@applydigital/claude (>=1.0.0, <=1.2.1), @bsklaroff/yaac (>=0.0.1, <=0.0.6) +13 more potentially affected by CVE-2026-55607 via @anthropic-ai/claude-code (>=2.1.39, <=2.1.154)

@anthropic-ai/claude-code NPM version =2.1.39, =1.0.0, =0.0.1, =0.7.5, =0.6.0-beta.3, =1.30.1-broken.0, =0.8.1, =0.8.0, =1.0.33, =1.0.0-dev.1, =2.1.99, =0.0.2, =1.2.2, =1.2.3 Source cves: CVE-2026-55607 Source advisory: OSV:GHSA-7835-87Q9-RGVV...

io.javalin.community.openapi:javalin-redoc-plugin (>=5.0.0, <=5.2.0), io.javalin.community.openapi:openapi-test (>=5.0.0, <=5.0.1) +41 more potentially affected by CVE-2026-73643 via org.webjars.npm:js-yaml (>=3.1.0, <=4.3.1)

org.webjars.npm:js-yaml MAVEN version =3.1.0, =5.0.0, =5.0.0, =9.0.6, =2.0.0, =2.1.3, =0.1.3, =1.1.4, =2.1.0, =4.0.3 and more Source cves: CVE-2026-73643 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-18313071...

@20206205tech/nestjs-auth (>=1.0.0, <=1.4.1), @20206205tech/nestjs-common (>=0.3.0, <=0.11.4) +726 more potentially affected by CVE-2026-73643 via js-yaml (>=5.0.0, <=5.2.1)

js-yaml NPM version =5.0.0, =1.0.0, =0.3.0, =1.0.0, =0.0.1, =0.0.1, =0.0.1, =1.1.0, =1.1.0, =16.21.1, =1.9.29, =6.29.8, =3.4.141, =7.1.20, =2.2.62, =1.5.3, =1.5.6 and more Source cves: CVE-2026-73643 Source advisory: OSV:GHSA-PM4M-PH32-GHV5...

@20206205tech/nestjs-auth (>=1.0.0, <=1.4.1), @20206205tech/nestjs-common (>=0.3.0, <=0.11.4) +726 more potentially affected by unknown CVE via js-yaml (>=5.0.0, <=5.2.1)

js-yaml NPM version =5.0.0, =1.0.0, =0.3.0, =1.0.0, =0.0.1, =0.0.1, =0.0.1, =1.1.0, =1.1.0, =16.21.1, =1.9.29, =6.29.8, =3.4.141, =7.1.20, =2.2.62, =1.5.3, =1.5.6 and more Source cves: unknown CVE Source advisory: SNYK:JS-JSYAML-18313070...

@appigram/react-code-split-ssr (>=2.1.0, <=2.1.2), @ariestools/sdk-react-crypto (>=11.1.1, <=11.1.5) +28 more potentially affected by unknown CVE via react-router (>=8.0.0-pre.1, <=8.2.0)

react-router NPM version =8.0.0-pre.1, =2.1.0, =11.1.1, =3.4.0-ultramodern.0, =3.4.0-ultramodern.0, =3.4.0-ultramodern.0, =3.4.0-ultramodern.0, =3.4.0-ultramodern.0, =3.4.0-ultramodern.0, =3.4.0-ultramodern.0, =3.4.0-ultramodern.0, =3.4.0-ultramodern.0, =3.4.0-ultramodern.0, =3.4.0-ultramodern.0,...

@104corp/cdk-aws-codedeploy-on-premises (>=1.0.0, <=1.0.2), @aws-amplify/amplify-category-api (>=1.1.0-GqlExtensibility.1, <=4.2.0-rdsv2preview.0) +97 more potentially affected by unknown CVE via @aws-cdk/aws-codebuild (>=1.75.0, <=1.203.0)

@aws-cdk/aws-codebuild NPM version =1.75.0, =1.0.0, =1.1.0-GqlExtensibility.1, =1.2.0-geo.0, =4.13.3-beta.0, =7.6.26-npm-pkg-cli.0, =7.6.27-alpha.5030, =1.1.0-ext1.0, =1.75.0, =1.75.0, =1.75.0, =1.75.0, =1.75.0, =1.75.0, =1.75.0, =1.75.0, =1.203.0 and more Source cves: unknown CVE Source advisory...

