npm
Monthly
Seroval deserialization can invoke attacker-chosen callables when an application passes untrusted input to fromJSON and registers a plugin whose deserialize result is a function or an object exposing an on method; a crafted AsyncIteratorFactoryInstance node reuses an identifier so the rebuild calls source.on(listener) on that plugin-produced value. All versions through 1.6.7 are affected, although 1.6.4 through 1.6.7 block the originally reported payload only to remain bypassable via node-id reuse. Practical risk is constrained by the non-default plugin prerequisite and by what the plugin's own callable does, and no public exploit was identified at time of analysis; version 1.6.8 fixes the flaw.
Remote code execution in @rog0x/mcp-docker-tools 1.0.1 is possible when the MCP server is deployed and an operator or AI agent invokes the Docker image-listing path, allowing attacker-controlled data supplied to handleImageList to reach code execution. The CVSS 3.1 score is 7.5 (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H), so exploitation is unauthenticated from the network but requires user interaction and non-trivial conditions. No confirmed working exploit or CISA KEV entry is present in the available data; the decision label is this_week.
Command injection in @justice8096/sagemath-mcp-server 1.0.1 allows remote attackers to execute arbitrary code because the escapeShellString and sanitizeCode routines fail to adequately neutralize attacker-supplied input before it reaches shell execution. Only version 1.0.1 is identified as affected, and exploitation requires the package to be deployed and to process malicious input that a user or agent must route into the sanitization path (UI:R), with a payload specifically crafted to bypass both functions (AC:H). No CISA KEV entry or confirmed working exploit code was reported; a public issue reference exists, and the product's very small install base limits realistic exposure.
Integrity bypass in adm-zip through 0.6.0 allows an unauthenticated attacker who supplies a crafted ZIP to a validate-then-extract application to have getEntry() approve one duplicate entry while extractAllTo() writes a different entry's bytes to disk. The flaw is conditional: the consuming application must inspect a named entry's content via getEntry() and then extract the same archive, and the archive must contain duplicate entry names with the relevant ordering; applications that only extract without a getEntry-based content check are not affected. Public proof-of-concept code is present in the upstream advisory, and no CISA KEV active-exploitation listing is associated with this CVE.
Signature-verification bypass in NearForm fast-jwt 6.2.4 lets a remote, unauthenticated attacker forge HS256-signed JWTs with arbitrary claims when the application supplies a raw serialized public JWK or JWKS JSON string as the verifier key and HS256 (or another HS* algorithm) is allowed or auto-inferred. Because JWK public material is public by design, those exact JSON bytes become the HMAC secret, so the attacker can mint tokens that createVerifier accepts - the affected configuration is narrow but the impact is a full authentication/authorization bypass. Exploitation requires the attacker to reproduce the victim's exact serialized bytes (property ordering and whitespace must match), and publicly available exploit code exists; CISA KEV does not list this CVE and EPSS data was not provided. Version 6.3.0 fixes the flaw. CWE-347 (Improper Verification of Cryptographic Signature).
Denial of service in music-metadata versions prior to 11.16.0 lets remote attackers crash or exhaust memory in any application that parses an attacker-supplied MP4-family file. The MP4 atom parser trusts an attacker-controlled 64-bit extended atom size, converts it to a JavaScript Number, and passes the oversized length into atom-specific readToken payload parsing (mvhd, stsd, stsz, or date) before confirming the atom fits within its parent or the remaining input, so a tiny crafted file can force a large allocation attempt or process failure. The flaw is remotely triggerable without authentication and without user interaction beyond the file being processed (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5); publicly available exploit code exists, but there is no evidence of active exploitation, no KEV listing, and EPSS is low at 0.13% (2nd percentile), with impact confined to availability.
Prototype pollution in dot-access through 1.0.0 allows remote attackers to modify Object.prototype when a consuming application passes an attacker-influenced dotted path to set(). By injecting __proto__ path segments, attackers can alter authorization flags or option defaults across all objects and may crash the process; the flaw is CWE-1321, rated 8.8 in CVSS 4.0, and assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L with high integrity and low availability impact. No public exploit identified at time of analysis and no CISA KEV confirmation; exploitation is integration-specific because the path argument must be attacker-controlled.
Remote code execution in dot-access versions 0.0.3 through 1.0.0 allows unauthenticated attackers to execute arbitrary JavaScript and operating system commands when a consuming application passes attacker-controlled input as the path argument to the get() function. The vulnerability arises from unsanitized path concatenation into a dynamically constructed Function body, enabling access to constructor.constructor and child_process. No public exploit code was identified at time of analysis, but the CVSS 4.0 score of 9.3 reflects high confidentiality, integrity, and availability impact. Exploitation is conditional on untrusted input reaching get().
Path traversal in decompress-zip through 0.3.3 allows a crafted ZIP archive to write files outside the intended extraction directory when a victim or application uses the package to extract it, potentially enabling arbitrary file overwrite, application compromise, or code execution in environments with a useful writable sibling path. The assessed vector is local (AV:L) with required user/application interaction (UI:R), no network exposure, and no special authentication (PR:N), so exploitation requires the attacker to deliver the archive into an extraction workflow; RCE is conditional, not guaranteed. No public exploit identified at time of analysis, and no CISA KEV active-exploitation report was provided; the overall risk is real but conditional rather than an urgent mass-exploitation threat.
Denial of service in the @stablelib/cbor decoder before version 2.0.4 (the GitHub advisory records the fix as 2.0.3) allows remote, unauthenticated attackers to exhaust the JavaScript call stack by submitting a CBOR payload composed of deeply nested arrays, maps, or tagged values, producing a RangeError during decoding that can terminate the worker or process handling the request. Because the pre-patch decoder imposed no nesting limit and had no iterative fallback, no non-default configuration, credentials, or user interaction are required - only that the application decode attacker-controlled CBOR. Public proof-of-concept code is included in the vendor advisory (a 12,000-level nested-array payload), and the flaw is scored HIGH (CVSS 4.0 base 8.7, assessed independently as CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with impact confined entirely to availability, since confidentiality and integrity are explicitly unaffected. Exploitation escalates to a real outage only where the thrown exception is left uncaught and allowed to kill the request worker or process; services that wrap decode() in try/catch degrade to a single failed request. There is no indication of confirmed active exploitation (not in CISA KEV).
An authentication bypass in the npm packages @insumermodel/mppx-condition-gate (before 3.0.0) and @insumermodel/mppx-token-gate (1.0.0 through 1.0.3) lets unauthenticated remote attackers obtain content that should require payment by simply naming any wallet address that satisfies the configured on-chain condition. The gates trusted the client-supplied credential.source as proof of payer identity instead of verifying wallet control, so since qualifying wallets are public blockchain state, no secret or wallet ownership is needed; cached free-access grants can also be reused for the configured cache lifetime. No public exploit code was identified at time of analysis, and practical risk is bounded by the small deployment footprint of these packages; the vendor-released fixes are @insumermodel/mppx-condition-gate 3.0.0 and @insumermodel/mppx-token-gate 1.0.4.
Command injection in simple-git and its @simple-git/argv-parser package prior to 2.0.1 lets an attacker who can influence environment values forwarded by a consuming Node.js application cause Git to launch an attacker-selected editor executable, which runs with the privileges of the Node.js process. The root cause is that parseEnv's GitEnvKeys allowlist omits VISUAL, so prepareEnv silently drops the key before vulnerabilityCheck can classify it as allowUnsafeEditor, letting the value pass through to Git during editor-invoking operations such as commit amendment or interactive rebase. Exploitation requires the wrapping application to unsafely propagate untrusted environment input, the attacker to control VISUAL, and no higher-priority editor setting (GIT_EDITOR, core.editor, or a higher-priority EDITOR) to shadow it, which is why the assessed vector carries AC:H and AT:P despite the high 9.2 CVSS 4.0 base - no public exploit identified at time of analysis, and the flaw is fixed in argv-parser 2.0.1.
Untrusted git configuration includes reachable through simple-git before 4.0.0 let an attacker execute arbitrary commands with the privileges of the Node.js process. The default blockUnsafeOperationsPlugin failed to classify include.path inside customArgs passed to git.clone(), and the initial remediation also missed includeIf.<condition>.path, so a loaded config file could set an executable option such as core.sshCommand that Git runs during the clone. Exploitation is unauthenticated (CVSS:3.1/AV:N/AC:H/PR:N/UI:N, base 8.1) but requires both attacker-influenced customArgs reaching git.clone() and an attacker-controlled file already readable by the Node.js process; no public exploit was identified at time of analysis and the issue is fixed in simple-git 4.0.0.
Local privilege escalation in the npm package adm-zip through version 0.6.0: when an application extracts an archive with the non-default keepOriginalPermission=true option, the library copies the Unix permission bits recorded in each zip entry's external file attributes straight to disk via fs.chmodSync() without stripping the setuid (0o4000), setgid (0o2000) or sticky (0o1000) bits. An attacker who can supply a zip - no special access needed to craft one - can therefore plant a 04755 root-owned binary whenever the extraction runs as root (the common Docker-build, CI-runner and privileged-install posture where this flag is used), and the attacker's code executes as root once a lower-privileged user later runs that file. The issue is correctly rated Medium despite a 7.1 CVSS score because it is highly conditional (flag enabled, root extraction, setuid file preserved and executed by another user); confirmed actively exploited: no - not in CISA KEV - but a working proof-of-concept (a Python-crafted zip with external_attr 0o4755 << 16) is documented in the vendor advisory. Default usage with the flag off, or extraction as a non-root user, is not exploitable.
Denial of service in Socket.IO Cluster Engine versions before 0.1.1 allows unauthenticated remote attackers to crash Node.js processes in clustered Socket.IO deployments by supplying crafted session IDs such as __proto__ or constructor. Only applications using @socket.io/cluster-engine are affected, and the flaw requires network reachability to the Socket.IO endpoint but no credentials or user interaction; the CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H with base 7.5. No public exploit identified at time of analysis, and the issue is fixed in 0.1.1.
