254894 matches found
PT-2026-62044
Data::RadixTree::Shared versions before 0.02 for Perl allow an out-of-bounds read via unvalidated node and arena indices in rdx find locked. The attach-time validator rdx validate header checks the header scalars and region layout against the file size, but does not validate the node records it...
PT-2026-63262
Name of the Vulnerable Software and Affected Versions Elasticsearch affected versions not specified Description Uncontrolled Recursion in the query evaluation component allows a low-privileged authenticated user with read-level index access to cause a denial of service. By submitting a specially...
PT-2026-62043
Data::SortedSet::Shared versions before 0.03 for Perl allow an out-of-bounds read via unvalidated node indices in the rank and min/max query paths. The attach-time validator ss validate header bounds only the root index against the node pool node capacity. The order-statistics and min/max queries...
@astrojs/node: Backslash-prefixed paths not recognized as internal by trailing-slash redirect
Impact With trailingSlash: 'always' configured, the @astrojs/node standalone server's static file handler appends a trailing slash to request paths and issues a 301 redirect. Paths beginning with /\ slash-backslash were not recognized as internal paths, so the handler would echo the raw path back...
GHSA-GCFJ-64VW-6MP9 Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning
Summary Axios’ Node.js HTTP adapter can route requests through an attacker-controlled proxy when Object.prototype.proxy is polluted and request configuration is materialized as a regular object before dispatch. Recent axios releases harden merged request config by creating a null-prototype object...
Prototype Pollution
Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Prototype Pollution in the Node HTTP adapter lib/adapters/http.js, which reads config.proxy through the prototype chain after a request interceptor returns a plain-object...
GHSA-MWF2-3PR3-8698 Axios: HTTP/2 streamed uploads bypass `maxBodyLength`
Summary Axios versions with Node.js HTTP/2 support allow streamed request bodies to bypass maxBodyLength enforcement when requests are sent with httpVersion: 2. This affects applications that rely on maxBodyLength as a hard cap while forwarding attacker-controlled streams, such as upload endpoint...
CVE-2026-59875
creationtimestamp| type| source ---|---|--- 2026-07-20 22:35:12+00:00| published-proof-of-concept| https://github.com/isaacs/node-tar/security/advisories/GHSA-gvwx-54wh-qm9j 2026-07-22 12:01:16+00:00| seen| https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mrabmsdhlk24...
CVE-2026-59871
creationtimestamp| type| source ---|---|--- 2026-07-20 22:35:05+00:00| published-proof-of-concept| https://github.com/isaacs/node-tar/security/advisories/GHSA-w8wr-v893-vjvp 2026-07-22 12:01:14+00:00| seen| https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mrabmqeztj2n...
Allocation of Resources Without Limits or Throttling
Overview org.webjars.npm:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the getBodyLength and resolveBodyLength functions of lib/adapters/fetch.js, which lack a branch fo...
GHSA-F4GW-2P7V-4548 Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios
Summary Axios versions containing lib/helpers/shouldBypassProxy.js do not treat 0.0.0.0 as a local address when evaluating NOPROXY rules. In Node.js applications that use HTTPPROXY or HTTPSPROXY together with NOPROXY=localhost,127.0.0.1,::1 or similar, a request to http://0.0.0.0:/ can be routed...
EUVD-2026-42308
node-tar: Process crash via PAX numeric path type confusion...
GHSA-W8WR-V893-VJVP node-tar: Process crash via PAX numeric path type confusion
Summary A crafted 2.5KB tar archive crashes any Node.js process that extracts it. The PAX header parser coerces all-digit path values to JavaScript numbers, which causes an uncaught TypeError when downstream code calls .split'/' on the numeric value. Error handlers and strict: false cannot...
node-tar: Decompression/parse DoS via unlimited input
Summary A Decompression/parse DoS via unlimited input vulnerability in node-tar allows an attacker to exhaust server resources disk space and CPU. Because the library does not enforce hard upper bounds on total decompressed data or entry counts, a small, maliciously crafted "Gzip Bomb" can be use...
GHSA-23HP-3JRH-7FPW node-tar: Decompression/parse DoS via unlimited input
Summary A Decompression/parse DoS via unlimited input vulnerability in node-tar allows an attacker to exhaust server resources disk space and CPU. Because the library does not enforce hard upper bounds on total decompressed data or entry counts, a small, maliciously crafted "Gzip Bomb" can be use...
NPM: node-tar: Decompression/parse DoS via unlimited input
NPM: node-tar: Decompression/parse DoS via unlimited input vulnerability discovered by ? in WordPress Npm tar versions = 7.5.18...
EUVD-2026-42305
node-tar: Decompression/parse DoS via unlimited input...
NPM: node-tar: Negative tar entry size causes infinite loop in archive replace
NPM: node-tar: Negative tar entry size causes infinite loop in archive replace vulnerability discovered by ? in WordPress Npm tar versions = 7.5.17...