Malicious code in typst-resume-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 104d03639d9a9d48d03641fef83163391bb1540c8a01c56287bcaf8ca45ad01c index.js loads https, http, and childprocess at the top of the module and sends host/environment data to a hardcoded AWS Lambda URL at...

CVE-2026-18248 @fastify/aws-lambda vulnerable to Lambda event spoofing via client-controlled x-apigateway-event header

@fastify/aws-lambda version 6.4.0 decorates each Fastify request with request.awsLambda.event and request.awsLambda.context, values that applications are documented to use for authorization decisions such as reading API Gateway authorizer claims. In the default configuration, the getter that...

io.quarkus:quarkus-amazon-lambda-http (1.6.0.cr1), io.quarkus:quarkus-amazon-lambda-http-deployment (1.6.0.cr1) +69 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (1.6.0.cr1)

io.quarkus:quarkus-vertx-http MAVEN version 1.6.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 1.6.0.cr1 - io.quarkus:quarkus-amazon-lambda-http-deploymen...

io.quarkiverse.cxf:quarkus-cxf (1.5.0.cr1), io.quarkiverse.cxf:quarkus-cxf-deployment (1.5.0.cr1) +104 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.12.0.cr1)

io.quarkus:quarkus-vertx-http MAVEN version 2.12.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.cxf:quarkus-cxf 1.5.0.cr1 - io.quarkiverse.cxf:quarkus-cxf-deployment 1.5.0.cr1 -...

com.datastax.oss.quarkus:cassandra-quarkus-client (1.0.0), com.datastax.oss.quarkus:cassandra-quarkus-client-deployment (1.0.0) +401 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (1.8.0.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.8.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - com.datastax.oss.quarkus:cassandra-quarkus-client 1.0.0 -...

io.quarkus:quarkus-amazon-lambda-http (1.9.0.cr1), io.quarkus:quarkus-amazon-lambda-http-deployment (1.9.0.cr1) +72 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (1.9.0.cr1)

io.quarkus:quarkus-vertx-http MAVEN version 1.9.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 1.9.0.cr1 - io.quarkus:quarkus-amazon-lambda-http-deploymen...

io.quarkiverse.githubapp:quarkus-github-app (>=1.5.0, <=1.6.0), io.quarkiverse.githubapp:quarkus-github-app-deployment (>=1.5.0, <=1.6.0) +111 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.5.2.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.5.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.githubapp:quarkus-github-app =1.5.0, =1.5.0, =1.5.0, =1.5.0, =1.5.0, =1.6.0 -...

io.quarkus:quarkus-amazon-lambda-http (1.7.3.final), io.quarkus:quarkus-amazon-lambda-http-deployment (1.7.3.final) +69 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (1.7.3.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.7.3.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 1.7.3.final -...

io.quarkiverse.renarde:quarkus-renarde (1.0.1), io.quarkiverse.renarde:quarkus-renarde-backoffice (1.0.1) +104 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.9.0.cr1)

io.quarkus:quarkus-vertx-http MAVEN version 2.9.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.renarde:quarkus-renarde 1.0.1 - io.quarkiverse.renarde:quarkus-renarde-backoffice...

io.quarkus:quarkus-amazon-lambda-http (1.4.0.final), io.quarkus:quarkus-amazon-lambda-http-deployment (1.4.0.final) +60 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (1.4.0.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.4.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 1.4.0.final -...

EUVD-2026-38331

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, the Body Limit Middleware trusts the request's Content-Length header to decide whether a body is within the limit. On AWS Lambda API Gateway v1/v2, ALB, VPC Lattice, and Lambda@Edge the body is...

CVE-2026-54288 Hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length`

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, the Body Limit Middleware trusts the request's Content-Length header to decide whether a body is within the limit. On AWS Lambda API Gateway v1/v2, ALB, VPC Lattice, and Lambda@Edge the body is...

Insufficient Verification of Data Authenticity

Overview hono is an Ultrafast web framework for the Edges Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity in the Body Limit Middleware. An attacker can cause the application to process payloads larger than the configured maximum by understating t...

NPM: hono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and Lattice

NPM: hono: AWS Lambda adapter merges multiple Set-Cookie headers into one value, dropping cookies on ALB single-header and Lattice vulnerability discovered by ? in WordPress Npm hono versions 4.12.25...

MAL-2026-4682 Malicious code in tango-app-api-trax (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e7d8f3ef8e6fa016bfc17617ebcedce012c6cce870d89564965a476c3ec8da1c The tarball contains live, importable credentials for systems other than the installer's own. src/controllers/internalTrax.controller.js hardcodes...

io.quarkiverse.operatorsdk:quarkus-operator-sdk (4.0.6), io.quarkiverse.operatorsdk:quarkus-operator-sdk-bundle-generator (4.0.6) +110 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (2.13.6.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.13.6.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.operatorsdk:quarkus-operator-sdk 4.0.6 -...

io.quarkus:quarkus-amazon-lambda-http (2.15.0.cr1), io.quarkus:quarkus-amazon-lambda-http-deployment (2.15.0.cr1) +101 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (2.15.0.cr1)

io.quarkus:quarkus-vertx-http MAVEN version 2.15.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 2.15.0.cr1 -...

io.quarkus:quarkus-amazon-lambda-http (1.7.4.final), io.quarkus:quarkus-amazon-lambda-http-deployment (1.7.4.final) +68 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (1.7.4.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.7.4.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 1.7.4.final -...

io.quarkus:quarkus-amazon-lambda-http (1.7.2.final), io.quarkus:quarkus-amazon-lambda-http-deployment (1.7.2.final) +69 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (1.7.2.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.7.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 1.7.2.final -...

io.quarkus:quarkus-amazon-lambda-http (2.10.4.final), io.quarkus:quarkus-amazon-lambda-http-deployment (2.10.4.final) +105 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (2.10.4.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.10.4.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 2.10.4.final -...