Malicious code in winston-loopback-nodejs-bulma (npm)

The package winston-loopback-nodejs-bulma was found to contain malicious code...

MAL-2025-43676 Malicious code in bulma-nodejs-achernar-farout (npm)

The package bulma-nodejs-achernar-farout was found to contain malicious code...

MAL-2025-46278 Malicious code in test-mlw2-borde-reest-lazed-cocas (npm)

The package test-mlw2-borde-reest-lazed-cocas was found to contain malicious code...

MAL-2025-42965 Malicious code in @trp-ta-nitro/secrets-nodejs (npm)

The package @trp-ta-nitro/secrets-nodejs was found to contain malicious code...

MAL-2025-46436 Malicious code in uglify-js-forever-equinox-nodejs (npm)

The package uglify-js-forever-equinox-nodejs was found to contain malicious code...

Malicious code in boson-nodejs-jupiter-robotics (npm)

The package boson-nodejs-jupiter-robotics was found to contain malicious code...

Malicious code in bulma-nodejs-achernar-farout (npm)

The package bulma-nodejs-achernar-farout was found to contain malicious code...

Malicious code in uglify-js-forever-equinox-nodejs (npm)

The package uglify-js-forever-equinox-nodejs was found to contain malicious code...

Malicious code in izar-magellan-readable-nodejs (npm)

The package izar-magellan-readable-nodejs was found to contain malicious code...

MAL-2025-43646 Malicious code in boson-nodejs-jupiter-robotics (npm)

The package boson-nodejs-jupiter-robotics was found to contain malicious code...

MAL-2025-44700 Malicious code in ini-nodejs-speleology-filament (npm)

The package ini-nodejs-speleology-filament was found to contain malicious code...

Malicious code in nodejs-smtp (npm)

The package nodejs-smtp was found to contain malicious code...

MAL-2025-45337 Malicious code in nodejs-smtp (npm)

The package nodejs-smtp was found to contain malicious code...

MAL-2025-42186 Malicious code in @amiga-fwk-nodejs/metrics (npm)

The package @amiga-fwk-nodejs/metrics was found to contain malicious code...

OESA-2025-2204 nodejs-form-data security update

A module to create readable "multipart/form-data" streams. Can be used to submit forms and file uploads to other web applications. Security Fixes: Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution HPP. This vulnerability is associated with program file...

urllib3 does not control redirects in browsers and Node.js

...

A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used. Node.js Permission Model do not operate on file descriptors, however, operations such as fs.fchown or fs.fchmod can use a "read-only" file descriptor to change the owner and permissions of a file.

...

The vulnerability of the Node.js software platform’s permission model, related to deficiencies in HTTP request processing, allows attackers to circumvent existing security restrictions and send unauthorized requests.

The vulnerability of the Node.js software platform’s permission model is related to deficiencies in HTTP request processing. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions and send unauthorized requests...

CVE-2025-58047

Volto is a React based frontend for the Plone Content Management System. In versions from 19.0.0-alpha.1 to before 19.0.0-alpha.4, 18.0.0 to before 18.24.0, 17.0.0 to before 17.22.1, and prior to 16.34.0, an anonymous user could cause the NodeJS server part of Volto to quit with an error when...

Linux Distros Unpatched Vulnerability : CVE-2018-7158

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The 'path' module in the Node.js 4.x release line contains a potential regular expression denial of service ReDoS vector. The code in question was replaced in...