CVE-2026-77037

multer is a Node.js middleware for handling multipart/form-data uploads. In version 2.2.0 , when a disk-backed upload is aborted or truncated before the write stream finishes, the disk storage engine removes the visible file but fails to close the underlying write file descriptor , leaving a dele...

CVE-2026-77037 multer vulnerable to Denial of Service via file descriptor leak on aborted uploads

multer is a middleware for handling multipart/form-data in Node.js. In version 2.2.0, when a disk-backed upload is aborted or truncated before the write stream finishes, multer's disk storage engine removes the visible file but does not close the underlying write file descriptor, leaving a delete...

@aliceo2/infologger (1.14.0), @azimutt/connector-mariadb (>=0.1.0, <=0.1.9) +7 more potentially affected by CVE-2026-55215 via mariadb (>=3.3.0, <=3.3.2)

mariadb NPM version =3.3.0, =0.1.0, =0.1.0, =6.1.13-dev.2, =1.0.0, =0.1.0, =0.1.39 - nodefony 7.0.0 Source cves: CVE-2026-55215 Source advisory: OSV:GHSA-CQHC-2H57-WPXF...

@aliceo2/bookkeeping (>=0.27.0, <=1.20.0), @azteam/mysql-model (>=1.0.70, <=1.0.155) +62 more potentially affected by CVE-2026-55215 via mariadb (>=3.0.0, <=3.2.3)

mariadb NPM version =3.0.0, =0.27.0, =1.0.70, =2.0.0, =0.0.1, =1.0.0-alpha.0, =0.0.6, =1.1.0, =1.1.1, =1.1.2 - @keystone-6-master/example-assets-cloud 0.0.2 - @keystone-6-master/example-assets-local 0.0.2 - @keystone-6-master/example-auth 0.0.3 - @keystone-6-master/example-blog 0.0.2 -...

CVE-2026-55215 MariaDB Connector/Node.js: Connector leaks the cleartext password to an MitM despite `ssl: true`

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to versions 3.3.3, 3.4.6, and 3.5.3, when ssl is enabled without a pinned CA or server certificate, MariaDB Connector/Node.js sends credentials before completing certificate...

CVE-2026-55215

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to versions 3.3.3, 3.4.6, and 3.5.3, when ssl is enabled without a pinned CA or server certificate, MariaDB Connector/Node.js sends credentials before completing certificate...

CVE-2026-55215 MariaDB Connector/Node.js: Connector leaks the cleartext password to an MitM despite `ssl: true`

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to versions 3.3.3, 3.4.6, and 3.5.3, when ssl is enabled without a pinned CA or server certificate, MariaDB Connector/Node.js sends credentials before completing certificate...

CVE-2026-55215 MariaDB Connector/Node.js: Connector leaks the cleartext password to an MitM despite `ssl: true`

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to versions 3.3.3, 3.4.6, and 3.5.3, when ssl is enabled without a pinned CA or server certificate, MariaDB Connector/Node.js sends credentials before completing certificate...

CVE-2026-15603

morgan is an HTTP request logger middleware for Node.js. In versions prior to 1.12.0, the internal helper that escapes log token values did not neutralize the Unicode line separator characters U+0085 Next Line, U+2028 Line Separator, and U+2029 Paragraph Separator. An unauthenticated remote clien...

DEBIAN-CVE-2026-15603

morgan is an HTTP request logger middleware for Node.js. In versions prior to 1.12.0, the internal helper that escapes log token values did not neutralize the Unicode line separator characters U+0085 Next Line, U+2028 Line Separator, and U+2029 Paragraph Separator. An unauthenticated remote clien...

CVE-2026-15603

morgan is an HTTP request logger middleware for Node.js. In versions prior to 1.12.0, the internal helper that escapes log token values did not neutralize the Unicode line separator characters U+0085 Next Line, U+2028 Line Separator, and U+2029 Paragraph Separator. An unauthenticated remote clien...

UBUNTU-CVE-2026-15603

morgan is an HTTP request logger middleware for Node.js. In versions prior to 1.12.0, the internal helper that escapes log token values did not neutralize the Unicode line separator characters U+0085 Next Line, U+2028 Line Separator, and U+2029 Paragraph Separator. An unauthenticated remote clien...

CVE-2026-15603

morgan (HTTP request logger middleware for Node.js) is affected by a log forging issue (CWE-117) in versions prior to 1.12.0 . The internal helper that escapes log token values failed to neutralize Unicode line separator characters U+0085 , U+2028 , and U+2029 . An unauthenticated remote client c...

CVE-2026-15603

morgan is an HTTP request logger middleware for Node.js. In versions prior to 1.12.0, the internal helper that escapes log token values did not neutralize the Unicode line separator characters U+0085 Next Line, U+2028 Line Separator, and U+2029 Paragraph Separator. An unauthenticated remote clien...

CVE-2026-15603 morgan vulnerable to Log Forging via unescaped Unicode line separators

morgan is an HTTP request logger middleware for Node.js. In versions prior to 1.12.0, the internal helper that escapes log token values did not neutralize the Unicode line separator characters U+0085 Next Line, U+2028 Line Separator, and U+2029 Paragraph Separator. An unauthenticated remote clien...

CVE-2026-15603 morgan vulnerable to Log Forging via unescaped Unicode line separators

morgan is an HTTP request logger middleware for Node.js. In versions prior to 1.12.0, the internal helper that escapes log token values did not neutralize the Unicode line separator characters U+0085 Next Line, U+2028 Line Separator, and U+2029 Paragraph Separator. An unauthenticated remote clien...

CVE-2026-15603 morgan vulnerable to Log Forging via unescaped Unicode line separators

morgan is an HTTP request logger middleware for Node.js. In versions prior to 1.12.0, the internal helper that escapes log token values did not neutralize the Unicode line separator characters U+0085 Next Line, U+2028 Line Separator, and U+2029 Paragraph Separator. An unauthenticated remote clien...

CVE-2026-15603

morgan is an HTTP request logger middleware for Node.js. In versions prior to 1.12.0, the internal helper that escapes log token values did not neutralize the Unicode line separator characters U+0085 Next Line, U+2028 Line Separator, and U+2029 Paragraph Separator. An unauthenticated remote clien...

CVE-2026-82244 Budibase before 3.41.3 Remote Code Execution via Plugin eval()

Budibase versions before 3.41.3 contain a remote code execution vulnerability in plugin handling that allows authenticated admin users to execute arbitrary code by uploading a malicious plugin tarball. The server calls eval on plugin JavaScript files without sandboxing in the main Node.js process...

CVE-2026-82244 Budibase before 3.41.3 Remote Code Execution via Plugin eval()

Budibase versions before 3.41.3 contain a remote code execution vulnerability in plugin handling that allows authenticated admin users to execute arbitrary code by uploading a malicious plugin tarball. The server calls eval on plugin JavaScript files without sandboxing in the main Node.js process...