Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing

Summary Nodemailer's address parser can produce an unexpected recipient address when an RFC 5322 comment follows the domain of an address whose local-part is a quoted string. For example: text "user"@example.comxevil.com is parsed as: text address: "[email protected] evil.com", name: "" The...

Nodemailer: Quadratic backtracking in the addressparser free-text fallback allows remote denial of service

Summary When addressparser finds no address by its strict reading, it falls back to pulling one out of the free text with /\s\b^@\s+@^\s+\b\s/. That pattern backtracks quadratically: ^@\s+ is retried from every offset and rescans the run to the next @ each time. A single header value holding a lo...

PyJWT: PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation

Summary A service that verifies HS256 tokens using an empty oct JWK through PyJWK, including a PyJWK obtained from PyJWKSet, can therefore accept attacker-generated tokens as authenticated. PyJWT 2.13.0 rejects an empty HMAC key when it is supplied through the raw str/bytes key path, but accepts...

PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header

Package pyjwt PyPI Affected versions tested & verified on: 2.13.0. Every version whose PyJWS.load translates only ValueError is affected Description PyJWS.looad jwt/apijws.py:337 splits the compact token, base64url decodes the header segment and hands it to json.loads before verifysignature runs...

PyJWT: Non-canonical signature segments enable raw-token revocation bypass

Summary PyJWT 2.13.0 accepts compact JWS signature segments containing characters that are not in the Base64URL alphabet. Appending !!!! to a valid signature does not change the decoded signature bytes or authenticated claims, but it changes the serialized token and its SHA-256 hash. An applicati...

PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard

Prerequisites both conditions must hold; both are deployment properties, not attacker-controlled at request time: - The jwt.decode allow-list mixes an HMAC algorithm with an asymmetric one, e.g. algorithms="ES256", "HS256" the RFC 8725 footgun the guard exists to backstop. - The verification key ...

PyJWT accepts public JWK containers as HMAC secrets

Summary PyJWT 2.13.0 contains an incomplete defense against algorithm confusion when an application mixes symmetric and asymmetric algorithms in one verification path. A public RSA, EC, or OKP JWK can be accepted as an HMAC secret when it is wrapped in a JWKS object, nested in an array, or...

PyJWT: PyJWKClient follows redirects when fetching JWKS

Summary PyJWT 2.13.0 PyJWKClient followed HTTP redirects while fetching a JWKS, without validating the redirect destination. A configured trusted endpoint could therefore redirect the client to a different host. Impact When an application uses PyJWKClient with caller-supplied request headers and ...

PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard

Summary HMACAlgorithm.preparekey blocks asymmetric keys from being used as HMAC secrets by searching for text markers only. It looks for -----BEGIN and for an ssh- prefix. The same key in DER form is binary ASN.1 and has neither marker, so it passes the check and is used as an HMAC secret. An...

PyJWT BOM Bypass

Affected Package - Package: PyJWT pyjwt on PyPI - Repository: https://www.google.com/url?q=https://github.com/jpadilla/pyjwt&source=gmail&ust=1781794518474000&sa=E - Affected version: 2.13.0 - Vulnerability class: Algorithm confusion / patch bypass --- Root Cause PyJWT 2.13.0 introduced a guard i...

PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)

Summary CVE-2026-48524 GHSA-fhv5-28vv-h8m8, "PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values DoS" was fixed in 2.13.0 by stopping fetchdata from clearing the cache on a fetch error. That closed one amplification path but did not add the mitigation the advisory's...

adm-zip: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different content

Summary A ZIP file can contain two entries with the identical name. adm-zip keeps both in its internal entry list, but its name-lookup table only retains the last one written. getEntryname and extractAllTo walk these two different internal structures, so they can each resolve a duplicate name to ...

adm-zip: getDataAsync() bypasses the maxOutputLength size guard enforced by the synchronous getData() path

Summary adm-zip enforces a maxOutputLength guard against decompression bombs on its synchronous getData path, but the equivalent asynchronous getDataAsync path does not enforce it — it accumulates and returns the entire decompressed output regardless of the entry's declared size. An application...

adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process (DoS)

Summary Denial of Service in adm-zip's async decompression API allows an unauthenticated attacker to crash the entire Node.js host process by supplying a single malformed ZIP file. Details Affected package: adm-zip Affected versions: at least 0.6.0 current latest; likely all versions containing t...

Ammonia: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it. svg Click set Impact Allows stored XSS in applications that allow the animate and set tags. Patches Fixed in 3.3.3, 4.0.3, and 4.1.4 Workarounds Do not enable the animate or set tags...

Malicious code in queeuees (PyPI)

Source: kam193 1adc88dd9031dc991006afcf10242d1de3aa7994f6bcb4542faed95524d6ebe0 Obfuscated code iterates over files in the system and adds a comment to every .py file found. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-09-queeuees Reasons...

