ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray`

A flaw was found in ws, an open source WebSocket client and server for Node.js. The websocket.close implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This can lead to the disclosure of sensitive information from uninitialized memor...

AZL-91127 CVE-2026-48937 affecting package nodejs for versions less than 24.17.0-1

A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a GOAWAY frame. This vulnerability affects two supported release lines: Node.js 22 and Node.js 24...

CVE-2026-48937

A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a "GOAWAY" frame. This vulnerability affects two supported release lines: Node.js 22 and Node.js 24...

CVE-2026-48937

A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a GOAWAY frame. This vulnerability affects two supported release lines: Node.js 22 and Node.js 24...

CVE-2026-48937

A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a GOAWAY frame. This vulnerability affects two supported release lines: Node.js 22 and Node.js 24...

CVE-2026-48937

A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a GOAWAY frame. This vulnerability affects two supported release lines: Node.js 22 and Node.js 24...

CVE-2026-48937

A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a GOAWAY frame. This vulnerability affects two supported release lines: Node.js 22 and Node.js 24...

CVE-2026-48937

A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a GOAWAY frame. This vulnerability affects two supported release lines: Node.js 22 and Node.js 24...

AZL-91124 CVE-2026-48617 affecting package nodejs for versions less than 24.17.0-1

A flaw in Node.js Permission Model enforcement allows Bypass via process.report.writeReport Path Misvalidation. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: Node.js 22,...

ALPINE-CVE-2026-48617

A flaw in Node.js Permission Model enforcement allows Bypass via process.report.writeReport Path Misvalidation. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: Node.js 22,...

CVE-2026-48617

A flaw in Node.js Permission Model enforcement allows Bypass via process.report.writeReport Path Misvalidation. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: Node.js 22,...

CVE-2026-48617

A flaw in Node.js Permission Model enforcement allows Bypass via process.report.writeReport Path Misvalidation. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: Node.js 22,...

UBUNTU-CVE-2026-48617

A flaw in Node.js Permission Model enforcement allows Bypass via process.report.writeReport Path Misvalidation. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: Node.js 22,...

CVE-2026-48617

A flaw in Node.js Permission Model enforcement allows Bypass via process.report.writeReport Path Misvalidation. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: Node.js 22,...

CVE-2026-48617

A flaw in Node.js Permission Model enforcement allows Bypass via process.report.writeReport Path Misvalidation. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: Node.js 22,...

CVE-2026-48617

A flaw in Node.js Permission Model enforcement allows Bypass via process.report.writeReport Path Misvalidation. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: Node.js 22,...

@01.software/cli (>=0.1.1, <=0.2.0), @01.software/sdk (>=0.0.1-251008.90016, <=0.3.0) +694 more potentially affected by CVE-2026-9678 via undici (>=7.0.0, <=7.27.2)

undici NPM version =7.0.0, =0.1.1, =0.0.1-251008.90016, =0.0.6, =0.18.1, =0.18.4, =0.18.4, =0.26.4, =0.0.33, =0.0.1, =1.0.0, =21.0.0-rc.2, =21.0.0-rc.2, =0.5.0, =0.5.1 - @anyauth/shared-deps 0.1.0 and more Source cves: CVE-2026-9678 Source advisory: OSV:GHSA-PR7R-676H-XCF6...

@angular-devkit/build-angular (22.1.0-next.0), @oslokommune/auth-bff (>=2.0.1, <=2.2.1) +2 more potentially affected by CVE-2026-55602 via http-proxy-middleware (4.0.0)

http-proxy-middleware NPM version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on http-proxy-middleware and may be impacted: - @angular-devkit/build-angular 22.1.0-next.0 - @oslokommune/auth-bff =2.0.1, =8.6.0, =0.4.5, =0.5.0 Source cves:...

Prototype Pollution

Overview piscina is an A fast, efficient Node.js Worker Thread Pool implementation Affected versions of this package are vulnerable to Prototype Pollution via the options.filename property in the constructor and run function. An attacker can execute arbitrary code and gain control over worker...

NPM: OpenClaw: Host environment sanitizer missed two Node.js control variables

NPM: OpenClaw: Host environment sanitizer missed two Node.js control variables vulnerability discovered by ? in WordPress Npm openclaw versions = 2026.5.22...