@chrisleekr/mcp-server-playground (>=1.1.0-dev-0d04f54.1, <=1.1.2), @intlayer/backend (>=7.0.9-canary.2, <=7.5.9) +29 more potentially affected by CVE-2026-30827 via express-rate-limit (8.2.1)

express-rate-limit NPM version 8.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on express-rate-limit and may be impacted: - @chrisleekr/mcp-server-playground =1.1.0-dev-0d04f54.1, =7.0.9-canary.2, =1.597.450, =4.0.0, =3.1.0, =0.0.1-canary.1, =0.42.0...

@igea/oac_backend (>=1.0.35, <=1.0.119), @igea/oac_frontend (>=1.0.31, <=1.0.119) +11 more potentially affected by CVE-2026-30827 via express-rate-limit (8.1.0)

express-rate-limit NPM version 8.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on express-rate-limit and may be impacted: - @igea/oacbackend =1.0.35, =1.0.31, =7.0.0-canary.2, =2.0.0-test.19, =0.29.0, =0.16.0, =0.42.0, =0.27.0, =0.42.0, =0.70.0,...

@chrisleekr/mcp-server-playground (>=1.1.0-dev-0d04f54.1, <=1.1.2), @intlayer/backend (>=7.0.9-canary.2, <=7.5.9) +29 more potentially affected by CVE-2026-30827 via express-rate-limit (8.2.1)

express-rate-limit NPM version 8.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on express-rate-limit and may be impacted: - @chrisleekr/mcp-server-playground =1.1.0-dev-0d04f54.1, =7.0.9-canary.2, =1.597.450, =4.0.0, =3.1.0, =0.0.1-canary.1, =0.42.0...

@igea/oac_backend (>=1.0.35, <=1.0.119), @igea/oac_frontend (>=1.0.31, <=1.0.119) +11 more potentially affected by CVE-2026-30827 via express-rate-limit (8.1.0)

express-rate-limit NPM version 8.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on express-rate-limit and may be impacted: - @igea/oacbackend =1.0.35, =1.0.31, =7.0.0-canary.2, =2.0.0-test.19, =0.29.0, =0.16.0, =0.42.0, =0.27.0, =0.42.0, =0.70.0,...

@george.talusan/node-red-contrib-copilot (>=0.0.5, <=1.0.5), @github/copilot-sdk (>=0.1.9, <=0.1.31-unstable.0) +19 more potentially affected by CVE-2026-29783 via @github/copilot (>=0.0.375, <=0.0.421)

@github/copilot NPM version =0.0.375, =0.0.5, =0.1.9, =1.1.0, =0.0.0, =0.13.0, =0.0.1, =1.2.3, =0.6.0, =1.0.1, =0.1.0, =1.0.0, =1.0.0, =1.0.15 - devdoctor-js 0.1.0 and more Source cves: CVE-2026-29783 Source advisory: OSV:GHSA-G8R9-G2V8-JV6F...

@george.talusan/node-red-contrib-copilot (>=0.0.5, <=1.0.5), @github/copilot-sdk (>=0.1.9, <=0.1.31-unstable.0) +19 more potentially affected by CVE-2026-29783 via @github/copilot (>=0.0.375, <=0.0.421)

@github/copilot NPM version =0.0.375, =0.0.5, =0.1.9, =1.1.0, =0.0.0, =0.13.0, =0.0.1, =1.2.3, =0.6.0, =1.0.1, =0.1.0, =1.0.0, =1.0.0, =1.0.15 - devdoctor-js 0.1.0 and more Source cves: CVE-2026-29783 Source advisory: SNYK:JS-GITHUBCOPILOT-15468228...

ifood2-github-io (9.9.9) potentially affected by unknown CVE via ifood-github-io (9.9.9)

ifood-github-io NPM version 9.9.9 is affected by a known vulnerability. The following packages have a transitive dependency on ifood-github-io and may be impacted: - ifood2-github-io 9.9.9 Source cves: unknown CVE Source advisory: SNYK:JS-IFOODGITHUBIO-16300296...

