Malicious code in typst-resume-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 104d03639d9a9d48d03641fef83163391bb1540c8a01c56287bcaf8ca45ad01c index.js loads https, http, and childprocess at the top of the module and sends host/environment data to a hardcoded AWS Lambda URL at...

CVE-2026-18248 @fastify/aws-lambda vulnerable to Lambda event spoofing via client-controlled x-apigateway-event header

@fastify/aws-lambda version 6.4.0 decorates each Fastify request with request.awsLambda.event and request.awsLambda.context, values that applications are documented to use for authorization decisions such as reading API Gateway authorizer claims. In the default configuration, the getter that...

io.quarkus:quarkus-amazon-lambda-http (2.4.0.cr1), io.quarkus:quarkus-amazon-lambda-http-deployment (2.4.0.cr1) +106 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.4.0.cr1)

io.quarkus:quarkus-vertx-http MAVEN version 2.4.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 2.4.0.cr1 - io.quarkus:quarkus-amazon-lambda-http-deploymen...

io.quarkiverse.githubapp:quarkus-github-app (>=1.5.0, <=1.6.0), io.quarkiverse.githubapp:quarkus-github-app-deployment (>=1.5.0, <=1.6.0) +111 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.5.2.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.5.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.githubapp:quarkus-github-app =1.5.0, =1.5.0, =1.5.0, =1.5.0, =1.5.0, =1.6.0 -...

io.quarkiverse.operatorsdk:quarkus-operator-sdk (2.0.0.beta1), io.quarkiverse.operatorsdk:quarkus-operator-sdk-deployment (2.0.0.beta1) +111 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.0.0.cr2)

io.quarkus:quarkus-vertx-http MAVEN version 2.0.0.cr2 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.operatorsdk:quarkus-operator-sdk 2.0.0.beta1 -...

com.datastax.oss.quarkus:cassandra-quarkus-client (1.0.0), com.datastax.oss.quarkus:cassandra-quarkus-client-deployment (1.0.0) +401 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (1.8.0.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.8.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - com.datastax.oss.quarkus:cassandra-quarkus-client 1.0.0 -...

io.quarkus:quarkus-amazon-lambda-http (2.16.0.cr1), io.quarkus:quarkus-amazon-lambda-http-deployment (2.16.0.cr1) +102 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.16.0.cr1)

io.quarkus:quarkus-vertx-http MAVEN version 2.16.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 2.16.0.cr1 -...

io.quarkus:quarkus-amazon-lambda-http (1.7.5.final), io.quarkus:quarkus-amazon-lambda-http-deployment (1.7.5.final) +68 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (1.7.5.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.7.5.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 1.7.5.final -...

io.quarkiverse.renarde:quarkus-renarde (1.0.1), io.quarkiverse.renarde:quarkus-renarde-backoffice (1.0.1) +104 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.9.0.cr1)

io.quarkus:quarkus-vertx-http MAVEN version 2.9.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.renarde:quarkus-renarde 1.0.1 - io.quarkiverse.renarde:quarkus-renarde-backoffice...

io.quarkus:quarkus-amazon-lambda-http (1.4.0.final), io.quarkus:quarkus-amazon-lambda-http-deployment (1.4.0.final) +60 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (1.4.0.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.4.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 1.4.0.final -...

io.quarkus:quarkus-amazon-lambda-http (1.7.2.final), io.quarkus:quarkus-amazon-lambda-http-deployment (1.7.2.final) +69 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (1.7.2.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.7.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 1.7.2.final -...

io.quarkus:quarkus-amazon-lambda-http (1.7.3.final), io.quarkus:quarkus-amazon-lambda-http-deployment (1.7.3.final) +69 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (1.7.3.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.7.3.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 1.7.3.final -...

io.quarkiverse.cxf:quarkus-cxf (1.5.0.cr1), io.quarkiverse.cxf:quarkus-cxf-deployment (1.5.0.cr1) +104 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.12.0.cr1)

io.quarkus:quarkus-vertx-http MAVEN version 2.12.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.cxf:quarkus-cxf 1.5.0.cr1 - io.quarkiverse.cxf:quarkus-cxf-deployment 1.5.0.cr1 -...

io.quarkus:quarkus-amazon-lambda-http (2.2.4.final), io.quarkus:quarkus-amazon-lambda-http-deployment (2.2.4.final) +107 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.2.4.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.2.4.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 2.2.4.final -...

br.com.senior:crm-http-camel-api (>=0.0.2-alpha, <=0.0.81-alpha), br.com.senior:novasoft-http-camel-api (>=0.0.3-alpha, <=0.0.93-alpha) +191 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.1.2.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.1.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - br.com.senior:crm-http-camel-api =0.0.2-alpha, =0.0.3-alpha, =0.0.10-alpha, =1.3.0 -...

io.quarkus:quarkus-amazon-lambda-http (1.2.0.cr1), io.quarkus:quarkus-amazon-lambda-http-deployment (1.2.0.cr1) +49 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (1.2.0.cr1)

io.quarkus:quarkus-vertx-http MAVEN version 1.2.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 1.2.0.cr1 - io.quarkus:quarkus-amazon-lambda-http-deploymen...

io.quarkus:quarkus-amazon-lambda-http (1.9.0.cr1), io.quarkus:quarkus-amazon-lambda-http-deployment (1.9.0.cr1) +72 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (1.9.0.cr1)

io.quarkus:quarkus-vertx-http MAVEN version 1.9.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 1.9.0.cr1 - io.quarkus:quarkus-amazon-lambda-http-deploymen...

io.quarkus:quarkus-amazon-lambda-http (1.6.0.cr1), io.quarkus:quarkus-amazon-lambda-http-deployment (1.6.0.cr1) +69 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (1.6.0.cr1)

io.quarkus:quarkus-vertx-http MAVEN version 1.6.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 1.6.0.cr1 - io.quarkus:quarkus-amazon-lambda-http-deploymen...

CVE-2026-54288 Hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length`

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, the Body Limit Middleware trusts the request's Content-Length header to decide whether a body is within the limit. On AWS Lambda API Gateway v1/v2, ALB, VPC Lattice, and Lambda@Edge the body is...

EUVD-2026-38331

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, the Body Limit Middleware trusts the request's Content-Length header to decide whether a body is within the limit. On AWS Lambda API Gateway v1/v2, ALB, VPC Lattice, and Lambda@Edge the body is...