@darthcav/ts-http-server (0.9.1), @digitalpaws/starr (0.0.2) +4 more potentially affected by CVE-2026-7120 via @fastify/static (10.1.0)

@fastify/static NPM version 10.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on @fastify/static and may be impacted: - @darthcav/ts-http-server 0.9.1 - @digitalpaws/starr 0.0.2 - @node-cli/static-server =3.1.17, =9.0.0-canary.19, =9.0.2 Source cves:...

GHSA-R292-9MHP-454M node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection

Summary node-tar npm tar contains an uncontrolled-recursion stack-exhaustion DoS in the internal mapHas helper used by filesFilter. When a consumer calls tar.t... or tar.x... with a non-empty member-selection list, node-tar installs a filter that closes over the recursive mapHas src/list.ts:33-44...

Directory Traversal

Overview org.webjars.npm:postcss is a PostCSS is a tool for transforming styles with JS plugins. Affected versions of this package are vulnerable to Directory Traversal via the loadMap process. An attacker can access the contents of arbitrary .map files on the filesystem by submitting crafted CSS...

@a-la-fois/api (>=0.0.25, <=0.0.39), @a-la-fois/doc-client (>=0.0.1-alpha.89, <=0.0.39) +116 more potentially affected by CVE-2026-73562 via mongoose (>=7.0.0, <=7.8.8)

mongoose NPM version =7.0.0, =0.0.25, =0.0.1-alpha.89, =0.0.25, =0.0.1, =0.0.25, =3.12.0, =1.0.0, =1.0.6-beta.0, =0.2.0-alpha.1, =0.2.0-alpha.0, =0.0.0, =1.0.2, =1.0.0, =7.6.10, =7.8.6 and more Source cves: CVE-2026-73562 Source advisory: OSV:GHSA-664H-WQGQ-64GW...

123ts-backend-setup-prod (1.0.0), 4casterschemas (>=1.0.0, <=1.0.1) +199 more potentially affected by unknown CVE via mongoose (>=8.0.0, <=8.24.0)

mongoose NPM version =8.0.0, =1.0.0, =2.1.5, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =3.13.0, =3.17.2 - @albertoielpo/kk-cli 1.0.7 and more Source cves: unknown CVE Source advisory: SNYK:JS-MONGOOSE-18319533...

123ts-backend-setup-prod (1.0.0), 4casterschemas (>=1.0.0, <=1.0.1) +199 more potentially affected by CVE-2026-73562 via mongoose (>=8.0.0, <=8.24.0)

mongoose NPM version =8.0.0, =1.0.0, =2.1.5, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =3.13.0, =3.17.2 - @albertoielpo/kk-cli 1.0.7 and more Source cves: CVE-2026-73562 Source advisory: OSV:GHSA-664H-WQGQ-64GW...

@akemona-org/strapi-connector-mongoose (>=3.18.2, <=3.19.3), @albertoielpo/kk-cli (>=1.1.0, <=1.1.2) +30 more potentially affected by CVE-2026-73562 via mongoose (>=9.0.0, <=9.7.1)

mongoose NPM version =9.0.0, =3.18.2, =1.1.0, =2.20.0, =12.3.0, =11.0.36, =8.2.3, =0.2.29, =0.0.1, =11.7.0, =4.0.0, =2.0.0, =2.0.0, =0.4.1, =0.1.24, =0.7.0, =0.11.0 and more Source cves: CVE-2026-73562 Source advisory: OSV:GHSA-664H-WQGQ-64GW...

