ALSA-2026:74464 Moderate: ghostscript security update

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Security Fixes: ghostscript: ghostscript: Heap buffer overflow via JPEG 2000 output adapter...

Oracle Linux 10 : ghostscript (ELSA-2026-74464)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-74464 advisory. 10.02.1-16.1 - RHEL-264925 CVE-2026-39919 ghostscript: Heap buffer overflow in JPEG 2000 JPXDecode output adapter Tenable has extracted the preceding...

RHEL 10 : ghostscript (RHSA-2026:74464)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:74464 advisory. The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap format...

Astro: Malformed port in the Host header can crash the Node adapter

Summary In the Astro Node adapter, a request whose Host header contains a malformed port for example example.com:65536 or example.com:8080:8080 produced an invalid request URL. The fallback intended to recover from an unparseable URL reused the same malformed host, so it failed again and raised a...

GHSA-4HQW-QXG8-JXX2 Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders

Summary Axios contains a guard in the Node HTTP adapter to avoid using an inherited Object.prototype.getHeaders as a FormData header source. The fetch adapter calls the shared resolveConfig helper before dispatch, and that helper lacks the same guard. If another vulnerability pollutes...

NPM: Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders

NPM: Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders vulnerability discovered by ? in WordPress Npm axios versions = 1.12.0, 1.20.0...

EUVD-2026-88368

Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders...

Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders

Summary Axios contains a guard in the Node HTTP adapter to avoid using an inherited Object.prototype.getHeaders as a FormData header source. The fetch adapter calls the shared resolveConfig helper before dispatch, and that helper lacks the same guard. If another vulnerability pollutes...

GHSA-M8M8-QJ5V-23W3 Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection

Summary Axios' Node HTTP adapter can act as a read-side prototype-pollution gadget for Node's sensitive createConnection request option. The adapter creates a null-prototype options object, but Node's HTTP client can copy or normalize request options into ordinary objects before connection...

Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection

Summary Axios' Node HTTP adapter can act as a read-side prototype-pollution gadget for Node's sensitive createConnection request option. The adapter creates a null-prototype options object, but Node's HTTP client can copy or normalize request options into ordinary objects before connection...

NPM: Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection

NPM: Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection vulnerability discovered by ? in WordPress Npm axios versions = 1.15.2, 1.20.0...

Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges

Summary Axios supports proxy environment variables and evaluates NOPROXY exclusions in the Node.js adapter. CIDR-form NOPROXY entries such as 127.0.0.0/8, 10.0.0.0/8, or 169.254.169.254/32 are not interpreted as IP ranges. As a result, a request to an IP address inside a configured CIDR exclusion...

Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF

Summary Axios exposes maxRedirects to limit redirect following, and maxRedirects: 0 is used by applications as a redirect-based SSRF guard. The Node HTTP adapter enforces this option. The fetch adapter does not read it and does not set a Fetch API redirect mode, so the runtime default of redirect...

EUVD-2026-88384

Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF...

NPM: Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF

NPM: Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF vulnerability discovered by ? in WordPress Npm axios versions = 1.17.0, 1.20.0...

HTTP3-Adapter

HTTP/3-Adapter Расширение для Burp Suite, отправляющее запросы по HTTP/3. Burp не поддерживает HTTP/3 нативно. Это расширение реализует стек HTTP/3, перехватывает все запросы, преобразует и отправляет их по HTTP/3, а затем преобразует ответ обратно в версию HTTP, понятную Burp. Установка Доступно...

NPM: Axios: Prototype pollution gadget in fetch adapter can alter outbound requests

NPM: Axios: Prototype pollution gadget in fetch adapter can alter outbound requests vulnerability discovered by ? in WordPress Npm axios versions = 1.7.0, 1.20.0...

EUVD-2026-88387

Axios: Prototype pollution gadget in fetch adapter can alter outbound requests...

Axios: Prototype pollution gadget in fetch adapter can alter outbound requests

Summary Axios fetch adapter requests can be altered by inherited properties on fetchOptions. The adapter resolves method, headers, body, signal, and credentials into resolvedOptions, creates a Request, and then calls fetchrequest, fetchOptions instead of fetchrequest, resolvedOptions. In runtimes...

Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location

Summary Axios shouldBypassProxy normalizes hostnames with hostname.replace/.+$/, ''. For a hostname shaped as many dots followed by a non-dot, the anchored regex can perform quadratic backtracking. Because axios re-evaluates proxy bypass rules for redirected requests, a malicious server can...