SUSE CVE-2026-101894

The decompress package for Node.js extracts archives. Prior to 10.2.2 and 11.1.4, the default decompressinput, output API relies on lexical containment checks that do not account for the kernel following a planted symlink chain. An attacker can supply a crafted archive containing chained symlink...

SUSE CVE-2026-101900

Axios is a promise-based HTTP client for the browser and Node.js. From 1.12.0 until 1.20.0, ResolveConfig reads inherited Symbol.toStringTag, append, and getHeaders properties while resolving FormData headers. A separate same-process prototype-pollution flaw supplies an array or non-plain class...

SUSE CVE-2026-101901

Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Http2Sessions does not install adequate error handling for a ClientHttp2Session during Axios HTTP/2 session initialization or reuse. A request uses httpVersion: 2 and the ClientHttp2Session emits an error...

SUSE CVE-2026-101902

Axios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vulnerability in the same process pollutes...

SUSE CVE-2026-101903

Axios is a promise-based HTTP client for the browser and Node.js. From 1.16.1 until 1.20.0, the RFC 2397 regular expression allows slash characters on both sides of the media-type separator. An application passes an attacker-controlled malformed data URL containing many slash characters and no...

SUSE CVE-2026-101905

Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.2 until 1.20.0, the Node HTTP adapter in lib/adapters/http.js supplies request options without an own createConnection value. A separate same-process prototype-pollution flaw places a function on...

SUSE CVE-2026-101906

Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy applies a quadratic trailing-dot regular expression to redirect hostnames. HTTPPROXY or HTTPSPROXY is configured, NOPROXY or noproxy is non-empty, redirects are followed, and a...

Malicious code in fs-commons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f7e82e98343807c39ea786017de4d2a7455815424155ca2a856333d895c8a48b The package presents itself as a filesystem/data-helper library, but its exported getTransactions/loadtransactiondata functions are a two-file...

MAL-2026-17301 Malicious code in fs-commons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f7e82e98343807c39ea786017de4d2a7455815424155ca2a856333d895c8a48b The package presents itself as a filesystem/data-helper library, but its exported getTransactions/loadtransactiondata functions are a two-file...

adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process (DoS)

Summary Denial of Service in adm-zip's async decompression API allows an unauthenticated attacker to crash the entire Node.js host process by supplying a single malformed ZIP file. Details Affected package: adm-zip Affected versions: at least 0.6.0 current latest; likely all versions containing t...

NPM: adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process (DoS)

NPM: adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process DoS vulnerability discovered by ? in WordPress Npm adm-zip versions = 0.6.0...

GHSA-8238-W5PM-2374 adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process (DoS)

Summary Denial of Service in adm-zip's async decompression API allows an unauthenticated attacker to crash the entire Node.js host process by supplying a single malformed ZIP file. Details Affected package: adm-zip Affected versions: at least 0.6.0 current latest; likely all versions containing t...

CVE-2026-103043 anchorme through 3.0.8 Regular Expression Denial of Service

anchorme through 3.0.8 contains a regular expression denial of service vulnerability in the IPv6 host extraction regex due to catastrophic backtracking. Attackers can supply specially crafted input strings with repeated patterns to cause exponential regex engine backtracking, blocking the Node.js...

CVE-2026-103043 anchorme through 3.0.8 Regular Expression Denial of Service

anchorme through 3.0.8 contains a regular expression denial of service vulnerability in the IPv6 host extraction regex due to catastrophic backtracking. Attackers can supply specially crafted input strings with repeated patterns to cause exponential regex engine backtracking, blocking the Node.js...

CVE-2026-103043

The anchorme library (versions through 3.0.8 ) is vulnerable to a Regular Expression Denial of Service (ReDoS) . The issue resides in the IPv6 host extraction regex , where catastrophic backtracking can be triggered by specially crafted input strings with repeated patterns. This causes exponentia...

Malicious code in @rutxploit-sec/subsplash-google-tag-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8fe2c746dc5c09bc67257fd4eba671824806c9080b7ca94949e45175deb03b8d package.json declares a preinstall script that executes inline Node code reading os.hostname and os.userInfo.username and issuing an HTTP GET to...

undici: undici: Denial of Service via unrequested WebSocket subprotocol

A flaw was found in undici. A remote attacker can exploit this vulnerability by responding with an unrequested WebSocket subprotocol during the opening handshake. This causes the undici WebSocket client to crash the entire Node.js process, leading to a denial of service DoS...

CVE-2026-102827

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin compares parsed option names with literal dangerous option spellings while Git accepts unambiguous...

CVE-2026-102829 simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detection

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 2.0.1 of the argv-parser package, parseEnv omits VISUAL from GitEnvKeys, so prepareEnv drops the value before vulnerabilityCheck can classify it a...

CVE-2026-102829 simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detection

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 2.0.1 of the argv-parser package, parseEnv omits VISUAL from GitEnvKeys, so prepareEnv drops the value before vulnerabilityCheck can classify it a...