An out-of-bounds read in lib0's binary decoder before version 0.2.119 lets remote attackers who control serialized input cause the decoder to return bytes from outside the intended buffer view, exposing adjacent process memory that may contain credentials, tokens, or log data. The flaw is unauthenticated and remotely reachable (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, 8.6) because any application that decodes attacker-supplied data with lib0 - directly or transitively through Yjs - can be driven into the over-read; the leaked bytes are opportunistic contents of the backing/pooled ArrayBuffer rather than attacker-selected addresses. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV), and the impact is limited to confidentiality with no integrity or availability effect; the vendor has published a fix in lib0 0.2.119.
Command injection in the Node.js shell-quote library (formerly published as shell-quote on npm) allows an attacker who controls a string placed after a { comment } token to break out of the generated shell command and execute arbitrary shell input. The flaw affects the quote() function before version 1.11.0: a line terminator (\n, \r, U+2028 or U+2029) inside a later string terminates the '#' comment emitted for the comment token, causing the remainder of that string to be interpreted as shell syntax - for example quote(['echo','ok',{comment:'x'},'a\nid;#']) executes id under sh, bash, dash, ksh and zsh. It is also reachable through the quote(parse(untrustedCommand).concat(untrustedArg)) idiom, because parse() emits a mid-word comment token for inputs such as a URL fragment (http://example.com/#frag). This is a genuine command-injection flaw (CWE-78) in a foundational Node.js utility; the vendor CVSS 4.0 score of 9.2 reflects the potential for full shell execution, though our independent CVSS 3.1 assessment is AV:N/AC:H (the vulnerable calling pattern is a prerequisite and is not present in a bare default install). No public exploit was identified at time of analysis and the issue is not in CISA KEV; the upstream fix commit includes test cases that demonstrate the triggering payload shapes. Vendor-released patch: shell-quote 1.11.0.
An unauthenticated remote attacker can lock up an Angular server-side rendering process by submitting HTML that contains an unterminated DOCTYPE declaration with trailing whitespace (for example `<!DOCTYPE html `), which drives the bundled domino HTML parser into an infinite synchronous loop that pins a CPU core at 100% and stalls the Node.js event loop, silently dropping all concurrent and subsequent requests. Only SSR deployments that run @angular/platform-server and feed attacker-controlled markup into server-side DOM parsing - via `[innerHTML]`, interpolation into rendered HTML, `insertAdjacentHTML`, `outerHTML`, or server-side sanitization - are reachable; the vulnerable version ranges are <=19.2.25, 20.0.0 through 20.3.30, 21.0.0 through 21.2.22, and 22.0.0 through 22.1.5. The trigger payload is trivial to construct, but no public exploit code has been observed circulating and the issue is not listed in CISA KEV, so the practical risk is a function of whether the application actually routes untrusted HTML through domino on the server.
A remote, unauthenticated denial-of-service condition in the NestJS (Nest) microservices framework lets an attacker crash a service on demand by sending a single message whose 'pattern' field is a deeply nested object. Only deployments using the TCP transport (ServerTCP) or the RabbitMQ transport (ServerRMQ) are exposed, because those paths pass a client-controlled, non-string pattern into JSON.stringify to compute the handler lookup key; sufficient nesting throws 'RangeError: Maximum call stack size exceeded', and the unhandled promise rejection terminates the Node.js process under default behavior. Affected versions are prior to 11.2.4 and prior to 12.0.2; the CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects pure availability loss with no confidentiality or integrity impact, and no public exploit has been identified at time of analysis. Risk is highest where the raw TCP port or consumed RabbitMQ queue/exchange is reachable by untrusted parties, since these are typically internal service-to-service surfaces.
Deeply nested brace patterns cause unbounded recursion in the npm brace-expansion library, exhausting the native stack and terminating the Node.js process (CWE-400). All versions prior to 1.1.20, 2.1.6, 3.0.8 and 5.0.11 are affected, and the trigger is remote and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) whenever an application passes attacker-controlled input into expand()/expand_() - directly or transitively through minimatch or glob. A payload of roughly 3,100 stacked '{' followed by 'a,b' and matching '}' (about 6KB) is sufficient, and because the stack is consumed before any output is generated, neither the max nor maxLength output bounds prevent the crash; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, though its availability-only impact and deep embedding in the JavaScript toolchain make it relevant to any service that expands untrusted glob or path patterns.
Stack exhaustion in the npm library brace-expansion (all versions prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10) lets a crafted brace pattern terminate the Node.js process, a process-terminating denial of service. The flaw is reachable by remote, unauthenticated attackers (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) whenever an application passes attacker-controlled strings into expand(), most commonly indirectly through minimatch or glob pattern matching of user-supplied glob or filter expressions. No public exploit code has been identified and the issue is not listed in CISA KEV, but the consuming application must expose a path to brace expansion for the bug to be reachable, so the practical risk depends entirely on how the library is embedded.
Prototype-pollution gadget in the Axios promise-based HTTP client for Node.js and the browser lets a separate, pre-existing prototype-pollution flaw in the same JavaScript process steer how ToFormData serializes outgoing request bodies in Axios 0.28.0 through 0.33.x and 1.15.1 through 1.19.x. Inherited dots, indexes, metaTokens, maxDepth, visitor, or Blob values planted on Object.prototype silently rename or reinterpret serialized fields, or make requests fail outright via a polluted maxDepth; a polluted visitor only executes when the attacker already possesses a stronger function-injection primitive, so Axios adds no new code-execution capability on its own. Remote unauthenticated exploitation is inert without that chained second bug, and no public exploit identified at time of analysis, with no confirmed actively exploited (CISA KEV) status; vendor-released patches ship in 0.34.0 and 1.20.0.
Redirect-policy bypass in Axios 1.17.0 up to (but not including) 1.20.0 causes the fetch adapter to follow HTTP 3xx redirects even when the application explicitly sets maxRedirects: 0, so a redirect-blocking control that developers rely on as a security boundary is silently ignored. The flaw is a confused-deputy issue (CWE-441): an attacker positioned to control a redirect response from a server the application calls can push the request to internal responses or state-changing internal endpoints that should have been unreachable. Exploitation requires three simultaneous conditions - use of the fetch adapter (not the default http/xhr adapters), an explicit maxRedirects: 0 setting used as a security control, and an attacker-influenced redirect target - and per the independent assessment it is unauthenticated (CVSS PR:N) with only a single additional precondition (AT:P), yielding no direct impact on the axios host (VC/VI/VA:N) but high confidentiality and integrity impact on the subsequent internal systems reached (SC:H/SI:H). There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV).
Denial of service in the Axios HTTP client affects Node.js deployments running versions 1.15.0 through 1.19.x, where a crafted redirect Location hostname triggers quadratic regular-expression backtracking inside the proxy-bypass check and blocks the Node.js event loop. Successful exploitation requires an unusually specific combination - HTTP_PROXY/HTTPS_PROXY set, a non-empty NO_PROXY/no_proxy value, redirect following enabled, and requests reaching an attacker-influenced server that can return the malicious redirect - so exposure is narrow, and the reverse-trust nature of the attack means the adversary must control or compromise the redirect target rather than simply send a request to the victim. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV) for CVE-2026-101906; the high vendor CVSS 4.0 score of 8.2 largely reflects the VA:H availability weighting rather than ease of exploitation, as reflected in our independent assessment of CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H.
Credential and response tampering in Axios's Node HTTP adapter (lib/adapters/http.js) affects versions 1.15.2 through 1.19.x when a separate, same-process prototype-pollution flaw plants a function on Object.prototype.createConnection: because the adapter supplies request options without an own createConnection property, Node resolves and invokes the inherited function as the socket factory, redirecting the transport to an attacker-controlled endpoint that receives request headers and bodies (including credentials) and returns forged responses while the requested URL still appears legitimate. This is a confused-deputy gadget rather than a self-contained flaw - it is inert without a co-resident pollution primitive that can write a function onto Object.prototype, which is why the vendor CVSS 4.0 vector carries AT:P and why our independent assessment (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) treats exploitation as contingent on that chain. The issue is fixed in Axios 1.20.0; there is confirmed actively exploited (CISA KEV) status absent and no public exploit code identified at time of analysis.
Axios 1.16.1 through 1.19.x can be driven into catastrophic regular-expression backtracking through its data-URI parser, letting an unauthenticated remote attacker stall the Node.js event loop and cause a denial of service. The trigger is an attacker-controlled, malformed RFC 2397 data URL containing many slash characters on both sides of the media-type separator and no comma, which the fromDataURI / DATA_URL_PATTERN logic must exhaustively re-split before rejecting; because the parse is synchronous, the whole single-threaded process is blocked. Exploitation requires that the application actually route untrusted input into Axios's data: parsing path, so services that only make ordinary HTTP requests are not exposed; there is no confidentiality or integrity impact, authentication is not required, and no public exploit identified at time of analysis. Severity is rated 8.2 under the supplied CVSS 4.0 vector, while our independent CVSS 3.1 assessment (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) treats it as availability-only and high-complexity given the deployment prerequisite, and the vendor-released patch is Axios 1.20.0.
Axios versions 1.13.0 through 1.19.x can crash a Node.js process because the HTTP/2 adapter installs no error handler on a ClientHttp2Session created for a request made with httpVersion: 2, so a session-level 'error' event emitted during session initialization or reuse escapes normal Promise rejection handling and becomes an uncaught exception that terminates the process, producing a denial of service. Only applications that explicitly opt into HTTP/2 are affected; the browser build and the default HTTP/1.x path are not, and the attacker must additionally be able to induce a genuine HTTP/2 session error (for example via a peer or intermediary), which is why the independent assessment rates this as high complexity rather than trivially triggerable. Impact is availability-only - no data exposure, no code execution, and no privilege requirement (unauthenticated). No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing).