@amedia/brick-mcp (>=0.0.0-vSNAPSHOT-20260217144000, <=1.0.0), @area15/ticket-component (0.1.0) +109 more potentially affected by CVE-2026-3419 via fastify (>=5.7.2, <=5.7.4)

fastify NPM version =5.7.2, =0.0.0-vSNAPSHOT-20260217144000, =0.5.2, =0.5.2, =0.5.2, =0.5.2, =0.2.11, =2.4.2-next.143, =2.4.2-next.143, =2.4.2-next.143, =2.4.2-next.143, =2.11.6, =5.1.19, =2.21.2, =2.21.2, =2.21.3 and more Source cves: CVE-2026-3419 Source advisory: OSV:GHSA-573F-X89G-HQP9...

@amedia/brick-mcp (>=0.0.0-vSNAPSHOT-20260217144000, <=1.0.0), @area15/ticket-component (0.1.0) +109 more potentially affected by CVE-2026-3419 via fastify (>=5.7.2, <=5.7.4)

fastify NPM version =5.7.2, =0.0.0-vSNAPSHOT-20260217144000, =0.5.2, =0.5.2, =0.5.2, =0.5.2, =0.2.11, =2.4.2-next.143, =2.4.2-next.143, =2.4.2-next.143, =2.4.2-next.143, =2.11.6, =5.1.19, =2.21.2, =2.21.2, =2.21.3 and more Source cves: CVE-2026-3419 Source advisory: SNYK:JS-FASTIFY-15428269...

bws-web-server (>=0.1.0, <=0.1.1), pingora (>=0.1.0, <=0.6.0) +3 more potentially affected by CVE-2026-2836 via pingora-cache (>=0.1.1, <=0.6.0)

pingora-cache CARGO version =0.1.1, =0.1.0, =0.1.0, =0.1.0, =0.6.0 - revoke-gateway 0.3.0 - static-files-module 0.1.0 Source cves: CVE-2026-2836 Source advisory: OSV:GHSA-F93W-PCJ3-RGGC...

bws-web-server (>=0.1.0, <=0.1.1), pingora (>=0.1.0, <=0.6.0) +6 more potentially affected by CVE-2026-2833 via pingora-core (>=0.1.1, <=0.6.0)

pingora-core CARGO version =0.1.1, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.7 - revoke-gateway 0.3.0 - static-files-module 0.1.0 Source cves: CVE-2026-2833 Source advisory: OSV:GHSA-XQ2H-P299-VJWV...

web3.db-fileconnector (>=1.4.0, <=1.8.6) potentially affected by CVE-2025-64166 via mercurius (16.1.0)

mercurius NPM version 16.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on mercurius and may be impacted: - web3.db-fileconnector =1.4.0, =1.8.6 Source cves: CVE-2025-64166 Source advisory: SNYK:JS-MERCURIUS-15428327...

web3.db-fileconnector (>=1.4.0, <=1.8.6) potentially affected by CVE-2025-64166 via mercurius (16.1.0)

mercurius NPM version 16.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on mercurius and may be impacted: - web3.db-fileconnector =1.4.0, =1.8.6 Source cves: CVE-2025-64166 Source advisory: OSV:GHSA-V66J-6WWF-JC57...

@3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5), @a0dotrun/expose (>=0.0.2, <=0.0.4) +644 more potentially affected by CVE-2026-29085 via hono (>=3.8.4, <=4.12.3)

hono NPM version =3.8.4, =0.1.8-fix.3, =0.0.2, =5.0.0, =0.9.0, =0.1.9, =0.2.0, =0.2.0, =0.4.0, =0.2.0, =0.0.1, =1.0.2, =2.0.0-beta.66, =2.0.0-beta.66, =0.0.1, =0.0.16 and more Source cves: CVE-2026-29085 Source advisory: SNYK:JS-HONO-15423717...

