pageant: Out-of-bounds read / oversized allocation in `pageant` MemoryMap::read via a malicious Pageant agent (Windows)

Summary MemoryMap::read in the pageant crate part of the russh workspace, used by russh's SSH-agent client on Windows via AgentClient::connectpageant copies a peer-controlled number of bytes out of an 8192-byte shared-memory view with no bounds check — unlike the sibling MemoryMap::write, which...

Russh: Unbounded memory exhaustion via CHANNEL_OPEN flood during a client-stalled rekey

Summary A russh server can be driven to unbounded heap growth process OOM / kill by a peer that speaks only standard SSH messages, in the default configuration. The peer starts a key re-exchange sends SSHMSGKEXINIT but never sends the follow-up SSHMSGKEXECDHINIT, leaving the server's kex state...

Astro: Netlify Image CDN allowlist bypass enables SSRF

Summary The @astrojs/netlify adapter generated regular expressions for Netlify Image CDN remote-image allowlists without anchoring them to the beginning of the URL. Netlify evaluates these expressions with RegExp.test, so an allowed image origin appearing anywhere in a URL, including its path or...

Astro: Malformed port in the Host header can crash the Node adapter

Summary In the Astro Node adapter, a request whose Host header contains a malformed port for example example.com:65536 or example.com:8080:8080 produced an invalid request URL. The fallback intended to recover from an unparseable URL reused the same malformed host, so it failed again and raised a...

GitPython: Denial of Service via catastrophic backtracking (ReDoS) in Actor.name_email_regex — commit author/committer field parsing

Summary GitPython's Actor.nameemailregex regular expression git/util.py, line 863 is vulnerable to catastrophic backtracking ReDoS — Regular Expression Denial of Service. When GitPython parses the author or committer header of a git commit object that contains a long string with an unterminated ,...

GitPython: --no-index bypasses diff unsafe-option protections and enables a blind local-file content oracle

Summary GitPython 3.1.59 blocks a previously available local-file read path through unsafe git diff options such as -O/--orderfile. However, the high-level diff API still permits --no-index with the default allowunsafeoptions=False. --no-index changes the semantics of the paths arguments: instead...

GitPython: Repository content can impersonate the git directory, leading to arbitrary code execution

Summary Repo.init decides which directory is the git directory by testing candidate paths in an order that considers the real .git last. Two earlier tests can be satisfied by ordinary tracked files. Git reserves only the literal name .git, so HEAD, objects/, refs/, config, gitdir, commondir and...

russh: negotiating a MAC-requiring block cipher (CTR/CBC) with mac=none causes a slice-index-out-of-range panic

Summary SshBlockCipher implementations AES-CBC, AES-CTR, 3DES-CBC, etc. report needsmac == true, meaning they are documented/intended to always be paired with a separate integrity MAC. However, key-exchange negotiation only checks needsmac inside the fallback branch of MAC algorithm selection use...

russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never opened

Summary CVE-2026-68930 was fixed by adding Session::isestablishedchannel in russh/src/server/encrypted.rs, which gates every channel-scoped SERVER-side message CHANNELREQUEST, CHANNELDATA, CHANNELEOF, CHANNELCLOSE, CHANNELWINDOWADJUST, CHANNELEXTENDEDDATA on enc.channels.get&channel.issomeand|c|...

Russh: Missing X25519 zero-point validation in hybrid ML-KEM key exchange

Vulnerability The hybrid ML-KEM 768 + X25519 key exchange implementation in russh/src/kex/hybridmlkem.rs does not validate that the remote peer's X25519 public key is not the zero point all-zero 32-byte value. This allows a remote peer to force the X25519 contribution to the combined shared secre...

Russh: Configured server auth-attempt cap is not enforced in the USERAUTH_REQUEST runtime path

Details Affected versions and vulnerable location - Confirmed present on default branch main at HEAD 0089c89c94753bebbec12b956c07a1cd38740379. - Crate version at HEAD: 0.62.4. - Vulnerable locations on current default branch: - russh/src/server/mod.rs:91 pub maxauthattempts: usize -...

Malicious code in friendly-greeting-tools (PyPI)

Source: amazon-inspector 4d584c571cf5d112735aefd07c78bc19659af32f5950b1331a4970cba97c9707 The package presents itself as a harmless greeting demo but src/friendlygreeting/main.py ships two base64+gzip-encoded Python blobs DEMOEN and DEMOST that are decoded and executed via...

Malicious code in beautifytext (PyPI)

Source: kam193 cba19cfc0b2bdeec177fafdffa10e730769079a14ece3bb4740bfc0ded9fef3b During import, the package silently spans a separate process that waits for and executes remote commands. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters

Impact Any authenticated LiteLLM proxy user could redirect an outbound provider call to a destination they control and cause the proxy to send its own configured provider credentials to that destination. The proxy's request-body validation was a denylist that did not cover every sensitive paramet...

