Medium
CVE-2026-101900
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 2,476
Reset filters
High
CVE-2026-101905
Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection
Medium
CVE-2026-101899
Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges
High
CVE-2026-101907
Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF
Medium
CVE-2026-101908
Axios: Prototype pollution gadget in fetch adapter can alter outbound requests
Medium
CVE-2026-101902
Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method
High
CVE-2026-101903
Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)
High
CVE-2026-101906
Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location
High
CVE-2026-101909
Axios: Prototype Pollution Gadget in axios toFormData Options
High
CVE-2026-101898
Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls
High
CVE-2026-101901
Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization
Medium
ghsa-96h4-vgxj-gvm2
Nest: Unbounded memory growth in the NestJS TCP microservice transport
High
ghsa-9c5c-9qcx-q35q
@nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets
High
CVE-2026-102281
Nest: Remote process termination via a deeply nested microservice message pattern
Medium
CVE-2026-86472
fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets
Medium
CVE-2026-86818
fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization
Medium
CVE-2026-101911
ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process
Medium
CVE-2026-17495
moment vulnerable to Path Traversal via crafted non-string locale name
Medium
CVE-2026-102277
brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service
High
CVE-2026-102278
brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion
High
CVE-2026-102276
brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion
High
CVE-2026-102599
Socket.IO: Engine.IO Protocol Revision Mismatch DoS
Medium
CVE-2026-100699
Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing
High
CVE-2026-114102
adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process (DoS)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.