675c8a84b41aef8afbb1f4b62ab7ef7fb437bb53692095e0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17681 Malicious code in node-env-resolve (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f3e0e1b364a3d74534d6ce1eca74778a85e508cf10952f84f36bf1badd8a581 The package is advertised as an environment configuration resolver but its postinstall script installs a hidden persistent agent into user-level...

Malicious code in node-env-resolve (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f3e0e1b364a3d74534d6ce1eca74778a85e508cf10952f84f36bf1badd8a581 The package is advertised as an environment configuration resolver but its postinstall script installs a hidden persistent agent into user-level...

CLSA-2026-1791467333 TuxCare security update for node-forge (3 CVEs)

TuxCare rebuilt node-forge to address 3 CVEs. Fixed in 1.3.3-tuxcare.2...

@corexium/xbails (0.0.7), @synergyxd/baileys (0.0.3) potentially affected by unknown CVE via @bellaxchuu/libsignal-node (0.0.1-security)

@bellaxchuu/libsignal-node NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on @bellaxchuu/libsignal-node and may be impacted: - @corexium/xbails 0.0.7 - @synergyxd/baileys 0.0.3 Source cves: unknown CVE Source advisory:...

@corexium/xbails (0.0.7), @synergyxd/baileys (0.0.3) potentially affected by unknown CVE via @bellaxchuu/libsignal-node (0.0.1-security)

@bellaxchuu/libsignal-node NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on @bellaxchuu/libsignal-node and may be impacted: - @corexium/xbails 0.0.7 - @synergyxd/baileys 0.0.3 Source cves: unknown CVE Source advisory:...

MAL-2026-17676 Malicious code in @bellaxchuu/libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 69f70788aeca5b98fbe0c721d7f6a88c036d661c3f0132443a6bdb97080f5819 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17672 Malicious code in @xayz/libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8a9744aa6c5f3c994e66b4847aba63d6cf1503583f0a23185c67bb32b7394e77 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...