CLEANSTART-2026-XC13093 Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service

Security vulnerability affects the nodejs-24 package. Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service...

CLEANSTART-2026-WZ77365 Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service

Security vulnerability affects the nodejs-24 package. Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service...

CLEANSTART-2026-ST98216 Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service

Security vulnerability affects the nodejs-24 package. Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service...

CLEANSTART-2026-UM64475 Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service

Security vulnerability affects the nodejs-24 package. Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service...

CLEANSTART-2026-QQ59156 Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service

Security vulnerability affects the nodejs-24 package. Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service...

CLEANSTART-2026-BU08584 Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service

Security vulnerability affects the nodejs-24 package. Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service...

CLEANSTART-2026-BX90561 Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service

Security vulnerability affects the nodejs-24 package. Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service...

CVE-2026-114102 adm-zip before 0.6.1 Denial of Service via inflateAsync Unhandled Error Event

adm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated attackers to crash the Node.js process via a malformed ZIP file, because inflateAsync in methods/inflater.js lacks a zlib stream error listener. Attackers can supply a ZIP with corrupted DEFLATE data...

EUVD-2026-106905

adm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated attackers to crash the Node.js process via a malformed ZIP file, because inflateAsync in methods/inflater.js lacks a zlib stream error listener. Attackers can supply a ZIP with corrupted DEFLATE data...

CVE-2026-114102

adm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated attackers to crash the Node.js process via a malformed ZIP file, because inflateAsync in methods/inflater.js lacks a zlib stream error listener. Attackers can supply a ZIP with corrupted DEFLATE data...

CVE-2026-114102 adm-zip before 0.6.1 Denial of Service via inflateAsync Unhandled Error Event

adm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated attackers to crash the Node.js process via a malformed ZIP file, because inflateAsync in methods/inflater.js lacks a zlib stream error listener. Attackers can supply a ZIP with corrupted DEFLATE data...

CVE-2026-114102

The adm-zip library (versions before 0.6.1 ) is vulnerable to a Denial of Service (DoS) attack. The root cause is located in methods/inflater.js, where the inflateAsync function lacks a zlib stream error listener . An unauthenticated attacker can provide a malformed ZIP file containing corrupted ...

CVE-2026-114095 Dulwich before 1.2.9 Infinite Loop DoS via Pack.resolve_object

Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolveobject that allows attackers to cause infinite recursion via self-referential OFSDELTA objects. Attackers can supply a malicious packfile with an OFSDELTA deltaoffset of 0 to exhaust CPU during clone, fetch, or cat-fil...

CVE-2026-114095 Dulwich before 1.2.9 Infinite Loop DoS via Pack.resolve_object

Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolveobject that allows attackers to cause infinite recursion via self-referential OFSDELTA objects. Attackers can supply a malicious packfile with an OFSDELTA deltaoffset of 0 to exhaust CPU during clone, fetch, or cat-fil...

EUVD-2026-106898

Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolveobject that allows attackers to cause infinite recursion via self-referential OFSDELTA objects. Attackers can supply a malicious packfile with an OFSDELTA deltaoffset of 0 to exhaust CPU during clone, fetch, or cat-fil...

CVE-2026-114095

Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolveobject that allows attackers to cause infinite recursion via self-referential OFSDELTA objects. Attackers can supply a malicious packfile with an OFSDELTA deltaoffset of 0 to exhaust CPU during clone, fetch, or cat-fil...

CVE-2026-114095 Dulwich before 1.2.9 Infinite Loop DoS via Pack.resolve_object

Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolveobject that allows attackers to cause infinite recursion via self-referential OFSDELTA objects. Attackers can supply a malicious packfile with an OFSDELTA deltaoffset of 0 to exhaust CPU during clone, fetch, or cat-fil...

CVE-2026-114095

The Dulwich library (versions before 1.2.9 ) is vulnerable to a denial of service (DoS) via an infinite loop in the Pack.resolve_object function. An attacker can trigger infinite recursion by providing a malicious packfile containing self-referential OFS_DELTA objects with a delta_offset of 0. Th...

CVE-2026-114095

Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolveobject that allows attackers to cause infinite recursion via self-referential OFSDELTA objects. Attackers can supply a malicious packfile with an OFSDELTA deltaoffset of 0 to exhaust CPU during clone, fetch, or cat-fil...

EUVD-2026-106883

Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated project members to make the server send requests by setting unvalidated alert-channel webhook URLs. Attackers can create alert channels pointing to loopback, internal, or cloud metadata...