google_gax

googlegax patched Patched fork of googlegax v0.4.1 for compatibility with Tesla = 1.18.3. Why this fork exists Tesla 1.18.3 June 2, 2026 introduced strict validation of multipart field names via assertquotedstringsafe!/2 as part of security fixes for CVE-2026-48598. The upstream googlegax last...

Exploit for CVE-2026-109618

RCE Chain — Verified End-to-End PHP 8.4.4, stock php:8.4.4-cl...

GHSA-WC9G-MQFW-JRWM multer vulnerable to Denial of Service via crafted multipart field names

Impact A vulnerability in multer allows a remote, unauthenticated attacker to crash the Node.js process with a single multipart/form-data request. Two specially crafted text field names cause an uncaught RangeError: Invalid array length inside multer's field parsing, which is not routed to the...

NPM: multer vulnerable to Denial of Service via crafted multipart field names

NPM: multer vulnerable to Denial of Service via crafted multipart field names vulnerability discovered by ? in WordPress Npm multer versions 2.3.0...

multer vulnerable to Denial of Service via crafted multipart field names

Impact A vulnerability in multer allows a remote, unauthenticated attacker to crash the Node.js process with a single multipart/form-data request. Two specially crafted text field names cause an uncaught RangeError: Invalid array length inside multer's field parsing, which is not routed to the...

GHSA-535W-7CP7-47Q4 multer vulnerable to Denial of Service via oversized array index in field names

Impact multer is vulnerable to a Denial of Service DoS via a crafted array index in multipart field names. The append-field dependency parses bracket notation in field names, and a large numeric index such as items4294967294 forces allocation of a maximum-length sparse array. A following field wi...

CVE-2026-77078 multer vulnerable to Denial of Service via crafted multipart field names

multer is a middleware for handling multipart/form-data in Node.js. A small multipart request containing two specially crafted text field names can cause an uncaught RangeError Invalid array length that terminates the Node.js process. The first field uses a very large numeric array index to...

CVE-2026-77078

multer , a popular Node.js middleware for handling multipart/form-data, is vulnerable to a remote denial-of-service in all versions before 2.3.0 . A small multipart request containing two specially crafted text field names triggers an uncaught RangeError (Invalid array length) : the first field a...

CVE-2026-77078 multer vulnerable to Denial of Service via crafted multipart field names

multer is a middleware for handling multipart/form-data in Node.js. A small multipart request containing two specially crafted text field names can cause an uncaught RangeError Invalid array length that terminates the Node.js process. The first field uses a very large numeric array index to...

CVE-2026-48795

AdonisJS is a TypeScript-first web framework. From 10.1.3 until 10.1.5 and 11.0.3, AdonisJS @adonisjs/bodyparser incompletely fixed CVE-2026-25754 because nested multipart field payloads such as user.proto.polluted and constructor.prototype still caused lodash .set via @poppinss/utils to create...

CVE-2026-12143 form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)

form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the field argument to FormDataappend and the filename option are concatenated verbatim into the Content-Disposition header without escaping carriage return CR, line feed LF, or double-quote "...

CVE-2026-34517

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, for some multipart form fields, aiohttp read the entire field into memory before checking clientmaxsize. This issue has been patched in version 3.13.4...

CVE-2026-34517

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, for some multipart form fields, aiohttp read the entire field into memory before checking clientmaxsize. This issue has been patched in version 3.13.4...