Axios versions 1.13.0 through 1.19.x on Node.js can silently bypass a configured HTTP(S) proxy or a caller-supplied DNS lookup policy for requests that opt into HTTP/2, because the HTTP/2 adapter calls http2.connect() without consistently applying config.proxy, environment-derived proxy settings, or config.lookup before the connection is established. This is a defense-in-depth control bypass (CWE-918, SSRF-adjacent): confidentiality and integrity impacts fall on the systems the bypassed egress or DNS control was meant to protect, not on the local vulnerable host, and exploitation is gated by non-default configuration - the application must explicitly set httpVersion: 2 and must actually depend on the proxy or lookup policy as a security boundary. Unauthenticated remote reachability is indicated by the CVSS vectors, but practical risk is moderate given the narrow affected version band and the opt-in requirement; no public exploit identified at time of analysis.
Archive extraction in the Node.js decompress package allows a crafted archive containing chained symlink entries to resolve file writes outside the intended output directory, because the default decompress(input, output) API relies on lexical path containment checks that the kernel's symlink resolution can bypass. This affects @xhmikosr/decompress before 10.2.2 and before 11.1.4, and the separately maintained but unmaintained kevva/decompress package through 4.2.1, which remains unpatched. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N, 9.1) indicates unauthenticated remote triggering with high confidentiality and integrity impact; writing outside output can overwrite startup scripts or configuration and escalate to remote code execution, and the flaw is a bypass of the incomplete hardening previously applied for CVE-2026-53486. Exploitation requires the consuming application to extract an attacker-influenced archive on a non-Windows platform (Windows emulates symlinks via hardlinks and does not follow the affected path), and no public exploit code was identified at time of analysis, though the upstream fix ships a regression test that documents the escape technique.
OpenClaw (npm package openclaw) before 2026.7.1 misbinds Signal approval reactions to the wrong message, so a reaction an approver places on ordinary outbound text can be interpreted as approving or denying a structured host-action request that happens to be pending in the same conversation. Exploitation requires an authenticated participant acting as approver (PR:L), deliberate user interaction via a reaction (UI:P), and precise timing where unrelated outbound messages and a pending approval coexist (AC:H, AT:P), which is why the CVSS 4.0 base score is 7.5 rather than critical. The flaw does not grant any party new authority and does not change the legitimacy of correctly identified approvers; impact is bounded by whatever host actions the OpenClaw process is authorized to perform for the specific pending request. Vendor-released patch: 2026.7.1; no public exploit identified at time of analysis and the issue is not in CISA KEV.
A credential-isolation flaw in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker who controls or can predict the MCP server URL a victim configures to cause MD5-derived credential-store paths to collide or match, potentially exposing or overwriting another server's cached OAuth tokens via the getServerUrlHash function in src/lib/utils.ts. The package is an npm bridge that connects local MCP clients to remote MCP servers, so practical exploitation depends on the victim adding the attacker's server URL and on the OAuth credential-persistence feature being in use (user interaction), which is inconsistent with the no-interaction AV:N/AC:L/PR:N/UI:N profile of the 9.8 headline score. No public exploit code was identified at time of analysis and EPSS is low (0.29%, 19th percentile), so the CWE-94 arbitrary-code-execution framing should be treated as unverified rather than confirmed remote code execution.
Code injection in the Orval OpenAPI client generator's @orval/effect package (versions 8.14.0 through 8.28.1) lets an attacker who can influence an OpenAPI schema embed arbitrary JavaScript expressions in the generated validation module, which execute at module scope as soon as that generated code is built or imported. The injection point is the schema `default` value, which the effect generator rewrites into a template literal so that `${...}` syntax (or a literal backtick) re-arms interpolation, with numeric constraints such as minimum/maximum/multipleOf similarly emitted as unquoted expressions; exploitation is remote and does not require prior credentials per the vendor vector (PR:N), but it does require the victim to run the generator against an untrusted or third-party spec and then build or import the output, giving injected code the developer's build-time privileges. No public exploit code has been identified at time of analysis and the issue is patched upstream, so real-world urgency is lower than the vendor's CVSS 4.0 score of 9.3 suggests - this is a build-time/developer-tooling flaw rather than a network-facing service exposure (independent assessment: CVSS 3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, reflecting the victim interaction the vendor rating understates).
Code injection in orval's opt-in @orval/hono generator (all versions before 8.29.0) lets an attacker who controls an OpenAPI document plant an apostrophe in a static path segment and break out of the single-quoted route literal, injecting arbitrary JavaScript that runs whenever the generated TypeScript module is imported or built. This is a build-time supply-chain style flaw rather than a runtime flaw in a network service: the affected party must run orval code generation against an untrusted spec and then import the generated output, and the CVSS v4.0 score of 9.3 reflects high confidentiality, integrity and availability impact on the build/developer environment. Exploitation is not confirmed in the wild (no CISA KEV entry) and no public exploit code was identified at time of analysis, though the upstream patch and the exact vulnerable code path are publicly documented.
The legacy DOC renderer in File Viewer emits document-controlled hyperlink targets into generated HTML after character escaping but without restricting URL schemes, so a crafted legacy .doc file can render a live javascript:, vbscript:, or data: link and execute script in the embedding application's origin when a user clicks it. Applications are affected if they use @file-viewer/doc up to and including 2.3.0 or the msdoc-viewer compatibility package up to and including 0.2.1 to render untrusted .doc files; exploitation is conditionally gated, requiring a victim to open the preview and click the malicious link (CVSS 8.2, UI:R, scope changed). No public exploit code or confirmed active exploitation was identified at time of analysis, and vendor-released fixes exist in @file-viewer/doc 2.3.1 and msdoc-viewer 0.2.2.
Crafted RESP replies from a malicious, compromised, or impersonated Redis endpoint crash Node.js processes that use redis-parser through 3.0.0, including applications built on node-redis and ioredis, because repeated nested array headers drive unbounded recursion that exhausts the V8 call stack and raises an uncaught RangeError. The flaw is a client-side parser denial of service: it is unauthenticated on the parsing path (CVSS 4.0 vector PR:N/UI:N, CVSS 3.1 assessment AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and affects default configurations, since recursion depth is not bounded by any setting. Impact is limited to availability - the process terminates without invoking error-handling callbacks - with no confidentiality or integrity effect; the vendor score of 8.7 reflects that high availability impact. No public exploit identified at time of analysis.
DNS rebinding against the local Streamable HTTP MCP listener in @zereight/mcp-gitlab before 2.1.30 lets a malicious web page reach a victim's loopback MCP endpoint while preserving an attacker-controlled Host and Origin, so the request is accepted at the HTTP boundary and reaches the MCP initialization path - and, where a GitLab token is configured, can drive GitLab API tool calls through the victim's browser. Exploitation is network-reachable with no attacker credentials required (CVSS PR:N) but hinges on victim interaction (UI:R): the user must browse to an attacker-controlled page while an unpatched server listens on its default 127.0.0.1 bind with no effective Host/Origin allowlist. Publicly available exploit code exists - the vendor advisory ships a proof-of-concept reproduction - and the upstream/NVD vector scores 9.6 Critical, while the independent assessment lowers availability impact to Low (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L); in REMOTE_AUTHORIZATION=true deployments, token checks block material unauthenticated GitLab API tool calls, reducing realized impact to the HTTP-boundary/initialization failure.
SSRF denylist bypass in the npm package mcp-from-openapi (2.2.0 through 2.8.0) lets an attacker who controls the OpenAPI spec URL passed to fromURL - or a redirect target it follows - reach hosts the operator listed in refResolution.blockedHosts simply by appending a trailing root dot (http://internal.corp./), because DNS resolves the dotted FQDN to the same host while the library compares raw URL.hostname strings. The same release range separately forwarded caller-supplied Authorization and Cookie headers to cross-origin redirect targets, handing bearer tokens to an open redirect on the spec host. Impact is limited to fetching operator-blocked content (low confidentiality, no integrity or availability effect), exploitation depends on non-default reliance on blockedHosts as the host guard, no CISA KEV listing exists, and the upstream advisory documents proof-of-concept reproductions; 2.9.0 normalizes hostnames on both sides of the comparison and drops caller headers once a redirect leaves the spec origin.
adm-zip versions before 0.6.1 can apply attacker-controlled setuid, setgid, or sticky bits when extracting archives with the non-default keepOriginalPermission option enabled. This is a conditional local privilege-escalation risk: the archive must be extracted in a privileged context such as root and the resulting executable must later be run, so exploitation depends on that specific workflow. No public exploit identified at time of analysis, and the vendor-released patch is adm-zip 0.6.1.
Denial of service in the ip-address npm library before 10.7.4 allows unauthenticated remote attackers to consume CPU and stall applications that pass untrusted input containing many '%' characters into the Address6 IPv6 constructor. The flaw is CWE-1333 inefficient regular expression / quadratic complexity, rated medium severity (CVSS 4.0 base 6.3), with availability-only partial impact; exploitation depends on a reachable application code path that forwards attacker-controlled data to Address6 parsing (CVSS AT:P). No public exploit code was identified at time of analysis, and upgrading to 10.7.4 or later removes the condition.
A crafted flat CSS selector can stall a synchronous parser thread in postcss-selector-parser versions prior to 7.1.6, because class and ID index lists are scanned repeatedly inside parsing passes that should be linear, producing quadratic (O(n^2)) parse cost. Only consumers that synchronously parse untrusted selector strings on an exposed request path are affected; the vendor explicitly notes ordinary build-time parsing of trusted sources is not affected. The issue is remotely triggerable by unauthenticated attackers where that precondition holds (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, 5.9), is availability-only with no confidentiality or integrity impact, and there is no public exploit code and no confirmed active exploitation (no KEV listing) at time of analysis. A vendor-released patch, version 7.1.6, is available.
