Security Bulletin: Security vulnerability in IBM Datacap

Summary This vulnerability, CVE-2026-49844, is addressed in IBM Datacap version 9.1.9 Interim Fix 009. Vulnerability Details CVEID:CVE-2026-49844 DESCRIPTION: Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not...

UBUNTU-CVE-2026-97711

Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. From 7.1.1 until 7.1.2, function values serialized by serialize-javascript are not fully protected against script-closing tags in attacker-influenced function source because...

CLEANSTART-2026-NT71796 undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON

Security vulnerability affects the langfuse package. undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON...

CLEANSTART-2026-CC59685 fast-uri serializes the port component of a URI without validating it

Security vulnerability affects the langfuse package. fast-uri serializes the port component of a URI without validating it...

CLEANSTART-2026-SQ92018 WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute

Security vulnerability affects the apache-hive package. A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute...

CLEANSTART-2026-PP78809 Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON

CVE-2026-49844 affects multiple packages. Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. See references for individual vulnerability details...

CLEANSTART-2026-GV24243 Serialize JavaScript to a superset of JSON that includes regular expressions and functions

Security vulnerability affects the argo-workflows package. Serialize JavaScript to a superset of JSON that includes regular expressions and functions...

PT-2026-108488

Security vulnerability affects the langfuse package. undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON...

PT-2026-108361

Security vulnerability affects the langfuse package. fast-uri serializes the port component of a URI without validating it...

PT-2026-108413

Security vulnerability affects the argo-workflows package. Serialize JavaScript to a superset of JSON that includes regular expressions and functions...

EUVD-2026-70280

fast-uri vulnerable to authority injection via an unvalidated port in serialize...

Angular SSR: XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements

Summary An XSS vulnerability exists in @angular/platform-server during server-side rendering SSR HTML serialization of ProcessingInstruction DOM nodes , nodeType === 7 when nested inside fallback raw-content elements , , , . While processing instruction data escaped to , it did not check for or...

GHSA-J3R3-MXQP-R2P4 Angular SSR: XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements

Summary An XSS vulnerability exists in @angular/platform-server during server-side rendering SSR HTML serialization of ProcessingInstruction DOM nodes , nodeType === 7 when nested inside fallback raw-content elements , , , . While processing instruction data escaped to , it did not check for or...

EUVD-2026-88465

Authlib v1.7.2 and below contains a signature verification bypass vulnerability. The JsonWebSignature.deserializejson method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key...

CVE-2026-101909

A flaw was found in axios. In applications affected by prototype pollution, where an attacker can modify base JavaScript object properties, axios processes inherited options during form data serialization without verifying property ownership. An attacker can leverage this behavior to trigger a...

DEBIAN-CVE-2026-101909

Axios is a promise-based HTTP client for the browser and Node.js. From 0.28.0 until 0.34.0 and 1.15.1 until 1.20.0, ToFormData processes inherited serialization options and visitor properties supplied through prototype pollution. A separate same-process prototype-pollution flaw supplies inherited...

CVE-2026-101909

Axios is a promise-based HTTP client for the browser and Node.js. From 0.28.0 until 0.34.0 and 1.15.1 until 1.20.0, ToFormData processes inherited serialization options and visitor properties supplied through prototype pollution. A separate same-process prototype-pollution flaw supplies inherited...

CVE-2026-101909

Axios is a promise-based HTTP client for the browser and Node.js. From 0.28.0 until 0.34.0 and 1.15.1 until 1.20.0, ToFormData processes inherited serialization options and visitor properties supplied through prototype pollution. A separate same-process prototype-pollution flaw supplies inherited...

CVE-2026-101909

The Axios promise-based HTTP client (versions 0.28.0 to 0.34.0 and 1.15.1 to 1.20.0 ) contains a Prototype Pollution Gadget in the toFormData options. The vulnerability exists because ToFormData processes inherited serialization options and visitor properties. This allows an attacker who has alre...

CVE-2026-100647

vLLM versions before 0.29.0 contain a denial-of-service vulnerability in the cachesalt parameter accepted on OpenAI-compatible and Anthropic API endpoints, which lacks maximum length validation and is processed on the single EngineCore scheduler thread. Unauthenticated attackers can send HTTP...