@backstage/plugin-auth-backend (>=0.0.0-nightly-20240122021809, <=0.22.11), @backstage/plugin-auth-backend-module-aws-alb-provider (>=0.0.0-nightly-20240126021148, <=0.4.17-next.0) +12 more potentially affected by CVE-2026-73563 via @backstage/plugin-auth-backend (>=0.0.0-nightly-20240929023448, <=0.29.1-next.0)

@backstage/plugin-auth-backend NPM version =0.0.0-nightly-20240929023448, =0.0.0-nightly-20240122021809, =0.0.0-nightly-20240126021148, =0.0.0-nightly-20240122021809, =0.0.0-nightly-202201422556, =0.0.0-nightly-202111222339, =0.0.0-nightly-2021102522541, =0.0.0-nightly-20220203021748,...

@backstage/plugin-auth-backend (>=0.0.0-nightly-20240122021809, <=0.22.11), @backstage/plugin-auth-backend-module-aws-alb-provider (>=0.0.0-nightly-20240126021148, <=0.4.17-next.0) +12 more potentially affected by unknown CVE via @backstage/plugin-auth-backend (>=0.0.0-nightly-20240929023448, <=0.29.1-next.0)

@backstage/plugin-auth-backend NPM version =0.0.0-nightly-20240929023448, =0.0.0-nightly-20240122021809, =0.0.0-nightly-20240126021148, =0.0.0-nightly-20240122021809, =0.0.0-nightly-202201422556, =0.0.0-nightly-202111222339, =0.0.0-nightly-2021102522541, =0.0.0-nightly-20220203021748,...

@burger-editor/blocks (>=4.0.0-alpha.1, <=4.0.0-alpha.7), @burger-editor/client (>=4.0.0-alpha.1, <=4.0.0-alpha.7) +4 more potentially affected by unknown CVE via trix (>=2.0.8, <=2.1.15)

trix NPM version =2.0.8, =4.0.0-alpha.1, =4.0.0-alpha.1, =4.0.0-alpha.1, =4.0.0-alpha.5, =4.0.0-alpha.1, =1.0.1, =1.0.3 Source cves: unknown CVE Source advisory: SNYK:JS-TRIX-18307297...

@0xfutbol/id (>=2.0.0, <=2.0.200), @2060.io/credo-ts-didcomm-media-sharing (>=0.0.5, <=0.1.0) +806 more potentially affected by CVE-2026-59952 via valibot (>=1.0.0, <=1.4.1)

valibot NPM version =1.0.0, =2.0.0, =0.0.5, =0.0.4, =0.0.8, =0.0.12, =0.0.5, =4.3.136-beta.1, =0.10.1, =0.10.1, =0.10.1, =0.10.1, =0.4.0, =0.0.27, =0.1.0, =0.6.0, =0.6.4 and more Source cves: CVE-2026-59952 Source advisory: SNYK:JS-VALIBOT-18313048...

@aexol/opencode-tui (>=0.2.5, <=0.2.10), @agent-qofeno/agentx-cli (>=1.20.47, <=1.20.52) +122 more potentially affected by CVE-2026-59940 via seroval (>=1.0.7, <=1.3.2)

seroval NPM version =1.0.7, =0.2.5, =1.20.47, =2.11.0, =1.0.0, =1.0.0, =1.1.54, =1.1.54, =1.0.24, =0.1.0, =0.3.0, =0.3.2 - @entropy-tamer/reynard-config 0.1.2 - @entropy-tamer/reynard-i18n 1.2.0 - @entropy-tamer/reynard-validation 0.2.0 and more Source cves: CVE-2026-59940 Source advisory:...

@openinc/parse-server-opendash (>=4.0.0, <=4.1.1) potentially affected by CVE-2026-66009 via parse-server (>=9.6.0-alpha.37, <=9.9.1-alpha.13)

parse-server NPM version =9.6.0-alpha.37, =4.0.0, =4.1.1 Source cves: CVE-2026-66009 Source advisory: SNYK:JS-PARSESERVER-18306805...

@openinc/parse-server-opendash (>=4.0.0, <=4.1.1) potentially affected by CVE-2026-66008 via parse-server (>=9.6.0-alpha.37, <=9.9.1-alpha.13)

parse-server NPM version =9.6.0-alpha.37, =4.0.0, =4.1.1 Source cves: CVE-2026-66008 Source advisory: SNYK:JS-PARSESERVER-18306804...