Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-53663React Router: `handleDocumentRequest` CSRF check covers `POST` only; PUT/PATCH/DELETE bypassnpm · @remix-run/server-runtime, react-router · fixed in 2.17.5, 7.15.1
- CVE-2026-54299Astro: Host-header full-read SSRF in core prerendered error-page fetch (prerenderedErrorPageFetch default + unvalidated createRequestFromNodeRequest URL)npm · astro · fixed in 6.4.6
- CVE-2026-54298Astro: XSS via Unescaped Attribute Names in Spread Propsnpm · astro · fixed in 6.4.6
- CVE-2026-50146Astro: Reflected XSS via unescaped slot namenpm · astro · fixed in 6.3.3
- CVE-2026-54300@astrojs/netlify broadens Astro image.remotePatterns in Netlify Image CDN confignpm · @astrojs/netlify · fixed in 7.0.13
- CVE-2026-54288Hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length`npm · hono · fixed in 4.12.25
- CVE-2026-54289Hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the restnpm · hono · fixed in 4.12.25
- CVE-2026-54290Hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcardnpm · hono · fixed in 4.12.25
- CVE-2026-54286Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)npm · hono · fixed in 4.12.25
- CVE-2026-54287Hono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and Latticenpm · hono · fixed in 4.12.25
- CVE-2026-54285opentelemetry-js: Unbounded memory allocation in W3C Baggage propagationnpm · @opentelemetry/core · fixed in 2.8.0
- CVE-2026-55388piscina: Prototype Pollution Gadget → RCE via inherited options.filenamenpm · piscina · fixed in 5.2.0, 4.9.3, 6.0.0-rc.2
- CVE-2026-54269protobufjs: Schema-derived names can shadow runtime-significant propertiesnpm · protobufjs, protobufjs-cli · fixed in 7.6.3, 8.6.0, 2.5.1 and more
- CVE-2026-48712protobufjs: Denial of service through unbounded Any expansion during JSON conversionnpm · protobufjs · fixed in 7.6.1, 8.4.1
- CVE-2026-54270protobufjs: Memory amplification from preserved unknown fields in binary decodenpm · protobufjs · fixed in 8.5.0
- CVE-2026-54271protobufjs-cli: Code injection in pbjs static output from crafted JSON descriptor namesnpm · protobufjs-cli · fixed in 1.3.2, 2.5.0
- CVE-2026-53571Vite: `server.fs.deny` bypass on Windows alternate pathsnpm · vite, vite-plus · fixed in 8.0.16, 7.3.5, 6.4.3 and more
- CVE-2026-49356Babel: Arbitrary File Read via sourceMappingURL Comment in @babel/corenpm · @babel/core · fixed in 8.0.0-rc.6, 7.29.6
- CVE-2026-55602http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypassnpm · http-proxy-middleware · fixed in 3.0.6, 4.1.0, 2.0.10
- CVE-2026-53632NTLMv2 hash disclosure via UNC path handling on Windowsnpm · launch-editor, vite +1 · fixed in 2.14.1, 8.0.16, 7.3.5 and more
- CVE-2026-50171Angular: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo)npm · @angular/common · fixed in 22.0.0-rc.2, 20.3.22, 19.2.23 and more
- CVE-2026-50184Angular: Request Credential & Cache Policy Stripping in Angular Service Workernpm · @angular/service-worker · fixed in 22.0.0-rc.2, 21.2.15, 20.3.22 and more
- CVE-2026-50169Angular Service Worker Policy-Bypass & Credential-Stripping Vulnerabilitiesnpm · @angular/service-worker · fixed in 22.0.0-rc.2, 20.3.22, 19.2.23 and more
- CVE-2026-46417Angular: SSRF via Hostname Hijacking in @angular/platform-servernpm · @angular/platform-server · fixed in 22.0.0-next.12, 21.2.13, 20.3.21 and more
- CVE-2026-50168Angular: URL Parser Differential in @angular/platform-server leading to SSRF Allowlist Bypassnpm · @angular/platform-server · fixed in 22.0.0-rc.2, 20.3.22, 19.2.23 and more
- CVE-2026-50170Angular: Information Leak via Default Caching of Credentialed Requests in HttpTransferCachenpm · @angular/common · fixed in 22.0.0-rc.2, 20.3.22, 19.2.23 and more
- CVE-2026-50556Angular: Missing `<noscript>` Raw-Text Serialization Escaping leads to Cross-Site Scripting (XSS) in Angular SSRnpm · @angular/platform-server · fixed in 22.0.0-rc.2, 21.2.16, 20.3.24 and more
- CVE-2026-50555Angular: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in @angular/platform-servernpm · @angular/platform-server · fixed in 22.0.0-rc.2, 21.2.16, 20.3.24 and more
- CVE-2026-54264Angular: Sensitive Header Leakage on Cross-Origin Redirects in Angular Service Workernpm · @angular/service-worker · fixed in 22.0.1, 21.2.17, 20.3.25
- CVE-2026-54268Angular: Denial of Service (DoS) via OOM in Date Formatting (formatDate)npm · @angular/common · fixed in 22.0.1, 21.2.17, 20.3.25