CVE-2026-41213

@node-oauth/oauth2-server is a module for implementing an OAuth2 server in Node.js. The token exchange path accepts RFC7636-invalid codeverifier values including one-character strings for S256 PKCE flows. Because short/weak verifiers are accepted and failed verifier attempts do not consume the...

CVE-2026-44003

A flaw was found in vm2 before 3.11.0. A code transformer fast-path skips AST analysis when catch, import, and async are absent, allowing direct access to VM2INTERNALSTATEDONOTUSEORPROGRAMWILLFAIL and internal security functions handleException, wrapWith, import. Fixed in 3.11.0...

CVE-2026-43997

A flaw was found in vm2 before 3.11.0, a Node.js sandbox library. Sandboxed code can obtain the host Object e.g. via HostObject.getOwnPropertySymbols and Symbolnodejs.util.inspect.custom, bypassing isolation and enabling arbitrary code execution on the host...

CVE-2026-46357

CVE-2026-46357 affects HAX CMS NodeJS backend. An authenticated attacker can crash the NodeJS process by sending a malformed request to the remote import workflow via the createSite endpoint, causing an availability DoS with a single HTTP request. The crash originates from a file object without o...

CVE-2026-46357

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, the HAX CMS NodeJS application crashes when an authenticated attacker sends a specially crafted site creation request to the createSite endpoint. A single request is sufficient to take the entire...

@haxtheweb/create (>=0.1.3, <=26.0.0), @haxtheweb/open-apis (>=11.0.2, <=26.0.0) potentially affected by CVE-2026-46357 via @haxtheweb/haxcms-nodejs (>=0.0.13, <=25.0.0)

@haxtheweb/haxcms-nodejs NPM version =0.0.13, =0.1.3, =11.0.2, =26.0.0 Source cves: CVE-2026-46357 Source advisory: MEND:CVE-2026-46357...

@haxtheweb/create (>=0.1.3, <=26.0.0), @haxtheweb/open-apis (>=11.0.2, <=26.0.0) potentially affected by CVE-2026-46493 via @haxtheweb/haxcms-nodejs (>=0.0.13, <=25.0.0)

@haxtheweb/haxcms-nodejs NPM version =0.0.13, =0.1.3, =11.0.2, =26.0.0 Source cves: CVE-2026-46493 Source advisory: MEND:CVE-2026-46493...

@haxtheweb/create (>=0.1.3, <=26.0.0), @haxtheweb/open-apis (>=11.0.2, <=26.0.0) potentially affected by CVE-2026-46401 via @haxtheweb/haxcms-nodejs (>=0.0.13, <=25.0.0)

@haxtheweb/haxcms-nodejs NPM version =0.0.13, =0.1.3, =11.0.2, =26.0.0 Source cves: CVE-2026-46401 Source advisory: MEND:CVE-2026-46401...

CVE-2026-46395

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, the hmacBase64 function in the HAXcms Node.js backend contains two critical cryptographic implementation errors that together allow any unauthenticated attacker to extract the system’s private signing ke...

@haxtheweb/create (>=25.0.2, <=26.0.0), @haxtheweb/open-apis (>=25.0.0, <=26.0.0) potentially affected by CVE-2026-46398 via @haxtheweb/haxcms-nodejs (25.0.0)

@haxtheweb/haxcms-nodejs NPM version 25.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @haxtheweb/haxcms-nodejs and may be impacted: - @haxtheweb/create =25.0.2, =25.0.0, =26.0.0 Source cves: CVE-2026-46398 Source advisory: MEND:CVE-2026-46398...

@haxtheweb/create (>=0.1.3, <=26.0.0), @haxtheweb/open-apis (>=11.0.2, <=26.0.0) potentially affected by CVE-2026-46397 via @haxtheweb/haxcms-nodejs (>=0.0.13, <=25.0.0)

@haxtheweb/haxcms-nodejs NPM version =0.0.13, =0.1.3, =11.0.2, =26.0.0 Source cves: CVE-2026-46397 Source advisory: MEND:CVE-2026-46397...

