ApostropheCMS Sanitize-html: Unbounded Recursion When Re-sanitizing The Fallback Of A Discarded Iframe (stack Overflow,

Summary Since 2.18.0, when an "" is not allowed and "disallowedTagsMode" is "'discard'" the defaults, its raw-text content is re-sanitized by a recursive call to "sanitizeHtmltext, options" the change from 5564, fixing 5550. The recursion has no bound and starts each nested call with a fresh stat...

CVE-2026-89418

google-protobuf contains an unbounded recursion when parsing unknown protobuf group fields. An attacker can send a small crafted payload of deeply nested STARTGROUP wire bytes to any Node.js service that calls the generated deserializeBinary API, causing a RangeError: Maximum call stack size...

Axios form serializer maxDepth bypass via {} metatoken

Summary Axios versions in the fixed lines for GHSA-62hf-57xw-28j9 still contain an incomplete depth-limit bypass in lib/helpers/toFormData.js. When serializing an object with a top-level key ending in , axios calls JSON.stringify on that value before the formSerializer.maxDepth guard can inspect...

GHSA-PMV8-RQ9R-6J72 Axios: Deep formToJSON Key Recursion Can Cause Denial of Service

Summary Axios versions starting with 0.28.0 contain uncontrolled recursion in formDataToJSON, which is exposed as axios.formToJSON and used internally when axios serialises FormData with Content-Type: application/json. If an application passes attacker-controlled FormData field names to this...

PT-2026-32613

Summary @stablelib/cbor decodes nested CBOR structures recursively and does not enforce a maximum nesting depth. A sufficiently deep attacker-controlled CBOR payload can therefore crash decoding with RangeError: Maximum call stack size exceeded. Details The decoder processes arrays, maps, and...

CVE-2026-33532

Summary: CVE-2026-33532 affects the yaml JavaScript library. The vulnerability is in the compose/resolve phase of the parser, where a recursive call path without a depth bound can cause a RangeError: Maximum call stack size exceeded when parsing YAML input (typical payload ~2–10 KB). This can lea...

AZL-74985 CVE-2025-59466 affecting package nodejs for versions less than 20.14.0-13

We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when asynchooks.createHook is enabled. Instead of reaching process.on'uncaughtException', the process terminates, making the crash unrecoverable. Applications that rely on...

CVE-2025-59466

We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when asynchooks.createHook is enabled. Instead of reaching process.on'uncaughtException', the process terminates, making the crash unrecoverable. Applications that rely on...

CVE-2025-59466

We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when asynchooks.createHook is enabled. Instead of reaching process.on'uncaughtException', the process terminates, making the crash unrecoverable. Applications that rely on...

CVE-2025-59466: Uncaught Exception

We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when asynchooks.createHook is enabled. Instead of reaching process.on'uncaughtException', the process terminates, making the crash unrecoverable. Applications that rely on...

PT-2025-54720

Name of the Vulnerable Software and Affected Versions Nodemailer affected versions not specified Description A Denial of Service DoS can occur due to the use of an unsafe function in the email address parser located in lib/addressparser/index.js. The parser attempts to flatten nested group...