CVE-2026-58044

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...

CVE-2026-58045

A flaw in Node.js allows a spoofed TypedArray byteLength to trigger a reachable assertion in the synchronous node:zlib APIs, causing the entire process to crash. All 11 synchronous zlib functions are affected. Repeated exploitation of this condition can result in a denial of service. This...

CVE-2026-56846

A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion. This vulnerability affects Node.js 24.x and 22.x...

CVE-2026-58045

The CVE-2026-58045 entry describes a vulnerability in Node.js where a spoofed TypedArray byteLength can trigger a reachable assertion in the synchronous node:zlib APIs, causing the process to crash. All 11 synchronous zlib functions are affected, and repeated exploitation may lead to denial of se...

PT-2026-74304

TuxCare rebuilt node-forge to address 4 CVEs. Fixed in 0.10.0-tuxcare.6...

PT-2026-67749

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.3 Description A sandbox escape exists in the executeJavaScriptCode function that allows an authenticated attacker to execute arbitrary system commands as root on the server. The issue occurs because the function...

The vulnerability of the library for web requests, node-XMLHttpRequest, related to errors in the certificate validation process, allows a perpetrator to trigger a service failure.

The vulnerability of the node-XMLHttpRequest library for web requests is related to errors in the certificate validation process. Exploiting this vulnerability could allow a malicious actor to cause service failures...

PT-2026-67770

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.3 Description An authenticated attacker can achieve remote code execution RCE through the SQLite Record Manager node. The issue occurs because the additionalConfig input is spread after the intended database setti...

PT-2026-74227

TuxCare rebuilt node-notifier to address 1 CVE. Fixed in 5.4.5-tuxcare.1...

PT-2026-73864

TuxCare rebuilt node-uuid to address 1 CVE. Fixed in 1.4.3-tuxcare.1...

PT-2026-89553

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=541969271 Crash type: Check failed Crash state: CheckUnwind mrb basic alloc func pm node hash insert...

PT-2026-74234

TuxCare rebuilt node-forge to address 6 CVEs. Fixed in 0.10.0-tuxcare.4...

PT-2026-74229

TuxCare rebuilt node-forge to address 2 CVEs. Fixed in 0.10.0-tuxcare.1...

CVE-2026-70477: Improper Control of Generation of Code

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, a prompt injection sent to a chatflow using a CSV Agent node can cause the LLM to respond with a malicious Python script that bypasses the blocklist validator and executes in an unsandboxed...

PT-2026-74253

TuxCare rebuilt node-fetch to address 1 CVE. Fixed in 1.7.3-tuxcare.1...

PT-2026-74252

TuxCare rebuilt node-fetch to address 1 CVE. Fixed in 2.6.1-tuxcare.1...

PT-2026-74250

TuxCare rebuilt node-fetch to address 1 CVE. Fixed in 1.6.3-tuxcare.1...

PT-2026-67910

-- ABSTRACT ------------------------------------- Trend Micro's Zero Day Initiative has identified a vulnerability affecting the following products: Flowise - Flowise -- VULNERABILITY DETAILS ------------------------ Version tested: 3.1.1 Installer file: https://github.com/FlowiseAI/Flowise npm...

PT-2026-67830

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.3 Description An unauthenticated remote attacker can execute arbitrary code in the context of the service account or the user running the server. The issue occurs when a chatflow uses a CSV Agent node, where the r...

PT-2026-67810

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.3 Description Flowise injects $vars into the code execution sandbox without requiring the variables:view permission, which bypasses the permission-protected Variables API. An unauthorized user or API key denied...