134377 matches found
ROOT-APP-NPM-CVE-2026-18446 CVE-2026-18446 in fast-uri - Patched by Root
Root has patched CVE-2026-18446 in the fast-uri package for Root:npm. Multiple fixed versions available...
CVE-2026-104848
A flaw was found in tinypool. When an attacker is able to modify base JavaScript object properties prototype pollution, tinypool inadvertently copies these inherited configuration values into newly spawned worker threads. An attacker can exploit this behavior by injecting malicious startup...
ROOT-APP-NPM-GHSA-JQH4-M9W3-8HP9 GHSA-jqh4-m9w3-8hp9 in axios - Patched by Root
Root has patched GHSA-jqh4-m9w3-8hp9 in the axios package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-GHSA-MWF2-3PR3-8698 GHSA-mwf2-3pr3-8698 in axios - Patched by Root
Root has patched GHSA-mwf2-3pr3-8698 in the axios package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-GHSA-42H9-826W-CGV3 GHSA-42h9-826w-cgv3 in axios - Patched by Root
Root has patched GHSA-42h9-826w-cgv3 in the axios package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-GHSA-7Q8Q-RJ6J-MHJQ GHSA-7q8q-rj6j-mhjq in axios - Patched by Root
Root has patched GHSA-7q8q-rj6j-mhjq in the axios package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-GHSA-MMX7-HFXF-JPPX GHSA-mmx7-hfxf-jppx in axios - Patched by Root
Root has patched GHSA-mmx7-hfxf-jppx in the axios package for Root:npm. Multiple fixed versions available...
CVE-2026-104849
A flaw was found in tinypool. When processing tasks with caller-supplied configuration options, the worker pool does not verify whether properties, such as the worker filename, belong directly to the provided object. An attacker who can manipulate shared JavaScript base objects prototype pollutio...
react-cve-2025-55182-lab
Setup: git clone https://github.com/alexandre-briongos-wavestone/react-cve-2025-55182-lab cd react-cve-2025-55182-lab sudo docker build -t react-rsc-lab . sudo docker run -p 3000:3000 react-rsc-lab Exploit: curl --path-as-is -i -s -k -X $'POST' \ -H $'Host: localhost:3000' -H $'User-Agent:...
Security Bulletin: Multiple Vulnerabilities in Axios affect IBM Cloud Pak System
Summary Due to the use of Axios, multiple vulnerabilities were addressed in IBM Cloud Pak System version 2.3.5.1. Vulnerability Details CVEID:CVE-2026-42264 DESCRIPTION: Axios is a promise based HTTP client for the browser and Node.js. From version 1.0.0 to before version 1.15.2, fFive config...
CVE-2026-106550
A flaw was found in convict. An attacker capable of submitting untrusted configuration keys can bypass property filters within the config.set function to modify base JavaScript objects. This prototype pollution allows the attacker to alter fundamental language methods, causing persistent...
PT-2026-107667
traverse npm versions 0.3.6 through 0.3.9, 0.4.0 through 0.4.6, 0.5.0 through 0.5.2, and 0.6.0 through 0.6.11 allow prototype pollution through set. When the path passed to set crosses a primitive value, the next path segment is resolved on that primitive's built-in prototype, so an application...
CVE-2026-107353: Improperly Controlled Modification of Object Prototype Attributes
traverse npm versions 0.3.6 through 0.3.9, 0.4.0 through 0.4.6, 0.5.0 through 0.5.2, and 0.6.0 through 0.6.11 allow prototype pollution through set. When the path passed to set crosses a primitive value, the next path segment is resolved on that primitive's built-in prototype, so an application...
CVE-2026-106550
Mozilla's Node-convict version 6.2.2 and later is vulnerable to a Denial of Service vulnerability caused by incomplete prototype‑pollution protections in config.set. An attacker controlling the configuration key can write arbitrary properties to constructor., which walk resolves to the global...
CVE-2026-106448
StableLib is a stable library of useful TypeScript and JavaScript code. Prior to 2.0.4, the @stablelib/cbor CBOR map decoding path creates ordinary JavaScript objects and assigns attacker-controlled keys with bracket assignment. A map key named proto invokes the inherited prototype setter instead...
CVE-2026-106550
Mozilla's Node-convict (version 6.2.2 and later) is vulnerable to a Denial of Service (DoS) via prototype pollution in the config.set() function. An attacker providing untrusted configuration keys can bypass existing filters (which only block constructor.prototype.* and __proto__.*) to write arbi...
EUVD-2026-93988
Mozilla's Node-convict version 6.2.2 and later is vulnerable to a Denial of Service vulnerability caused by incomplete prototype‑pollution protections in config.set. An attacker controlling the configuration key can write arbitrary properties to constructor., which walk resolves to the global...
CVE-2026-106550 CVE-2026-106550
Mozilla's Node-convict version 6.2.2 and later is vulnerable to a Denial of Service vulnerability caused by incomplete prototype‑pollution protections in config.set. An attacker controlling the configuration key can write arbitrary properties to constructor., which walk resolves to the global...
CVE-2026-106550 CVE-2026-106550
Mozilla's Node-convict version 6.2.2 and later is vulnerable to a Denial of Service vulnerability caused by incomplete prototype‑pollution protections in config.set. An attacker controlling the configuration key can write arbitrary properties to constructor., which walk resolves to the global...
CVE-2026-106550 CVE-2026-106550
Mozilla's Node-convict version 6.2.2 and later is vulnerable to a Denial of Service vulnerability caused by incomplete prototype‑pollution protections in config.set. An attacker controlling the configuration key can write arbitrary properties to constructor., which walk resolves to the global...