@haxtheweb/create (>=0.1.3, <=26.0.0), @haxtheweb/open-apis (>=11.0.2, <=26.0.0) potentially affected by CVE-2026-46496 via @haxtheweb/haxcms-nodejs (>=0.0.13, <=25.0.0)

@haxtheweb/haxcms-nodejs NPM version =0.0.13, =0.1.3, =11.0.2, =26.0.0 Source cves: CVE-2026-46496 Source advisory: MEND:CVE-2026-46496...

@haxtheweb/create (>=0.1.3, <=26.0.0), @haxtheweb/open-apis (>=11.0.2, <=26.0.0) potentially affected by CVE-2026-46396 via @haxtheweb/haxcms-nodejs (>=0.0.13, <=25.0.0)

@haxtheweb/haxcms-nodejs NPM version =0.0.13, =0.1.3, =11.0.2, =26.0.0 Source cves: CVE-2026-46396 Source advisory: MEND:CVE-2026-46396...

@haxtheweb/create (>=0.1.3, <=26.0.0), @haxtheweb/open-apis (>=11.0.2, <=26.0.0) potentially affected by CVE-2026-46511 via @haxtheweb/haxcms-nodejs (>=0.0.13, <=25.0.0)

@haxtheweb/haxcms-nodejs NPM version =0.0.13, =0.1.3, =11.0.2, =26.0.0 Source cves: CVE-2026-46511 Source advisory: MEND:CVE-2026-46511...

CVE-2026-46395 HAX CMS Vulnerable to Private Key Disclosure via Broken HMAC Implementation

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, the hmacBase64 function in the HAXcms Node.js backend contains two critical cryptographic implementation errors that together allow any unauthenticated attacker to extract the system’s private signing ke...

@haxtheweb/create (>=0.1.3, <=26.0.0), @haxtheweb/open-apis (>=11.0.2, <=26.0.0) potentially affected by CVE-2026-46395 via @haxtheweb/haxcms-nodejs (>=0.0.13, <=25.0.0)

@haxtheweb/haxcms-nodejs NPM version =0.0.13, =0.1.3, =11.0.2, =26.0.0 Source cves: CVE-2026-46395 Source advisory: MEND:CVE-2026-46395...

@haxtheweb/create (>=0.1.3, <=26.0.0), @haxtheweb/open-apis (>=11.0.2, <=26.0.0) potentially affected by CVE-2026-46393 via @haxtheweb/haxcms-nodejs (>=0.0.13, <=25.0.0)

@haxtheweb/haxcms-nodejs NPM version =0.0.13, =0.1.3, =11.0.2, =26.0.0 Source cves: CVE-2026-46393 Source advisory: MEND:CVE-2026-46393...

@haxtheweb/create (>=9.0.1, <=26.0.0), @haxtheweb/open-apis (>=11.0.2, <=26.0.0) potentially affected by CVE-2026-46390 via @haxtheweb/haxcms-nodejs (>=9.0.21, <=25.0.0)

@haxtheweb/haxcms-nodejs NPM version =9.0.21, =9.0.1, =11.0.2, =26.0.0 Source cves: CVE-2026-46390 Source advisory: MEND:CVE-2026-46390...

@haxtheweb/create (>=0.1.3, <=26.0.0), @haxtheweb/open-apis (>=11.0.2, <=26.0.0) potentially affected by CVE-2026-46399 via @haxtheweb/haxcms-nodejs (>=0.0.13, <=25.0.0)

@haxtheweb/haxcms-nodejs NPM version =0.0.13, =0.1.3, =11.0.2, =26.0.0 Source cves: CVE-2026-46399 Source advisory: MEND:CVE-2026-46399...

CVE-2026-4450 affecting package nodejs for versions less than 24.14.1-3

CVE-2026-4450 affecting package nodejs for versions less than 24.14.1-3. An upgraded version of the package is available that resolves this issue...