CVE-2026-78208 exceljs through 4.4.0 Path Traversal via Unvalidated addImage filename

exceljs through 4.4.0 contains a path traversal vulnerability in the Workbook.addImage function that fails to validate file paths. Attackers can supply arbitrary file paths to read any file accessible to the Node.js process and embed it in the generated workbook...

CVE-2026-78208 exceljs through 4.4.0 Path Traversal via Unvalidated addImage filename

exceljs through 4.4.0 contains a path traversal vulnerability in the Workbook.addImage function that fails to validate file paths. Attackers can supply arbitrary file paths to read any file accessible to the Node.js process and embed it in the generated workbook...

PT-2026-79801

Name of the Vulnerable Software and Affected Versions exceljs-hardened versions prior to 5.0.0 Description A path traversal issue exists in the Workbook.addImage function due to insufficient validation of file paths. This allows an attacker to provide arbitrary file paths to read any file...

CVE-2026-76172: Improper Handling of URL Encoding (Hex Encoding)

fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and serialization writes the scheme back out verbatim, unlike the host component which is re-escaped. As a result an input whose scheme carries...

PT-2026-80192

Name of the Vulnerable Software and Affected Versions fast-uri versions 2.4.2 through 2.4.4 fast-uri versions 3.1.3 through 3.1.5 fast-uri versions 4.0.1 through 4.1.2 Description fast-uri, a URI parser for Node.js, fails to consistently canonicalize hosts to ASCII form when processing...

CVE-2026-78208: External Control of File Name or Path

exceljs through 4.4.0 contains a path traversal vulnerability in the Workbook.addImage function that fails to validate file paths. Attackers can supply arbitrary file paths to read any file accessible to the Node.js process and embed it in the generated workbook...

CVE-2026-76842: Improper Limitation of a Pathname to a Restricted Directory

The Mercado Pago Node.js SDK interpolates caller-supplied identifiers into API request paths without percent-encoding them, so characters that are structural in a URL survive into the outgoing request. The payment get, capture, cancel, paymentRefund create, total, list, get, advancedPayment get,...

PT-2026-80788

Name of the Vulnerable Software and Affected Versions fast-uri versions 2.3.1 through 2.4.4 fast-uri versions 3.0.0 through 3.1.5 fast-uri versions 4.0.0 through 4.1.2 Description The custom parser for bracketed IPv6 literals fails to validate the complete IPv6 grammar. This allows invalid traili...

CVE-2026-75899: Double Decoding of the Same Data

fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a single call to normalize or resolve can turn nested percent-encoded input into a different network destination such...

PT-2026-80798

Name of the Vulnerable Software and Affected Versions fast-uri versions 2.3.1 through 2.4.4 fast-uri versions 3.0.0 through 3.1.5 fast-uri versions 4.0.0 through 4.1.2 Description During URI parsing, the software performs a legacy decoding pass on the scheme component without re-escaping the...

CVE-2026-75931: Interpretation Conflict

fast-uri is a URI parser for Node.js. It canonicalizes a host to its ASCII form only when the input carries an explicit scheme, so a scheme-relative reference such as a host preceded by two slashes is returned with its host verbatim and no error set. As a result fast-uri's own entry points disagr...

CVE-2026-75975: Improper Input Validation

fast-uri is a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not validate the complete IPv6 grammar, so invalid trailing text in an authority can be silently discarded and a malformed attacker-controlled host is turned into a different valid IPv6 destination. For...

waf-checker v1.1.0

WAF Checker This project helps you check how well your Web Application Firewall WAF protects your product against common web attacks. It can be run as a Cloudflare Worker with a built-in interactive Web UI or as a standalone Node.js CLI tool. Features Core Testing Enter a target URL, pick HTTP...

Rust for Secure Backend Development: A Critical Review and Extended Vulnerability Comparison with Node.Js and Django

The Rust programming language is widely credited with eliminating entire classes of memory-safety and concurrency vulnerabilities, but the security implications of adopting it in practice extend well beyond memory safety. This paper presents a critical review of prior work on Rust's security...

xsslab

XSS Educational Learning Lab 🛡️ An interactive, educational w...

SUSE CVE-2026-74866

@fastify/busboy is a multipart form-data parser for Node.js. Its multipart part-header parser splits header lines only on the two-byte carriage-return line-feed sequence, so a lone carriage return or line feed embedded in a part header is not treated as a line break and is carried verbatim into t...

@3c-node-red/runtime (3.1.6), @adeunis/node-red-contrib-adeunis-codecs (1.0.0) +340 more potentially affected by CVE-2026-77414 via jsonata (>=1.0.10, <=1.8.7)

jsonata NPM version =1.0.10, =0.0.1, =0.0.1, =0.0.1, =0.17.5, =20.2.3, =5.0.0-aws-sdk-v3.2, =0.0.1, =0.8.0, =0.0.1, =0.0.114 and more Source cves: CVE-2026-77414 Source advisory: SNYK:JS-JSONATA-19233336...

CVE-2026-73566

creationtimestamp| type| source ---|---|--- 2026-08-21 20:35:04+00:00| published-proof-of-concept| https://github.com/isaacs/node-tar/security/advisories/GHSA-r292-9mhp-454m 2026-08-22 12:00:51+00:00| seen| https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mtoa2m3bdg2n...

Security Bulletin:IBM Spectrum Control is vulnerable to weaknesses related to multer-1.4.2.tgz (CVE-2026-3520)

Summary Multer is vulnerable to DOS attack. These vulnerabilities affect IBM Spectrum Control. Vulnerability Details CVEID:CVE-2026-3520 DESCRIPTION: Multer is a node.js middleware for handling multipart/form-data. A vulnerability in Multer prior to version 2.1.1 allows an attacker to trigger a...

CVE-2026-74866 @fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name

@fastify/busboy is a multipart form-data parser for Node.js. Its multipart part-header parser splits header lines only on the two-byte carriage-return line-feed sequence, so a lone carriage return or line feed embedded in a part header is not treated as a line break and is carried verbatim into t...