Malicious code in ultimate-websocket (npm)

Source: amazon-inspector 7574e423b830695141ee6e089006e0c355109e240c69881512806869cfee8114 package.json declares its only dependency node-net-pool as a bare tarball URL pointing at the mutable main branch of an unrelated GitHub user...

Debian dla-4820 : libjs-lodash - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4820 advisory. - ----------------------------------------------------------------------- Debian LTS Advisory DLA-4820-1 [email protected]...

Malicious code in ultimate-websocket (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7574e423b830695141ee6e089006e0c355109e240c69881512806869cfee8114 package.json declares its only dependency node-net-pool as a bare tarball URL pointing at the mutable main branch of an unrelated GitHub user...

MAL-2026-17529 Malicious code in ultimate-websocket (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7574e423b830695141ee6e089006e0c355109e240c69881512806869cfee8114 package.json declares its only dependency node-net-pool as a bare tarball URL pointing at the mutable main branch of an unrelated GitHub user...

CLSA-2026-1791028051 TuxCare security update for node-forge (3 CVEs)

TuxCare rebuilt node-forge to address 3 CVEs. Fixed in 1.3.1-tuxcare.1...

[SECURITY] Fedora 45 Update: perl-RDF-Trine-Node-Literal-XML-0.16-23.fc45

This Perl module encapsulates XML literals into RDF objects...

PT-2026-111747

TuxCare rebuilt node-forge to address 3 CVEs. Fixed in 1.3.1-tuxcare.1...

@nx/express (>=23.0.0, <=23.1.0), @nx/nest (>=23.0.0, <=23.1.0) +1 more potentially affected by CVE-2026-104859 via @nx/docker (>=23.0.0, <=23.1.0)

@nx/docker NPM version =23.0.0, =23.0.0, =23.0.0, =23.0.0, =23.1.0 Source cves: CVE-2026-104859 Source advisory: SNYK:JS-NXDOCKER-20417215...

CVE-2026-104871

The Angular SSR is a server-rise rendering tool for Angular applications. Prior to versions 20.3.36, 21.2.23, and 22.1.7, the CommonEngine retrieveSSGPage prerendered-page retrieval logic in @angular/ssr/node, and in @angular/ssr for versions 17 through 18, accepts a relative request URL containi...

@nx/express (>=23.0.0, <=23.1.0), @nx/nest (>=23.0.0, <=23.1.0) +1 more potentially affected by CVE-2026-104859 via @nx/docker (>=23.0.0, <=23.1.0)

@nx/docker NPM version =23.0.0, =23.0.0, =23.0.0, =23.0.0, =23.1.0 Source cves: CVE-2026-104859 Source advisory: MEND:CVE-2026-104859...

Infinite loop

Overview Affected versions of this package are vulnerable to Infinite loop due to improper handling of JSON member names in the TJSONProtocol process. An attacker can cause the Node server's event loop to become unresponsive by sending specially crafted JSON input with a member name that triggers...

Infinite loop

Overview thrift is a lightweight, language-independent software stack with an associated code generation mechanism for point-to-point RPC. Affected versions of this package are vulnerable to Infinite loop due to improper handling of JSON member names in the TJSONProtocol process. An attacker can...

Infinite loop

Overview org.webjars.npm:thrift is a lightweight, language-independent software stack with an associated code generation mechanism for point-to-point RPC. Affected versions of this package are vulnerable to Infinite loop due to improper handling of JSON member names in the TJSONProtocol process. ...

CVE-2026-104428

The getblock RPC method in zebra-rpc before 11.0.0, used by the Zcash Foundation's Zebra node, panics on verbosity 2 for a side-chain block because the block's -1 confirmations sentinel is converted to u32 with .expect, aborting the process. Remote unauthenticated attackers, directly or through...

CVE-2026-104427

Zebra before 6.1.0 contains an incomplete cleanup vulnerability in the state write task that allows remote unauthenticated peers to stall node synchronization by poisoning parenterrormap. Attackers can deliver a coinbase-malleated block sharing a canonical block's hash before it propagates, causi...

CVE-2026-104426

Zebra before 6.1.0 contains an inefficient algorithmic complexity vulnerability in remainingtransactionvalue that clones the entire block-level spent-UTXO map per transaction during contextual verification. Attackers can mine or seed the mempool with roughly 26,000 minimal single-input transactio...

CVE-2026-104428

The getblock RPC method in zebra-rpc before 11.0.0, used by the Zcash Foundation's Zebra node, panics on verbosity 2 for a side-chain block because the block's -1 confirmations sentinel is converted to u32 with .expect, aborting the process. Remote unauthenticated attackers, directly or through...

CVE-2026-104427

Zebra before 6.1.0 contains an incomplete cleanup vulnerability in the state write task that allows remote unauthenticated peers to stall node synchronization by poisoning parenterrormap. Attackers can deliver a coinbase-malleated block sharing a canonical block's hash before it propagates, causi...

CVE-2026-104427 Zebra before 6.1.0 Chain Stall via Stale parent_error_map Entry

Zebra before 6.1.0 contains an incomplete cleanup vulnerability in the state write task that allows remote unauthenticated peers to stall node synchronization by poisoning parenterrormap. Attackers can deliver a coinbase-malleated block sharing a canonical block's hash before it propagates, causi...

CVE-2026-104427 Zebra before 6.1.0 Chain Stall via Stale parent_error_map Entry

Zebra before 6.1.0 contains an incomplete cleanup vulnerability in the state write task that allows remote unauthenticated peers to stall node synchronization by poisoning parenterrormap. Attackers can deliver a coinbase-malleated block sharing a canonical block's hash before it propagates, causi...