Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-90711proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnetnpm · proxy-addr · fixed in 2.0.8
- CVE-2026-17495moment vulnerable to Path Traversal via crafted non-string locale namenpm · moment · fixed in 2.31.0
- CVE-2026-57583OpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated sourcenpm · @openzeppelin/wizard, @openzeppelin/wizard-cairo +2 · fixed in 0.10.11, 3.0.1, 0.6.2 and more
- CVE-2026-55091flat-to-nested: Prototype pollution in flat-to-nested convert() via __proto__ parent/id keynpm · flat-to-nested · fixed in 1.1.2
- CVE-2026-54150next-video: Unauthenticated arbitrary file read via /api/video request handlernpm · next-video · fixed in 2.8.1
- CVE-2026-49250Conform: parseSubmission vulnerable to CPU exhaustion when parsing many unique form fieldsnpm · @conform-to/dom · fixed in 1.19.4
- CVE-2026-59960Argos JavaScript: CI Branch Name OS Command Injection in @argos-ci/corenpm · @argos-ci/core · fixed in 6.2.1
- CVE-2026-55102hashi-vault-js: Vault token and secret values exposed in thrown errorsnpm · hashi-vault-js · fixed in 0.5.2
- CVE-2026-55451gettext-converter: Prototype pollution in js2i18next() via crafted translation keysnpm · gettext-converter · fixed in 1.3.3
- CVE-2026-53496ExifReader HEIC/AVIF ISO-BMFF parser throws uncaught RangeError on truncated boxesnpm · exifreader · fixed in 4.40.1
- CVE-2026-54156node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoSnpm · node-opcua · fixed in 2.166.0
- CVE-2026-54155node-opcua: Missing nonce verification in UserNameIdentityToken authenticationnpm · node-opcua
- CVE-2026-61534Yayson: Prototype pollution in the Store/LegacyStore deserializationnpm · yayson · fixed in 4.3.0
- CVE-2026-88932multer vulnerable to Denial of Service via orphaned disk writes on aborted uploadsnpm · multer · fixed in 2.4.0
- CVE-2026-90776Nodemailer 9.1.0 through 10.0.4 Denial of Service via Quadratic Address Parsingnpm · nodemailer · fixed in 10.0.5
- CVE-2026-90771joi before 17.13.8 and 18.2.9 Prototype Pollution via messagesnpm · joi · fixed in 17.13.8, 18.2.9
- CVE-2026-87776compression vulnerable to Denial of Service via memory leak on premature response closenpm · compression · fixed in 1.8.2
- CVE-2026-87859morgan vulnerable to Log Injection via unescaped double quote in quoted log fieldsnpm · morgan · fixed in 1.12.1
- CVE-2026-88062OmniRoute ACP Custom-Agent Remote Code Execution (RCE)npm · omniroute
- CVE-2026-88060Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elementsnpm · @angular/platform-server · fixed in 22.1.4, 21.2.22, 20.3.30
- CVE-2026-88059Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`npm · @angular/common · fixed in 22.1.1, 21.2.20, 20.3.28
- CVE-2026-88058Angular: SSR XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elementsnpm · @angular/platform-server · fixed in 22.1.4, 21.2.22, 20.3.30
- CVE-2026-88057Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compilernpm · @angular/compiler, @angular/core · fixed in 22.1.0, 21.2.20, 20.3.28
- CVE-2026-88056Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSRnpm · @angular/platform-server · fixed in 22.1.4, 21.2.22, 20.3.30
- CVE-2026-86075n8n: Unauthenticated Persistent Storage Exhaustion via OAuth Dynamic Client Registration Endpointnpm · n8n · fixed in 2.38.2, 2.37.7
- CVE-2026-86076n8n: Expression Sandbox Escape in Editor-UI Enables Stored Cross-User JavaScript Executionnpm · n8n · fixed in 1.123.76, 2.38.2, 2.37.7
- CVE-2026-86077n8n: Anonymous Approval-Gate Bypass via Reused resumeToken over the Chat WebSocketnpm · n8n · fixed in 2.38.2, 2.37.7
- CVE-2026-86078n8n: Prototype Pollution via Workflow Structure Summary Can Lead to Denial of Servicenpm · n8n · fixed in 2.38.2, 2.37.7
- CVE-2026-86079n8n: Path Injection in Elasticsearch and ElasticSecurity Nodes via Unencoded Identifiersnpm · n8n · fixed in 1.123.76, 2.38.2, 2.37.7
- CVE-2026-86080n8n: GitHub Trigger 422 Reuse Path Skips Webhook Secret Storage, Causing Signature Verification to Fail-Opennpm · n8n · fixed in 1.123.76, 2.38.2, 2.37.7