CVE-2026-85429 MOOS-IvP through 24.8.1 uFldNodeComms Node Message Source Spoofing

MOOS-IvP uFldNodeComms through 24.8.1 trusts the source node identity from the message body rather than validating it from the connection source. Attackers can craft NODEMESSAGE packets with spoofed source identities to impersonate other nodes and post arbitrary variable notifications without...

CVE-2026-85429

MOOS-IvP uFldNodeComms (through version 24.8.1) trusts the source node identity from the message body rather than validating it against the connection source. An attacker can craft NODE_MESSAGE packets with spoofed source identities to impersonate other nodes and post arbitrary variable notificat...

DEBIAN-CVE-2026-85063

node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and groupcolumnsbyname options enabled treats a duplicate proto header as an existing property in packages/csv-parse/lib/api/index.js, assigns an...

CVE-2026-85063

node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and groupcolumnsbyname options enabled treats a duplicate proto header as an existing property in packages/csv-parse/lib/api/index.js, assigns an...

CVE-2026-77465

toml-node is a TOML parser for Node.js and the browser. Prior to 4.2.0, toml.parse uses a Peggy 5.1.0 generated recursive-descent parser in lib/parser.js whose peg$parsevalue, peg$parsearray, and peg$parseinlinetableentry functions recurse through nested arrays and inline tables without a depth...

CVE-2026-63376

toml-node is a TOML parser for Node.js and the browser. Prior to 4.1.2, toml.parse in lib/compiler.js can be tricked by a table path such as a.b.y.proto.proto, allowing traversal from a scalar value into Number.prototype and Object.prototype. The currentPath tracking value uses both arrays and...

CVE-2026-85063

node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and groupcolumnsbyname options enabled treats a duplicate proto header as an existing property in packages/csv-parse/lib/api/index.js, assigns an...

CVE-2026-77465

creationtimestamp| type| source ---|---|--- 2026-09-03 21:05:03+00:00| seen| https://gist.github.com/alon710/aeca88a9cadc2c33877b37b541208edc 2026-09-03 22:35:11+00:00| published-proof-of-concept| https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-82x6-q7mm-w9cf 2026-09-03...

CVE-2026-85063

A flaw was found in node-csv, specifically within its csv-parse component. When configured with columns and groupcolumnsbyname options, a remote attacker can craft a malicious CSV header to manipulate the proto property. This allows the injection of attacker-controlled values into the parsed...

NPM: toml-node: Uncontrolled Recursion

NPM: toml-node: Uncontrolled Recursion vulnerability discovered by ? in WordPress Npm toml versions 4.2.0...

GHSA-82X6-Q7MM-W9CF toml-node: Uncontrolled Recursion

Summary toml.parse crashes with an uncaught RangeError: Maximum call stack size exceeded when parsing deeply nested arrays or inline tables. The parser is generated by Peggy 5.1.0 a PEG parser generator as a recursive-descent parser; the value rule mutually recurses with the array and inline-tabl...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion in lib/parser.js, where the mutually recursive peg$parsevalue, peg$parsearray, and peg$parseinlinetableentry functions recurse to the input's nesting depth with no depth limit. An attacker can crash the process wi...

toml-node: Uncontrolled Recursion

Summary toml.parse crashes with an uncaught RangeError: Maximum call stack size exceeded when parsing deeply nested arrays or inline tables. The parser is generated by Peggy 5.1.0 a PEG parser generator as a recursive-descent parser; the value rule mutually recurses with the array and inline-tabl...

toml-node: Prototype Pollution Leads to `Object.prototype` Corruption via `__proto__` Key-Path Desynchronization

Summary toml.parse writes attacker-controlled keys onto Object.prototype. The compiler protects the tables it builds by creating them with Object.createnull, which neutralizes a direct proto table. An attacker bypasses that protection by routing a table path through a scalar value and into the re...

NPM: toml-node: Prototype Pollution Leads to `Object.prototype` Corruption via `__proto__` Key-Path Desynchronization

NPM: toml-node: Prototype Pollution Leads to Object.prototype Corruption via proto Key-Path Desynchronization vulnerability discovered by ? in WordPress Npm toml versions 4.1.2...

GHSA-V5MP-JGW5-2X6J toml-node: Prototype Pollution Leads to `Object.prototype` Corruption via `__proto__` Key-Path Desynchronization

Summary toml.parse writes attacker-controlled keys onto Object.prototype. The compiler protects the tables it builds by creating them with Object.createnull, which neutralizes a direct proto table. An attacker bypasses that protection by routing a table path through a scalar value and into the re...

CVE-2026-77465 toml-node: Uncontrolled Recursion

toml-node is a TOML parser for Node.js and the browser. Prior to 4.2.0, toml.parse uses a Peggy 5.1.0 generated recursive-descent parser in lib/parser.js whose peg$parsevalue, peg$parsearray, and peg$parseinlinetableentry functions recurse through nested arrays and inline tables without a depth...

CVE-2026-77465 toml-node: Uncontrolled Recursion

toml-node is a TOML parser for Node.js and the browser. Prior to 4.2.0, toml.parse uses a Peggy 5.1.0 generated recursive-descent parser in lib/parser.js whose peg$parsevalue, peg$parsearray, and peg$parseinlinetableentry functions recurse through nested arrays and inline tables without a depth...

CVE-2026-77465 toml-node: Uncontrolled Recursion

toml-node is a TOML parser for Node.js and the browser. Prior to 4.2.0, toml.parse uses a Peggy 5.1.0 generated recursive-descent parser in lib/parser.js whose peg$parsevalue, peg$parsearray, and peg$parseinlinetableentry functions recurse through nested arrays and inline tables without a depth...

CVE-2026-77465

toml-node is a TOML parser for Node.js and the browser. Prior to 4.2.0 , the Peggy 5.1.0-generated recursive-descent parser in lib/parser.js has functions (peg$parsevalue, peg$parsearray, peg$parseinline_table_entry) that recurse through nested arrays and inline tables without a depth limit . A r...