EUVD-2026-88382

Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection...

Improper Isolation or Compartmentalization

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Improper Isolation or Compartmentalization in lib/helpers/shouldBypassProxy.js, which matches NOPROXY entries by exact host or IP and has no parsing for CIDR notation, so...

Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)

Summary Axios for Node.js parses data: URLs in lib/helpers/fromDataURI.js. The current RFC-2397 parser uses a regular expression whose media type groups allow / inside both sides of the type/subtype match. A malformed data: URL containing many slashes and no comma forces the JavaScript regex engi...

Malicious code in chaienv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cbb73465123d4e732dae815badc8950b40e9447463c1fca697551ab3aa00e020 [email protected] is published as a small Chai environment helper, but its index.js unconditionally loads lib/config.js at require time via const config ...

Malicious code in test-supply-npm-lib-4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44f10381ad047460986bbeedafad42f8c71db61fff98fe07c915cd0d3678d268 package.json declares a dependency sourced from a git URL git+https://[email protected]/agustedone/test-supply-npm-git-prepare-proof-4.git pinned to...

MAL-2026-17308 Malicious code in mfahelper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6df54a49845aa55e3310261ccc7002fe5aabcdf3924875bf7c1ad3fb4751297 package.json declares its only runtime dependency, node-net-pool, as an https tarball pointing at the main branch of an unrelated GitHub account...

CentOS Linux 7 [TuxCare] Security Update: python / python-debug / python-devel / python-libs / python-test / etc (CENTOS7:CLSA-2023:1697464069)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2023:1697464069 advisory. - An issue was discovered in comparedigest in Lib/hmac.py in Python through 3.9.1. Constant-time-defeating optimisations were possible in the...

CentOS Linux 7 [TuxCare] Security Update: python3 / python3-debug / python3-devel / python3-idle / etc Multiple Vulnerabilities (CENTOS7:CLSA-2023:1697739575)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2023:1697739575 advisory. - Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple / at the...

Linux Distros Unpatched Vulnerability : CVE-2026-101905

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.2 until 1.20.0, the Node HTTP adapter in lib/adapters/http.js supplies request optio...

Linux Distros Unpatched Vulnerability : CVE-2026-102414

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback lib/sync.js. A password longer than t...

AlmaLinux 9.2 [TuxCare] Security Update: maven / maven-javadoc / maven-lib / maven-openjdk11 / etc (ALMALINUX9.2:CLSA-2026:1786433114)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1786433114 advisory. - Apache Maven will follow repositories that are defined in a dependency's Project Object Model pom which may be surprising to some users,...

SUSE CVE-2026-101905

Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.2 until 1.20.0, the Node HTTP adapter in lib/adapters/http.js supplies request options without an own createConnection value. A separate same-process prototype-pollution flaw places a function on...

MAL-2026-17284 Malicious code in sk-lib-enc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50da04ce2032df71a298f83648d49995542c28b18052f48cf38c721fc6d80f8f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in sk-lib-enc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50da04ce2032df71a298f83648d49995542c28b18052f48cf38c721fc6d80f8f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the pbkdf2 function in lib/sync.js, which passes the raw password to createHmac on every PBKDF2 iteration. Because HMAC rehashes any key longer than the digest's block size per RF...

CVE-2026-102414

pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback lib/sync.js. A password longer than the block size 64 bytes, or 128 bytes for sha384 and sha512 is passed to HMAC as the key on every iteration, and HMAC hashes such keys in...

DEBIAN-CVE-2026-102414

pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback lib/sync.js. A password longer than the block size 64 bytes, or 128 bytes for sha384 and sha512 is passed to HMAC as the key on every iteration, and HMAC hashes such keys in...

UBUNTU-CVE-2026-102414

pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback lib/sync.js. A password longer than the block size 64 bytes, or 128 bytes for sha384 and sha512 is passed to HMAC as the key on every iteration, and HMAC hashes such keys in...

CVE-2026-102414 pbkdf2 rehashes long passwords on every iteration, enabling denial of service

pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback lib/sync.js. A password longer than the block size 64 bytes, or 128 bytes for sha384 and sha512 is passed to HMAC as the key on every iteration, and HMAC hashes such keys in...

CVE-2026-102414

The pbkdf2 library (versions through 3.1.6 ) contains a vulnerability where passwords exceeding the digest's block size (64 bytes, or 128 bytes for sha384/sha512) are re-hashed on every iteration within the JavaScript fallback (lib/sync.js ). This results in a computational cost of O(iterations ×...