PT-2026-83348

Name of the Vulnerable Software and Affected Versions MariaDB Connector/Node.js versions prior to 3.2.4 MariaDB Connector/Node.js versions prior to 3.3.3 MariaDB Connector/Node.js versions prior to 3.4.6 MariaDB Connector/Node.js versions prior to 3.5.3 Description MariaDB Connector/Node.js can...

PT-2026-83237

Name of the Vulnerable Software and Affected Versions MariaDB Connector/Node.js versions prior to 3.2.4 MariaDB Connector/Node.js versions 3.3.0 through 3.3.2 MariaDB Connector/Node.js versions 3.4.0 through 3.4.5 MariaDB Connector/Node.js versions 3.5.0 through 3.5.2 Description When SSL is...

CVE-2026-82333: Uncontrolled Resource Consumption

multer is a middleware for handling multipart/form-data in Node.js. A small multipart request with two specially crafted text field names can make multer's field parser synchronously iterate a maximum-length sparse array, blocking the event loop so the process cannot handle other requests. A larg...

PT-2026-83358

Name of the Vulnerable Software and Affected Versions multer versions prior to 2.3.0 Description A denial of service issue exists in the middleware used for handling multipart/form-data in Node.js. A specially crafted multipart request containing two text field names can trigger an uncaught...

PT-2026-83120

Name of the Vulnerable Software and Affected Versions morgan versions prior to 1.12.0 Description An issue exists in the internal helper used to escape log token values. The software fails to neutralize Unicode line separator characters U+0085 Next Line, U+2028 Line Separator, and U+2029 Paragrap...

CVE-2026-15603: Improper Output Neutralization for Logs

morgan is an HTTP request logger middleware for Node.js. In versions prior to 1.12.0, the internal helper that escapes log token values did not neutralize the Unicode line separator characters U+0085 Next Line, U+2028 Line Separator, and U+2029 Paragraph Separator. An unauthenticated remote clien...

CVE-2026-82244: Improper Control of Generation of Code

Budibase versions before 3.41.3 contain a remote code execution vulnerability in plugin handling that allows authenticated admin users to execute arbitrary code by uploading a malicious plugin tarball. The server calls eval on plugin JavaScript files without sandboxing in the main Node.js process...

CVE-2026-77063: Concurrent Execution using Shared Resource with Improper Synchronization

multer is a middleware for handling multipart/form-data in Node.js. When an application uses an asynchronous fileFilter together with the fileSize limit, a race condition in multer's file stream handling can allow a file that exceeds the configured size limit to bypass the size-limit rejection. A...

CVE-2026-77078: Uncaught Exception

multer is a middleware for handling multipart/form-data in Node.js. A small multipart request containing two specially crafted text field names can cause an uncaught RangeError Invalid array length that terminates the Node.js process. The first field uses a very large numeric array index to...

CVE-2026-55215: Improper Certificate Validation

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to versions 3.3.3, 3.4.6, and 3.5.3, when ssl is enabled without a pinned CA or server certificate, MariaDB Connector/Node.js sends credentials before completing certificate...

CVE-2026-55855: Improper Neutralization of Special Elements used in an SQL Command

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB Connector/Node.js permits SQL injection when attacker-controlled Buffer parameters are escaped client-side under the big5, gbk, sjis,...

PT-2026-83357

Name of the Vulnerable Software and Affected Versions multer versions prior to 2.3.0 Description A race condition exists in the file stream handling when an application utilizes an asynchronous fileFilter in conjunction with the fileSize limit. This allows files that exceed the configured size...

CVE-2026-54732

libreoffice-convert is a Node.js module for converting office documents to different formats. Prior to 1.8.2, index.js uses the caller-controlled options.fileName value in path.jointempDir.name, fileName without reducing it to a base name. A filename containing ../ can escape the temporary...

CVE-2026-54732

libreoffice-convert is a Node.js module for converting office documents to different formats. Prior to 1.8.2 , the options.fileName value passed to path.join(tempDir.name, fileName) in index.js is never reduced to a base name. A filename containing ../ allows an attacker to escape the temporary d...

CVE-2026-54732 libreoffice-convert: path traversal / arbitrary file write

libreoffice-convert is a Node.js module for converting office documents to different formats. Prior to 1.8.2, index.js uses the caller-controlled options.fileName value in path.jointempDir.name, fileName without reducing it to a base name. A filename containing ../ can escape the temporary...

CVE-2026-54732 libreoffice-convert: path traversal / arbitrary file write

libreoffice-convert is a Node.js module for converting office documents to different formats. Prior to 1.8.2, index.js uses the caller-controlled options.fileName value in path.jointempDir.name, fileName without reducing it to a base name. A filename containing ../ can escape the temporary...

CVE-2026-54732 libreoffice-convert: path traversal / arbitrary file write

libreoffice-convert is a Node.js module for converting office documents to different formats. Prior to 1.8.2, index.js uses the caller-controlled options.fileName value in path.jointempDir.name, fileName without reducing it to a base name. A filename containing ../ can escape the temporary...

[R1] Tenable Enclave Security 1.9.0 Fixes Multiple Vulnerabilities

R1 Tenable Enclave Security 1.9.0 Fixes Multiple Vulnerabilities Arnie Cabral Thu, 08/27/2026 - 12:25 Tenable Enclave Security leverages third-party software to help provide underlying functionality. Several of the third-party components Node.Js, Go were found to contain vulnerabilities, and...

CVE-2026-55553

A flaw was found in urllib. This HTTP client for Node.js can be exploited by a remote attacker due to improper handling of cross-origin redirects. When following redirects, urllib reuses sensitive request headers, such as Authorization and Cookie, across different origins. This can lead to the...

CVE-2026-76845

A flaw was found in adm-zip, a Node.js library used for handling zip archives. This vulnerability allows a local attacker to overwrite arbitrary files on the system. When extracting an archive, adm-zip follows symbolic links, which are special files that point to other files or directories. An...