CVE-2026-107392

music-metadata is a metadata parser for audio and video media files. Prior to 11.15.0, the DSF parser handles an unrecognized chunk by calling tokenizer.ignore without awaiting the returned promise and without first rejecting a chunk size smaller than the 12-byte chunk header. A crafted DSF input...

CVE-2026-107392

The music-metadata library, a metadata parser for audio and video files, is vulnerable to an uncatchable process crash in versions prior to 11.15.0 . The DSF parser fails to await a promise or validate chunk sizes (specifically those smaller than 12 bytes) when handling unrecognized chunks. A cra...

vm2: Host-returned Promise rejection can bypass vm2's unhandled-rejection hardening and terminate the host process

Summary vm2 current head v3.11.5, commit 7a1f5100b96f48d34e0fe104ab37c0acc5944f92 can still be used to terminate the host Node.js process when sandbox code calls a host-realm function that returns a rejected host Promise and then ignores the returned value. This is an incomplete-fix variant of th...

EUVD-2026-81603

vm2: Host-returned Promise rejection can bypass vm2's unhandled-rejection hardening and terminate the host process...

GHSA-GJQ8-XM47-88RC vm2: Host-returned Promise rejection can bypass vm2's unhandled-rejection hardening and terminate the host process

Summary vm2 current head v3.11.5, commit 7a1f5100b96f48d34e0fe104ab37c0acc5944f92 can still be used to terminate the host Node.js process when sandbox code calls a host-realm function that returns a rejected host Promise and then ignores the returned value. This is an incomplete-fix variant of th...

NPM: devalue: stringifyAsync can cause an unhandled rejection despite a caught returned promise

NPM: devalue: stringifyAsync can cause an unhandled rejection despite a caught returned promise vulnerability discovered by ? in WordPress Npm devalue versions = 5.8.0, = 5.9.2...

GHSA-X5RW-Q4PP-HG5G devalue: stringifyAsync can cause an unhandled rejection despite a caught returned promise

When serializing multiple promises, a later promise can reject before an earlier one settles. An internal rejected promise remains unhandled even if the caller catches the returned stringifyAsync promise. Under Node's default unhandled-rejection behavior this can terminate the process. Applicatio...

devalue: stringifyAsync can cause an unhandled rejection despite a caught returned promise

When serializing multiple promises, a later promise can reject before an earlier one settles. An internal rejected promise remains unhandled even if the caller catches the returned stringifyAsync promise. Under Node's default unhandled-rejection behavior this can terminate the process. Applicatio...

EUVD-2026-71465

undici vulnerable to Denial of Service via WebSocketStream unclean close...

CVE-2026-100722 vm2 before 3.12.2 Host Process Termination via Construct Trap

vm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap. In BaseHandler, the apply trap calls markHostPromiseHandled on the returned value, but the adjacent construct path returns the result of Reflect.construct without the same sanitization. If...

Uncaught Exception

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Uncaught Exception in the handling of Promises returned from the host realm into the sandbox. An attacker can cause the host process to terminate...

CVE-2026-92954

vm2 is a sandbox library for running untrusted JavaScript in Node.js. In versions = 3.10.0 and = 3.11.7, Promises returned from the host realm into the sandbox are not marked as handled at the bridge boundary; only Promises created inside the sandbox are wrapped with a rejection-swallowing handle...

CVE-2026-92954 vm2 3.10.0 through 3.11.7 Denial of Service via Host Promise

vm2 is a sandbox library for running untrusted JavaScript in Node.js. In versions = 3.10.0 and = 3.11.7, Promises returned from the host realm into the sandbox are not marked as handled at the bridge boundary; only Promises created inside the sandbox are wrapped with a rejection-swallowing handle...

CVE-2026-92954 vm2 3.10.0 through 3.11.7 Denial of Service via Host Promise

vm2 is a sandbox library for running untrusted JavaScript in Node.js. In versions = 3.10.0 and = 3.11.7, Promises returned from the host realm into the sandbox are not marked as handled at the bridge boundary; only Promises created inside the sandbox are wrapped with a rejection-swallowing handle...

Uncaught Exception

Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Uncaught Exception in the WebSocketStream API, whose socket-close handler calls abort on the writable stream while the application holds a writer lock and then discards t...

DEBIAN-CVE-2026-85014

undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection without a WebSocket close handshake. On an unclean close the internal socket-close handler calls abort on the writable stream unconditionally and discards the returned...

CVE-2026-85014

undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection without a WebSocket close handshake. On an unclean close the internal socket-close handler calls abort on the writable stream unconditionally and discards the returned...

CVE-2026-85014

CVE-2026-85014 affects undici's experimental WebSocketStream client in Node.js. When a remote peer closes the TCP connection without a proper WebSocket close handshake, the internal socket-close handler calls abort on the locked writable stream and discards the returned promise. Per the WHATWG St...

CVE-2026-85014 undici vulnerable to Denial of Service via WebSocketStream unclean close

undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection without a WebSocket close handshake. On an unclean close the internal socket-close handler calls abort on the writable stream unconditionally and discards the returned...

CVE-2026-85014

undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection without a WebSocket close handshake. On an unclean close the internal socket-close handler calls abort on the writable stream unconditionally and discards the returned...