Information Exposure

Axios is vulnerable to Information Exposure. The vulnerability is due to improper handling of the Proxy-Authorization header in the Node.js HTTP adapter, where proxy credentials can be retained across redirects and inadvertently sent to a redirected destination after the request is no longer rout...

nodejs24 security update

1:24.14.1-2.0.2 - Rebuild to correct NVR 1:24.14.1-2.0.1 - Update upstream references...

MessagePack NodeJS/JavaScript msgpackr Heap Buffer Overflow DoS

The vulnerability of the ExtensionValue getData implementation in MessagePack NodeJS/JavaScript msgpackr is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service failures...

CVE-2026-41213

@node-oauth/oauth2-server is a module for implementing an OAuth2 server in Node.js. The token exchange path accepts RFC7636-invalid codeverifier values including one-character strings for S256 PKCE flows. Because short/weak verifiers are accepted and failed verifier attempts do not consume the...

CVE-2026-44003

A flaw was found in vm2 before 3.11.0. A code transformer fast-path skips AST analysis when catch, import, and async are absent, allowing direct access to VM2INTERNALSTATEDONOTUSEORPROGRAMWILLFAIL and internal security functions handleException, wrapWith, import. Fixed in 3.11.0...

CVE-2026-43997

A flaw was found in vm2 before 3.11.0, a Node.js sandbox library. Sandboxed code can obtain the host Object e.g. via HostObject.getOwnPropertySymbols and Symbolnodejs.util.inspect.custom, bypassing isolation and enabling arbitrary code execution on the host...

@haxtheweb/create (>=0.1.3, <=26.0.0), @haxtheweb/open-apis (>=11.0.2, <=26.0.0) potentially affected by CVE-2026-46357 via @haxtheweb/haxcms-nodejs (>=0.0.13, <=25.0.0)

@haxtheweb/haxcms-nodejs NPM version =0.0.13, =0.1.3, =11.0.2, =26.0.0 Source cves: CVE-2026-46357 Source advisory: MEND:CVE-2026-46357...

CVE-2026-46357

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, the HAX CMS NodeJS application crashes when an authenticated attacker sends a specially crafted site creation request to the createSite endpoint. A single request is sufficient to take the entire...

CVE-2026-46357

CVE-2026-46357 affects HAX CMS NodeJS backend. An authenticated attacker can crash the NodeJS process by sending a malformed request to the remote import workflow via the createSite endpoint, causing an availability DoS with a single HTTP request. The crash originates from a file object without o...

@haxtheweb/create (>=0.1.3, <=26.0.0), @haxtheweb/open-apis (>=11.0.2, <=26.0.0) potentially affected by CVE-2026-46493 via @haxtheweb/haxcms-nodejs (>=0.0.13, <=25.0.0)

@haxtheweb/haxcms-nodejs NPM version =0.0.13, =0.1.3, =11.0.2, =26.0.0 Source cves: CVE-2026-46493 Source advisory: MEND:CVE-2026-46493...

@haxtheweb/create (>=0.1.3, <=26.0.0), @haxtheweb/open-apis (>=11.0.2, <=26.0.0) potentially affected by CVE-2026-46401 via @haxtheweb/haxcms-nodejs (>=0.0.13, <=25.0.0)

@haxtheweb/haxcms-nodejs NPM version =0.0.13, =0.1.3, =11.0.2, =26.0.0 Source cves: CVE-2026-46401 Source advisory: MEND:CVE-2026-46401...

CVE-2026-46395

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, the hmacBase64 function in the HAXcms Node.js backend contains two critical cryptographic implementation errors that together allow any unauthenticated attacker to extract the system’s private signing ke...

@haxtheweb/create (>=25.0.2, <=26.0.0), @haxtheweb/open-apis (>=25.0.0, <=26.0.0) potentially affected by CVE-2026-46398 via @haxtheweb/haxcms-nodejs (25.0.0)

@haxtheweb/haxcms-nodejs NPM version 25.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @haxtheweb/haxcms-nodejs and may be impacted: - @haxtheweb/create =25.0.2, =25.0.0, =26.0.0 Source cves: CVE-2026-46398 Source advisory: MEND:CVE-2026-46398...

@haxtheweb/create (>=0.1.3, <=26.0.0), @haxtheweb/open-apis (>=11.0.2, <=26.0.0) potentially affected by CVE-2026-46397 via @haxtheweb/haxcms-nodejs (>=0.0.13, <=25.0.0)

@haxtheweb/haxcms-nodejs NPM version =0.0.13, =0.1.3, =11.0.2, =26.0.0 Source cves: CVE-2026-46397 Source advisory: MEND:CVE-2026-46397...

@haxtheweb/create (>=0.1.3, <=26.0.0), @haxtheweb/open-apis (>=11.0.2, <=26.0.0) potentially affected by CVE-2026-46496 via @haxtheweb/haxcms-nodejs (>=0.0.13, <=25.0.0)

@haxtheweb/haxcms-nodejs NPM version =0.0.13, =0.1.3, =11.0.2, =26.0.0 Source cves: CVE-2026-46496 Source advisory: MEND:CVE-2026-46496...

@haxtheweb/create (>=0.1.3, <=26.0.0), @haxtheweb/open-apis (>=11.0.2, <=26.0.0) potentially affected by CVE-2026-46396 via @haxtheweb/haxcms-nodejs (>=0.0.13, <=25.0.0)

@haxtheweb/haxcms-nodejs NPM version =0.0.13, =0.1.3, =11.0.2, =26.0.0 Source cves: CVE-2026-46396 Source advisory: MEND:CVE-2026-46396...

@haxtheweb/create (>=0.1.3, <=26.0.0), @haxtheweb/open-apis (>=11.0.2, <=26.0.0) potentially affected by CVE-2026-46511 via @haxtheweb/haxcms-nodejs (>=0.0.13, <=25.0.0)

@haxtheweb/haxcms-nodejs NPM version =0.0.13, =0.1.3, =11.0.2, =26.0.0 Source cves: CVE-2026-46511 Source advisory: MEND:CVE-2026-46511...

CVE-2026-46395 HAX CMS Vulnerable to Private Key Disclosure via Broken HMAC Implementation

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, the hmacBase64 function in the HAXcms Node.js backend contains two critical cryptographic implementation errors that together allow any unauthenticated attacker to extract the system’s private signing ke...

@haxtheweb/create (>=0.1.3, <=26.0.0), @haxtheweb/open-apis (>=11.0.2, <=26.0.0) potentially affected by CVE-2026-46395 via @haxtheweb/haxcms-nodejs (>=0.0.13, <=25.0.0)

@haxtheweb/haxcms-nodejs NPM version =0.0.13, =0.1.3, =11.0.2, =26.0.0 Source cves: CVE-2026-46395 Source advisory: MEND:CVE-2026-46395...

@haxtheweb/create (>=0.1.3, <=26.0.0), @haxtheweb/open-apis (>=11.0.2, <=26.0.0) potentially affected by CVE-2026-46393 via @haxtheweb/haxcms-nodejs (>=0.0.13, <=25.0.0)

@haxtheweb/haxcms-nodejs NPM version =0.0.13, =0.1.3, =11.0.2, =26.0.0 Source cves: CVE-2026-46393 Source advisory: MEND:CVE-2026-46393...