Critical Next.js ImageResponse Flaw Can Lead to Server Code Execution via Crafted SVG Input

A new security vulnerability in Next.js could allow attackers to run code on a server via ImageResponse, the feature that generates Open Graph and other social preview images, Vercel said. The risk applies when an app puts values an attacker controls, such as text read from the request URL, into...

MAL-2026-16461 Malicious code in godxxx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a22893c200272af03998e9f6c5df91c6e4971b3d2622a80df8eab58b98e0a9a1 cdpinject.js is declared as the package main and unconditionally calls main at module top level when the process is not invoked with --stop/--detach,...

CLEANSTART-2026-BT23660 Browserslist is a configuration tool for sharing target browsers and Node

Security vulnerability affects the qdrant package. Browserslist is a configuration tool for sharing target browsers and Node...

CLEANSTART-2026-NW83834 Browserslist is a configuration tool for sharing target browsers and Node

Security vulnerability affects the qdrant package. Browserslist is a configuration tool for sharing target browsers and Node...

CLEANSTART-2026-QV01130 Improper OCSP response validation in the Snowflake Python, Go, JDBC, and Node

Security vulnerability affects the vault package. Improper OCSP response validation in the Snowflake Python, Go, JDBC, and Node...

Linux Distros Unpatched Vulnerability : CVE-2026-77301

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, getData in zipEntry.js trusts an entry's central-directory...

MAL-2026-16413 Malicious code in @tvg-mar/promos-gtm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c4ce7a8a15cabec2c11f60085a7b3bac2cc905ef037e5ce28d6dd3dd847ef28 @tvg-mar/[email protected] executes an out-of-band DNS exfiltration routine both at install time via a scripts.install hook running node index.js and...

CVE-2026-62985

request-filtering-agent is an https.Agent implementation that blocks requests to Private/Reserved IP addresses. Prior to 3.2.1, RequestFilteringHttpAgent and RequestFilteringHttpsAgent synchronously threw from createConnection when rejecting a literal private-IP host such as 169.254.169.254 or...

request-filtering-agent: Synchronous throw from createConnection() for literal private-IP hosts bypasses req.on('error'), crashing the Node.js process

Summary RequestFilteringHttpAgent / RequestFilteringHttpsAgent block requests to private IPs, but the blocking happens via a synchronous throw inside createConnection for literal private-IP hostnames e.g. 169.254.169.254, 127.0.0.1. Node.js's http.request / http.get expects createConnection to em...

GHSA-R3R9-WP5J-PQ5G request-filtering-agent: Synchronous throw from createConnection() for literal private-IP hosts bypasses req.on('error'), crashing the Node.js process

Summary RequestFilteringHttpAgent / RequestFilteringHttpsAgent block requests to private IPs, but the blocking happens via a synchronous throw inside createConnection for literal private-IP hostnames e.g. 169.254.169.254, 127.0.0.1. Node.js's http.request / http.get expects createConnection to em...

Uncaught Exception

Overview request-filtering-agent is an An https.Agent implementation that block request Private IP address. Affected versions of this package are vulnerable to Uncaught Exception via the createConnection method in RequestFilteringHttpAgent and RequestFilteringHttpsAgent, when a blocked IP address...

NPM: request-filtering-agent: Synchronous throw from createConnection() for literal private-IP hosts bypasses req.on('error'), crashing the Node.js process

NPM: request-filtering-agent: Synchronous throw from createConnection for literal private-IP hosts bypasses req.on'error', crashing the Node.js process vulnerability discovered by ? in WordPress Npm request-filtering-agent versions 3.2.1...

CVE-2026-62985 request-filtering-agent: Synchronous throw from createConnection() for literal private-IP hosts bypasses req.on('error'), crashing the Node.js process

request-filtering-agent is an https.Agent implementation that blocks requests to Private/Reserved IP addresses. Prior to 3.2.1, RequestFilteringHttpAgent and RequestFilteringHttpsAgent synchronously threw from createConnection when rejecting a literal private-IP host such as 169.254.169.254 or...

EUVD-2026-84679

request-filtering-agent is an https.Agent implementation that blocks requests to Private/Reserved IP addresses. Prior to 3.2.1, RequestFilteringHttpAgent and RequestFilteringHttpsAgent synchronously threw from createConnection when rejecting a literal private-IP host such as 169.254.169.254 or...

CVE-2026-62985 request-filtering-agent: Synchronous throw from createConnection() for literal private-IP hosts bypasses req.on('error'), crashing the Node.js process

request-filtering-agent is an https.Agent implementation that blocks requests to Private/Reserved IP addresses. Prior to 3.2.1, RequestFilteringHttpAgent and RequestFilteringHttpsAgent synchronously threw from createConnection when rejecting a literal private-IP host such as 169.254.169.254 or...

CVE-2026-62985 request-filtering-agent: Synchronous throw from createConnection() for literal private-IP hosts bypasses req.on('error'), crashing the Node.js process

request-filtering-agent is an https.Agent implementation that blocks requests to Private/Reserved IP addresses. Prior to 3.2.1, RequestFilteringHttpAgent and RequestFilteringHttpsAgent synchronously threw from createConnection when rejecting a literal private-IP host such as 169.254.169.254 or...

CVE-2026-93687

A flaw was found in braces. This stack overflow vulnerability exists in the recursive Abstract Syntax Tree AST walkers due to a lack of depth guards. A remote attacker can exploit this by supplying deeply nested brace patterns, leading to the exhaustion of the call stack and termination of the...

K000163374: Node.js vulnerability CVE-2026-21717

Security Advisory Description A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8's internal string table, an attacker can significantly...

EUVD-2026-84198

Sync-in Server has a ReDoS via Unsanitized Regex in Sync Diff pathFilters...

Sync-in Server has a ReDoS via Unsanitized Regex in Sync Diff `pathFilters`

Affected component: Sync-in Server v2.3.0, POST /api/app/sync/operation/diff/:id, vulnerable implementation of pathFilters in backend/src/applications/sync/dtos/sync-operations.dto.ts. Summary In the vulnerable version, the sync diff endpoint accepted a user-controlled regex pattern through...