Node_CVE-2023-29017

CVE-2023-29017 | Remote Code Execution via vm2 Sandbox Escape WHS 4th Generation, Class 31 - Kim Geon-woo @gunwoo105 Vulnerability Summary vm2 is a Node.js sandbox library for executing untrusted JavaScript in a restricted environment. Under normal circumstances, code inside the sandbox should no...

CVE-2025-70886

CVE-2025-70886 A Proof of Concept PoC exploit for CVE-2025-70886, a persistent denial-of-service vulnerability in Halo CMS v2.22.4 and earlier that allows remote attackers to crash the admin comment interface by submitting malformed payloads. Basic Information Product Vendor: 凌霞软件 Vendor Website:...

CVE-2026-107392

music-metadata is a metadata parser for audio and video media files. Prior to 11.15.0, the DSF parser handles an unrecognized chunk by calling tokenizer.ignore without awaiting the returned promise and without first rejecting a chunk size smaller than the 12-byte chunk header. A crafted DSF input...

CVE-2026-107392

The music-metadata library, a metadata parser for audio and video files, is vulnerable to an uncatchable process crash in versions prior to 11.15.0 . The DSF parser fails to await a promise or validate chunk sizes (specifically those smaller than 12 bytes) when handling unrecognized chunks. A cra...

CVE-2026-102413 Uncaught Exception in Elastic Endpoint Leading to Denial of Service

Uncaught Exception CWE-248 in Elastic Endpoint can lead to denial of service via a specially crafted file name. When Elastic Defend's Elastic Endpoint component processes a file name under certain system locale configurations including Chinese, Japanese, and Korean locales on Windows, an unhandle...

CVE-2026-102413

The Elastic Defend component within Elastic Agent / Endpoint is vulnerable to a Denial of Service (DoS) due to an Uncaught Exception (CWE-248) . When processing a specially crafted file name on Windows hosts using specific system locales (such as Chinese, Japanese, or Korean ), an unhandled excep...

Elastic Agent / Endpoint 8.19.22, 9.4.8, and 9.5.5 Security Update (ESA-2026-194)

Uncaught Exception in Elastic Endpoint Leading to Denial of Service Uncaught Exception CWE-248 in Elastic Endpoint can lead to denial of service via a specially crafted file name. When Elastic Defend's Elastic Endpoint component processes a file name under certain system locale configurations...

PT-2026-107163

Uncaught Exception CWE-248 in Elastic Endpoint can lead to denial of service via a specially crafted file name. When Elastic Defend's Elastic Endpoint component processes a file name under certain system locale configurations including Chinese, Japanese, and Korean locales on Windows, an unhandle...

vm2: Host-returned Promise rejection can bypass vm2's unhandled-rejection hardening and terminate the host process

Summary vm2 current head v3.11.5, commit 7a1f5100b96f48d34e0fe104ab37c0acc5944f92 can still be used to terminate the host Node.js process when sandbox code calls a host-realm function that returns a rejected host Promise and then ignores the returned value. This is an incomplete-fix variant of th...

EUVD-2026-81603

vm2: Host-returned Promise rejection can bypass vm2's unhandled-rejection hardening and terminate the host process...

GHSA-GJQ8-XM47-88RC vm2: Host-returned Promise rejection can bypass vm2's unhandled-rejection hardening and terminate the host process

Summary vm2 current head v3.11.5, commit 7a1f5100b96f48d34e0fe104ab37c0acc5944f92 can still be used to terminate the host Node.js process when sandbox code calls a host-realm function that returns a rejected host Promise and then ignores the returned value. This is an incomplete-fix variant of th...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel before version 6.1.3, fs/ntfs3/inode.c does not validate the attribute name offset. A unhandled page fault may occur...

CVE-2026-86537

A flaw was found in Apache Thrift's D language bindings. A remote, unauthenticated attacker could cause a Denial of Service DoS by sending specially crafted input to an affected application. This input triggers an integer underflow or an unhandled exception, causing the process to enter an infini...

Infinite loop

Overview Affected versions of this package are vulnerable to Infinite loop via the D language bindings. An attacker can cause the application to enter an infinite loop or terminate unexpectedly by sending specially crafted input that triggers an integer underflow or an unhandled exception...

NPM: devalue: stringifyAsync can cause an unhandled rejection despite a caught returned promise

NPM: devalue: stringifyAsync can cause an unhandled rejection despite a caught returned promise vulnerability discovered by ? in WordPress Npm devalue versions = 5.8.0, = 5.9.2...

devalue: stringifyAsync can cause an unhandled rejection despite a caught returned promise

When serializing multiple promises, a later promise can reject before an earlier one settles. An internal rejected promise remains unhandled even if the caller catches the returned stringifyAsync promise. Under Node's default unhandled-rejection behavior this can terminate the process. Applicatio...

GHSA-X5RW-Q4PP-HG5G devalue: stringifyAsync can cause an unhandled rejection despite a caught returned promise

When serializing multiple promises, a later promise can reject before an earlier one settles. An internal rejected promise remains unhandled even if the caller catches the returned stringifyAsync promise. Under Node's default unhandled-rejection behavior this can terminate the process. Applicatio...

NPM: fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses

NPM: fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses vulnerability discovered by ? in WordPress Npm fastify versions 5.12.5...

EUVD-2026-88370

Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization...

GHSA-542G-H47M-68V8 Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization

Summary Axios versions with Node.js HTTP/2 support can terminate the caller’s process when a ClientHttp2Session emits an error event that is not handled by axios. This affects applications that use the Node HTTP adapter with httpVersion: 2. A malicious, unavailable, or non-HTTP/2 endpoint can cau...