Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-118775Forge: ASN.1 OID first arc truncation in asn1.oidToDernpm · node-forge · fixed in 1.4.1
- CVE-2026-118773Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversalnpm · glob · fixed in 14.0.2
- CVE-2026-118772joi: quadratic-time split in `string().email({ multiple: true })` allows denial of servicenpm · @hapi/joi, joi · fixed in 17.13.9, 18.3.1
- CVE-2026-118764minimatch: potential denial of service via globparts amplificationnpm · minimatch · fixed in 11.0.1
- CVE-2026-118763@sigstore/oci sends the registry Authorization header to a cross-host blob-upload Locationnpm · @sigstore/oci · fixed in 0.7.2
- GHSA-W9X9-J56R-H98R@eeacms/volto-chatbot has Unauthenticated Danswer API Confused Deputy Proxynpm · @eeacms/volto-chatbot · fixed in 2.0.4
- GHSA-C33X-VCV4-VG3GCedar: JSON template is in scope missing slot-id validation allows link panic and decision divergencenpm · @cedar-policy/cedar-wasm · fixed in 4.11.1, 3.4.3
- CVE-2026-62374SD JWT JS: Tampered disclosures silently dropped instead of rejectednpm · @sd-jwt/core, @sd-jwt/decode · fixed in 0.20.0
- CVE-2026-118666GraphQL Tools: Shared legacy executor routes one subscription's results to a different callernpm · @graphql-tools/executor-legacy-ws · fixed in 1.1.36
- CVE-2026-118665GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authenticationsnpm · @graphql-tools/executor-legacy-ws · fixed in 1.1.36
- CVE-2026-118664decode-uri-component: Denial of service via quadratic replacement of percent-encoded runsnpm · decode-uri-component · fixed in 0.5.1
- CVE-2026-118663@hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static pathsnpm · @hono/node-server · fixed in 2.1.3
- CVE-2026-118662Vite: `server.fs.deny` bypassed with queriesnpm · vite · fixed in 6.4.5
- CVE-2026-118661Happy DOM: Cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookiesnpm · happy-dom · fixed in 20.14.6
- CVE-2026-118660Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTMLnpm · happy-dom · fixed in 21.0.0
- GHSA-4MFG-R38W-W8FGmcp-sanitizer: URL sanitizer allows localhost/IPv6 loopback SSRF bypass via explicit port or bracketed IPv6npm · mcp-sanitizer · fixed in 1.4.0
- GHSA-7W82-6F9J-V9JPmcp-sanitizer: File Path Sanitizer Permits Arbitrary User-Home Absolute Pathsnpm · mcp-sanitizer · fixed in 1.4.0
- CVE-2026-118258i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query stringnpm · i18next-http-backend · fixed in 4.0.4
- CVE-2026-118257Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messagesnpm · @intlify/core, @intlify/core-base +4 · fixed in 11.4.14, 12.0.0-alpha.5
- CVE-2026-118256Vue I18n: `escapeParameter` does not escape named values when the same call also passes a listnpm · @intlify/core, @intlify/core-base +3 · fixed in 11.4.14, 12.0.0-alpha.5
- CVE-2026-118255Highcharts Grid: javascript: URL in credits.href runs script on clicknpm · @highcharts/dashboards, @highcharts/grid-pro · fixed in 4.0.0, 3.2.0
- CVE-2026-118254Highcharts Grid: pagination language options are parsed as HTMLnpm · @highcharts/grid-lite, @highcharts/grid-pro · fixed in 3.2.0
- CVE-2026-118253Highcharts Dashboards: fullscreen labels are parsed as HTMLnpm · @highcharts/dashboards · fixed in 4.2.3
- CVE-2026-118252Highcharts Dashboards: sidebar component labels are parsed as HTMLnpm · @highcharts/dashboards · fixed in 4.2.3
- CVE-2026-118251Highcharts: javascript: URL in credits.href runs script on clicknpm · highcharts · fixed in 11.4.9, 12.6.1, 13.1.0
- CVE-2026-118250Highcharts: dotted series.keys paths write to Object.prototypenpm · highcharts · fixed in 12.6.1, 13.1.0, 11.4.9
- CVE-2026-118249Highcharts: series column construction writes to Object.prototypenpm · highcharts · fixed in 13.1.0
- CVE-2026-118247Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `proto` as an existing column.npm · @highcharts/dashboards, @highcharts/grid-pro · fixed in 4.2.2, 3.2.0
- CVE-2026-118246Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributesnpm · highcharts · fixed in 11.4.9, 12.6.1, 13.1.0
- CVE-2026-118245Highcharts Dashboards: `chartConstructor` is an unchecked lookup into the Highcharts namespacenpm · @highcharts/dashboards · fixed in 4.2.2