Type Confusion

Preact is vulnerable to Type Confusion. The vulnerability is due to weakened JSON serialization protections that allow specially crafted JSON objects to be treated as valid Virtual DOM nodes, which allows an attacker to inject malicious HTML or scripts when untrusted data is rendered without prop...

SUSE CVE-2026-22028

Preact, a lightweight web development framework, JSON serialization protection to prevent Virtual DOM elements from being constructed from arbitrary JSON. A regression introduced in Preact 10.26.5 caused this protection to be softened. In applications where values from JSON payloads are assumed t...

CVE-2026-22028

A flaw was found in Preact, a lightweight web development framework. A security regression allows an attacker to bypass JSON serialization protection, leading to HTML injection. This vulnerability arises when applications process unsanitized data from external sources, allowing malicious JSON to ...

CVE-2026-22028

Preact, a lightweight web development framework, JSON serialization protection to prevent Virtual DOM elements from being constructed from arbitrary JSON. A regression introduced in Preact 10.26.5 caused this protection to be softened. In applications where values from JSON payloads are assumed t...

UBUNTU-CVE-2026-22028

Preact, a lightweight web development framework, JSON serialization protection to prevent Virtual DOM elements from being constructed from arbitrary JSON. A regression introduced in Preact 10.26.5 caused this protection to be softened. In applications where values from JSON payloads are assumed t...

CVE-2026-22028

Preact, a lightweight web development framework, JSON serialization protection to prevent Virtual DOM elements from being constructed from arbitrary JSON. A regression introduced in Preact 10.26.5 caused this protection to be softened. In applications where values from JSON payloads are assumed t...

CVE-2026-22028 Preact has JSON VNode Injection issue

Preact, a lightweight web development framework, JSON serialization protection to prevent Virtual DOM elements from being constructed from arbitrary JSON. A regression introduced in Preact 10.26.5 caused this protection to be softened. In applications where values from JSON payloads are assumed t...

CVE-2026-22028 Preact has JSON VNode Injection issue

Preact, a lightweight web development framework, JSON serialization protection to prevent Virtual DOM elements from being constructed from arbitrary JSON. A regression introduced in Preact 10.26.5 caused this protection to be softened. In applications where values from JSON payloads are assumed t...

EUVD-2026-1184

Preact, a lightweight web development framework, JSON serialization protection to prevent Virtual DOM elements from being constructed from arbitrary JSON. A regression introduced in Preact 10.26.5 caused this protection to be softened. In applications where values from JSON payloads are assumed t...

CVE-2026-22028

Preact, a lightweight web development framework, JSON serialization protection to prevent Virtual DOM elements from being constructed from arbitrary JSON. A regression introduced in Preact 10.26.5 caused this protection to be softened. In applications where values from JSON payloads are assumed t...

CVE-2026-22028 Preact has JSON VNode Injection issue

Preact, a lightweight web development framework, JSON serialization protection to prevent Virtual DOM elements from being constructed from arbitrary JSON. A regression introduced in Preact 10.26.5 caused this protection to be softened. In applications where values from JSON payloads are assumed t...

CVE-2026-22028

CVE-2026-22028 affects Preact where a regression in 10.26.5 weakened JSON serialization protection, allowing JSON payloads to be mis-parsed as valid VNodes and potentially leading to HTML injection and script execution if CSP or other mitigations are not in place. Affected versions include 10.26....

Linux Distros Unpatched Vulnerability : CVE-2026-22028

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Preact, a lightweight web development framework, JSON serialization protection to prevent Virtual DOM elements from being constructed from arbitrary JSON. A...

preact 安全漏洞

preact is a Java library from Preact open source. A security vulnerability exists in preact version 10.26.5, which stems from weakened JSON serialization protection and could lead to HTML injection...

@knowbl_ai/nexus-chat (1.0.0), @wistia/wistia-player (0.4.0) +2 more potentially affected by CVE-2026-22028 via preact (>=10.28.0, <=10.28.1)

preact NPM version =10.28.0, =10.28.1 is affected by a known vulnerability. The following packages have a transitive dependency on preact and may be impacted: - @knowblai/nexus-chat 1.0.0 - @wistia/wistia-player 0.4.0 - @wistia/wistia-player-react 0.4.0 - astro-og 0.3.1 Source cves: CVE-2026-2202...

@clidey/dory (0.35.0), @garage44/bunchy (>=2.0.0, <=2.1.12) +15 more potentially affected by CVE-2026-22028 via preact (>=10.26.5, <=10.26.9)

preact NPM version =10.26.5, =2.0.0, =1.0.5, =3.0.0, =2.0.0, =19.0.0, =19.0.0, =19.0.0, =1.1.6, =5.14.0, =0.0.105, =0.0.105, =0.0.2, =0.0.109, =0.0.110 and more Source cves: CVE-2026-22028 Source advisory: OSV:GHSA-36HM-QXXP-PG3M...

@aigelb/chatbot-widget (>=5.0.0, <=8.2.0), @evelan/jexity-widget (>=0.0.1, <=0.13.1) +14 more potentially affected by CVE-2026-22028 via preact (>=10.27.0, <=10.27.2)

preact NPM version =10.27.0, =5.0.0, =0.0.1, =0.2.0-canary.7cb2837, =1.2.1, =1.4.1-snapshot-20251113025641, =3.0.263, =0.1.17, =0.1.17, =0.2.22, =1.14.0, =0.0.111, =0.0.122 - extension 3.11.1-canary.254.c83f9e7 and more Source cves: CVE-2026-22028 Source advisory: SNYK:JS-PREACT-14897824...

Access of Resource Using Incompatible Type ('Type Confusion')

Overview preact is a fast 3kB alternative to React with the same modern API. Affected versions of this package are vulnerable to Access of Resource Using Incompatible Type 'Type Confusion' during rendering in the vnode constructor. An attacker can inject arbitrary HTML or execute scripts by...

@knowbl_ai/nexus-chat (1.0.0), @wistia/wistia-player (0.4.0) +2 more potentially affected by CVE-2026-22028 via preact (>=10.28.0, <=10.28.1)

preact NPM version =10.28.0, =10.28.1 is affected by a known vulnerability. The following packages have a transitive dependency on preact and may be impacted: - @knowblai/nexus-chat 1.0.0 - @wistia/wistia-player 0.4.0 - @wistia/wistia-player-react 0.4.0 - astro-og 0.3.1 Source cves: CVE-2026-2202...

@aigelb/chatbot-widget (>=5.0.0, <=8.2.0), @evelan/jexity-widget (>=0.0.1, <=0.13.1) +14 more potentially affected by CVE-2026-22028 via preact (>=10.27.0, <=10.27.2)

preact NPM version =10.27.0, =5.0.0, =0.0.1, =0.2.0-canary.7cb2837, =1.2.1, =1.4.1-snapshot-20251113025641, =3.0.263, =0.1.17, =0.1.17, =0.2.22, =1.14.0, =0.0.111, =0.0.122 - extension 3.11.1-canary.254.c83f9e7 and more Source cves: CVE-2026-22028 Source advisory: OSV:GHSA-36HM-QXXP-PG3M...