42 matches found
CVE-2026-47219 find-my-way is Vulnerable to DDoS with HTTP2
find-my-way is a framework-independent HTTP router that internally uses a Radix Tree and supports route parameters and wildcards. Versions prior to 9.7.0 are vulnerable to remotely triggerable DoS in find-my-way when it is used with Node's HTTP/2 server. The lookup function passes req.method into...
find-my-way: DDoS with HTTP2
Impact Remotely triggerable DoS in find-my-way when it is used with Node's HTTP/2 server. The short version is that lookup passes req.method into find, and find indexes this.treesmethod. Since this.trees is a normal object, HTTP/2 method values like constructor, toString, or proto can resolve...
PT-2026-64211
Name of the Vulnerable Software and Affected Versions find-my-way versions prior to 9.7.0 Description A remotely triggerable Denial of Service DoS exists when the software is used with Node's HTTP/2 server. The lookup function passes the req.method variable into the find function, which then...
Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning
Summary Axios’ Node.js HTTP adapter can route requests through an attacker-controlled proxy when Object.prototype.proxy is polluted and request configuration is materialized as a regular object before dispatch. Recent axios releases harden merged request config by creating a null-prototype object...
Prototype Pollution
Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Prototype Pollution in the Node HTTP adapter lib/adapters/http.js, which reads config.proxy through the prototype chain after a request interceptor returns a plain-object...
GHSA-MWF2-3PR3-8698 Axios: HTTP/2 streamed uploads bypass `maxBodyLength`
Summary Axios versions with Node.js HTTP/2 support allow streamed request bodies to bypass maxBodyLength enforcement when requests are sent with httpVersion: 2. This affects applications that rely on maxBodyLength as a hard cap while forwarding attacker-controlled streams, such as upload endpoint...
PT-2026-67300
Name of the Vulnerable Software and Affected Versions axios versions 0.31.1 through 0.32.x axios versions 1.15.2 through 1.17.x Description In Node.js deployments using the HTTP adapter, a bypass of prototype pollution hardening allows requests to be routed through an attacker-controlled proxy...
CVE-2026-49411 Deno Node TCPWrap numeric hostname aliases bypass --deny-net resolved-IP deny checks
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.0, the Node.js compatibility TCP path checked the permission against the original hostname string before resolution and then did not re-check after resolution. A caller could therefore pass a numeric alias of an IP address fo...
UBUNTU-CVE-2026-40895
follow-redirects is an open source, drop-in replacement for Node's http and https modules that automatically follows redirects. Prior to 1.16.0, when an HTTP request follows a cross-domain redirect 301/302/307/308, follow-redirects only strips authorization, proxy-authorization, and cookie header...
EUVD-2026-24472
follow-redirects is an open source, drop-in replacement for Node's http and https modules that automatically follows redirects. Prior to 1.16.0, when an HTTP request follows a cross-domain redirect 301/302/307/308, follow-redirects only strips authorization, proxy-authorization, and cookie header...
BIT-NODE-2026-21710
A flaw in Node.js HTTP request handling causes an uncaught TypeError when a request is received with a header named proto and the application accesses req.headersDistinct. When this occurs, dest"proto" resolves to Object.prototype rather than undefined, causing .push to be called on a non-array...
CVE-2025-58754
Axios is a promise based HTTP client for the browser and Node.js. When Axios starting in version 0.28.0 and prior to versions 0.30.2 and 1.12.0 runs on Node.js and is given a URL with the data: scheme, it does not perform HTTP. Instead, its Node http adapter decodes the entire payload into memory...
Malicious code in node-http-langdetect (npm)
The package node-http-langdetect was found to contain malicious code...
BIT-NODE-MIN-2024-27982
The team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed headers can lead to HTTP request smuggling. Specifically, if a space is placed before a content-length header, it is not interpreted correctly, enabling attackers to smuggle in ...
CVE-2024-28849
follow-redirects is an open source, drop-in replacement for Node's http and https modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials...
MAL-2024-96 Malicious code in wdpr-node-http-error-handler (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4afec8bd883f6042f7047f6b0d29cd37d57ef2e6f179a717a0ee7bbf44a16fe8 The OpenSSF Package Analysis project identified 'wdpr-node-http-error-handler' @ 16.1.1 npm as malicious. It is considered malicious because: -...
Malicious Package
Overview node-http-uatraits is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this packag...
MAL-2023-632 Malicious code in node-http-uatraits (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 79f641b192ea9d09801f965d0b2e909f40fbc483a2f115e45feafed0376029a1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malware in node-http-uatraits
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
