Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2015-9239ansi2html is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in.npm · ansi2html
- CVE-2016-10518A vulnerability was found in the ping functionality of the ws module before 1.0.0 which allowed clients to allocate memory by sending a pingnpm · ws · fixed in 1.0.1
- CVE-2016-10519A security issue was found in bittorrent-dht before 5.1.3 that allows someone to send a specific series of messages to a listening peer and npm · bittorrent-dht · fixed in 5.1.3
- CVE-2016-10520jadedown is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in.npm · jadedown
- CVE-2016-10521jshamcrest is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in to the emailAddress vnpm · jshamcrest
- CVE-2016-10523MQTT before 3.4.6 and 4.0.x before 4.0.5 allows specifically crafted MQTT packets to crash the application, making a DoS attack feasible witnpm · mqtt-packet · fixed in 3.4.6, 4.0.5
- CVE-2016-10524i18n-node-angular is a module used to interact between i18n and angular without using additional resources.npm · i18n-node-angular · fixed in 1.4.0
- CVE-2016-10526A common setup to deploy to gh-pages on every commit via a CI system is to expose a github token to ENV and to use it directly in the auth pnpm · grunt-gh-pages · fixed in 0.10.0
- CVE-2016-10527The riot-compiler version version 2.3.21 has an issue in a regex (Catastrophic Backtracking) thats make it unusable under certain conditionsnpm · riot-compiler · fixed in 2.3.22
- CVE-2016-10528restafary is a REpresentful State Transfer API for Creating, Reading, Using, Deleting files on a server from the web.npm · restafary · fixed in 1.6.1
- CVE-2016-10529Droppy versions <3.5.0 does not perform any verification for cross-domain websocket requests.npm · droppy · fixed in 3.5.0
- CVE-2016-10530The airbrake module 0.3.8 and earlier defaults to sending environment variables over HTTP.npm · airbrake · fixed in 0.4.0
- CVE-2016-10531marked is an application that is meant to parse and compile markdown.npm · marked · fixed in 0.3.6
- CVE-2016-10532console-io is a module that allows users to implement a web console in their application.npm · console-io · fixed in 2.3.0
- CVE-2016-10533express-restify-mongoose is a module to easily create a flexible REST interface for mongoose models.npm · express-restify-mongoose · fixed in 3.1.0, 2.5.0
- CVE-2016-10534electron-packager is a command line tool that packages Electron source code into `.app` and `.exe` packages.npm · electron-packager · fixed in 7.0.0
- CVE-2016-10535csrf-lite is a cross-site request forgery protection library for framework-less node sites.npm · csrf-lite · fixed in 0.1.2
- CVE-2016-10536engine.io-client is the client for engine.io, the implementation of a transport-based cross-browser/cross-device bi-directional communicationpm · engine.io-client · fixed in 1.6.9
- CVE-2016-10537backbone is a module that adds in structure to a JavaScript heavy application through key-value pairs and custom events connecting to your Rnpm · backbone · fixed in 0.5.0
- CVE-2016-10538The package `node-cli` before 1.0.0 insecurely uses the lock_file and log_file.npm · cli · fixed in 1.0.0
- CVE-2016-10539negotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Koa.npm · negotiator · fixed in 0.6.1
- CVE-2016-10540Minimatch is a minimal matching utility that works by converting glob expressions into JavaScript `RegExp` objects.npm · minimatch · fixed in 3.0.2
- CVE-2016-10541The npm module "shell-quote" 1.6.0 and earlier cannot correctly escape ">" and "<" operator used for redirection in shell.npm · shell-quote · fixed in 1.6.1
- CVE-2016-10542ws is a "simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455".npm · ws · fixed in 1.1.1
- CVE-2016-10543call is an HTTP router that is primarily used by the hapi framework.npm · call · fixed in 3.0.2
- CVE-2016-10544uws is a WebSocket server library.npm · uws · fixed in 0.10.9
- CVE-2016-10546An arbitrary code injection vector was found in PouchDB 6.0.4 and lesser via the map/reduce functions used in PouchDB temporary views and denpm · pouchdb · fixed in 6.0.5
- CVE-2016-10547Nunjucks is a full featured templating engine for JavaScript.npm · nunjucks · fixed in 2.4.3
- CVE-2016-10548Arbitrary code execution is possible in reduce-css-calc node module <=1.2.4 through crafted css.npm · reduce-css-calc · fixed in 1.2.5
- CVE-2016-10549Sails is an MVC style framework for building realtime web applications.npm · sails · fixed in 0.12.7