Denial-Of-Service (DoS)

io.netty, netty-codec-http3 is vulnerable to a denial-of-service DoS. The vulnerability is due to unbounded processing of continuation bytes, which allows a remote, unauthenticated attacker to exhaust heap memory and consume excessive CPU resources by sending malformed QPACK data, potentially...

Inefficient Algorithmic Complexity

Overview nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in the isPartialResponse function and the onData method of SMTPConnection in src/smtp-connection/index.ts, where each...

Inefficient Algorithmic Complexity

Overview org.webjars.npm:nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in the isPartialResponse function and the onData method of SMTPConnection in src/smtp-connection/index.ts,...

CVE-2026-104845: Allocation of Resources Without Limits or Throttling

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.3, deserializeTypedArray in fromJSON and fromCrossJSON trusts a deserialized source value as an ArrayBuffer and does not bound the serialized element count. An attacker can...

curl: Unbounded GZIP Decompression Leading to Event-Loop Starvation

When libcurl is configured to decompress HTTP responses via CURLOPTACCEPTENCODING or the --compressed CLI flag, it lacks decompression bounds checking or a mechanism to yield execution during massive expansion tasks. If an attacker provides a highly compressed payload zip bomb, libcurl's underlyi...