Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`

Summary axios’ fetch adapter does not enforce maxBodyLength for live WHATWG ReadableStream request bodies whose size cannot be determined before dispatch. Applications that use adapter: "fetch" and rely on maxBodyLength to cap untrusted upload/proxy streams can send the full stream even when it...

Axios: Prototype pollution gadgets can alter axios request construction

Summary axios is vulnerable to read-side prototype-pollution gadgets when Object.prototype has already been polluted by another vulnerability or dependency. The most broadly reachable issue is in the bodyless method aliases: axios.get, axios.delete, axios.head, and axios.options read inherited da...

Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios

Summary Axios versions containing lib/helpers/shouldBypassProxy.js do not treat 0.0.0.0 as a local address when evaluating NOPROXY rules. In Node.js applications that use HTTPPROXY or HTTPSPROXY together with NOPROXY=localhost,127.0.0.1,::1 or similar, a request to http://0.0.0.0:/ can be routed...

File Browser: Colliding username normalization gives two users the same home directory

Summary FileBrowser confines each user to a scope: a home directory that acts as the boundary for everything they can read or write. When self-registration and automatic home-directory creation are both enabled Signup=true and CreateUserDir=true, a new user's scope is built from their username...

File Browser: Share API exposes the password hash and bypass token

Summary When a user creates a password-protected share or lists existing shares, the JSON response includes the full bcrypt passwordhash and the secret token of the share. The Link storage struct is serialized directly with json.Marshal and tags passwordhash and token for output, with no field...

File Browser: Archive builder turns backslash filenames into path traversal (zip-slip)

Summary The fix for GHSA-gxjx-7m74-hcq8 / CVE-2026-54093 shipped in v2.63.6 added a strings.ReplaceAllnameInArchive, "\", "/" step to the archive builder; this was the advisory's recommended "Primary Fix." On a Linux host a backslash is a legal, non-separator filename character, so replacing it...

protobufjs: Text Format string map parsing can mutate returned map object prototype

Summary The protobuf.js text format extension parsed string-keyed map entries using ordinary property assignment. A text-format map entry with key proto could therefore change the prototype of the returned map object instead of creating an own map entry. This affected the optional Text Format...

protobufjs: Denial of Service via infinite loop in .proto option parsing

Summary protobufjs parsed option names by advancing through schema tokens until it reached an = token, without checking for end of input. A crafted .proto schema that opens an option declaration but ends prematurely could cause the option parser to loop without ever terminating. This affects the...

webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header

Impact An unauthenticated peer that can reach the webpack-dev-server process can terminate it by sending either a normal HTTP request with a malformed Host header, or a WebSocket upgrade to the default /ws endpoint with a malformed Origin header. The malformed header triggers an uncaught exceptio...

webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints

Impact The internal /webpack-dev-server/open-editor and /webpack-dev-server/invalidate endpoints perform state-changing actions on any GET request, without verifying that the request originated from the dev server's own page. Any website a developer visits while the dev server is running can...

Guzzle: Cookie Disclosure and Injection via IP-Address Domains

Impact CookieJar does not restrict a cookie scoped to an IP address to the exact host that set it. When a stored cookie's Domain attribute is an IPv4 literal Domain=192.168.0.1, a bracketed IPv6 literal Domain=::1, or a bare numeric value that denotes an IPv4 address Domain=1, which is 0.0.0.1,...

Astro: Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch

Astro 6.4.7 Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch Summary Astro 6.4.7 appears to reintroduce a middleware authorization bypass pattern when a request path is encoded more deeply than the newly introduced iterative URL decoder's maximum decoding...

Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files

Summary A Composer package declares its executables in the bin field of its composer.json. When Composer installs a package, it processes each bin entry and changes the file mode of the corresponding file so it is executable. If a bin entry contains .. path segments, it can resolve to a path...

Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure)

Summary When Composer is run with -vvv debug verbosity, it could print a credential that was embedded directly in a repository or package URL, but not as a password, to its debug output. Composer already masked the password portion of such URLs, but the username portion was shown in clear text...

node-tar: Process crash via PAX numeric path type confusion

Summary A crafted 2.5KB tar archive crashes any Node.js process that extracts it. The PAX header parser coerces all-digit path values to JavaScript numbers, which causes an uncaught TypeError when downstream code calls .split'/' on the numeric value. Error handlers and strict: false cannot...

node-tar: Decompression/parse DoS via unlimited input

Summary A Decompression/parse DoS via unlimited input vulnerability in node-tar allows an attacker to exhaust server resources disk space and CPU. Because the library does not enforce hard upper bounds on total decompressed data or entry counts, a small, maliciously crafted "Gzip Bomb" can be use...

node-tar: Negative tar entry size causes infinite loop in archive replace

Summary A checksum-valid tar archive with a negative base-256 encoded entry size can make tar.replace loop forever while scanning the existing archive. Applications that update attacker-controlled tar archives can have a worker process pinned indefinitely, causing denial of service. Details The...

node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records

Summary node-tar strips trailing NUL bytes from long-name L and long-linkpath K GNU extended headers but does not apply the same sanitization to equivalent fields delivered via PAX x typeflag extended headers. A PAX record of the form path=visible.txt\x00hidden.txt is parsed verbatim into...

