Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-67331better-auth SCIM 1.5.0 before 1.7.0-beta.4 Authorization Bypassnpm · @better-auth/scim · fixed in 1.7.0-beta.4
- CVE-2026-67320axios before 0.33.0 Prototype Pollution via Node HTTP adapternpm · axios · fixed in 0.33.0, 1.18.0
- CVE-2026-67335better-auth before 1.6.2 OAuth State Validation Bypassnpm · better-auth · fixed in 1.6.2
- CVE-2026-67330better-auth SCIM 1.4.0-beta.27 through 1.6.21 Account Takeover via Provider-ID Collisionnpm · @better-auth/scim · fixed in 1.6.22, 1.7.0-beta.10
- CVE-2026-67317axios 1.7.0 before 1.18.0 maxBodyLength Bypass via ReadableStreamnpm · axios · fixed in 1.18.0
- CVE-2025-71402better-auth before 1.4.0 Session Revocation via Forged Cookienpm · better-auth · fixed in 1.4.0
- CVE-2026-67314axios before 1.18.0 Prototype Pollution via auth subfieldsnpm · axios · fixed in 1.18.0
- CVE-2026-67313axios 0.28.0 before 1.18.0 Denial of Service via formDataToJSONnpm · axios · fixed in 0.33.0, 1.18.0
- CVE-2026-65841Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitizationnpm · jodit · fixed in 4.13.6
- CVE-2026-62324Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSSnpm · jodit · fixed in 4.12.31
- CVE-2026-54737@phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Mergingnpm · @phun-ky/defaults-deep · fixed in 2.0.5
- CVE-2026-55100hashi-vault-js has a path traversal and query parameter injectionnpm · hashi-vault-js · fixed in 0.5.2
- CVE-2026-54729dssrf: any users using 1.1.1.1 DNS is impacted by SSRFnpm · dssrf · fixed in 1.0.5
- GHSA-P7W7-4929-VPJ5`@dynatrace-oss/dynatrace-mcp-server` has Unauthenticated HTTP MCP Tool Invocationnpm · @dynatrace-oss/dynatrace-mcp-server · fixed in 2.0.0
- GHSA-XRMJ-5G4G-8987@dynatrace-oss/dynatrace-mcp-server has a workflow template injection via create_workflow_for_notificationnpm · @dynatrace-oss/dynatrace-mcp-server · fixed in 2.0.0
- GHSA-PQH8-P93P-2RX7@dynatrace-oss/dynatrace-mcp-server has a DQL injection via parameters not documented as DQLnpm · @dynatrace-oss/dynatrace-mcp-server · fixed in 2.1.1
- CVE-2026-18446fast-uri vulnerable to host confusion via backslash authority introducernpm · fast-uri · fixed in 2.4.4, 3.1.5, 4.1.2
- CVE-2026-68499re2: Global `String.prototype.match` with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth (DoS)npm · re2 · fixed in 1.25.2
- CVE-2026-67550re2: Out-of-bounds heap read in `exec`/`test`/`match` via attacker-influenced `lastIndex` on a non-ASCII subject → uncatchable process crash (DoS)npm · re2 · fixed in 1.25.2
- CVE-2026-54722dssrf: there a critical security bug with remove_at_symbol_in_stringnpm · dssrf · fixed in 1.0.4
- CVE-2026-59952Valibot: record() issue paths can make flatten() throw for inherited Object property namesnpm · valibot · fixed in 1.4.2
- CVE-2026-15157undici vulnerable to CRLF Injection via blob-like body 'type' propertynpm · undici · fixed in 6.28.0, 7.29.0, 8.9.0
- CVE-2026-14643undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directivesnpm · undici · fixed in 7.29.0, 8.9.0
- CVE-2026-16728undici vulnerable to downstream response desynchronization via retry interceptornpm · undici · fixed in 6.28.0, 7.29.0, 8.9.0
- CVE-2026-54705mathlive's Lack of Escaping of HTML allows for XSSnpm · mathlive · fixed in 0.110.0
- CVE-2026-16729undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fieldsnpm · undici · fixed in 6.28.0, 7.29.0, 8.9.0
- CVE-2026-13697undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directivesnpm · undici · fixed in 7.29.0, 8.9.0
- CVE-2026-54666swagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodiesnpm · swagger-typescript-api · fixed in 13.12.2
- CVE-2026-54664swagger-typescript-api vulnerable to code injection via unescaped enum string valuesnpm · swagger-typescript-api · fixed in 13.12.2
- CVE-2026-54661swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in axios http-client templatenpm · swagger-typescript-api · fixed in 13.12.2