GHSA-9MQV-5HH9-4CGG Node.js Adapter for Hono: Unauthenticated memory-leak DoS via aborted WebSocket handshake

Summary A WebSocket upgrade request to an upgradeWebSocket route with a missing or malformed Sec-WebSocket-Key header leaks memory permanently. The request's IncomingMessage is retained in an internal map and a pending promise is never settled, even though no connection is established. Since the...

AZL-93279 CVE-2026-56852 affecting package prometheus-adapter for versions less than 0.12.0-7

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes...

NPM: Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication

NPM: Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication vulnerability discovered by ? in WordPress Npm hono versions = 4.3.3, 4.12.27...

Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication

Summary The AWS API Gateway v1 adapter can drop a distinct repeated request header value. When a header appears multiple times, the adapter de-duplicates values using a substring comparison instead of an exact match, so a value that is a substring of another value of the same header is omitted fo...

Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)

The same as the hono core Path traversal in serve-static on Windows via encoded backslash %5C. Summary On Windows hosts, an encoded backslash %5C in the request path decodes to , which the Windows path resolver treats as a separator. serve-static then resolves a single URL segment such as...

GHSA-FRVP-7C67-39W9 Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)

The same as the hono core Path traversal in serve-static on Windows via encoded backslash %5C. Summary On Windows hosts, an encoded backslash %5C in the request path decodes to , which the Windows path resolver treats as a separator. serve-static then resolves a single URL segment such as...

CLEANSTART-2026-LZ81863 Security fixes for CVE-2025-29923, CVE-2026-34040, CVE-2026-39822, CVE-2026-49834, CVE-2026-49835, CVE-2026-50151 applied in versions: 0.36.0-r0, 0.36.0-r1

Multiple security vulnerabilities affect the harbor-trivy-adapter-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning

Summary Axios’ Node.js HTTP adapter can route requests through an attacker-controlled proxy when Object.prototype.proxy is polluted and request configuration is materialized as a regular object before dispatch. Recent axios releases harden merged request config by creating a null-prototype object...

GHSA-GCFJ-64VW-6MP9 Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning

Summary Axios’ Node.js HTTP adapter can route requests through an attacker-controlled proxy when Object.prototype.proxy is polluted and request configuration is materialized as a regular object before dispatch. Recent axios releases harden merged request config by creating a null-prototype object...

Prototype Pollution

Overview org.webjars.npm:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Prototype Pollution in the Node HTTP adapter lib/adapters/http.js, which reads config.proxy through the prototype chain after a request interceptor return...

Prototype Pollution

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Prototype Pollution in the Node HTTP adapter lib/adapters/http.js, which reads config.proxy through the prototype chain after a request interceptor returns a plain-object...

Allocation of Resources Without Limits or Throttling

Overview org.webjars.npm:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the getBodyLength and resolveBodyLength functions of lib/adapters/fetch.js, which lack a branch fo...

Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`

Summary axios’ fetch adapter does not enforce maxBodyLength for live WHATWG ReadableStream request bodies whose size cannot be determined before dispatch. Applications that use adapter: "fetch" and rely on maxBodyLength to cap untrusted upload/proxy streams can send the full stream even when it...

GHSA-JQH4-M9W3-8HP9 Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`

Summary axios’ fetch adapter does not enforce maxBodyLength for live WHATWG ReadableStream request bodies whose size cannot be determined before dispatch. Applications that use adapter: "fetch" and rely on maxBodyLength to cap untrusted upload/proxy streams can send the full stream even when it...

Allocation of Resources Without Limits or Throttling

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the getBodyLength and resolveBodyLength functions of lib/adapters/fetch.js, which lack a branch for WHATWG...

GHSA-F4GW-2P7V-4548 Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios

Summary Axios versions containing lib/helpers/shouldBypassProxy.js do not treat 0.0.0.0 as a local address when evaluating NOPROXY rules. In Node.js applications that use HTTPPROXY or HTTPSPROXY together with NOPROXY=localhost,127.0.0.1,::1 or similar, a request to http://0.0.0.0:/ can be routed...

GHSA-XJ6Q-8X83-JV6G Axios: Prototype pollution auth subfields can inject Basic auth

Summary Axios versions after the GHSA-q8qp-cvcw-x6jj fix still contain prototype-pollution read-side gadgets in Basic auth subfield handling. If a host application is already affected by prototype pollution and then makes an axios request with an own auth object that omits username or password,...

axios: Axios: Denial of Service due to unenforced request and response size limits

A flaw was found in Axios, a promise-based HTTP client. When using the fetch adapter, Axios did not properly enforce configured request and response size limits. This vulnerability allows a remote attacker, through a malicious or compromised server, or by supplying a large data URL, to send or...

axios: Axios: Information disclosure of proxy credentials via HTTP redirects

A flaw was found in Axios, a promise-based HTTP client, specifically in its Node.js HTTP adapter. When Axios is configured to use an authenticated proxy and follows a redirect, it may inadvertently send the Proxy-Authorization header, containing proxy credentials, to the redirect target. This can...

CVE-2026-53400

A flaw was found in the Linux kernel, specifically within its I2C Inter-Integrated Circuit core component. This vulnerability arises from a timing issue during the registration of I2C adapters, where an adapter could be accessed before it is fully prepared. This premature access to uninitialized...