Malware in ddok-modal

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)

Summary PyJWKClient.getsigningkeyfromjwttoken — the first step of the JWKS verification flow documented in docs/usage.rst — must decode a token's payload before its signature can be checked, via jwt.apijwt.decodecompletetoken, options="verifysignature": False. That call parses the payload with...

Angular Server-Side Rendering (SSR): Denial of Service via Numeric URL Matrix Parameters

A denial of service DoS vulnerability was identified in @angular/router when Server-Side Rendering SSR is enabled on Node.js V8. When @angular/router parses incoming request URLs, it extracts path segments, matrix parameters, and child outlets into plain JavaScript objects Record. When matrix...

Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodies

Impact serialize-javascript escapes its output so it is safe to embed inside a element. In 7.1.1 that guarantee does not hold for function values: a crafted function body can carry a literal, unescaped into the output, terminating the script element early so the remainder is parsed as HTML...

DOMPurify: IN_PLACE: node-removing afterSanitize hook leaves detached subtree event handlers armed, causing DOM XSS

Summary In INPLACE mode DOMPurify sanitizes the caller's live DOM subtree directly. To close a known hazard GHSA-55q2-fjhq-7xh7, the library neutralizes any node a hook detaches during sanitization by stripping its subtree's non-allow-listed attributes, but this neutralization is wired only into...

jackson-databind quadratic forward-reference completion

Summary When an @JsonIdentityInfo collection or map first creates N unresolved object-ID references and later resolves the same IDs in reverse order, jackson-databind scans the remaining pending-reference accumulator for each resolution. A shallow JSON document whose size grows linearly can...

jackson-databind retains every unknown raw type ID

Summary With @JsonTypeInfouse = Id.NAME, defaultImpl = ..., every distinct unknown raw type ID selects the same fallback deserializer but is retained as a separate key in TypeDeserializerBase.deserializers. An attacker who can repeatedly supply new unknown type IDs can grow this process-lifetime...

league/commonmark: DisallowedRawHtml bypassed when a disallowed tag name ends the raw-HTML literal

Summary The DisallowedRawHtml extension does not escape a disallowed tag when the tag name is the last thing in the raw HTML. A Markdown line containing just /i The trailing character class requires one character after the tag name. The block parser does not: RegexHelper::PARTIALHTMLBLOCKOPEN...

league/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scan

Summary league/commonmark's GitHub Flavored Markdown Table extension registers TableStartParser as a block-start parser. While a paragraph is the active block, the core block parser calls TableStartParser::tryStart on every non-blank line. Its first action fetches the entire growing paragraph...

@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized

Impact When server credentials are created with the requireClientCertificate option set to false, getAuthContext does not distinguish between authorized and unauthorized certificates in its return value. This can create improper authentication vulnerabilities for @grpc/grpc-js users who use the...

@grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages

Impact If an application method handler crashes, the error message is included in the status message sent to the client. This can leak to the client any sensitive data that may be included in the error message. This impacts anyone using @grpc/grpc-js to run servers. Patches This vulnerability is...

Axios: Header Injection via Inherited headers After Minimal Interceptor

Summary Axios request interceptors may return a replacement config object. If an interceptor returns a plain object without an own headers property, dispatchRequest later evaluates config.headers and can resolve an inherited Object.prototype.headers value. In a process where another vulnerability...

Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders

Summary Axios contains a guard in the Node HTTP adapter to avoid using an inherited Object.prototype.getHeaders as a FormData header source. The fetch adapter calls the shared resolveConfig helper before dispatch, and that helper lacks the same guard. If another vulnerability pollutes...

Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection

Summary Axios' Node HTTP adapter can act as a read-side prototype-pollution gadget for Node's sensitive createConnection request option. The adapter creates a null-prototype options object, but Node's HTTP client can copy or normalize request options into ordinary objects before connection...

Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges

Summary Axios supports proxy environment variables and evaluates NOPROXY exclusions in the Node.js adapter. CIDR-form NOPROXY entries such as 127.0.0.0/8, 10.0.0.0/8, or 169.254.169.254/32 are not interpreted as IP ranges. As a result, a request to an IP address inside a configured CIDR exclusion...

Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF

Summary Axios exposes maxRedirects to limit redirect following, and maxRedirects: 0 is used by applications as a redirect-based SSRF guard. The Node HTTP adapter enforces this option. The fetch adapter does not read it and does not set a Fetch API redirect mode, so the runtime default of redirect...

