Exploit for Improper Handling of Exceptional Conditions in Google Chrome

CVE-2021-38003 PoC - Commit: v8 a4252db32 vulnerabili...

V8 9.7 JSON.stringify TheHole Disclosure

V8 version 9.7 contains a JSON.stringify exception-handling flaw that exposes the internal TheHole value to JavaScript. The proof of concept triggers the leak and includes a partial Map corruption amplification demonstration. https://packetstorm.news/download/235616...

Cross-site Scripting (XSS)

Overview ghost is a publishing platform Affected versions of this package are vulnerable to Cross-site Scripting XSS via the JSON-LD schema output in ghosthead.js, where user-controlled field values such as site title, author website, and social URLs are serialised with JSON.stringify and injecte...

Nest: Remote process termination via a deeply nested microservice message pattern

| Field | Value | | --- | --- | | Ecosystem | npm | | Package | @nestjs/microservices | | Affected versions | = 12.0.0, 12.0.2 and 11.2.4 | | Patched versions | 12.0.2 and 11.2.4 upgrade to 12.0.3 / 11.2.5 | Summary A single message whose pattern is a deeply nested object terminates a NestJS...

Uncaught Exception

Overview @nestjs/microservices is a Nest - modern, fast, powerful node.js web framework @microservices Affected versions of this package are vulnerable to Uncaught Exception via unguarded JSON.stringify calls on client-controlled message patterns in the TCP and RMQ server handlers...

CVE-2026-102281

Nest is a framework for building scalable Node.js server-side applications. Prior to 11.2.4 and 12.0.2, a single message with a deeply nested object in its pattern can terminate a NestJS microservice using the TCP or RabbitMQ transport. ServerTCPhandleMessage and ServerRMQhandleMessage pass a...

CVE-2026-102281

The NestJS framework (prior to versions 11.2.4 and 12.0.2 ) is vulnerable to a remote process termination when using the TCP or RabbitMQ transports. The root cause is that the ServerTCP#handleMessage and ServerRMQ#handleMessage functions pass a client-controlled non-string pattern to JSON.stringi...

CVE-2026-102281

Nest is a framework for building scalable Node.js server-side applications. Prior to 11.2.4 and 12.0.2, a single message with a deeply nested object in its pattern can terminate a NestJS microservice using the TCP or RabbitMQ transport. ServerTCPhandleMessage and ServerRMQhandleMessage pass a...

CVE-2026-102281 Nest: Remote process termination via a deeply nested microservice message pattern

Nest is a framework for building scalable Node.js server-side applications. Prior to 11.2.4 and 12.0.2, a single message with a deeply nested object in its pattern can terminate a NestJS microservice using the TCP or RabbitMQ transport. ServerTCPhandleMessage and ServerRMQhandleMessage pass a...

CVE-2026-102281 Nest: Remote process termination via a deeply nested microservice message pattern

Nest is a framework for building scalable Node.js server-side applications. Prior to 11.2.4 and 12.0.2, a single message with a deeply nested object in its pattern can terminate a NestJS microservice using the TCP or RabbitMQ transport. ServerTCPhandleMessage and ServerRMQhandleMessage pass a...

PT-2026-102385

Name of the Vulnerable Software and Affected Versions Nest versions prior to 11.2.4 Nest versions prior to 12.0.2 Description A microservice using TCP or RabbitMQ transport can be terminated by a single message containing a deeply nested object in its pattern. The functions ServerTCPhandleMessage...

n8n Node.js Package < 1.123.76 / 2.0.x < 2.37.7 / 2.38.x < 2.38.2 Multiple Vulnerabilities

The version of the n8n Node.js Package installed on the remote host is less than 1.123.76, or is 2.0.x prior to 2.37.7, or is 2.38.x prior to 2.38.2. It is, therefore, affected by multiple vulnerabilities: - n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2...

EUVD-2026-74273

n8n: Expression Sandbox Escape via Shared Builtin Tampering and Code-Printer Injection Leads to Code Execution...

GHSA-6XCW-7XM6-48C6 n8n: Expression Sandbox Escape via Shared Builtin Tampering and Code-Printer Injection Leads to Code Execution

Impact Two stages of expression code generation built source text by calling the global JSON.stringify at generation time: the compiler when printing synthetic string literals, and the isolate bridge when interpolating a timezone value into its per-evaluation wrapper. An expression that replaced...

n8n: Expression Sandbox Escape via Shared Builtin Tampering and Code-Printer Injection Leads to Code Execution

Impact Two stages of expression code generation built source text by calling the global JSON.stringify at generation time: the compiler when printing synthetic string literals, and the isolate bridge when interpolating a timezone value into its per-evaluation wrapper. An expression that replaced...

CVE-2026-86083

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the legacy expression engine generated source text by calling the mutable global JSON.stringify while printing synthetic string literals and interpolating timezone data. An expression could replace...

CVE-2026-86083 n8n: Expression Sandbox Escape via Shared Builtin Tampering and Code-Printer Injection Leads to Code Execution

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the legacy expression engine generated source text by calling the mutable global JSON.stringify while printing synthetic string literals and interpolating timezone data. An expression could replace...

CVE-2026-86083 n8n: Expression Sandbox Escape via Shared Builtin Tampering and Code-Printer Injection Leads to Code Execution

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the legacy expression engine generated source text by calling the mutable global JSON.stringify while printing synthetic string literals and interpolating timezone data. An expression could replace...

CVE-2026-86083 n8n: Expression Sandbox Escape via Shared Builtin Tampering and Code-Printer Injection Leads to Code Execution

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the legacy expression engine generated source text by calling the mutable global JSON.stringify while printing synthetic string literals and interpolating timezone data. An expression could replace...

PT-2026-88499

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.76 n8n versions prior to 2.37.7 n8n versions prior to 2.38.2 Description The legacy expression engine generates source text by calling the mutable global JSON.stringify when printing synthetic string literals and...