Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-53781Summarize < 0.17.0 Disk Exhaustion via Uncapped Media Downloadnpm · @steipete/summarize-core · fixed in 0.17.0
- CVE-2026-47250mcp-server-kubernetes: kubectl-generic flag injection enables Kubernetes bearer token exfiltrationnpm · mcp-server-kubernetes · fixed in 3.7.0
- CVE-2026-46519mcp-server-kubernetes Affected By Tool Access Control Bypass: Presentation-Layer Filtering Without Execution-Layer Enforcementnpm · mcp-server-kubernetes · fixed in 3.6.0
- CVE-2026-49982tmp: Type-confusion bypass of _assertPath in tmp@0.2.6 allows path traversal via non-string prefix/postfix/templatenpm · tmp · fixed in 0.2.7
- CVE-2026-44705tmp: Path Traversal via unsanitized prefix/postfix enables directory escapenpm · tmp · fixed in 0.2.6
- CVE-2026-44486Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connectionnpm · axios · fixed in 1.16.0, 0.32.0
- CVE-2026-44487Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapternpm · axios · fixed in 1.16.0, 0.32.0
- CVE-2026-44488Axios: Allocation of Resources Without Limits or Throttling in axiosnpm · axios · fixed in 1.16.0
- CVE-2026-44490Axios: DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functionsnpm · axios · fixed in 1.16.0, 0.32.0
- CVE-2026-44496Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injectionnpm · axios · fixed in 1.16.0, 0.32.0
- CVE-2026-44495Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Mergenpm · axios · fixed in 1.15.2, 0.31.1
- CVE-2026-44494Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`npm · axios · fixed in 1.16.0
- CVE-2026-44489Axios: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fixnpm · axios · fixed in 1.16.0
- CVE-2026-44492Axios: shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)npm · axios · fixed in 1.16.0, 0.32.0
- CVE-2026-46695BoxLite: Permission Bypass in boxlite Allows Modification of Read-Only Filesnpm · @boxlite-ai/boxlite · fixed in 0.9.0
- CVE-2026-46703BoxLite: Path Traversal Vulnerability in boxlite Leads to Arbitrary File Write on the Hostnpm · @boxlite-ai/boxlite · fixed in 0.9.0
- CVE-2026-46625JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injectionnpm · js-cookie · fixed in 3.0.7
- CVE-2026-45783libp2p: Unvalidated PUT_VALUE records allow unbounded disk exhaustion on DHT server nodesnpm · @libp2p/kad-dht · fixed in 16.2.6
- CVE-2026-46679libp2p: Memory DoS via subscription flood of unique topicsnpm · @libp2p/gossipsub · fixed in 15.0.23
- CVE-2026-50131Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 rangesnpm · @fedify/fedify, @fedify/vocab-runtime · fixed in 1.9.12, 1.10.11, 2.0.19 and more
- CVE-2026-42462Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuringnpm · @fedify/fedify · fixed in 2.2.3, 2.1.14, 2.0.18 and more
- CVE-2026-11417OS Command Injection in NodejsFunction Bundling in aws-cdk-libnpm · aws-cdk-lib · fixed in 2.246.0
- CVE-2025-71329image-size 2.0.2 Denial of Service via Infinite Loop in JXL/HEIF Parsernpm · image-size · fixed in 2.0.3
- CVE-2025-71330image-size 2.0.2 Denial of Service via Malformed ICNS Image Parsingnpm · image-size · fixed in 2.0.3
- CVE-2025-71319image-size 2.0.2 Denial of Service via Infinite Loop in JXL/HEIF Parsernpm · image-size · fixed in 1.2.1, 2.0.2
- CVE-2026-42599Cross-site scripting via spread attributes in Svelte SSRnpm · svelte · fixed in 5.55.7
- CVE-2026-42567Svelte: ReDoS in `<svelte:element>` Tag Validationnpm · svelte · fixed in 5.55.7
- CVE-2026-42573Svelte: XSS via DOM Clobbering of Internal Framework Statenpm · svelte · fixed in 5.55.7
- CVE-2026-42570Svelte devalue: DoS via sparse array deserializationnpm · devalue · fixed in 5.8.1
- CVE-2026-46492md-fileserver: Stored/Reflected XSS when viewing Markdown (raw HTML allowed)npm · md-fileserver · fixed in 1.10.3