Malicious code in com.epi.e2e_test (npm)

Source: amazon-inspector 5a0c1068af335818f2b9d905f2d39ebe594f84a6c63e470877692554bc95103b package.json declares a preinstall script that runs index.js on npm install. index.js collects host identifiers os.homedir, os.hostname, os.userInfo.username, dns.getServers, current working directory along...

Axios: Prototype pollution gadget in fetch adapter can alter outbound requests

Summary Axios fetch adapter requests can be altered by inherited properties on fetchOptions. The adapter resolves method, headers, body, signal, and credentials into resolvedOptions, creates a Request, and then calls fetchrequest, fetchOptions instead of fetchrequest, resolvedOptions. In runtimes...

Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method

Summary Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vulnerability in the same process pollutes Object.prototype.method, calls such as axios.request url and axios url can send a state-changing HTTP method instead...

Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)

Summary Axios for Node.js parses data: URLs in lib/helpers/fromDataURI.js. The current RFC-2397 parser uses a regular expression whose media type groups allow / inside both sides of the type/subtype match. A malformed data: URL containing many slashes and no comma forces the JavaScript regex engi...

Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location

Summary Axios shouldBypassProxy normalizes hostnames with hostname.replace/.+$/, ''. For a hostname shaped as many dots followed by a non-dot, the anchored regex can perform quadratic backtracking. Because axios re-evaluates proxy bypass rules for redirected requests, a malicious server can...

Axios: Prototype Pollution Gadget in axios toFormData Options

Summary Axios form serialization reads visitor, maxDepth, dots, indexes, metaTokens, and Blob from an internal options object without own-property guards. When Object.prototype has been polluted elsewhere in the same process, those inherited values can change how axios serializes multipart and...

Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls

Summary Axios for Node.js does not apply configured DNS lookup or proxy controls when a request uses httpVersion: 2. The HTTP/1 adapter path wraps and forwards config.lookup, builds normal request options, and applies proxy routing through setProxy. The HTTP/2 path builds a session with...

Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization

Summary Axios versions with Node.js HTTP/2 support can terminate the caller’s process when a ClientHttp2Session emits an error event that is not handled by axios. This affects applications that use the Node HTTP adapter with httpVersion: 2. A malicious, unavailable, or non-HTTP/2 endpoint can cau...

urllib3: Chunked Deflate streaming can enter an infinite loop

Impact urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading content in chunks instead of loading the entire response body into memory at once. urllib3 can decompress response bodies according to the HTTP Content-Encoding header. When streaming a...

Next.js: Remote Code Execution in next/og ImageResponse

Impact The Node.js ImageResponse implementation from next/og is affected by an upstream vulnerability. This can lead to remote code execution. Affected applications pass attacker-controlled values into SVG content, attributes, or styles during image generation: tsx import ImageResponse from...

urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory

Impact urllib3's streaming API is designed for efficiently handling large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When decoding a chunked-transfer-encoded response, this API reads each chunk's size field by buffering until...

urllib3: HTTPS proxy TLS configuration may be ignored or overridden

Impact urllib3 supports configuring TLS independently for an HTTPS proxy and the target server. proxysslcontext, proxyasserthostname, and proxyassertfingerprint configure the TLS connection to the proxy. sslcontext and the other target-specific TLS parameters configure the connection to the targe...

Nest: Unbounded memory growth in the NestJS TCP microservice transport

Summary A peer that can open a TCP connection to a NestJS microservice using the built-in TCP transport can make the server process allocate memory without limit, on either side of the connection, until the process is killed by the OS or by its container memory limit. No authentication, no...

@nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets

| Field | Value | | --- | --- | | Ecosystem | npm | | Package | @nestjs/platform-fastify | | Affected versions | = 12.0.0, 12.0.2 and 11.2.4 | | Patched versions | 12.0.2 and 11.2.4 upgrade to 12.0.3 / 11.2.5 | Summary On the Fastify adapter, an HTTP request that uses an absolute-form request...

Nodemailer addressparser: O(n^2) on comment-joined addresses enables a remote DoS (reachable via mailparser)

Summary nodemailer/lib/addressparser parses one shape of address in On^2 time. A single 640 KB address value blocks the Node.js event loop for roughly 7 seconds. And it is reachable without auth: mailparser feeds inbound email headers straight into this parser, so one crafted email is enough to...

PyJWT: ReDoS vulnerability when calling the `is_pem_format` function.

Summary There is a Re-DoS vulnerability in the ispemformat function which results in a intesive CPU usage if an attacker is been able to provide a custom certificate. Details The problem is that the lazy quantifier .+? will always first try to match as little as possible until it finds a ---- END...

Malicious code in kiyoramarkets (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

Malicious code in @xayz/baileys (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

Malicious code in xzvexpzcbailey (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

Malicious code in noxxleys (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...