Malicious code in @akapaki/baileys (npm)

Source: amazon-inspector c14fdf44df68d2544cc235039ef40a99c7df7bcbfc968e8d5809762031f0dd16 @akapaki/[email protected] is an unofficial republish of the Baileys WhatsApp library under a new scope author paki, empty README, repository pernapasquale647-dotcom/paki-baileys. Its package.json declares the...

Malicious code in @hrmony/kit-4 (npm)

Source: amazon-inspector cb6ac778d35433101385eb57755b6079e76c7bb3dc40306218cf5b1295d5a853 The package runs credential-harvesting code both at install time and at import time. The declared preinstall hook scripts/check-setup.mjs queries the AWS EC2 instance metadata service IMDSv2 at 169.254.169.2...

Malicious code in @hrmony/kit-1 (npm)

Source: amazon-inspector 0a4084c44ab6554d66c474338de2cb482a25b31e6822d470e08b2b2ef5b1735a The package executes credential-harvesting code both from its postinstall script scripts/check-setup.mjs and from its main entry index.js, so theft fires on npm install and again on require/import even when...

Malicious code in @hrmony/kit (npm)

Source: amazon-inspector 6976b2f9327b9a181d77cd0597ef2f657575961a3d47ef8c57de1f6d4141503d On require/import, index.js contacts the EC2 Instance Metadata Service at 169.254.169.254 using an IMDSv2 token, enumerates the instance's IAM role security-credentials including temporary AWS access key,...

adm-zip: Decompression-bomb protection (fix for CVE-2026-39244) can be bypassed by declaring uncompressed size as 0

Affected package: adm-zip npm Affected version: 0.6.0 Summary The fix shipped for CVE-2026-39244 methods/inflater.js caps zlib's decompression output via maxOutputLength: expectedLength, where expectedLength is read directly from the ZIP entry's attacker-controlled "uncompressed size" header fiel...

adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation

Summary adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via fs.chmodSync when keepOriginalPermission=true is passed to extractAllTo/extractEntryTo — and it never filters the setuid/setgid/sticky bits out of those bits. A zip crafted by an attacker can...

Laravel: XSS in Debug Page Information

Impact When APPDEBUG=true, attacker-controlled input is passed to a Tippy.js tooltip configured with allowHTML: true, enabling DOM-based XSS during mouse hover. Patches 61381...

Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoS

Submission metadata | Field | Value | |---|---| | Ecosystem | npm | | Package | nodemailer | | Repository | https://github.com/nodemailer/nodemailer | | Tested commit | 40d52215aac65b811d7e131bc916f68605efd9d2 | | Current tested version | 10.0.1 | | Confirmed vulnerable versions | 2.7.2, 3.0.0,...

PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set

Summary A malformed RSA JWK inside a JWK Set aborts parsing of the entire set instead of being skipped, because RSAAlgorithm.fromjwk can raise a plain ValueError that isn't caught by PyJWKSet's per-key error-skipping logic. Affected component / version - Package: PyJWT PyPI, ecosystem pip - Files...

undici vulnerable to Denial of Service via orphaned RetryHandler response body

Impact undici's RetryHandler can leave a response body pending indefinitely. When a retried request receives a non-retryable response after a truncated one, the original response.body held by the application is never settled, so reads such as response.body.text hang and bodyTimeout does not fire....

undici vulnerable to downstream response splitting via retry interceptor

Impact Undici's interceptors.retry can resume a request after a partial response and append the resumed bytes to an already partially delivered body, while the application still receives the original response's status and headers. When that response carried a Content-Length, the application can...

undici vulnerable to Denial of Service via unrequested WebSocket subprotocol

Impact The undici WebSocket client throws an uncaught TypeError during the opening handshake when a server's 101 response includes a Sec-WebSocket-Protocol header that the client never requested. The throw occurs in a queueMicrotask callback with no surrounding try/catch, so it propagates as an...

undici vulnerable to Denial of Service via unbounded decompression of compressed responses

Impact The interceptors.decompress interceptor decompresses HTTP response bodies according to the untrusted Content-Encoding header. The number of decompression layers is capped at 5, but the total decompressed output size is not bounded and there is no option to limit it. A malicious or faulty...

undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches

Impact undici's interceptors.cache does not handle Set-Cookie in the cache path. In shared-cache mode type: 'shared', the default, a cacheable response for example Cache-Control: public, max-age=... carrying a Set-Cookie header is stored, and the stored Set-Cookie is re-served to a later caller...

undici vulnerable to response truncation via oversized chunked responses in the dump interceptor

Impact undici's interceptors.dump reads and discards response bodies up to a configurable maxSize. When a response declares a Content-Length that exceeds maxSize, the request is aborted cleanly. When a response is sent chunked no Content-Length and its body exceeds maxSize, it is not aborted: the...

undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool

Impact undici's BalancedPool passes its constructor options through a JSON-based deep clone JSON.parseJSON.stringify... before forwarding them to each per-upstream Pool. JSON cannot represent functions, so a caller-supplied connect or tls option containing a checkServerIdentity callback or a cust...