Cross-site scripting in serialize-javascript 7.1.1 arises because function values serialized by the library are not fully protected against script-closing tags: the SCRIPT_CLOSE_REGEXP escaping pattern can match across and swallow a second closing tag, so a surviving </script> terminates the embedding script element early and the remaining output is parsed as HTML in the page origin. Exploitation requires an application on the narrow vulnerable release to serialize a function value whose source is attacker-influenced and embed that output inside an HTML <script> element, and a victim must load the resulting page (user interaction); ordinary data values and options.isJSON output are unaffected. The flaw is fixed in 7.1.2, and no public exploit was identified at time of analysis.
The pbkdf2 npm library through version 3.1.6 lets a long password drive an event-loop-blocking denial of service in its pure-JavaScript fallback (lib/sync.js), because passwords longer than the digest block size are re-hashed by HMAC on every PBKDF2 iteration. Applications are affected only when running on a runtime that actually uses that fallback - Node.js before 0.12, Bun 1.0.0-1.1.34 or 1.2.6 and later, Deno 2.9.0 and later, or code importing lib/sync.js directly - and only when attacker-controlled data is passed as the PBKDF2 password with no reasonable maximum length enforced. No public exploit code was identified at time of analysis; an upstream fix (commit 493d8d8) pre-hashes over-length keys once instead of per iteration, and the issue is a modest-severity availability bug (CVSS 4.0 6.3; independent assessment ~CVSS 3.1 5.3).
Quadratic-time CPU exhaustion in the brace-expansion npm library (all releases prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12) lets unauthenticated remote attackers stall the Node.js event loop by supplying a crafted brace pattern shaped like '{a},b}' with a very large number of trailing closing braces. Parsing such input forces successive full-string rescans with growing working strings, so ~128 KB of the payload has been measured to block the event loop for tens of seconds; the process recovers afterward, making this a recoverable denial-of-service rather than a persistent crash, which is why it is rated only 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Exploitation requires that an application pass attacker-controlled input into expand() - directly or transitively through consumers such as minimatch/glob - and it affects Node.js runtimes only; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV.
Uncaught exceptions raised inside server method handlers in @grpc/grpc-js leak their error message text back to the calling client, exposing internal details such as file paths, SQL fragments, or connection strings. The flaw affects the pure-JavaScript gRPC implementation for Node.js in versions before 1.13.6 and before 1.14.5, and remote clients can trigger it without authentication (CVSS 3.7, AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N), though disclosure is opportunistic because the attacker cannot control what the handler throws. No public exploit code has been identified and the issue is not reported as actively exploited, but it is a straightforward logic flaw with a trivially reachable trigger for any server whose handlers throw unguarded errors.
Trust-boundary bypass in the ip-address JavaScript library (all versions prior to 10.5.1) lets a remote, unauthenticated attacker who can supply or influence the IPv6 address being validated slip an address within the full fe80::/10 link-local range past Address6.isLinkLocal(), which only matched the narrower fe80::/64. Applications that use isLinkLocal() as an SSRF or on-link filter - the sole prerequisite for exploitation, reflected as AT:P in the CVSS 4.0 vector and AC:H in the independent assessment - may then be steered to reach a link-local host outside the intended trust boundary, with impact limited to confidentiality and reachability (C:L, S:C) and no integrity or availability effect. No public exploit code identified at time of analysis; the vendor fix is version 10.5.1.
Cross-family subnet comparisons in the ip-address npm library (all versions before 10.7.1) can cause isInSubnet and isHostInSubnet to report that an address falls inside a range it does not belong to, allowing an allowlist or denylist decision built on those predicates to misclassify an out-of-scope address as trusted. The flaw is a logic/comparison error (CWE-697) rather than a memory-safety issue: masked binary strings are compared without first confirming that the address and the subnet share the same IP family, so an IPv4 address checked against an IPv6 mask (or vice versa) can compare equal when the leading masked bits align. Exploitation requires a consuming application to use these methods as a security gate and to pass attacker-influenced addresses into a cross-family check; no public exploit code was identified at time of analysis, and the weakness is inert in applications that never use these predicates or that normalize IP family before comparison. Impact is bounded to integrity of the containment decision (no confidentiality or availability effect), and the vendor's CVSS 4.0 score of 6.3 is higher than our assessed CVSS 3.1 vector of AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N because practical exploitation is gated by how the host application wires these predicates.
Denial of service in the ip-address JavaScript/npm library (all versions prior to 10.7.1) lets remote attackers stall or crash a Node.js process by supplying megabyte-scale strings to the IPv6 parsing paths - the Address6 constructor, Address6.isValid, and the underlying parse routine in src/ipv6.ts. An application is only exposed if it accepts an attacker-controlled field of roughly 16 MiB or more and passes it to those entry points without an earlier length bound; common URL, HTTP header, and default body-parser limits keep inputs well below the ~32 MiB needed to terminate the process, so default configurations typically exclude the impact and this is assessed as a low-to-moderate real-world risk that does not warrant emergency prioritization. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and a vendor-released patch in version 10.7.1 resolves it.
The JavaScript library ip-address (npm) fails to treat the NAT64 local-use prefix 64:ff9b:1::/48 as private, so applications that lean on Address6.isPrivate - typically together with isLoopback and isLinkLocal - to enforce an SSRF or trust-boundary policy can be tricked into reading an internal IPv4 destination as external. Unauthenticated network attackers can exploit this (CVSS v4.0 6.9; independent assessment CVSS v3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N) only when the target server's network actually uses an operator-chosen NAT64 prefix carved from the RFC 8215 local-use range, and only when the consuming application composes these classifiers as a security control; information disclosure is the realistic outcome, with no impact on integrity or availability. Versions 10.2.0 through 10.5.0 are affected and the issue is fixed in 10.5.1; no public exploit code or confirmed active exploitation was identified at time of analysis, and exploitation is further gated by the non-default NAT64 deployment and by the application's use of these methods for enforcement.
Header sanitization bypass in the Axios fetch adapter (npm axios 1.7.0 through 1.19.x) allows attacker-controlled request headers - such as Authorization, caching directives, or metadata-service targeting values - to be applied after Axios has already built a sanitized Request object, enabling scope-changed integrity impact (assessed CVSS 3.1: AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N). Exploitation is not standalone: it is a gadget that requires a separate same-process prototype-pollution flaw capable of writing Object.prototype.headers, plus use of the fetch-based transport rather than the default Node HTTP adapter. No public exploit code is identified at time of analysis, but the fix and code change are public in the Axios v1.20.0 release, pull request #11141, and commit d19040bd, so the affected range should be treated as patch-now.
Axios versions 1.0.0 through 1.19.x can leak attacker-controlled headers - including authorization-related values - into outgoing HTTP requests, but only as a secondary gadget in a chain: a separate same-process prototype-pollution flaw must first set Object.prototype.headers, and the application must use trusted request interceptors that return a fresh ordinary configuration object without its own headers property, causing dispatchRequest's normalization step to fall through to the inherited prototype value. The issue is fixed in Axios 1.20.0, which filters shared-prototype-inherited values during config merging and interceptor replacement; no public exploit code has been identified at time of analysis and the defect is inert in isolation, making this a defense-in-depth hardening fix rather than a standalone exploitable vulnerability. Authentication requirements are unauthenticated per the CVSS vector (PR:N), but exploitation is gated by the AT:P attack-requirements flag and the pre-existing pollution primitive.
Axios versions 0.27.2 through below 0.34.0, and 1.0.0 through below 1.20.0, can silently upgrade an intended GET into a state-changing HTTP method when a request is sent through the default instance without an explicit method. The flaw is a read-side gadget, not a pollution source: calls such as axios({ url }) or axios.request({ url }) omit a method, so dispatch looks up the method on the prototype chain and honours an Object.prototype.method value planted by an unrelated prototype-pollution vulnerability in the same process. Because a separate pollution primitive must already exist, this is only exploitable as part of a chain, which is why the vendor CVSS 4.0 vector carries AT:P; no public exploit code was identified at time of analysis and the issue is not listed in CISA KEV. The vendor scores it 6.9 (AV:N/AC:L/AT:P/PR:N/UI:N, SI:H only), while our independent assessment rates it CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N, treating the unauthenticated network-reachable integrity impact as high but gated on the pollution prerequisite.
Axios 1.12.0 through 1.19.x can be tricked into merging attacker-supplied HTTP headers into a fetch adapter request when the surrounding Node.js or browser application is already vulnerable to a separate, same-process prototype-pollution flaw. The polluted value must be an array or a non-plain class instance that masquerades as FormData via inherited append, getHeaders, or Symbol.toStringTag properties; plain objects are explicitly blocked, and the resulting header injection can alter authorization, cache, metadata-service, or application-specific request semantics. This is a defense-in-depth integrity gadget rather than a standalone remotely exploitable bug - exploitation is unauthenticated (PR:N) but conditional on a pre-existing pollution primitive (AT:P), no public exploit code was identified at time of analysis, and the flaw is fixed in Axios 1.20.0.
Cross-domain authenticated request bypass in the connect-xcors (connect-cors) Node.js middleware lets an attacker defeat origin verification so that a victim's browser issues credentialed cross-origin requests the application would otherwise reject. The flaw is remotely reachable without attacker authentication (CVSS 4.0 PR:N) but requires the victim to be logged in to the affected application and to load attacker-controlled web content (UI:P); impact is bounded to low confidentiality and low integrity with no availability effect, giving low-to-moderate real-world risk. No public exploit code has been identified at time of analysis, and no CISA KEV entry exists for this CVE.
npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
The npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if dependency information in package-lock.json differs from package.json. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Visual Studio Code npm-script Extension Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.
Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. Rated medium severity (CVSS 4.4).
Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An issue was discovered in an npm 5.7.0 2018-02-21 pre-release (marked as "next: 5.7.0" and therefore automatically installed by an "npm upgrade -g npm" command, and also announced in the vendor's. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
The CLI in npm before 2.15.1 and 3.x before 3.8.3, as used in Node.js 0.10 before 0.10.44, 0.12 before 0.12.13, 4 before 4.4.2, and 5 before 5.10.0, includes bearer tokens with arbitrary requests,. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Seroval deserialization can invoke attacker-chosen callables when an application passes untrusted input to fromJSON and registers a plugin whose deserialize result is a function or an object exposing an on method; a crafted AsyncIteratorFactoryInstance node reuses an identifier so the rebuild calls source.on(listener) on that plugin-produced value. All versions through 1.6.7 are affected, although 1.6.4 through 1.6.7 block the originally reported payload only to remain bypassable via node-id reuse. Practical risk is constrained by the non-default plugin prerequisite and by what the plugin's own callable does, and no public exploit was identified at time of analysis; version 1.6.8 fixes the flaw.
Remote code execution in @rog0x/mcp-docker-tools 1.0.1 is possible when the MCP server is deployed and an operator or AI agent invokes the Docker image-listing path, allowing attacker-controlled data supplied to handleImageList to reach code execution. The CVSS 3.1 score is 7.5 (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H), so exploitation is unauthenticated from the network but requires user interaction and non-trivial conditions. No confirmed working exploit or CISA KEV entry is present in the available data; the decision label is this_week.
Command injection in @justice8096/sagemath-mcp-server 1.0.1 allows remote attackers to execute arbitrary code because the escapeShellString and sanitizeCode routines fail to adequately neutralize attacker-supplied input before it reaches shell execution. Only version 1.0.1 is identified as affected, and exploitation requires the package to be deployed and to process malicious input that a user or agent must route into the sanitization path (UI:R), with a payload specifically crafted to bypass both functions (AC:H). No CISA KEV entry or confirmed working exploit code was reported; a public issue reference exists, and the product's very small install base limits realistic exposure.
Integrity bypass in adm-zip through 0.6.0 allows an unauthenticated attacker who supplies a crafted ZIP to a validate-then-extract application to have getEntry() approve one duplicate entry while extractAllTo() writes a different entry's bytes to disk. The flaw is conditional: the consuming application must inspect a named entry's content via getEntry() and then extract the same archive, and the archive must contain duplicate entry names with the relevant ordering; applications that only extract without a getEntry-based content check are not affected. Public proof-of-concept code is present in the upstream advisory, and no CISA KEV active-exploitation listing is associated with this CVE.
Signature-verification bypass in NearForm fast-jwt 6.2.4 lets a remote, unauthenticated attacker forge HS256-signed JWTs with arbitrary claims when the application supplies a raw serialized public JWK or JWKS JSON string as the verifier key and HS256 (or another HS* algorithm) is allowed or auto-inferred. Because JWK public material is public by design, those exact JSON bytes become the HMAC secret, so the attacker can mint tokens that createVerifier accepts - the affected configuration is narrow but the impact is a full authentication/authorization bypass. Exploitation requires the attacker to reproduce the victim's exact serialized bytes (property ordering and whitespace must match), and publicly available exploit code exists; CISA KEV does not list this CVE and EPSS data was not provided. Version 6.3.0 fixes the flaw. CWE-347 (Improper Verification of Cryptographic Signature).
Denial of service in music-metadata versions prior to 11.16.0 lets remote attackers crash or exhaust memory in any application that parses an attacker-supplied MP4-family file. The MP4 atom parser trusts an attacker-controlled 64-bit extended atom size, converts it to a JavaScript Number, and passes the oversized length into atom-specific readToken payload parsing (mvhd, stsd, stsz, or date) before confirming the atom fits within its parent or the remaining input, so a tiny crafted file can force a large allocation attempt or process failure. The flaw is remotely triggerable without authentication and without user interaction beyond the file being processed (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5); publicly available exploit code exists, but there is no evidence of active exploitation, no KEV listing, and EPSS is low at 0.13% (2nd percentile), with impact confined to availability.
Prototype pollution in dot-access through 1.0.0 allows remote attackers to modify Object.prototype when a consuming application passes an attacker-influenced dotted path to set(). By injecting __proto__ path segments, attackers can alter authorization flags or option defaults across all objects and may crash the process; the flaw is CWE-1321, rated 8.8 in CVSS 4.0, and assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L with high integrity and low availability impact. No public exploit identified at time of analysis and no CISA KEV confirmation; exploitation is integration-specific because the path argument must be attacker-controlled.
Remote code execution in dot-access versions 0.0.3 through 1.0.0 allows unauthenticated attackers to execute arbitrary JavaScript and operating system commands when a consuming application passes attacker-controlled input as the path argument to the get() function. The vulnerability arises from unsanitized path concatenation into a dynamically constructed Function body, enabling access to constructor.constructor and child_process. No public exploit code was identified at time of analysis, but the CVSS 4.0 score of 9.3 reflects high confidentiality, integrity, and availability impact. Exploitation is conditional on untrusted input reaching get().
Path traversal in decompress-zip through 0.3.3 allows a crafted ZIP archive to write files outside the intended extraction directory when a victim or application uses the package to extract it, potentially enabling arbitrary file overwrite, application compromise, or code execution in environments with a useful writable sibling path. The assessed vector is local (AV:L) with required user/application interaction (UI:R), no network exposure, and no special authentication (PR:N), so exploitation requires the attacker to deliver the archive into an extraction workflow; RCE is conditional, not guaranteed. No public exploit identified at time of analysis, and no CISA KEV active-exploitation report was provided; the overall risk is real but conditional rather than an urgent mass-exploitation threat.
Denial of service in the @stablelib/cbor decoder before version 2.0.4 (the GitHub advisory records the fix as 2.0.3) allows remote, unauthenticated attackers to exhaust the JavaScript call stack by submitting a CBOR payload composed of deeply nested arrays, maps, or tagged values, producing a RangeError during decoding that can terminate the worker or process handling the request. Because the pre-patch decoder imposed no nesting limit and had no iterative fallback, no non-default configuration, credentials, or user interaction are required - only that the application decode attacker-controlled CBOR. Public proof-of-concept code is included in the vendor advisory (a 12,000-level nested-array payload), and the flaw is scored HIGH (CVSS 4.0 base 8.7, assessed independently as CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with impact confined entirely to availability, since confidentiality and integrity are explicitly unaffected. Exploitation escalates to a real outage only where the thrown exception is left uncaught and allowed to kill the request worker or process; services that wrap decode() in try/catch degrade to a single failed request. There is no indication of confirmed active exploitation (not in CISA KEV).
An authentication bypass in the npm packages @insumermodel/mppx-condition-gate (before 3.0.0) and @insumermodel/mppx-token-gate (1.0.0 through 1.0.3) lets unauthenticated remote attackers obtain content that should require payment by simply naming any wallet address that satisfies the configured on-chain condition. The gates trusted the client-supplied credential.source as proof of payer identity instead of verifying wallet control, so since qualifying wallets are public blockchain state, no secret or wallet ownership is needed; cached free-access grants can also be reused for the configured cache lifetime. No public exploit code was identified at time of analysis, and practical risk is bounded by the small deployment footprint of these packages; the vendor-released fixes are @insumermodel/mppx-condition-gate 3.0.0 and @insumermodel/mppx-token-gate 1.0.4.
Command injection in simple-git and its @simple-git/argv-parser package prior to 2.0.1 lets an attacker who can influence environment values forwarded by a consuming Node.js application cause Git to launch an attacker-selected editor executable, which runs with the privileges of the Node.js process. The root cause is that parseEnv's GitEnvKeys allowlist omits VISUAL, so prepareEnv silently drops the key before vulnerabilityCheck can classify it as allowUnsafeEditor, letting the value pass through to Git during editor-invoking operations such as commit amendment or interactive rebase. Exploitation requires the wrapping application to unsafely propagate untrusted environment input, the attacker to control VISUAL, and no higher-priority editor setting (GIT_EDITOR, core.editor, or a higher-priority EDITOR) to shadow it, which is why the assessed vector carries AC:H and AT:P despite the high 9.2 CVSS 4.0 base - no public exploit identified at time of analysis, and the flaw is fixed in argv-parser 2.0.1.
Untrusted git configuration includes reachable through simple-git before 4.0.0 let an attacker execute arbitrary commands with the privileges of the Node.js process. The default blockUnsafeOperationsPlugin failed to classify include.path inside customArgs passed to git.clone(), and the initial remediation also missed includeIf.<condition>.path, so a loaded config file could set an executable option such as core.sshCommand that Git runs during the clone. Exploitation is unauthenticated (CVSS:3.1/AV:N/AC:H/PR:N/UI:N, base 8.1) but requires both attacker-influenced customArgs reaching git.clone() and an attacker-controlled file already readable by the Node.js process; no public exploit was identified at time of analysis and the issue is fixed in simple-git 4.0.0.
Local privilege escalation in the npm package adm-zip through version 0.6.0: when an application extracts an archive with the non-default keepOriginalPermission=true option, the library copies the Unix permission bits recorded in each zip entry's external file attributes straight to disk via fs.chmodSync() without stripping the setuid (0o4000), setgid (0o2000) or sticky (0o1000) bits. An attacker who can supply a zip - no special access needed to craft one - can therefore plant a 04755 root-owned binary whenever the extraction runs as root (the common Docker-build, CI-runner and privileged-install posture where this flag is used), and the attacker's code executes as root once a lower-privileged user later runs that file. The issue is correctly rated Medium despite a 7.1 CVSS score because it is highly conditional (flag enabled, root extraction, setuid file preserved and executed by another user); confirmed actively exploited: no - not in CISA KEV - but a working proof-of-concept (a Python-crafted zip with external_attr 0o4755 << 16) is documented in the vendor advisory. Default usage with the flag off, or extraction as a non-root user, is not exploitable.
Denial of service in Socket.IO Cluster Engine versions before 0.1.1 allows unauthenticated remote attackers to crash Node.js processes in clustered Socket.IO deployments by supplying crafted session IDs such as __proto__ or constructor. Only applications using @socket.io/cluster-engine are affected, and the flaw requires network reachability to the Socket.IO endpoint but no credentials or user interaction; the CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H with base 7.5. No public exploit identified at time of analysis, and the issue is fixed in 0.1.1.
