Medium
ghsa-jggr-w7fw-pc2j
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 419
Reset filters
Medium
CVE-2026-104183
stream-json has a prototype pollution issue: Assembler writes this.current[this.key] on plain objects
Critical
CVE-2026-92953
vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix
Critical
CVE-2026-92934
vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit
Critical
CVE-2026-92946
vm2: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE
Critical
CVE-2026-92947
vm2: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool
High
CVE-2026-104861
probe-image-size: Quadratic-time Denial of Service in the SVG Parser
High
CVE-2026-19481
@fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header
High
CVE-2026-19484
@fastify/busboy vulnerable to Denial of Service via oversized multipart boundary
High
CVE-2026-114081
Trigger.dev: Cross-tenant SQL injection in the TSQL query compiler (POST /api/v1/query) via unsanitized window-function name
Critical
CVE-2026-92948
vm2: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape
Critical
CVE-2026-92935
vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE
Critical
CVE-2026-92941
vm2 NodeVM can replace the host process TLS trust store
High
CVE-2026-92708
devalue: `stringify`/`uneval` serialize shared memory
Medium
ghsa-hx4r-w6wj-j8fg
devalue: Residual sparse-array CPU amplification in uneval
Low
ghsa-wf3x-273g-mvxv
devalue: Sparse arrays emitted by uneval cause eager allocation when evaluated
High
ghsa-r9w8-h9r3-54w4
devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation
Medium
CVE-2026-93981
hono/jsx renders plain strings unescaped in boundary components, leading to XSS
High
CVE-2026-84428
fastify vulnerable to header validation bypass via incomplete schema case normalization
High
CVE-2026-101896
Angular Server-Side Rendering (SSR): Denial of Service via Numeric URL Matrix Parameters
Medium
CVE-2026-101900
Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders
High
CVE-2026-101909
Axios: Prototype Pollution Gadget in axios toFormData Options
Medium
CVE-2026-101911
ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process
High
CVE-2026-102276
brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.