Microsoft Authentication Library (MSAL) for Node.js Spoofing Vulnerability

Authentication bypass by capture-replay in Microsoft Authentication Library MSAL for Node.js allows an unauthorized attacker to perform spoofing over a network...

CVE-2026-75021

fastify-cli starts the Node.js Inspector when a debug flag is used, but it ignores the explicit bind address the user supplies and binds the Inspector to a broadly reachable address instead of the intended loopback. As a result the debugging interface can be exposed beyond the local machine, and...

EUVD-2026-72734

fastify-cli starts the Node.js Inspector when a debug flag is used, but it ignores the explicit bind address the user supplies and binds the Inspector to a broadly reachable address instead of the intended loopback. As a result the debugging interface can be exposed beyond the local machine, and...

CVE-2026-75021 fastify-cli vulnerable to remote code execution via ignored explicit Inspector bind address

fastify-cli starts the Node.js Inspector when a debug flag is used, but it ignores the explicit bind address the user supplies and binds the Inspector to a broadly reachable address instead of the intended loopback. As a result the debugging interface can be exposed beyond the local machine, and...

CVE-2026-75021 fastify-cli vulnerable to remote code execution via ignored explicit Inspector bind address

fastify-cli starts the Node.js Inspector when a debug flag is used, but it ignores the explicit bind address the user supplies and binds the Inspector to a broadly reachable address instead of the intended loopback. As a result the debugging interface can be exposed beyond the local machine, and...

CVE-2026-75021

fastify-cli (versions 1.5.0 through 8.0.1) starts the Node.js Inspector when a debug flag is used, but ignores the explicit bind address the user supplies, binding the Inspector to a broadly reachable address instead of the intended loopback. Because the Inspector protocol permits arbitrary code ...

CVE-2026-75021 fastify-cli vulnerable to remote code execution via ignored explicit Inspector bind address

fastify-cli starts the Node.js Inspector when a debug flag is used, but it ignores the explicit bind address the user supplies and binds the Inspector to a broadly reachable address instead of the intended loopback. As a result the debugging interface can be exposed beyond the local machine, and...

CVE-2026-86712

SiYuan before 3.8.2 is an Electron-based note-taking application vulnerable to Remote Code Execution via its clipboard paste handler. The root cause is that SiYuan trusts the attacker-writable text/siyuan clipboard MIME type and skips sanitization in the paste handler (app/src/protyle/util/paste....

CVE-2026-86712 SiYuan before 3.8.2 Remote Code Execution via Clipboard

SiYuan before 3.8.2 trusts the attacker-writable text/siyuan clipboard MIME type and skips sanitization in the paste handler, allowing code execution in the Node-enabled desktop renderer. Attackers can craft malicious web pages that write to the clipboard, and when pasted into SiYuan, injected...

CVE-2026-86712 SiYuan before 3.8.2 Remote Code Execution via Clipboard

SiYuan before 3.8.2 trusts the attacker-writable text/siyuan clipboard MIME type and skips sanitization in the paste handler, allowing code execution in the Node-enabled desktop renderer. Attackers can craft malicious web pages that write to the clipboard, and when pasted into SiYuan, injected...

GHSA-5CWM-P7PJ-GQP2 Duplicate Advisory: Sensitive information written to logs by Snowflake drivers

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-qqj6-54q6-cxv6. This link is maintained to preserve external references. Original Description Insertion of sensitive information into log files in the Snowflake Python, Go, JDBC, Node.js, PHP PDO, and ODBC drive...

Duplicate Advisory: Sensitive information written to logs by Snowflake drivers

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-qqj6-54q6-cxv6. This link is maintained to preserve external references. Original Description Insertion of sensitive information into log files in the Snowflake Python, Go, JDBC, Node.js, PHP PDO, and ODBC drive...

K000163236: Node.js vulnerability CVE-2021-3918

Security Advisory Description json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution' CVE-2021-3918 Impact There is no impact; F5 products are not affected by this vulnerability. Security Advisory Status F5 Product Development has...

nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw

A flaw in the Node.js Permission Model allows attackers to bypass --permission restrictions, enabling unauthorized read or write access to files and directories...

nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service

A heap use-after-free vulnerability in the Node.js HTTP/2 component allows a remote attacker to crash the application, causing a denial of service. This is triggered by an unexpected re-entrant call to nghttp2sessionmemsend while nghttp2sessionmemrecv is still executing...

nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks

A flaw was found in Node.js's handling of HTTP/2. This vulnerability allows a remote attacker to bypass maxSessionMemory limits by sending specially crafted HTTP/2 retained header blocks. This can lead to memory exhaustion, resulting in a denial of service DoS for the affected system...

PT-2026-88447

In Eclipse Ditto's Node.js JavaScript client, all released versions of @eclipse-ditto/ditto-javascript-client-node from 2.0.0 to 3.9.0 and of its predecessor package @eclipse-ditto/ditto-javascript-client-node 1.0 from 1.0.0 to 2.1.0, the WebSocket transport hard-codes rejectUnauthorized: false...

PT-2026-88147

Name of the Vulnerable Software and Affected Versions Microsoft Authentication Library MSAL for Node.js affected versions not specified Description An authentication bypass exists due to a capture-replay mechanism, which allows an unauthorized remote attacker to perform spoofing attacks over a...

CVE-2026-86597: Insertion of Sensitive Information into Log File

Insertion of sensitive information into log files in the Snowflake Python, Go, JDBC, Node.js, PHP PDO, and ODBC drivers allowed authentication tokens, query-result encryption keys, pre-signed cloud-storage URLs, and SAML assertions to be written to diagnostic logs in circumstances where the...

CVE-2026-84003: Authentication Bypass by Capture-replay

Authentication bypass by capture-replay in Microsoft Authentication Library MSAL for Node.js allows an unauthorized attacker to perform spoofing over a network...