An out-of-bounds read in lib0's binary decoder before version 0.2.119 lets remote attackers who control serialized input cause the decoder to return bytes from outside the intended buffer view, exposing adjacent process memory that may contain credentials, tokens, or log data. The flaw is unauthenticated and remotely reachable (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, 8.6) because any application that decodes attacker-supplied data with lib0 - directly or transitively through Yjs - can be driven into the over-read; the leaked bytes are opportunistic contents of the backing/pooled ArrayBuffer rather than attacker-selected addresses. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV), and the impact is limited to confidentiality with no integrity or availability effect; the vendor has published a fix in lib0 0.2.119.
Command injection in the Node.js shell-quote library (formerly published as shell-quote on npm) allows an attacker who controls a string placed after a { comment } token to break out of the generated shell command and execute arbitrary shell input. The flaw affects the quote() function before version 1.11.0: a line terminator (\n, \r, U+2028 or U+2029) inside a later string terminates the '#' comment emitted for the comment token, causing the remainder of that string to be interpreted as shell syntax - for example quote(['echo','ok',{comment:'x'},'a\nid;#']) executes id under sh, bash, dash, ksh and zsh. It is also reachable through the quote(parse(untrustedCommand).concat(untrustedArg)) idiom, because parse() emits a mid-word comment token for inputs such as a URL fragment (http://example.com/#frag). This is a genuine command-injection flaw (CWE-78) in a foundational Node.js utility; the vendor CVSS 4.0 score of 9.2 reflects the potential for full shell execution, though our independent CVSS 3.1 assessment is AV:N/AC:H (the vulnerable calling pattern is a prerequisite and is not present in a bare default install). No public exploit was identified at time of analysis and the issue is not in CISA KEV; the upstream fix commit includes test cases that demonstrate the triggering payload shapes. Vendor-released patch: shell-quote 1.11.0.
An unauthenticated remote attacker can lock up an Angular server-side rendering process by submitting HTML that contains an unterminated DOCTYPE declaration with trailing whitespace (for example `<!DOCTYPE html `), which drives the bundled domino HTML parser into an infinite synchronous loop that pins a CPU core at 100% and stalls the Node.js event loop, silently dropping all concurrent and subsequent requests. Only SSR deployments that run @angular/platform-server and feed attacker-controlled markup into server-side DOM parsing - via `[innerHTML]`, interpolation into rendered HTML, `insertAdjacentHTML`, `outerHTML`, or server-side sanitization - are reachable; the vulnerable version ranges are <=19.2.25, 20.0.0 through 20.3.30, 21.0.0 through 21.2.22, and 22.0.0 through 22.1.5. The trigger payload is trivial to construct, but no public exploit code has been observed circulating and the issue is not listed in CISA KEV, so the practical risk is a function of whether the application actually routes untrusted HTML through domino on the server.
A remote, unauthenticated denial-of-service condition in the NestJS (Nest) microservices framework lets an attacker crash a service on demand by sending a single message whose 'pattern' field is a deeply nested object. Only deployments using the TCP transport (ServerTCP) or the RabbitMQ transport (ServerRMQ) are exposed, because those paths pass a client-controlled, non-string pattern into JSON.stringify to compute the handler lookup key; sufficient nesting throws 'RangeError: Maximum call stack size exceeded', and the unhandled promise rejection terminates the Node.js process under default behavior. Affected versions are prior to 11.2.4 and prior to 12.0.2; the CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects pure availability loss with no confidentiality or integrity impact, and no public exploit has been identified at time of analysis. Risk is highest where the raw TCP port or consumed RabbitMQ queue/exchange is reachable by untrusted parties, since these are typically internal service-to-service surfaces.
Deeply nested brace patterns cause unbounded recursion in the npm brace-expansion library, exhausting the native stack and terminating the Node.js process (CWE-400). All versions prior to 1.1.20, 2.1.6, 3.0.8 and 5.0.11 are affected, and the trigger is remote and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) whenever an application passes attacker-controlled input into expand()/expand_() - directly or transitively through minimatch or glob. A payload of roughly 3,100 stacked '{' followed by 'a,b' and matching '}' (about 6KB) is sufficient, and because the stack is consumed before any output is generated, neither the max nor maxLength output bounds prevent the crash; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, though its availability-only impact and deep embedding in the JavaScript toolchain make it relevant to any service that expands untrusted glob or path patterns.
Stack exhaustion in the npm library brace-expansion (all versions prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10) lets a crafted brace pattern terminate the Node.js process, a process-terminating denial of service. The flaw is reachable by remote, unauthenticated attackers (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) whenever an application passes attacker-controlled strings into expand(), most commonly indirectly through minimatch or glob pattern matching of user-supplied glob or filter expressions. No public exploit code has been identified and the issue is not listed in CISA KEV, but the consuming application must expose a path to brace expansion for the bug to be reachable, so the practical risk depends entirely on how the library is embedded.
Prototype-pollution gadget in the Axios promise-based HTTP client for Node.js and the browser lets a separate, pre-existing prototype-pollution flaw in the same JavaScript process steer how ToFormData serializes outgoing request bodies in Axios 0.28.0 through 0.33.x and 1.15.1 through 1.19.x. Inherited dots, indexes, metaTokens, maxDepth, visitor, or Blob values planted on Object.prototype silently rename or reinterpret serialized fields, or make requests fail outright via a polluted maxDepth; a polluted visitor only executes when the attacker already possesses a stronger function-injection primitive, so Axios adds no new code-execution capability on its own. Remote unauthenticated exploitation is inert without that chained second bug, and no public exploit identified at time of analysis, with no confirmed actively exploited (CISA KEV) status; vendor-released patches ship in 0.34.0 and 1.20.0.
Redirect-policy bypass in Axios 1.17.0 up to (but not including) 1.20.0 causes the fetch adapter to follow HTTP 3xx redirects even when the application explicitly sets maxRedirects: 0, so a redirect-blocking control that developers rely on as a security boundary is silently ignored. The flaw is a confused-deputy issue (CWE-441): an attacker positioned to control a redirect response from a server the application calls can push the request to internal responses or state-changing internal endpoints that should have been unreachable. Exploitation requires three simultaneous conditions - use of the fetch adapter (not the default http/xhr adapters), an explicit maxRedirects: 0 setting used as a security control, and an attacker-influenced redirect target - and per the independent assessment it is unauthenticated (CVSS PR:N) with only a single additional precondition (AT:P), yielding no direct impact on the axios host (VC/VI/VA:N) but high confidentiality and integrity impact on the subsequent internal systems reached (SC:H/SI:H). There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV).
Denial of service in the Axios HTTP client affects Node.js deployments running versions 1.15.0 through 1.19.x, where a crafted redirect Location hostname triggers quadratic regular-expression backtracking inside the proxy-bypass check and blocks the Node.js event loop. Successful exploitation requires an unusually specific combination - HTTP_PROXY/HTTPS_PROXY set, a non-empty NO_PROXY/no_proxy value, redirect following enabled, and requests reaching an attacker-influenced server that can return the malicious redirect - so exposure is narrow, and the reverse-trust nature of the attack means the adversary must control or compromise the redirect target rather than simply send a request to the victim. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV) for CVE-2026-101906; the high vendor CVSS 4.0 score of 8.2 largely reflects the VA:H availability weighting rather than ease of exploitation, as reflected in our independent assessment of CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H.
Credential and response tampering in Axios's Node HTTP adapter (lib/adapters/http.js) affects versions 1.15.2 through 1.19.x when a separate, same-process prototype-pollution flaw plants a function on Object.prototype.createConnection: because the adapter supplies request options without an own createConnection property, Node resolves and invokes the inherited function as the socket factory, redirecting the transport to an attacker-controlled endpoint that receives request headers and bodies (including credentials) and returns forged responses while the requested URL still appears legitimate. This is a confused-deputy gadget rather than a self-contained flaw - it is inert without a co-resident pollution primitive that can write a function onto Object.prototype, which is why the vendor CVSS 4.0 vector carries AT:P and why our independent assessment (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) treats exploitation as contingent on that chain. The issue is fixed in Axios 1.20.0; there is confirmed actively exploited (CISA KEV) status absent and no public exploit code identified at time of analysis.
Axios 1.16.1 through 1.19.x can be driven into catastrophic regular-expression backtracking through its data-URI parser, letting an unauthenticated remote attacker stall the Node.js event loop and cause a denial of service. The trigger is an attacker-controlled, malformed RFC 2397 data URL containing many slash characters on both sides of the media-type separator and no comma, which the fromDataURI / DATA_URL_PATTERN logic must exhaustively re-split before rejecting; because the parse is synchronous, the whole single-threaded process is blocked. Exploitation requires that the application actually route untrusted input into Axios's data: parsing path, so services that only make ordinary HTTP requests are not exposed; there is no confidentiality or integrity impact, authentication is not required, and no public exploit identified at time of analysis. Severity is rated 8.2 under the supplied CVSS 4.0 vector, while our independent CVSS 3.1 assessment (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) treats it as availability-only and high-complexity given the deployment prerequisite, and the vendor-released patch is Axios 1.20.0.
Axios versions 1.13.0 through 1.19.x can crash a Node.js process because the HTTP/2 adapter installs no error handler on a ClientHttp2Session created for a request made with httpVersion: 2, so a session-level 'error' event emitted during session initialization or reuse escapes normal Promise rejection handling and becomes an uncaught exception that terminates the process, producing a denial of service. Only applications that explicitly opt into HTTP/2 are affected; the browser build and the default HTTP/1.x path are not, and the attacker must additionally be able to induce a genuine HTTP/2 session error (for example via a peer or intermediary), which is why the independent assessment rates this as high complexity rather than trivially triggerable. Impact is availability-only - no data exposure, no code execution, and no privilege requirement (unauthenticated). No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing).
