11445 matches found
Allocation of Resources Without Limits or Throttling
Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the pbkdf2 function in lib/sync.js, which passes the raw password to createHmac on every PBKDF2 iteration. Because HMAC rehashes any key longer than the digest's block size per RF...
CVE-2026-102414
pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback lib/sync.js. A password longer than the block size 64 bytes, or 128 bytes for sha384 and sha512 is passed to HMAC as the key on every iteration, and HMAC hashes such keys in...
UBUNTU-CVE-2026-102414
pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback lib/sync.js. A password longer than the block size 64 bytes, or 128 bytes for sha384 and sha512 is passed to HMAC as the key on every iteration, and HMAC hashes such keys in...
CVE-2026-102414 pbkdf2 rehashes long passwords on every iteration, enabling denial of service
pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback lib/sync.js. A password longer than the block size 64 bytes, or 128 bytes for sha384 and sha512 is passed to HMAC as the key on every iteration, and HMAC hashes such keys in...
CVE-2026-102414
The pbkdf2 library (versions through 3.1.6 ) contains a vulnerability where passwords exceeding the digest's block size (64 bytes, or 128 bytes for sha384/sha512) are re-hashed on every iteration within the JavaScript fallback (lib/sync.js ). This results in a computational cost of O(iterations ×...
CVE-2026-102414
pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback lib/sync.js. A password longer than the block size 64 bytes, or 128 bytes for sha384 and sha512 is passed to HMAC as the key on every iteration, and HMAC hashes such keys in...
CVE-2026-102414 pbkdf2 rehashes long passwords on every iteration, enabling denial of service
pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback lib/sync.js. A password longer than the block size 64 bytes, or 128 bytes for sha384 and sha512 is passed to HMAC as the key on every iteration, and HMAC hashes such keys in...
sitesentinel
SiteSentinel A drop-in website security module that partici...
Exploit for CVE-2026-101894
CVE-2026-101894 — @xhmikosr/decompress symlink-chain path trav...
CLEANSTART-2026-IF81553 undici's WebSocket client crashes the whole Node
Security vulnerability affects the langfuse package. undici's WebSocket client crashes the whole Node...
CLEANSTART-2026-NP94260 flaw in Node
Security vulnerability affects the apache-superset package. A flaw in Node...
CLEANSTART-2026-NF20161 flaw in Node
Security vulnerability affects the apache-superset package. A flaw in Node...
CLEANSTART-2026-TF09981 flaw in Node
Security vulnerability affects the apache-superset package. A flaw in Node...
CLEANSTART-2026-OM37971 flaw in Node
Security vulnerability affects the apache-superset package. A flaw in Node...
CLEANSTART-2026-NZ34356 flaw in Node
Security vulnerability affects the apache-superset package. A flaw in Node...
CLEANSTART-2026-UP28744 malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node
Security vulnerability affects the apache-superset package. A malformed HTTP/2 HEADERS frame with oversized, invalid HPACK data can cause Node...
CLEANSTART-2026-DI68809 memory leak in Node
Security vulnerability affects the apache-superset package. A memory leak in Node...
CLEANSTART-2026-IH43299 Browserslist is a configuration tool for sharing target browsers and Node
Security vulnerability affects the argo-workflows package. Browserslist is a configuration tool for sharing target browsers and Node...
CLEANSTART-2026-HE25090 Browserslist is a configuration tool for sharing target browsers and Node
Security vulnerability affects the argo-workflows package. Browserslist is a configuration tool for sharing target browsers and Node...