undici vulnerable to caching and replay of unsafe HTTP method responses

Impact undici's interceptors.cache documents that it caches only safe HTTP methods. However, its internal skip-list is built by subtracting the configured methods from the safe-methods set, so an unsafe method POST, PUT, PATCH, DELETE never lands in the skip-list and is looked up against the cach...

undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors

Impact When interceptors.cache or interceptors.deduplicate is used with a dispatcher that does not carry a single authoritative origin, or when a request supplies its own origin, undici builds the cache and deduplication keys without the actual destination origin. If a cache store or interceptor...

undici vulnerable to Denial of Service via WebSocketStream unclean close

Impact undici's WebSocketStream crashes the client process when a WebSocket connection is closed abruptly without a close handshake. On such an unclean close, the internal socket-close handler calls abort on the writable stream even when the application holds a writer lock. Per the WHATWG Streams...

Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter

Related public issue context, not a duplicate Closed issue 1429 "Handle non-UTF-8 paths", 2024-03-24 raised exactly this general concern and even suggested detection via pregmatch'//u', $path !== 1 -- note the reporter's suggested check explicitly compares !== 1, which would correctly treat PCRE'...

joi: Quadratic regular-expression backtracking in `Joi.string().isoDate()`

Impact Any application that validates a user-supplied string with Joi.string.isoDate can be stalled by a single request. One of the regular expressions the rule runs over the input was unanchored, so a valid ISO date followed by a long run of fractional-second digits made the regex engine restart...

Electron: Local race condition in Squirrel.Mac update installation on macOS

Impact On macOS, Electron bundles the Squirrel.Mac auto-update framework, whose privileged ShipIt helper performs the final step of an update as root. A local attacker could cause that helper to overwrite a different application's files, as root, instead of the app that started the update...

Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab

Impact Popups opened from a sandboxed iframe through a link for example target="blank" or a middle-click did not inherit the iframe's HTML sandbox restrictions. Content that was meant to run sandboxed could open a popup with the embedding app's full origin, gaining access to that origin's cookies...

Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions

Impact Windows opened from a sandboxed top-level document did not inherit that document's HTML sandbox restrictions, so content that was meant to run sandboxed could open a window with the app's full origin. GHSA-hq2x-r82h-9wj4 covers the same issue for sandboxed iframes. Apps are only affected i...

Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled

Impact Responses served through protocol.registerFileProtocol or protocol.registerHttpProtocol for a custom scheme registered with supportFetchAPI: true but without corsEnabled: true could be read cross-origin by web content. This completes the fix for CVE-2026-70604. Apps are only affected if th...

Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions

Impact A could enable Node.js integration in its Web Workers even when its embedder had Node.js integration disabled, giving guest content more privilege than the embedder allowed. Apps are only affected if they enable the tag and the embedder is unsandboxed. Apps that do not use , or that keep t...

Electron: Sandboxed preload code cache can be poisoned by a compromised renderer

Impact The cache Electron keeps for sandboxed preload scripts did not verify that a cached entry matched the preload it was served for. A compromised renderer could use this to run its own code in the preload context on a later load. Apps are only affected if they load untrusted content. Apps tha...

OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full

Summary A BatchingProcessor in go.opentelemetry.io/otel/sdk/log can enter a tight CPU loop when the asynchronous export buffer is full. Under exporter backpressure, attacker-driven high-volume log emission can keep the queue at or above the batch size, causing repeated immediate export retries an...

OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation

Summary The OpenTelemetry Go SDK trace package can fail to enforce AttributeValueLengthLimit for string attributes containing the valid Unicode replacement character U+FFFD. An oversized attacker-controlled attribute value that includes U+FFFD is returned untruncated, bypassing the configured...

markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds

Summary Two independent quadratic paths in the linkify: true handling. Both are in markdown-it's own code rather than in linkify-it, which stays linear on both payloads. src/rulescore/linkify.ts calls arrayReplaceAt once per linkified text token, and that rebuilds the whole children array each...

js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

Summary maxTotalMergeKeys does not count empty mappings. An attacker can repeatedly merge a large sequence of them and consume significant CPU without reaching the configured limit. Example yaml arr: &arr , , , ... N empty mappings targets: - : arr repeated K times For every target, the loader...

PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()

Impact PHPCSUtils versions 1.0.0-alpha1 through 1.2.2 contain an arbitrary code execution vulnerability in PHPCSUtils\AbstractSniffs\AbstractArrayDeclarationSniff::getActualArrayKey. The vulnerable method is reached by any sniff that extends AbstractArrayDeclarationSniff and calls...

Oauthlib: Timing Attack Vulnerability in PKCE code_verifier Comparison (CWE-208)

Summary A timing side-channel vulnerability exists in the PKCE RFC 7636 implementation of the Authorization Code Grant flow. The codechallengemethodplain function uses Python's standard == operator for string comparison instead of a constant-time comparison function, potentially allowing...

Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation

Summary When enablejsonp=True, oauthlib's RevocationEndpoint reflects the user-supplied callback parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation inste...