Axios versions 1.13.0 through 1.19.x on Node.js can silently bypass a configured HTTP(S) proxy or a caller-supplied DNS lookup policy for requests that opt into HTTP/2, because the HTTP/2 adapter calls http2.connect() without consistently applying config.proxy, environment-derived proxy settings, or config.lookup before the connection is established. This is a defense-in-depth control bypass (CWE-918, SSRF-adjacent): confidentiality and integrity impacts fall on the systems the bypassed egress or DNS control was meant to protect, not on the local vulnerable host, and exploitation is gated by non-default configuration - the application must explicitly set httpVersion: 2 and must actually depend on the proxy or lookup policy as a security boundary. Unauthenticated remote reachability is indicated by the CVSS vectors, but practical risk is moderate given the narrow affected version band and the opt-in requirement; no public exploit identified at time of analysis.
Archive extraction in the Node.js decompress package allows a crafted archive containing chained symlink entries to resolve file writes outside the intended output directory, because the default decompress(input, output) API relies on lexical path containment checks that the kernel's symlink resolution can bypass. This affects @xhmikosr/decompress before 10.2.2 and before 11.1.4, and the separately maintained but unmaintained kevva/decompress package through 4.2.1, which remains unpatched. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N, 9.1) indicates unauthenticated remote triggering with high confidentiality and integrity impact; writing outside output can overwrite startup scripts or configuration and escalate to remote code execution, and the flaw is a bypass of the incomplete hardening previously applied for CVE-2026-53486. Exploitation requires the consuming application to extract an attacker-influenced archive on a non-Windows platform (Windows emulates symlinks via hardlinks and does not follow the affected path), and no public exploit code was identified at time of analysis, though the upstream fix ships a regression test that documents the escape technique.
OpenClaw (npm package openclaw) before 2026.7.1 misbinds Signal approval reactions to the wrong message, so a reaction an approver places on ordinary outbound text can be interpreted as approving or denying a structured host-action request that happens to be pending in the same conversation. Exploitation requires an authenticated participant acting as approver (PR:L), deliberate user interaction via a reaction (UI:P), and precise timing where unrelated outbound messages and a pending approval coexist (AC:H, AT:P), which is why the CVSS 4.0 base score is 7.5 rather than critical. The flaw does not grant any party new authority and does not change the legitimacy of correctly identified approvers; impact is bounded by whatever host actions the OpenClaw process is authorized to perform for the specific pending request. Vendor-released patch: 2026.7.1; no public exploit identified at time of analysis and the issue is not in CISA KEV.
A credential-isolation flaw in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker who controls or can predict the MCP server URL a victim configures to cause MD5-derived credential-store paths to collide or match, potentially exposing or overwriting another server's cached OAuth tokens via the getServerUrlHash function in src/lib/utils.ts. The package is an npm bridge that connects local MCP clients to remote MCP servers, so practical exploitation depends on the victim adding the attacker's server URL and on the OAuth credential-persistence feature being in use (user interaction), which is inconsistent with the no-interaction AV:N/AC:L/PR:N/UI:N profile of the 9.8 headline score. No public exploit code was identified at time of analysis and EPSS is low (0.29%, 19th percentile), so the CWE-94 arbitrary-code-execution framing should be treated as unverified rather than confirmed remote code execution.
Code injection in the Orval OpenAPI client generator's @orval/effect package (versions 8.14.0 through 8.28.1) lets an attacker who can influence an OpenAPI schema embed arbitrary JavaScript expressions in the generated validation module, which execute at module scope as soon as that generated code is built or imported. The injection point is the schema `default` value, which the effect generator rewrites into a template literal so that `${...}` syntax (or a literal backtick) re-arms interpolation, with numeric constraints such as minimum/maximum/multipleOf similarly emitted as unquoted expressions; exploitation is remote and does not require prior credentials per the vendor vector (PR:N), but it does require the victim to run the generator against an untrusted or third-party spec and then build or import the output, giving injected code the developer's build-time privileges. No public exploit code has been identified at time of analysis and the issue is patched upstream, so real-world urgency is lower than the vendor's CVSS 4.0 score of 9.3 suggests - this is a build-time/developer-tooling flaw rather than a network-facing service exposure (independent assessment: CVSS 3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, reflecting the victim interaction the vendor rating understates).
Code injection in orval's opt-in @orval/hono generator (all versions before 8.29.0) lets an attacker who controls an OpenAPI document plant an apostrophe in a static path segment and break out of the single-quoted route literal, injecting arbitrary JavaScript that runs whenever the generated TypeScript module is imported or built. This is a build-time supply-chain style flaw rather than a runtime flaw in a network service: the affected party must run orval code generation against an untrusted spec and then import the generated output, and the CVSS v4.0 score of 9.3 reflects high confidentiality, integrity and availability impact on the build/developer environment. Exploitation is not confirmed in the wild (no CISA KEV entry) and no public exploit code was identified at time of analysis, though the upstream patch and the exact vulnerable code path are publicly documented.
The legacy DOC renderer in File Viewer emits document-controlled hyperlink targets into generated HTML after character escaping but without restricting URL schemes, so a crafted legacy .doc file can render a live javascript:, vbscript:, or data: link and execute script in the embedding application's origin when a user clicks it. Applications are affected if they use @file-viewer/doc up to and including 2.3.0 or the msdoc-viewer compatibility package up to and including 0.2.1 to render untrusted .doc files; exploitation is conditionally gated, requiring a victim to open the preview and click the malicious link (CVSS 8.2, UI:R, scope changed). No public exploit code or confirmed active exploitation was identified at time of analysis, and vendor-released fixes exist in @file-viewer/doc 2.3.1 and msdoc-viewer 0.2.2.
Crafted RESP replies from a malicious, compromised, or impersonated Redis endpoint crash Node.js processes that use redis-parser through 3.0.0, including applications built on node-redis and ioredis, because repeated nested array headers drive unbounded recursion that exhausts the V8 call stack and raises an uncaught RangeError. The flaw is a client-side parser denial of service: it is unauthenticated on the parsing path (CVSS 4.0 vector PR:N/UI:N, CVSS 3.1 assessment AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and affects default configurations, since recursion depth is not bounded by any setting. Impact is limited to availability - the process terminates without invoking error-handling callbacks - with no confidentiality or integrity effect; the vendor score of 8.7 reflects that high availability impact. No public exploit identified at time of analysis.
DNS rebinding against the local Streamable HTTP MCP listener in @zereight/mcp-gitlab before 2.1.30 lets a malicious web page reach a victim's loopback MCP endpoint while preserving an attacker-controlled Host and Origin, so the request is accepted at the HTTP boundary and reaches the MCP initialization path - and, where a GitLab token is configured, can drive GitLab API tool calls through the victim's browser. Exploitation is network-reachable with no attacker credentials required (CVSS PR:N) but hinges on victim interaction (UI:R): the user must browse to an attacker-controlled page while an unpatched server listens on its default 127.0.0.1 bind with no effective Host/Origin allowlist. Publicly available exploit code exists - the vendor advisory ships a proof-of-concept reproduction - and the upstream/NVD vector scores 9.6 Critical, while the independent assessment lowers availability impact to Low (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L); in REMOTE_AUTHORIZATION=true deployments, token checks block material unauthenticated GitLab API tool calls, reducing realized impact to the HTTP-boundary/initialization failure.
SSRF denylist bypass in the npm package mcp-from-openapi (2.2.0 through 2.8.0) lets an attacker who controls the OpenAPI spec URL passed to fromURL - or a redirect target it follows - reach hosts the operator listed in refResolution.blockedHosts simply by appending a trailing root dot (http://internal.corp./), because DNS resolves the dotted FQDN to the same host while the library compares raw URL.hostname strings. The same release range separately forwarded caller-supplied Authorization and Cookie headers to cross-origin redirect targets, handing bearer tokens to an open redirect on the spec host. Impact is limited to fetching operator-blocked content (low confidentiality, no integrity or availability effect), exploitation depends on non-default reliance on blockedHosts as the host guard, no CISA KEV listing exists, and the upstream advisory documents proof-of-concept reproductions; 2.9.0 normalizes hostnames on both sides of the comparison and drops caller headers once a redirect leaves the spec origin.
adm-zip versions before 0.6.1 can apply attacker-controlled setuid, setgid, or sticky bits when extracting archives with the non-default keepOriginalPermission option enabled. This is a conditional local privilege-escalation risk: the archive must be extracted in a privileged context such as root and the resulting executable must later be run, so exploitation depends on that specific workflow. No public exploit identified at time of analysis, and the vendor-released patch is adm-zip 0.6.1.
Denial of service in the ip-address npm library before 10.7.4 allows unauthenticated remote attackers to consume CPU and stall applications that pass untrusted input containing many '%' characters into the Address6 IPv6 constructor. The flaw is CWE-1333 inefficient regular expression / quadratic complexity, rated medium severity (CVSS 4.0 base 6.3), with availability-only partial impact; exploitation depends on a reachable application code path that forwards attacker-controlled data to Address6 parsing (CVSS AT:P). No public exploit code was identified at time of analysis, and upgrading to 10.7.4 or later removes the condition.
A crafted flat CSS selector can stall a synchronous parser thread in postcss-selector-parser versions prior to 7.1.6, because class and ID index lists are scanned repeatedly inside parsing passes that should be linear, producing quadratic (O(n^2)) parse cost. Only consumers that synchronously parse untrusted selector strings on an exposed request path are affected; the vendor explicitly notes ordinary build-time parsing of trusted sources is not affected. The issue is remotely triggerable by unauthenticated attackers where that precondition holds (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, 5.9), is availability-only with no confidentiality or integrity impact, and there is no public exploit code and no confirmed active exploitation (no KEV listing) at time of analysis. A vendor-released patch, version 7.1.6, is available.