@3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5), @a0dotrun/expose (>=0.0.2, <=0.0.4) +396 more potentially affected by CVE-2026-29045 via hono (>=4.0.0, <=4.12.3)

hono NPM version =4.0.0, =0.1.8-fix.3, =0.0.2, =0.9.0, =0.1.9, =0.2.0, =0.2.0, =0.4.0, =0.2.0, =0.0.1, =1.0.2, =2.0.0-beta.66, =2.0.0-beta.66, =0.0.1, =0.0.1, =0.0.1-experimental.1, =0.0.26 and more Source cves: CVE-2026-29045 Source advisory: SNYK:JS-HONO-15419466...

@3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5), @a0dotrun/expose (>=0.0.2, <=0.0.4) +673 more potentially affected by CVE-2026-29086 via hono (>=0.5.10, <=4.12.3)

hono NPM version =0.5.10, =0.1.8-fix.3, =0.0.2, =5.0.0, =0.9.0, =0.1.9, =0.2.0, =0.2.0, =0.4.0, =0.2.0, =0.0.1, =1.0.2, =2.0.0-beta.66, =2.0.0-beta.66, =0.0.1, =0.0.16 and more Source cves: CVE-2026-29086 Source advisory: SNYK:JS-HONO-15418360...

better-auth-cloudflare (0.1.0), next-ai-draw-io (0.4.10) potentially affected by CVE-2025-6087 +1 more via @opennextjs/cloudflare (>=1.0.1, <=1.14.8)

@opennextjs/cloudflare NPM version =1.0.1, =1.14.8 is affected by a known vulnerability. The following packages have a transitive dependency on @opennextjs/cloudflare and may be impacted: - better-auth-cloudflare 0.1.0 - next-ai-draw-io 0.4.10 Source cves: CVE-2025-6087, CVE-2026-3125 Source...

@3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5), @adenta/cms (>=0.0.6, <=1.1.1-0) +563 more potentially affected by CVE-2026-29786 via tar (>=7.0.0, <=7.5.9)

tar NPM version =7.0.0, =0.1.8-fix.3, =0.0.6, =11.0.19, =1.0.0, =1.0.2, =0.1.1, =0.1.1, =2.17.11, =1.9.5, =1.0.2, =8.8.3, =8.11.4 - @altipla/directus-sdk-utils 0.7.2 - @applitools/core 4.20.0 - @applitools/core-base 1.17.0 - @applitools/ec-client 1.9.6 and more Source cves: CVE-2026-29786 Source...

4591-libs (>=0.0.1, <=0.2.0), @10abdullahbutt/nestjs-boilerplate (0.0.1) +1513 more potentially affected by CVE-2026-3520 via multer (>=2.0.0, <=2.1.0)

multer NPM version =2.0.0, =0.0.1, =0.0.1-alpha.1, =0.0.1-alpha.9, =0.0.0-alpha.119, =1.2.1-dev.3, =0.0.1, =1.0.0, =0.1.1, =0.0.1, =0.0.1, =0.0.1, =0.1.0, =0.0.2, =0.0.10, =0.6.2 and more Source cves: CVE-2026-3520 Source advisory: OSV:GHSA-5528-5VMV-3XC2...

@backstage/backend-defaults (>=0.0.0-nightly-20240929023448, <=0.15.2-next.1), @backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20240929023448, <=0.7.9-next.1) +80 more potentially affected by CVE-2026-29185 via @backstage/integration (>=1.6.2, <=1.20.0-next.2)

@backstage/integration NPM version =1.6.2, =0.0.0-nightly-20240929023448, =0.0.0-nightly-20240929023448, =0.0.0-nightly-20240929023448, =0.0.0-nightly-20240929023448, =0.0.0-nightly-20250614024041, =0.0.0-nightly-20240929023448, =0.0.0-nightly-20250129022746, =0.0.0-nightly-20250129022746,...