CVE-2026-109563: Inefficient Regular Expression Complexity

N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically on long digit runs. Attackers can supply untrusted Turtle or N3 input containing long runs of digits that do not end a number, blocking the Node.js event...

CVE-2026-107391

music-metadata is a metadata parser for audio and video media files. In the public development revision introduced after 11.14.0, a development-branch regression in the MP4 stsd sample-description parser allows an attacker-controlled sample-entry size of zero to prevent the StsdAtom.get cursor fr...

CVE-2026-107391 music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on master

music-metadata is a metadata parser for audio and video media files. In the public development revision introduced after 11.14.0, a development-branch regression in the MP4 stsd sample-description parser allows an attacker-controlled sample-entry size of zero to prevent the StsdAtom.get cursor fr...

CVE-2026-107391

The music-metadata library (NPM) versions >=11.0.0 and

GHSA-GCX5-HXJ7-GPQQ msgpack5: Quadratic parsing in the streaming decoder

Impact The streaming decoder reparses an incomplete container from the beginning whenever another chunk arrives. A remote peer can split one valid MessagePack value across many small chunks, causing quadratic CPU usage and blocking the event loop. Patches The decoder now preserves incremental...

AZL-106842 CVE-2026-107297 affecting package msgpack 3.3.0-1

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder reparses an incomplete array or map from the beginning whenever another chunk arrives. A remote peer can split one valid MessagePack container across many small chunks, causing completed...

CVE-2026-107297

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder reparses an incomplete array or map from the beginning whenever another chunk arrives. A remote peer can split one valid MessagePack container across many small chunks, causing completed...

CVE-2026-107290

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.6 and 2.44.0, the local webfetchtool and the WebFetch local fallback process server-controlled responses with quadratic title extraction, whitespace normalization, and...

CVE-2026-107297 msgpack5: Quadratic parsing in the streaming decoder

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder reparses an incomplete array or map from the beginning whenever another chunk arrives. A remote peer can split one valid MessagePack container across many small chunks, causing completed...

CVE-2026-107297

The msgpack5 library (a msgpack v5 implementation for Node.js and the browser) is vulnerable to a quadratic CPU use issue in versions prior to 6.1.0 . The streaming decoder reparses incomplete arrays or maps from the beginning every time a new chunk arrives. A remote peer can exploit this by spli...

CVE-2026-107297 msgpack5: Quadratic parsing in the streaming decoder

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder reparses an incomplete array or map from the beginning whenever another chunk arrives. A remote peer can split one valid MessagePack container across many small chunks, causing completed...

EUVD-2026-95108

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder reparses an incomplete array or map from the beginning whenever another chunk arrives. A remote peer can split one valid MessagePack container across many small chunks, causing completed...

CVE-2026-107297

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder reparses an incomplete array or map from the beginning whenever another chunk arrives. A remote peer can split one valid MessagePack container across many small chunks, causing completed...

CVE-2026-107297 msgpack5: Quadratic parsing in the streaming decoder

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder reparses an incomplete array or map from the beginning whenever another chunk arrives. A remote peer can split one valid MessagePack container across many small chunks, causing completed...

GHSA-FPF4-VWCP-V4HP Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`

Summary The local web-fetch tool webfetchtool, also used as the WebFetch capability's local fallback processed responses with several steps whose running time grows quadratically with the size of certain server-controlled inputs, and ran them on the event loop: decoding the body with whichever...

Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`

Summary The local web-fetch tool webfetchtool, also used as the WebFetch capability's local fallback processed responses with several steps whose running time grows quadratically with the size of certain server-controlled inputs, and ran them on the event loop: decoding the body with whichever...

Regular Expression Denial of Service (ReDoS)

Overview pydantic-ai is an AI Agent Framework, the Pydantic way Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the webfetch tool in pydanticai/commontools/webfetch.py, where response body decoding is performed synchronously on the event loop usi...

CVE-2026-107290

The Pydantic AI Python agent framework is vulnerable to a denial-of-service condition in the local web_fetch_tool and the WebFetch local fallback process. Specifically, versions 1.77.0 to 1.107.6 and 2.44.0 exhibit quadratic title extraction , whitespace normalization, and ordered-list numbering ...

CVE-2026-107290 Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.6 and 2.44.0, the local webfetchtool and the WebFetch local fallback process server-controlled responses with quadratic title extraction, whitespace normalization, and...

CVE-2026-107290

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.6 and 2.44.0, the local webfetchtool and the WebFetch local fallback process server-controlled responses with quadratic title extraction, whitespace normalization, and...