Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- GHSA-F2HQ-32VH-53CCpostal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded wordsnpm · postal-mime · fixed in 4.0.8
- GHSA-8C8M-P3M8-CJG8Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipientnpm · nodemailer · fixed in 10.1.4
- GHSA-M943-M63M-W62WNodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipientnpm · nodemailer · fixed in 10.1.4
- CVE-2026-115897Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function bodynpm · serialize-javascript · fixed in 7.1.3
- CVE-2026-115895Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code executionnpm · happy-dom · fixed in 21.0.4
- CVE-2026-115887graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of servicenpm · graphql-scalars · fixed in 2.0.1
- CVE-2026-115570Electron: Mitigation for compromised eMudhra intermediate certificatesnpm · electron · fixed in 45.0.0-beta.6, 44.9.1, 43.8.1 and more
- CVE-2026-115569Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project rootnpm · @fallow-cli/fallow-node, fallow · fixed in 3.34.0
- CVE-2026-58497Uni-CLI: Legacy HTTP MCP transport accepted browser-originated localhost requestsnpm · @zenalexa/unicli · fixed in 0.225.2
- CVE-2026-115478obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changesnpm · obsidian-tc · fixed in 1.31.4
- CVE-2026-115477obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTPnpm · obsidian-tc · fixed in 1.31.4
- CVE-2026-115754serialize-javascript 7.0.1 before 7.1.3 XSS via unescaped </script in function bodynpm · serialize-javascript · fixed in 7.1.3
- CVE-2026-115752Signal K Server 2.28.0-beta.2 before 2.34.0 SSRF via App Store appIconnpm · signalk-server · fixed in 2.34.0
- CVE-2026-115730i18next-http-backend 4.0.2 Protocol-Relative URL Injection via Namespace in interpolateUrlnpm · i18next-http-backend · fixed in 4.0.3
- CVE-2026-115728@hapi/content 6.0.1 before 6.0.3 ReDoS via Content.disposition() Parameter Parsingnpm · @hapi/content · fixed in 6.0.1
- CVE-2026-106763An issue in @justice8096/sagemath-mcp-server 1.0.1 allows a remote attacker to execute arbitrary code via the escapeShellString and…npm · @justice8096/sagemath-mcp-server
- CVE-2026-106764An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbitrary code via the resolveBaseBranch function.npm · @rog0x/mcp-git-tools
- CVE-2026-106765An issue in @rog0x/mcp-docker-tools 1.0.1 allows a remote attacker to execute arbitrary code via the handleImageList function.npm · @rog0x/mcp-docker-tools
- CVE-2026-115419Unintended disclosure of data element to wrong session in Strands Agents SDK A2A Servernpm · @strands-agents/sdk · fixed in 1.5.0
- CVE-2026-114607better-auth: OAuth state can be used as a Magic Link to sign in as another usernpm · better-auth · fixed in 1.7.7
- CVE-2026-94482Next.js: Denial of Service in App Router using Server Actionsnpm · next · fixed in 15.5.28, 16.4.1
- CVE-2026-113872multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardownnpm · multer · fixed in 2.5.0
- CVE-2026-114144toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()npm · toml · fixed in 5.0.1
- CVE-2026-114143toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()npm · toml · fixed in 5.0.1
- CVE-2026-114142toml-node: Prototype pollution: parsing a TOML document can write to Object.prototypenpm · toml · fixed in 5.0.1
- CVE-2026-114141toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()npm · toml · fixed in 5.0.1
- CVE-2026-114139Sentry-Javascript: Middleware Bypass when using Tunnel routenpm · @sentry/nextjs · fixed in 9.47.2, 10.75.2, 11.0.0-rc.1
- CVE-2026-114133Nuxt server islands render `useHeadSafe` input without sanitisationnpm · nuxt · fixed in 4.6.2
- CVE-2026-114132Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitivenpm · @nuxt/nitro-server, nuxt · fixed in 4.6.2
- CVE-2026-114131Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and…npm · nuxt · fixed in 4.4.4, 3.21.4