CVE-2026-19201 Denial of Service via Unbounded Recursion in go-attestation Windows SIPA Parser

An uncontrolled recursion vulnerability in the Windows SIPA event log parser of Google go-attestation versions up to and including 0.6.1 allows an attacker to cause a denial of service DoS. The WinEvents.readELAMAggregation function recurses for every nested elamAggregation sub-event without...

CVE-2026-77465

A flaw was found in toml-node. A remote, unauthenticated attacker can exploit an uncontrolled recursion vulnerability in the TOML parser by crafting a malicious TOML document with deeply nested arrays or inline tables. This can lead to the exhaustion of the Node.js call stack, causing a RangeErro...

GHSA-2X7J-588G-CCC2 Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address list

Summary Nodemailer's address parser lib/addressparser/index.js parses a list of comma‑separated addresses in quadratic time — On² in the number of addresses. A single crafted address string e.g. a To, Cc, Bcc, From, or Reply‑To value, or any value passed to the exported addressparser therefore...

Nodemailer: Recipient-domain validation bypass via RFC 5322 comment mis-parsing leads to email delivery to an attacker-controlled domain

Summary Nodemailer's email-address parser treats an RFC 5322 comment ... inside the domain as a point to concatenate the surrounding text, rather than as folding whitespace CFWS that terminates the domain. Consequently a recipient address such as [email protected] is parsed and delivere...

EUVD-2026-67932

multer vulnerable to Denial of Service via oversized array index in field names...

Tiptap: Quadratic ReDoS in block and inline Markdown attribute parsing

Summary @tiptap/core contains two quadratic regular-expression denial-of-service paths in its default Markdown attribute parsers. Pandoc-style block attributes use two unanchored greedy expressions that rescan repeated QUOTED0 prefixes. Inline shortcode attributes use another unanchored greedy ke...

Regular Expression Denial of Service (ReDoS)

Overview @tiptap/core is a headless rich text editor Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS through the Pandoc-style parseAttributes helper in packages/core/src/utilities/markdown/attributeUtils.ts and the shortcode attribute parser in...

NPM: Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

NPM: Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials vulnerability discovered by ? in WordPress Npm hono versions 4.13.5...

GHSA-CRVJ-82CR-HJCX Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Summary Hono's query parsing does not stop at the URL fragment: a ? appearing after a is treated as the start of a query string. As a result, the application can read request parameters that no other component involved in handling the request can see. Details A fragment is never part of the query...

Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Summary Hono's query parsing does not stop at the URL fragment: a ? appearing after a is treated as the start of a query string. As a result, the application can read request parameters that no other component involved in handling the request can see. Details A fragment is never part of the query...

NPM: xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content

NPM: xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content vulnerability discovered by ? in WordPress Npm xmldom versions = 0.6.0...

EUVD-2026-69225

xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content...

xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content

Summary xmldom's parser silently accepts a not-well-formed end tag whose valid name is followed by trailing content — e.g. . The element is closed, the trailing content is discarded, and no error is reported, even though the XML end-tag production allows only optional whitespace after the name an...

GHSA-6H8R-XR42-GP59 xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content

Summary xmldom's parser silently accepts a not-well-formed end tag whose valid name is followed by trailing content — e.g. . The element is closed, the trailing content is discarded, and no error is reported, even though the XML end-tag production allows only optional whitespace after the name an...

xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser

Summary On the @xmldom/xmldom 0.8.x line, parsing an XML end tag whose name is followed by a long run of whitespace and then a non-whitespace character triggers quadratic-time regular-expression backtracking ReDoS, so a single small crafted end tag stalls the Node.js event loop. It is reachable...

GHSA-X4FP-J954-R2F4 xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser

Summary On the @xmldom/xmldom 0.8.x line, parsing an XML end tag whose name is followed by a long run of whitespace and then a non-whitespace character triggers quadratic-time regular-expression backtracking ReDoS, so a single small crafted end tag stalls the Node.js event loop. It is reachable...

EUVD-2026-69234

xmldom: Quadratic-time parsing via the malformed-input recovery path — parseElementStartPart re-scan and normalize adjacent-text merge...

EUVD-2026-69227

xmldom: HTML raw-text closing-tag case mismatch causes output amplification...

GHSA-F2FP-RGF2-35CP HTTPX2: Quadratic SSE line buffering can cause CPU denial of service

Summary HTTPX2's Server-Sent Events SSE parser repeatedly copied and rescanned buffered text when a server split one unterminated line across many response chunks. The total work grows quadratically with the length of the line. An attacker-controlled or compromised SSE endpoint can exploit this...

CVE-2026-82537

Roo-Code through 3.54.0 contains an auto-approve bypass vulnerability that allows attackers to execute denied shell commands by exploiting a word-boundary mismatch in comment handling between the approval gate's shell parser and bash. Attackers can craft a command string with an allowlisted word...