PT-2026-105422

TuxCare rebuilt js-yaml to address 1 CVE. Fixed in 3.14.2-tuxcare.2...

PT-2026-105423

TuxCare rebuilt js-yaml to address 1 CVE. Fixed in 3.7.0-tuxcare.3...

PT-2026-105247

Security vulnerability affects the qdrant package. js-yaml is a JavaScript YAML parser and dumper...

CVE-2026-93690

A flaw was found in uri-js. A remote attacker can exploit a vulnerability in the removeDotSegments function by providing a specially crafted path segment that begins with Unicode line or paragraph separators. This can cause an infinite loop, leading to the Node.js event loop blocking indefinitely...

Nuclei: Arbitrary Code Execution via Goja JavaScript Engine Vulnerability

A vulnerability in the Goja JavaScript engine used by Nuclei's javascript: protocol allows arbitrary native code execution on the scanner host when running untrusted JavaScript templates. Affected Component The issue is in the Goja JavaScript runtime embedded in Nuclei's JavaScript protocol...

GHSA-8GR3-5J6F-25GP Novu: Stored XSS in In-App Inbox via notification redirect.url javascript: scheme

Summary The @novu/js In-App Inbox renderer passes a notification's redirect.url to window.open with no URL-scheme validation. The value originates from a notification's call-to-action and is delivered to the recipient verbatim. An authenticated organization member or any holder of the environment...

@novu/nextjs (>=3.0.0-canary.0, <=3.17.1-rc.1-rc.da35e9062d), @novu/react (>=3.0.0-canary.0, <=3.17.1-rc.1-rc.da35e9062d) +1 more potentially affected by CVE-2026-75510 via @novu/js (>=3.0.0, <=3.17.1-rc.1-rc.da35e9062d)

@novu/js NPM version =3.0.0, =3.0.0-canary.0, =3.0.0-canary.0, =2.6.8, =3.17.1-rc.1-rc.da35e9062d Source cves: CVE-2026-75510 Source advisory: OSV:GHSA-8GR3-5J6F-25GP...

CVE-2026-63386

js-toml is a TOML parser for JavaScript. Prior to 1.1.3, load does not bound nesting or dotted-key depth in the recursive parser at src/load/parser.ts or the interpreter at src/load/interpreter.ts, so deeply nested arrays, deeply nested inline tables, or long dotted keys can exhaust the V8 call...

CVE-2026-63386 js-toml: Uncontrolled recursion in `load()` causes `RangeError` (stack exhaustion) on deeply nested input

js-toml is a TOML parser for JavaScript. Prior to 1.1.3, load does not bound nesting or dotted-key depth in the recursive parser at src/load/parser.ts or the interpreter at src/load/interpreter.ts, so deeply nested arrays, deeply nested inline tables, or long dotted keys can exhaust the V8 call...

EUVD-2026-84801

js-toml is a TOML parser for JavaScript. Prior to 1.1.3, load does not bound nesting or dotted-key depth in the recursive parser at src/load/parser.ts or the interpreter at src/load/interpreter.ts, so deeply nested arrays, deeply nested inline tables, or long dotted keys can exhaust the V8 call...

CVE-2026-63386 js-toml: Uncontrolled recursion in `load()` causes `RangeError` (stack exhaustion) on deeply nested input

js-toml is a TOML parser for JavaScript. Prior to 1.1.3, load does not bound nesting or dotted-key depth in the recursive parser at src/load/parser.ts or the interpreter at src/load/interpreter.ts, so deeply nested arrays, deeply nested inline tables, or long dotted keys can exhaust the V8 call...

CVE-2026-63386

The js-toml JavaScript TOML parser is vulnerable to a denial of service (DoS) due to uncontrolled recursion in the load() function. In versions prior to 1.1.3 , the recursive parser at src/load/parser.ts and the interpreter at src/load/interpreter.ts fail to bound the nesting depth of arrays, inl...

CVE-2026-63386 js-toml: Uncontrolled recursion in `load()` causes `RangeError` (stack exhaustion) on deeply nested input

js-toml is a TOML parser for JavaScript. Prior to 1.1.3, load does not bound nesting or dotted-key depth in the recursive parser at src/load/parser.ts or the interpreter at src/load/interpreter.ts, so deeply nested arrays, deeply nested inline tables, or long dotted keys can exhaust the V8 call...

CVE-2026-93749

A flaw was found in source-map-js. This vulnerability allows a remote attacker to trigger a denial of service by providing malformed input. Specifically, by supplying extremely large offset line values in indexed source maps, the attacker can cause the service's event loop to block, making it...

CVE-2026-93751

A flaw was found in uri-js. This improper UTF-8 Unicode Transformation Format - 8-bit decoding vulnerability in the pctDecChars function allows a remote attacker to craft specially encoded payloads. These payloads can bypass platform decoder validation, leading to the injection of path traversal ...

CVE-2026-75510

Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu's @novu/js In-App Inbox and the @novu/react Inbox component accept a notification call-to-action redirect.url from the v1 cta.data object and pass it through...

CVE-2026-75510 Novu: Stored XSS in In-App Inbox via notification redirect.url javascript: scheme

Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu's @novu/js In-App Inbox and the @novu/react Inbox component accept a notification call-to-action redirect.url from the v1 cta.data object and pass it through...

ROOT-APP-NPM-CVE-2024-47831 CVE-2024-47831 in next - Patched by Root

Root has patched CVE-2024-47831 in the next package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-AIKIDO-2026-10754 AIKIDO-2026-10754 in next - Patched by Root

Root has patched AIKIDO-2026-10754 in the next package for Root:npm. Multiple fixed versions available...

PT-2026-96973

Name of the Vulnerable Software and Affected Versions js-toml versions prior to 1.1.3 Description The load function fails to limit nesting or dotted-key depth within the recursive parser at src/load/parser.ts and the interpreter at src/load/interpreter.ts. Consequently, processing deeply nested...