Socket.IO: Engine.IO Polling Transport Connection Exhaustion

Impact An unauthenticated remote attacker can cause a denial of service in affected versions of engine.io by opening Engine.IO polling sessions and sending an invalid binary POST request with: Content-Type: application/octet-stream against an Engine.IO protocol v4 polling transport. In the...

shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)

Summary shell-quote's parse finalizes its token list with a reduce that uses Array.prototype.concat as the accumulator. Each prev.concatarg copies the entire growing array, so parse runs in On² in the number of tokens. An unauthenticated attacker who can submit a string to any code path that call...

Directus: Authorization-dependent response served from unsegmented cache key

Summary When response caching is enabled CACHEENABLED=true, the cache-key derivation in api/src/utils/get-cache-key.ts includes only version, path, query, and accountability.user plus a conditional ip. Authorization context beyond user share, role, roles, admin, app, policies is not part of the...

Directus: SSRF Protection Bypass via 0.0.0.0 in File Import

Summary The SSRF protection on Directus's file-import-from-URL feature can be bypassed using the address 0.0.0.0. While 127.0.0.1 and other internal addresses are denied, 0.0.0.0 is not added to the blocklist. On Linux and macOS, connecting to 0.0.0.0 reaches localhost, so an authenticated user...

LightRAG is Vulnerable to Authentication Bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protection

Summary When LightRAG is deployed with LIGHTRAGAPIKEY set but AUTHACCOUNTS unset an officially documented "API-Key authentication" mode, the X-API-Key protection can be bypassed by any remote unauthenticated attacker. The bypass does not require network contact with the victim server — an attacke...

Guzzle: Proxy-Authorization headers can be sent to origin servers

Impact In affected versions, the built-in cURL handlers CurlHandler and CurlMultiHandler put every first-class request header in cURL's origin header list CURLOPTHTTPHEADER. These handlers are the default when the PHP cURL extension is available. They move Proxy-Authorization to the proxy-only li...

LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests

Summary The server defaults to CORSORIGINS= combined with allowcredentials=True. Starlette's CORSMiddleware echoes the requesting origin in preflight responses when credentials are enabled, meaning every origin is effectively whitelisted for credentialed cross-origin requests. Any malicious websi...

Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` execution

Summary Type: URL-scheme allowlist gap. The safeurl filter only blocks the four schemes javascript:, vbscript:, file:, data:. Several other schemes are accepted into rendered and tags despite being known XSS vectors in legacy or chain-handling browsers. The same gap applies to direct links,...

Mistune toc / TableOfContents directive: heading IDs use predictable `toc_N` numbering with no slugification, allowing collision with attacker-controlled `id="toc_N"` content

Summary Type: Predictable identifier generation. The toc plugin and TableOfContents directive both default to generating heading IDs of the form toc1, toc2, toc3, ... with no input-derived component. An attacker who can place a heading anywhere in the document can predict which tocN ID it will...

Mistune: Arbitrary File Read via Include directive path traversal

Summary A path traversal issue exists in mistune's Include directive when markdown files are processed using md.read. A crafted include path can cause files outside the intended markdown directory to be accessed. Details The issue occurs in the Include.parse method where user-supplied paths are...

Mistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert)

Summary Type: Algorithmic-complexity denial of service. A run of N closed pairs xx... or the analogous ==x== for mark, ^^x^^ for insert causes ON² work in the formatting parser. With the strikethrough, mark, or insert plugin enabled, an 8 KB input pegs the CPU for 4 seconds; 16 KB → 17 seconds...

Mistune: XSS via unescaped class option in Admonition directive

In src/mistune/directives/admonition.py, the renderadmonition function concatenates the :class: option directly into the HTML class attribute without escaping lines 63-68. This allows attribute injection and XSS even when HTMLRendererescape=True is used. The directive name parameter is safe...

Mistune: XSS via percent-encoded javascript URI bypass in safe_url()

Summary An XSS vulnerability in Mistune allows bypassing of safeurl protections via percent-encoded javascript URIs. Details The vulnerability exists in HTMLRenderer.safeurl in Mistune. The function is intended to block harmful URL schemes such as "javascript:" by checking the prefix of the...

Mistune inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs

Summary Type: Algorithmic-complexity DoS in core emphasis parsing. A long sequence of well-formed x strong or x strong-emphasis combined pairs causes ON² parser work. Distinct from the bracket-bomb DoS repetition and from the formatting-plugin DoS /==/^^; this one fires on default-config mistune...

Mistune directives/include: mutual `.. include::` recursion crashes the renderer with `RecursionError`, denial of service via two attacker-controlled markdown files

Summary Type: Uncontrolled recursion via mutual include. The Include directive checks for direct self-reference a.md cannot include a.md, but does not detect indirect cycles. Two markdown files that include each other a.md → includes b.md → includes a.md cause unbounded recursion until Python's...

Mistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitions

Summary Type: Algorithmic-complexity DoS in reference-link definition handling. A markdown document with N reference-link definitions of the same key or many distinct keys takes ON² parser time. 5000 repeated a: u\n definitions take 1.1 second; 10000 → 4.5 seconds. File: src/mistune/blockparser.p...

js-yaml: YAML merge-key chains can force quadratic CPU consumption in js-yaml

Impact This is the same report as for v3/v4, but with lower severity, because in v5, merge is off by default When merge keys 1s doc size 100K js import performance from 'node:perfhooks' import Buffer from 'node:buffer' import load, YAML11SCHEMA from 'js-yaml' const n = Numberprocess.argv2 || 4000...

js-yaml: YAML merge-key chains can force quadratic CPU consumption

Impact js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly. The issue is triggered by a chain of mappings where each mapping merges the previous one: yaml a0: &a0 k0: 0 a1: &a1 1s doc size 100K js import performance from 'node:perfhooks' import Buffer from...

js-yaml: Quadratic-complexity (O(n^2)) DoS via !!omap tag in YAML11_SCHEMA

Summary js-yaml v5.x introduces YAML11SCHEMA support with the !!omap ordered map tag. The omapTag.addItem function performs a linear On scan for duplicate key detection on every insertion, resulting in On^2 total time to parse a document with n omap entries. An attacker can send a small crafted...

File Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scope

Summary ScopedFs confines every File Browser user to a scope directory. Its within guard is meant to reject any operation that follows a symbolic link out of that scope. When the link target does not exist yet, the guard walks up to the nearest existing ancestor and validates that instead. For a...

File Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-following RemoveAll in upload failure-cleanup

Summary A scoped, non-admin File Browser user holding only the Create permission can delete arbitrary files outside their scope other tenants' data, and the application's own database via the upload failure-cleanup path. This is an incomplete fix of CVE-2026-54094: the v2.63.14 ScopedFs containme...

Cloudreve: Non-admin remote download users can SSRF loopback/internal services and read imported responses

Summary Cloudreve's remote download workflow accepts user-supplied URLs and passes them to the configured downloader without blocking loopback, localhost, IPv6 localhost, or redirect-to-loopback targets. When the remote download permission is granted to a non-admin user group, a normal...

Cloudreve: OAuth access tokens bypass scope enforcement due to missing client_id claim

Summary Cloudreve's OAuth access tokens can bypass OAuth scope enforcement. This does not appear to be the intended design. The documentation describes OAuth client permissions/scopes, the API has an insufficient-scope error code, and the code comments say RequiredScopes... should verify scopes...

Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path

Summary WindowsViewer.getcommand constructs a cmd.exe shell command by directly embedding a file path into an f-string without escaping. The result is passed to subprocess.Popen..., shell=True. Shell metacharacters in the file path — most importantly a double-quote " that breaks out of the...

Pillow `GdImageFile._open()`: image dimensions accepted without `_decompression_bomb_check()`

Description PIL/GdImageFile.py GdImageFile.open reads image dimensions from the GD 2.x header and stores them in self.size without calling Image.decompressionbombcheck. Because GdImageFile is not registered with Image.registeropen, it never passes through the standard Image.open code path that...

Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading

Summary PIL/BdfFontFile.py bdfchar lines 84–88 reads the BBX width height field from a BDF font file and passes the dimensions directly to Image.new without calling Image.decompressionbombcheck. This completely bypasses Pillow's documented decompression bomb protection. Image.open enforces...

Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`

Description PIL/FontFile.py FontFile.compile assembles per-glyph images into a single combined bitmap using Image.new"1", xsize, ysize without calling Image.decompressionbombcheck. This is the base-class method shared by both BdfFontFile and PcfFontFile, and it is triggered whenever a loaded font...

Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading

Description PIL/PcfFontFile.py loadbitmaps line 227 reads glyph dimensions from the PCF METRICS section and passes them directly to Image.frombytes without calling Image.decompressionbombcheck. Dimensions originate from unsigned 16-bit values: xsize = right - left max: 65535 − 0 = 65535 ysize =...

Astro: Reflected XSS via unescaped View Transition animation properties

Summary Astro's server-side View Transition CSS generator interpolates animation properties into an inline element without escaping them for the CSS and HTML contexts. An attacker-controlled value passed to an animation property such as duration can contain a sequence, terminate the generated sty...

Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)

Summary When Pillow loads an uncompressed image whose tile uses the raw codec and a mode in Image.MAPMODES, and the image was opened from a filename, it memory-maps the file and builds the image's row pointers directly into the mapping via PyImagingMapBuffer src/map.c. The per-row spacing stride ...

@better-auth/sso: SSO provider may allow registration for any org member without a checking their role

Am I affected? You are affected if all of the following are true: - You depend on @better-auth/sso at any version in = 1.2.10, 1.6.11, or any current next pre-release. - You enable both sso and organization plugins. - providersLimit is at its default 10 or any non-zero value, so SSO provider...

brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups

Summary brace-expansion's expand exhibits exponential-time - O2ⁿ - behavior in the number of consecutive non-expanding groups. A short, all-ASCII input 90 bytes/30 groups blocks the calling thread for minutes; a slightly longer input hangs it effectively indefinitely. Because the dominant consume...