3xhaustpi (>=0.1.3, <=0.2.1), @0x0.bug/pi-coding-agent (1.0.0) +1094 more potentially affected by CVE-2026-16728 via undici (>=8.0.0, <=8.8.0)

undici NPM version =8.0.0, =0.1.3, =0.1.8, =1.0.0, =0.2.0, =5.0.1-staging.19033314d476, =5.0.1-staging.19033314d476, =5.1.1-staging.00ceebd28cf2, =5.1.1-staging.00ceebd28cf2, =5.0.1-staging.19033314d476, =5.0.1-staging.3abdf9534c25, =0.1.0, =0.5.1 and more Source cves: CVE-2026-16728 Source...

3xhaustpi (>=0.1.3, <=0.2.1), @0x0.bug/pi-coding-agent (1.0.0) +1094 more potentially affected by CVE-2026-13697 via undici (>=8.0.0, <=8.8.0)

undici NPM version =8.0.0, =0.1.3, =0.1.8, =1.0.0, =0.2.0, =5.0.1-staging.19033314d476, =5.0.1-staging.19033314d476, =5.1.1-staging.00ceebd28cf2, =5.1.1-staging.00ceebd28cf2, =5.0.1-staging.19033314d476, =5.0.1-staging.3abdf9534c25, =0.1.0, =0.5.1 and more Source cves: CVE-2026-13697 Source...

Information Disclosure axios Dependency in Bitbucket Data Center

This High severity Information Disclosure vulnerability was introduced in versions 9.4.21, 10.2.4, and 10.3.1 of Bitbucket Data Center. This Information Disclosure vulnerability, with a CVSS Score of 8.3 and a CVSS Vector of CVSS:4.0/AV:N/AC:L/AT: P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N allows ...

Information Disclosure axios Dependency in Crowd Data Center

This High severity Information Disclosure vulnerability was introduced in version 7.2.1 of Crowd Data Center. This Information Disclosure vulnerability, with a CVSS Score of 8.3 and a CVSS Vector of CVSS:4.0/AV:N/AC:L/AT: P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N allows an unauthenticated attacke...

CVE-2026-67318

A flaw was found in axios, a popular JavaScript library for making HTTP requests. When using the Node.js HTTP/2 adapter, axios fails to properly enforce the configured maxBodyLength limit for streamed request bodies. This allows a remote attacker, by controlling the input stream, to send an...

nodejs:24 security update

An update is available for module.nodejs, nodejs, module.nodejs-packaging, nodejs-packaging, nodejs-nodemon, module.nodejs-nodemon. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

nodejs:22 security update

An update is available for module.nodejs, nodejs, module.nodejs-packaging, nodejs-packaging, nodejs-nodemon, module.nodejs-nodemon. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

RHSA-2026:47058 Red Hat Security Advisory: nodejs:22 security update

Bulletin has no description...

Exploit for Stack-based Buffer Overflow in Google Chrome

--- CVE-2026-4444 – JWT Algorithm Confusion via kid Injectio...

Duplicate Advisory: Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-gcfj-64vw-6mp9. This link is maintained to preserve external references. Original Description axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios...

CVE-2026-67318

axios versions =1.13.0 Node.js HTTP adapter fail to enforce the configured maxBodyLength limit on streamed request bodies when requests are sent with httpVersion: 2. Because Node's HTTP/2 request API does not honor the maxBodyLength option and axios's byte-counting stream wrapper is gated on...

CVE-2026-67320

axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hardens merged request configuration by creating a null-prototype object, but request interceptors run after the merge; a common immutable interceptor pattern such as ...config or...

CVE-2026-67320

axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hardens merged request configuration by creating a null-prototype object, but request interceptors run after the merge; a common immutable interceptor pattern such as ...config or...

PT-2026-67576

Name of the Vulnerable Software and Affected Versions Node.js versions 22.x and earlier Node.js versions 24.x and earlier Node.js versions 26.x and earlier Description A flaw in the Node.js HTTP client can lead to request desynchronization in Node.js-based forwarding proxies. This occurs when...

CVE-2026-67318: Uncontrolled Resource Consumption

axios versions =1.13.0 Node.js HTTP adapter fail to enforce the configured maxBodyLength limit on streamed request bodies when requests are sent with httpVersion: 2. Because Node's HTTP/2 request API does not honor the maxBodyLength option and axios's byte-counting stream wrapper is gated on...

CVE-2026-67320: Exposure of Sensitive Information to an Unauthorized Actor

axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hardens merged request configuration by creating a null-prototype object, but request interceptors run after the merge; a common immutable interceptor pattern such as ...config or...

CVE-2026-54729 dssrf: any users using 1.1.1.1 DNS is impacted by SSRF

DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.5, isurlsafe can treat localhost as safe when DNS resolver 1.1.1.1 returns NXDOMAIN because dns.resolve4 yields no address and no dns.lookup fallback occurs, allowing server-side...

CVE-2026-18446

fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based introducer in place of it backslash backslash, forward slash backslash, or backslash forward slash is parsed with no authority and folds into th...

CVE-2026-58039

A flaw in Node.js Permission Model enforcement allows process.report writes and overwrites files outside --allow-fs-write paths. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects Node.js 22.x, 24.x, and 26...

AZL-94343 CVE-2026-58039 affecting package nodejs for versions less than 24.18.1-1

A flaw in Node.js Permission Model enforcement allows process.report writes and overwrites files outside --allow-fs-write paths. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects Node.js 22.x, 24.x, and 26...