52 matches found
CVE-2026-21717
CVE-2026-21717 Node.js V8 字符串哈希可预测碰撞漏洞导致拒绝服务 概述 V8 字符串哈希机制中的一个严重漏洞允许攻击者对 Node.js 应用程序造成严重的性能下降。整数字符串会被哈希为其数值，使得哈希碰撞极易被预测。通过构造恶意输入，在 V8 内部字符串表中引发大量碰撞，攻击者可以显著降低性能或造成拒绝服务。 漏洞详情 CVE ID ：CVE-2026-21717 严重性 ：高 攻击向量 ：网络 攻击复杂度 ：低 影响 ：拒绝服务（DoS） 技术描述 该漏洞源于 V8 的字符串驻留（internalization）过程。当进行 JSON...
CVE-2026-101101
A vulnerability has been found in ag-ui-protocol ag-ui up to 2026-09-07. This issue affects the function JSON.parse of the file legacy/convert.ts of the component Middleware. The manipulation leads to uncaught exception. Remote exploitation of the attack is possible. Upgrading to version 2026-09-...
CVE-2026-101101
The ag-ui-protocol ag-ui software (versions up to 2026-09-07 ) contains a vulnerability in the Middleware component. Specifically, the JSON.parse function within the legacy/convert.ts file can be manipulated to trigger an uncaught exception . This issue is susceptible to remote exploitation . To ...
CVE-2026-101101 ag-ui-protocol ag-ui Middleware convert.ts JSON.parse uncaught exception
A vulnerability has been found in ag-ui-protocol ag-ui up to 2026-09-07. This issue affects the function JSON.parse of the file legacy/convert.ts of the component Middleware. The manipulation leads to uncaught exception. Remote exploitation of the attack is possible. Upgrading to version 2026-09-...
EUVD-2026-88393
A vulnerability has been found in ag-ui-protocol ag-ui up to 2026-09-07. This issue affects the function JSON.parse of the file legacy/convert.ts of the component Middleware. The manipulation leads to uncaught exception. Remote exploitation of the attack is possible. Upgrading to version 2026-09-...
CVE-2026-101101 ag-ui-protocol ag-ui Middleware convert.ts JSON.parse uncaught exception
A vulnerability has been found in ag-ui-protocol ag-ui up to 2026-09-07. This issue affects the function JSON.parse of the file legacy/convert.ts of the component Middleware. The manipulation leads to uncaught exception. Remote exploitation of the attack is possible. Upgrading to version 2026-09-...
CVE-2026-101101: Uncaught Exception
A vulnerability has been found in ag-ui-protocol ag-ui up to 2026-09-07. This issue affects the function JSON.parse of the file legacy/convert.ts of the component Middleware. The manipulation leads to uncaught exception. Remote exploitation of the attack is possible. Upgrading to version 2026-09-...
K000163374: Node.js vulnerability CVE-2026-21717
Security Advisory Description A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8's internal string table, an attacker can significantly...
CVE-2026-46625: Improperly Controlled Modification of Object Prototype Attributes
JavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-cookie's internal assign helper copies properties with for...in + plain assignment. When the source object is produced by JSON.parse, the JSON object's "proto" member is an own enumerable property,...
CVE-2026-42044: Improperly Controlled Modification of Dynamically-Determined Object Attributes
Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.2, he Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution in the application's dependency tree to be escalated into surgical, invisible...
AZL-81245 CVE-2026-21717 affecting package nodejs24 for versions less than 24.14.1-1
A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8's internal string table, an attacker can significantly degrade performance of the...
CVE-2026-21717
A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8's internal string table, an attacker can significantly degrade performance of the...
CVE-2026-21717: Use of Weak Hash
A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8's internal string table, an attacker can significantly degrade performance of the...
CVE-2026-25639: Improper Check for Unusual or Exceptional Conditions
Axios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing proto as an own property. An attacker can trigger this by providing a malicious...
@adebaraayomide/synchro_sdk (>=0.0.3, <=0.1.0-synchro-sdk), @akhmetovdev/avalanche (3.0.1) +169 more potentially affected by CVE-2024-57556 via store2 (>=2.3.0, <=2.14.3)
store2 NPM version =2.3.0, =0.0.3, =0.0.3, =1.0.0-alpha.3, =1.4.2, =1.0.0, =2.8.0, =3.0.6-statalanche, =0.1.0, =3.16.1, =1.0.0, =1.0.0, =3.0.5 and more Source cves: CVE-2024-57556 Source advisory: OSV:GHSA-W5HQ-HM5M-4548...
@audius/sdk (>=0.0.3-beta.1, <=3.0.8-beta.12), @audius/stems (>=1.5.2-beta.1, <=1.5.4) +14 more potentially affected by CVE-2024-30253 via @solana/web3.js (>=1.37.0, <=1.37.2)
@solana/web3.js NPM version =1.37.0, =0.0.3-beta.1, =1.5.2-beta.1, =0.0.3, =0.0.1, =0.2.0, =1.5.1, =0.3.3, =3.2.8, =3.3.0 - @winter-love/wallet 1.0.25-alpha.14 - kyzr-marketplace-sdk 0.0.1 and more Source cves: CVE-2024-30253 Source advisory: OSV:GHSA-8M45-2RJM-J347...
@vrite/sdk (0.0.4-beta) potentially affected by CVE-2023-5572 via @vrite/sdk (0.0.3-beta)
@vrite/sdk NPM version 0.0.3-beta is affected by a known vulnerability. The following packages have a transitive dependency on @vrite/sdk and may be impacted: - @vrite/sdk 0.0.4-beta Source cves: CVE-2023-5572 Source advisory: OSV:GHSA-W35P-WXWJ-RCM9...
GHSA-5C5F-7VFQ-3732 JMESPath for Ruby uses unsafe JSON.load when safe JSON.parse is preferable
jmespath.rb aka JMESPath for Ruby before 1.6.1 uses JSON.load in a situation where JSON.parse is preferable...
