Uncaught Exception

Overview astro is an Astro is a modern site builder with web best practices, performance, and DX front-of-mind. Affected versions of this package are vulnerable to Uncaught Exception via createRequest and createRequestFromNodeRequest in node.ts when processing a request with a malformed port valu...

GHSA-QH8J-HQJV-7M4X Astro: Malformed port in the Host header can crash the Node adapter

Summary In the Astro Node adapter, a request whose Host header contains a malformed port for example example.com:65536 or example.com:8080:8080 produced an invalid request URL. The fallback intended to recover from an unparseable URL reused the same malformed host, so it failed again and raised a...

CVE-2026-103592

simple-php-router through 5.4.1.7 contains an IP restriction bypass vulnerability in the IpRestrictAccess middleware that allows remote unauthenticated attackers to bypass IP whitelist and blacklist protections. Attackers can spoof X-Forwarded-For, CF-Connecting-IP, or Client-IP headers to...

CLEANSTART-2026-MR47153 Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU

CVE-2026-42504 affects multiple packages. Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU. See references for individual vulnerability details...

AZL-105351 CVE-2026-103387 affecting package js-jquery 3.5.0-4

A weakness has been identified in garycourt uri-js up to 4.4.1. This affects the function URI.parse of the file src/schemes/mailto.ts of the component Mailto Header Handler. This manipulation of the argument to causes uncaught exception. The attack may be initiated remotely. The exploit has been...

CVE-2026-103387

A weakness has been identified in garycourt uri-js up to 4.4.1. This affects the function URI.parse of the file src/schemes/mailto.ts of the component Mailto Header Handler. This manipulation of the argument to causes uncaught exception. The attack may be initiated remotely. The exploit has been...

DEBIAN-CVE-2026-103387

A weakness has been identified in garycourt uri-js up to 4.4.1. This affects the function URI.parse of the file src/schemes/mailto.ts of the component Mailto Header Handler. This manipulation of the argument to causes uncaught exception. The attack may be initiated remotely. The exploit has been...

UBUNTU-CVE-2026-103387

A weakness has been identified in garycourt uri-js up to 4.4.1. This affects the function URI.parse of the file src/schemes/mailto.ts of the component Mailto Header Handler. This manipulation of the argument to causes uncaught exception. The attack may be initiated remotely. The exploit has been...

CVE-2026-103387

A weakness has been identified in garycourt uri-js up to 4.4.1. This affects the function URI.parse of the file src/schemes/mailto.ts of the component Mailto Header Handler. This manipulation of the argument to causes uncaught exception. The attack may be initiated remotely. The exploit has been...

CVE-2026-102140 Kiteworks Core Insufficient Verification of Data Authenticity

An authenticated administrator could initiate an administrative import using a file whose contents were not fully verified, because the import validated only the file's header rather than the complete file. This could allow unverified or forged content to be accepted and processed, affecting the...

CVE-2026-103387 garycourt uri-js Mailto Header mailto.ts URI.parse uncaught exception

A weakness has been identified in garycourt uri-js up to 4.4.1. This affects the function URI.parse of the file src/schemes/mailto.ts of the component Mailto Header Handler. This manipulation of the argument to causes uncaught exception. The attack may be initiated remotely. The exploit has been...

CVE-2026-103387

A weakness has been identified in garycourt uri-js up to 4.4.1. This affects the function URI.parse of the file src/schemes/mailto.ts of the component Mailto Header Handler. This manipulation of the argument to causes uncaught exception. The attack may be initiated remotely. The exploit has been...

EUVD-2026-90361

A weakness has been identified in garycourt uri-js up to 4.4.1. This affects the function URI.parse of the file src/schemes/mailto.ts of the component Mailto Header Handler. This manipulation of the argument to causes uncaught exception. The attack may be initiated remotely. The exploit has been...

CVE-2026-103387

A weakness exists in garycourt uri-js versions up to 4.4.1 . The vulnerability is located in the Mailto Header Handler component, specifically within the URI.parse function of the src/schemes/mailto.ts file. An attacker can remotely initiate an attack by manipulating the function argument to trig...

CVE-2026-103387 garycourt uri-js Mailto Header mailto.ts URI.parse uncaught exception

A weakness has been identified in garycourt uri-js up to 4.4.1. This affects the function URI.parse of the file src/schemes/mailto.ts of the component Mailto Header Handler. This manipulation of the argument to causes uncaught exception. The attack may be initiated remotely. The exploit has been...

CVE-2026-103387 garycourt uri-js Mailto Header mailto.ts URI.parse uncaught exception

A weakness has been identified in garycourt uri-js up to 4.4.1. This affects the function URI.parse of the file src/schemes/mailto.ts of the component Mailto Header Handler. This manipulation of the argument to causes uncaught exception. The attack may be initiated remotely. The exploit has been...

CVE-2026-103471

The restbed library, versions through 5.0.0 , is vulnerable to a Denial of Service (DoS) condition due to unbounded header buffering . The software fails to enforce a maximum size limit on HTTP request headers, enabling remote unauthenticated attackers to open TCP connections and stream bytes ind...

CVE-2026-103471 restbed through 5.0.0 Denial of Service via Unbounded Header Buffering

restbed through 5.0.0 buffers HTTP request headers without enforcing a maximum size limit, allowing remote unauthenticated attackers to exhaust server memory. Attackers can open TCP connections and stream bytes indefinitely without sending the header delimiter, forcing the server to allocate...

CVE-2026-100263

In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible...

NPM: Axios: Header Injection via Inherited headers After Minimal Interceptor

NPM: Axios: Header Injection via Inherited headers After Minimal Interceptor vulnerability discovered by ? in WordPress Npm axios versions = 1.0.0, 1.20.0...