Cross-site scripting in serialize-javascript 7.1.1 arises because function values serialized by the library are not fully protected against script-closing tags: the SCRIPT_CLOSE_REGEXP escaping pattern can match across and swallow a second closing tag, so a surviving </script> terminates the embedding script element early and the remaining output is parsed as HTML in the page origin. Exploitation requires an application on the narrow vulnerable release to serialize a function value whose source is attacker-influenced and embed that output inside an HTML <script> element, and a victim must load the resulting page (user interaction); ordinary data values and options.isJSON output are unaffected. The flaw is fixed in 7.1.2, and no public exploit was identified at time of analysis.
The pbkdf2 npm library through version 3.1.6 lets a long password drive an event-loop-blocking denial of service in its pure-JavaScript fallback (lib/sync.js), because passwords longer than the digest block size are re-hashed by HMAC on every PBKDF2 iteration. Applications are affected only when running on a runtime that actually uses that fallback - Node.js before 0.12, Bun 1.0.0-1.1.34 or 1.2.6 and later, Deno 2.9.0 and later, or code importing lib/sync.js directly - and only when attacker-controlled data is passed as the PBKDF2 password with no reasonable maximum length enforced. No public exploit code was identified at time of analysis; an upstream fix (commit 493d8d8) pre-hashes over-length keys once instead of per iteration, and the issue is a modest-severity availability bug (CVSS 4.0 6.3; independent assessment ~CVSS 3.1 5.3).
Quadratic-time CPU exhaustion in the brace-expansion npm library (all releases prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12) lets unauthenticated remote attackers stall the Node.js event loop by supplying a crafted brace pattern shaped like '{a},b}' with a very large number of trailing closing braces. Parsing such input forces successive full-string rescans with growing working strings, so ~128 KB of the payload has been measured to block the event loop for tens of seconds; the process recovers afterward, making this a recoverable denial-of-service rather than a persistent crash, which is why it is rated only 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Exploitation requires that an application pass attacker-controlled input into expand() - directly or transitively through consumers such as minimatch/glob - and it affects Node.js runtimes only; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV.
Uncaught exceptions raised inside server method handlers in @grpc/grpc-js leak their error message text back to the calling client, exposing internal details such as file paths, SQL fragments, or connection strings. The flaw affects the pure-JavaScript gRPC implementation for Node.js in versions before 1.13.6 and before 1.14.5, and remote clients can trigger it without authentication (CVSS 3.7, AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N), though disclosure is opportunistic because the attacker cannot control what the handler throws. No public exploit code has been identified and the issue is not reported as actively exploited, but it is a straightforward logic flaw with a trivially reachable trigger for any server whose handlers throw unguarded errors.
Trust-boundary bypass in the ip-address JavaScript library (all versions prior to 10.5.1) lets a remote, unauthenticated attacker who can supply or influence the IPv6 address being validated slip an address within the full fe80::/10 link-local range past Address6.isLinkLocal(), which only matched the narrower fe80::/64. Applications that use isLinkLocal() as an SSRF or on-link filter - the sole prerequisite for exploitation, reflected as AT:P in the CVSS 4.0 vector and AC:H in the independent assessment - may then be steered to reach a link-local host outside the intended trust boundary, with impact limited to confidentiality and reachability (C:L, S:C) and no integrity or availability effect. No public exploit code identified at time of analysis; the vendor fix is version 10.5.1.
Cross-family subnet comparisons in the ip-address npm library (all versions before 10.7.1) can cause isInSubnet and isHostInSubnet to report that an address falls inside a range it does not belong to, allowing an allowlist or denylist decision built on those predicates to misclassify an out-of-scope address as trusted. The flaw is a logic/comparison error (CWE-697) rather than a memory-safety issue: masked binary strings are compared without first confirming that the address and the subnet share the same IP family, so an IPv4 address checked against an IPv6 mask (or vice versa) can compare equal when the leading masked bits align. Exploitation requires a consuming application to use these methods as a security gate and to pass attacker-influenced addresses into a cross-family check; no public exploit code was identified at time of analysis, and the weakness is inert in applications that never use these predicates or that normalize IP family before comparison. Impact is bounded to integrity of the containment decision (no confidentiality or availability effect), and the vendor's CVSS 4.0 score of 6.3 is higher than our assessed CVSS 3.1 vector of AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N because practical exploitation is gated by how the host application wires these predicates.
Denial of service in the ip-address JavaScript/npm library (all versions prior to 10.7.1) lets remote attackers stall or crash a Node.js process by supplying megabyte-scale strings to the IPv6 parsing paths - the Address6 constructor, Address6.isValid, and the underlying parse routine in src/ipv6.ts. An application is only exposed if it accepts an attacker-controlled field of roughly 16 MiB or more and passes it to those entry points without an earlier length bound; common URL, HTTP header, and default body-parser limits keep inputs well below the ~32 MiB needed to terminate the process, so default configurations typically exclude the impact and this is assessed as a low-to-moderate real-world risk that does not warrant emergency prioritization. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and a vendor-released patch in version 10.7.1 resolves it.
The JavaScript library ip-address (npm) fails to treat the NAT64 local-use prefix 64:ff9b:1::/48 as private, so applications that lean on Address6.isPrivate - typically together with isLoopback and isLinkLocal - to enforce an SSRF or trust-boundary policy can be tricked into reading an internal IPv4 destination as external. Unauthenticated network attackers can exploit this (CVSS v4.0 6.9; independent assessment CVSS v3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N) only when the target server's network actually uses an operator-chosen NAT64 prefix carved from the RFC 8215 local-use range, and only when the consuming application composes these classifiers as a security control; information disclosure is the realistic outcome, with no impact on integrity or availability. Versions 10.2.0 through 10.5.0 are affected and the issue is fixed in 10.5.1; no public exploit code or confirmed active exploitation was identified at time of analysis, and exploitation is further gated by the non-default NAT64 deployment and by the application's use of these methods for enforcement.
Header sanitization bypass in the Axios fetch adapter (npm axios 1.7.0 through 1.19.x) allows attacker-controlled request headers - such as Authorization, caching directives, or metadata-service targeting values - to be applied after Axios has already built a sanitized Request object, enabling scope-changed integrity impact (assessed CVSS 3.1: AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N). Exploitation is not standalone: it is a gadget that requires a separate same-process prototype-pollution flaw capable of writing Object.prototype.headers, plus use of the fetch-based transport rather than the default Node HTTP adapter. No public exploit code is identified at time of analysis, but the fix and code change are public in the Axios v1.20.0 release, pull request #11141, and commit d19040bd, so the affected range should be treated as patch-now.
Axios versions 1.0.0 through 1.19.x can leak attacker-controlled headers - including authorization-related values - into outgoing HTTP requests, but only as a secondary gadget in a chain: a separate same-process prototype-pollution flaw must first set Object.prototype.headers, and the application must use trusted request interceptors that return a fresh ordinary configuration object without its own headers property, causing dispatchRequest's normalization step to fall through to the inherited prototype value. The issue is fixed in Axios 1.20.0, which filters shared-prototype-inherited values during config merging and interceptor replacement; no public exploit code has been identified at time of analysis and the defect is inert in isolation, making this a defense-in-depth hardening fix rather than a standalone exploitable vulnerability. Authentication requirements are unauthenticated per the CVSS vector (PR:N), but exploitation is gated by the AT:P attack-requirements flag and the pre-existing pollution primitive.
Axios versions 0.27.2 through below 0.34.0, and 1.0.0 through below 1.20.0, can silently upgrade an intended GET into a state-changing HTTP method when a request is sent through the default instance without an explicit method. The flaw is a read-side gadget, not a pollution source: calls such as axios({ url }) or axios.request({ url }) omit a method, so dispatch looks up the method on the prototype chain and honours an Object.prototype.method value planted by an unrelated prototype-pollution vulnerability in the same process. Because a separate pollution primitive must already exist, this is only exploitable as part of a chain, which is why the vendor CVSS 4.0 vector carries AT:P; no public exploit code was identified at time of analysis and the issue is not listed in CISA KEV. The vendor scores it 6.9 (AV:N/AC:L/AT:P/PR:N/UI:N, SI:H only), while our independent assessment rates it CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N, treating the unauthenticated network-reachable integrity impact as high but gated on the pollution prerequisite.
Axios 1.12.0 through 1.19.x can be tricked into merging attacker-supplied HTTP headers into a fetch adapter request when the surrounding Node.js or browser application is already vulnerable to a separate, same-process prototype-pollution flaw. The polluted value must be an array or a non-plain class instance that masquerades as FormData via inherited append, getHeaders, or Symbol.toStringTag properties; plain objects are explicitly blocked, and the resulting header injection can alter authorization, cache, metadata-service, or application-specific request semantics. This is a defense-in-depth integrity gadget rather than a standalone remotely exploitable bug - exploitation is unauthenticated (PR:N) but conditional on a pre-existing pollution primitive (AT:P), no public exploit code was identified at time of analysis, and the flaw is fixed in Axios 1.20.0.
Cross-domain authenticated request bypass in the connect-xcors (connect-cors) Node.js middleware lets an attacker defeat origin verification so that a victim's browser issues credentialed cross-origin requests the application would otherwise reject. The flaw is remotely reachable without attacker authentication (CVSS 4.0 PR:N) but requires the victim to be logged in to the affected application and to load attacker-controlled web content (UI:P); impact is bounded to low confidentiality and low integrity with no availability effect, giving low-to-moderate real-world risk. No public exploit code has been identified at time of analysis, and no CISA KEV entry exists for this CVE.
npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
The npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if dependency information in package-lock.json differs from package.json. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Visual Studio Code npm-script Extension Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.
Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. Rated medium severity (CVSS 4.4).
Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An issue was discovered in an npm 5.7.0 2018-02-21 pre-release (marked as "next: 5.7.0" and therefore automatically installed by an "npm upgrade -g npm" command, and also announced in the vendor's. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
The CLI in npm before 2.15.1 and 3.x before 3.8.3, as used in Node.js 0.10 before 0.10.44, 0.12 before 0.12.13, 4 before 4.4.2, and 5 before 5.10.0, includes bearer tokens with arbitrary requests,. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.