NPM: Payload: ReDoS in Multipart Content-Type Validation

NPM: Payload: ReDoS in Multipart Content-Type Validation vulnerability discovered by ? in WordPress Npm payload versions = 3.0.0, 3.90.0...

GHSA-2G7P-5934-Q4W7 Payload: ReDoS in Multipart Content-Type Validation

Impact A malformed multipart request body could take an extremely long time to finish. Patches Users should upgrade Payload packages to = 3.90.0 or = 4.0.0-canary.34...

Regular Expression Denial of Service (ReDoS)

Overview payload is a Node, React and MongoDB Headless CMS and Application Framework Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via unbounded multipart request processing in processMultipart.ts. An unauthenticated attacker can send an arbitraril...

Payload: ReDoS in Multipart Content-Type Validation

Impact A malformed multipart request body could take an extremely long time to finish. Patches Users should upgrade Payload packages to = 3.90.0 or = 4.0.0-canary.34...

CVE-2026-105854 Payload: ReDoS in Multipart Content-Type Validation

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, a malformed multipart request body can cause multipart Content-Type processing to take an extremely long time, resulting in uncontrolled resource...

CVE-2026-105854

The Payload headless content management system is vulnerable to a Regular Expression Denial of Service (ReDoS) . In versions 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34 , a malformed multipart request body can cause the multipart Content-Type processing to take an extremely lon...

CVE-2026-105854 Payload: ReDoS in Multipart Content-Type Validation

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, a malformed multipart request body can cause multipart Content-Type processing to take an extremely long time, resulting in uncontrolled resource...

CVE-2026-105854 Payload: ReDoS in Multipart Content-Type Validation

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, a malformed multipart request body can cause multipart Content-Type processing to take an extremely long time, resulting in uncontrolled resource...

CVE-2026-106454: Inefficient Regular Expression Complexity

Twisted is an event-based framework for internet applications, supporting Python 3.6+. In 25.5.0 and earlier, wildcardToRegexp in twisted/mail/imap4.py translates the IMAP asterisk and percent wildcards but passes all other characters from an authenticated client's LIST or LSUB pattern directly t...

Security Bulletin: middleware is vulnerable to algorithmic complexity denial of service when processing a crafted language tag containing a large number of hyphen separated subtags.

Summary Upgrade to InformixHQ 3.3.2 included in 14.10.14W1 and 15.0.1.16 Vulnerability Details CVEID:CVE-2026-69207 DESCRIPTION: Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.34, the built-in CORS middleware, hono/cors, is vulnerable to a...

CVE-2026-105646 Ghost: Regular Expression Denial of Service in Content Import

Ghost is a Node.js content management system. From 4.0.0 until 6.67.0, a crafted content import file could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. This issue is fixed in version 6.67.0...

CVE-2026-105645 Ghost: Regular Expression Denial of Service in External Media Inliner

Ghost is a Node.js content management system. From 5.37.0 until 6.67.0, a crafted request to the external media inliner could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. This issue is fixed in version 6.67.0...

Astra Linux – Vulnerability in node-ajv

The ajv Another JSON Schema Validator before version 8.18.0 is vulnerable to Regular Expression Denial of Service ReDoS when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax $data reference, which is passed directly to the JavaScript RegExp constructor...

Astra Linux – Vulnerability in Ruby2.5, JRuby

A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby, up to 3.2.1. The Time parser improperly handles invalid URLs that contain specific characters. This causes an increase in execution time when parsing strings into Time objects. The fixed versions are 0.1.1 and 0.2.2...

Astra Linux – Vulnerability in Jinja2

This issue affects the Jinja2 package versions starting from 0.0.0 and earlier than 2.11.3. The ReDoS vulnerability is primarily caused by the punctuationre regex operator and its use of multiple wildcards. The last wildcard is the most exploitable, as it is used to search for trailing punctuatio...

Astra Linux – Vulnerability in node-minimatch

Minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, matchOne performed unbounded recursive backtracking when a glob pattern contained multiple non-adjacent GLOBSTAR...

Astra Linux – Vulnerability in node-semver

Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service ReDoS via the function new Range, when untrusted user data is provided as a range...

Astra Linux – Vulnerability in Ruby 2.5

A ReDoS vulnerability was discovered in the URI component before 0.12.2 for Ruby. The URI parser improperly handles invalid URLs that contain specific characters. There is an increase in execution time when parsing strings into URI objects using rfc2396parser.rb and rfc3986parser.rb. NOTE: This...

Regular Expression Denial of Service (ReDoS)

Overview mammoth is a Convert Word documents from docx to simple HTML and Markdown Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the style map tokeniser in lib/styles/parser/tokeniser.js due to overlapping regex alternatives. Attackers can supp...

CVE-2026-105219 Mammoth.js 1.3.0 before 1.12.3 ReDoS via Style Map Tokeniser

Mammoth.js 1.3.0 before 1.12.3 contains a regular expression denial of service vulnerability in the style map tokeniser in lib/styles/parser/tokeniser.js due to overlapping regex alternatives. Attackers can supply a crafted .docx with an unterminated quoted string of repeated backslash escapes in...