MAL-2026-529 Malicious code in fileupload-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5cfeee070d9e37cd2dda0d7557f93098e1589be17d77ff38abf265f564574ca3 The package fileupload-core was found to contain malicious code. Source: ghsa-malware aa58dfc19074922a9db4713e1aa1c17edc8de5a937d01a5c08271d4940bcc38...

Malicious Package

Overview fileupload-core is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling when processing multipart headers. An attacker can exhaust system resources by sending malicious requests with excessively large individual multipart headers. Remediation Upgrade...

au.com.versent.jenkins.plugins:ignore-committer-strategy (>=55.v51410e712e0c <=57.v0756db_b_f6926), be.personify.iam:personify-frontend (>=1.5.4.RELEASE <=1.5.5.RELEASE) +1914 more potentially affected by CVE-2025-48976 via org.apache.commons:commons-fileupload2-core (>=2.0.0-M1 <=2.0.0-M3)

org.apache.commons:commons-fileupload2-core MAVEN version =2.0.0-M1, =55.v51410e712e0c, =1.5.4.RELEASE, =1.0.0, =0.0.15, =24.7.0, =24.7.0, =24.7.0, =24.7.0, =24.11.0, =24.7.0, =24.7.0, =24.7.0, =25.1.0, =3.0.1, =3.2.12 and more Source cves: CVE-2025-48976 Source advisory: OSV:GHSA-VV7R-C36W-3PRJ...

au.com.versent.jenkins.plugins:ignore-committer-strategy (>=55.v51410e712e0c <=57.v0756db_b_f6926), be.personify.iam:personify-frontend (>=1.5.4.RELEASE <=1.5.5.RELEASE) +1914 more potentially affected by CVE-2025-48976 via org.apache.commons:commons-fileupload2-core (>=2.0.0-M1 <=2.0.0-M3)

org.apache.commons:commons-fileupload2-core MAVEN version =2.0.0-M1, =55.v51410e712e0c, =1.5.4.RELEASE, =1.0.0, =0.0.15, =24.7.0, =24.7.0, =24.7.0, =24.7.0, =24.11.0, =24.7.0, =24.7.0, =24.7.0, =25.1.0, =3.0.1, =3.2.12 and more Source cves: CVE-2025-48976 Source advisory:...