MAL-2026-10967 Malicious code in commonweb-moneymovement (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dee7c2ba53e2c7adae6a2b54776c21490794ee8f28fde98f5c61778380de1382 Package [email protected] contains 2 files with no a static rule matches and no traced behavioral findings. The version number 99.9.1 an...

Malicious code in commonweb-moneymovement (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dee7c2ba53e2c7adae6a2b54776c21490794ee8f28fde98f5c61778380de1382 Package [email protected] contains 2 files with no a static rule matches and no traced behavioral findings. The version number 99.9.1 an...

MAL-2026-10971 Malicious code in cxpw-offers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2288ef5dfb841556f7ba4907a025270dfda3439820215b7d98e644afca78a306 cxpw-offers ships an empty index.js and declares its only dependency ltidisafe as a direct tarball URL at...

MAL-2026-10940 Malicious code in chai-leaf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77cc7562a27df348fafc455124fd845dfc2e5774c42279ee6e3dd8f1cfb1f05b [email protected]'s main entry index.js unconditionally requires./lib/config, which is a single 3,546,568-byte obfuscator.io-encoded file 20,721-entry...

PT-2026-62116

Name of the Vulnerable Software and Affected Versions Elasticsearch affected versions not specified Description An issue exists where a specially crafted search request containing a null value in a specific query clause triggers an internal assertion during query parsing. Since assertion failures...

PT-2026-62044

Data::RadixTree::Shared versions before 0.02 for Perl allow an out-of-bounds read via unvalidated node and arena indices in rdx find locked. The attach-time validator rdx validate header checks the header scalars and region layout against the file size, but does not validate the node records it...

PT-2026-63262

Name of the Vulnerable Software and Affected Versions Elasticsearch affected versions not specified Description Uncontrolled Recursion in the query evaluation component allows a low-privileged authenticated user with read-level index access to cause a denial of service. By submitting a specially...

PT-2026-62043

Data::SortedSet::Shared versions before 0.03 for Perl allow an out-of-bounds read via unvalidated node indices in the rank and min/max query paths. The attach-time validator ss validate header bounds only the root index against the node pool node capacity. The order-statistics and min/max queries...

@astrojs/node: Backslash-prefixed paths not recognized as internal by trailing-slash redirect

Impact With trailingSlash: 'always' configured, the @astrojs/node standalone server's static file handler appends a trailing slash to request paths and issues a 301 redirect. Paths beginning with /\ slash-backslash were not recognized as internal paths, so the handler would echo the raw path back...

GHSA-GCFJ-64VW-6MP9 Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning

Summary Axios’ Node.js HTTP adapter can route requests through an attacker-controlled proxy when Object.prototype.proxy is polluted and request configuration is materialized as a regular object before dispatch. Recent axios releases harden merged request config by creating a null-prototype object...

Prototype Pollution

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Prototype Pollution in the Node HTTP adapter lib/adapters/http.js, which reads config.proxy through the prototype chain after a request interceptor returns a plain-object...

GHSA-MWF2-3PR3-8698 Axios: HTTP/2 streamed uploads bypass `maxBodyLength`

Summary Axios versions with Node.js HTTP/2 support allow streamed request bodies to bypass maxBodyLength enforcement when requests are sent with httpVersion: 2. This affects applications that rely on maxBodyLength as a hard cap while forwarding attacker-controlled streams, such as upload endpoint...

CVE-2026-59875

creationtimestamp| type| source ---|---|--- 2026-07-20 22:35:12+00:00| published-proof-of-concept| https://github.com/isaacs/node-tar/security/advisories/GHSA-gvwx-54wh-qm9j 2026-07-22 12:01:16+00:00| seen| https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mrabmsdhlk24...

CVE-2026-59871

creationtimestamp| type| source ---|---|--- 2026-07-20 22:35:05+00:00| published-proof-of-concept| https://github.com/isaacs/node-tar/security/advisories/GHSA-w8wr-v893-vjvp 2026-07-22 12:01:14+00:00| seen| https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mrabmqeztj2n...

Allocation of Resources Without Limits or Throttling

Overview org.webjars.npm:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the getBodyLength and resolveBodyLength functions of lib/adapters/fetch.js, which lack a branch fo...

GHSA-F4GW-2P7V-4548 Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios

Summary Axios versions containing lib/helpers/shouldBypassProxy.js do not treat 0.0.0.0 as a local address when evaluating NOPROXY rules. In Node.js applications that use HTTPPROXY or HTTPSPROXY together with NOPROXY=localhost,127.0.0.1,::1 or similar, a request to http://0.0.0.0:/ can be routed...

EUVD-2026-42308

node-tar: Process crash via PAX numeric path type confusion...

GHSA-W8WR-V893-VJVP node-tar: Process crash via PAX numeric path type confusion

Summary A crafted 2.5KB tar archive crashes any Node.js process that extracts it. The PAX header parser coerces all-digit path values to JavaScript numbers, which causes an uncaught TypeError when downstream code calls .split'/' on the numeric value. Error handlers and strict: false cannot...

GHSA-23HP-3JRH-7FPW node-tar: Decompression/parse DoS via unlimited input

Summary A Decompression/parse DoS via unlimited input vulnerability in node-tar allows an attacker to exhaust server resources disk space and CPU. Because the library does not enforce hard upper bounds on total decompressed data or entry counts, a small, maliciously crafted "Gzip Bomb" can be use...

node-tar: Decompression/parse DoS via unlimited input

Summary A Decompression/parse DoS via unlimited input vulnerability in node-tar allows an attacker to exhaust server resources disk space and CPU. Because the library does not enforce hard upper bounds on total decompressed data or entry counts, a small, maliciously crafted "Gzip Bomb" can be use...