Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-84367joi: object().rename() with a template target can set the validated object's prototypenpm · joi · fixed in 17.13.5, 18.2.4
- CVE-2026-84365Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directorynpm · hono · fixed in 4.13.5
- CVE-2026-84364Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustionnpm · hono · fixed in 4.13.5
- CVE-2026-84363Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentialsnpm · hono · fixed in 4.13.5
- CVE-2026-83619xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parsernpm · @xmldom/xmldom · fixed in 0.8.15
- CVE-2026-83618xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminatornpm · @xmldom/xmldom · fixed in 0.9.12
- CVE-2026-83617xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminatornpm · @xmldom/xmldom · fixed in 0.9.12
- CVE-2026-83616xmldom: Processing Instruction Target Injection Bypasses requireWellFormednpm · @xmldom/xmldom, xmldom · fixed in 0.8.15, 0.9.12
- CVE-2026-83615xmldom: Quadratic-memory consumptionnpm · @xmldom/xmldom, xmldom · fixed in 0.8.15, 0.9.12
- CVE-2026-83614xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text mergenpm · @xmldom/xmldom, xmldom · fixed in 0.8.15, 0.9.12
- CVE-2026-83613xmldom: Quadratic-time attribute deduplicationnpm · @xmldom/xmldom, xmldom · fixed in 0.8.15, 0.9.12
- CVE-2026-83612xmldom: HTML raw-text closing-tag case mismatch causes output amplificationnpm · @xmldom/xmldom · fixed in 0.9.12
- CVE-2026-83611xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing contentnpm · @xmldom/xmldom, xmldom · fixed in 0.8.15, 0.9.12
- CVE-2026-83610xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serializationnpm · @xmldom/xmldom, xmldom · fixed in 0.8.15, 0.9.12
- CVE-2026-83609xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization pathnpm · @xmldom/xmldom · fixed in 0.9.12
- CVE-2026-83608xmldom: DocType `name` Injection Bypasses requireWellFormednpm · @xmldom/xmldom, xmldom · fixed in 0.8.15, 0.9.12
- CVE-2026-83607xmldom: Element name injection via createElement() bypasses requireWellFormednpm · @xmldom/xmldom, xmldom · fixed in 0.9.11, 0.8.14
- CVE-2026-83606xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructionsnpm · @xmldom/xmldom · fixed in 0.9.11
- CVE-2026-83605xmldom: Attribute name injection via setAttribute() bypasses requireWellFormednpm · @xmldom/xmldom, xmldom · fixed in 0.9.11, 0.8.14
- CVE-2026-82393pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on installnpm · pnpm · fixed in 10.34.5, 11.11.0
- CVE-2026-82392pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraphnpm · pnpm · fixed in 10.34.5, 11.11.0
- CVE-2026-81888@hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linkingnpm · @hono/oauth-providers · fixed in 0.8.6
- CVE-2026-79743MCPHub: Path Traversal via Malicious MCPB Manifest Namenpm · @samanhappy/mcphub · fixed in 0.12.13
- CVE-2026-82868@pdfme/schemas before 5.5.9 Cross-Site Scripting via SVGnpm · @pdfme/schemas · fixed in 5.5.9
- CVE-2026-82867@pdfme/schemas before 5.5.9 Cross-Site Scripting via Selectnpm · @pdfme/schemas · fixed in 5.5.9
- CVE-2026-82866@pdfme/common before 5.5.10 SSRF via Unvalidated URL Fetchnpm · @pdfme/common · fixed in 5.5.10
- CVE-2026-82865pdfme schemas before 5.5.10 Cross-Site Scripting via i18n Labelnpm · @pdfme/schemas · fixed in 5.5.10
- CVE-2026-82864pdfme pdf-lib before 5.5.10 Denial of Service via Decompression Bombnpm · @pdfme/pdf-lib · fixed in 5.5.10
- CVE-2026-82863@hulumi/baseline before 1.3.2 CloudTrail Selector Tampering Detectionnpm · @hulumi/baseline · fixed in 1.3.2
- CVE-2026-82861@hulumi/policies before 1.3.2 SecureBucket Parent Spoof Bypassnpm · @hulumi/policies · fixed in 1.3.2