Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-22707Strapi Upload Plugin MIME Validation Bypass via Content APInpm · @strapi/upload · fixed in 5.33.3
- CVE-2026-22706Strapi: Password Reset Does Not Revoke Existing Refresh Sessionsnpm · @strapi/admin, @strapi/plugin-users-permissions · fixed in 5.33.3
- CVE-2026-22599Strapi Vulnerable to SQL Injection in Content Type Buildernpm · @strapi/content-type-builder, @strapi/plugin-content-type-builder · fixed in 5.33.2, 4.26.1
- CVE-2026-44589nuxt-og-image SSRF — bypass of GHSA-pqhr-mp3f-hrpp / v6.2.5 fix (IPv6 + redirect)npm · nuxt-og-image · fixed in 6.4.9
- CVE-2025-64526Strapi has a rate limit bypass on users-permissions plugin via attacker-controlled email keyingnpm · @strapi/plugin-users-permissions · fixed in 5.45.0
- CVE-2026-42334Mongoose: Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injectionnpm · mongoose · fixed in 6.13.9, 7.8.9, 8.22.1 and more
- CVE-2026-44503Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirectnpm · kiota-typescript · fixed in 1.0.0-preview.100
- CVE-2026-42281MagicMirror²: Unauthenticated SSRF via /cors endpointnpm · magicmirror · fixed in 2.36.0
- CVE-2026-44374Backstage: Catalog unprocessed read endpoints allow authenticated cross-owner data access without permission checksnpm · @backstage/plugin-catalog-backend-module-unprocessed, @backstage/plugin-catalog-unprocessed-entities +1 · fixed in 0.6.11, 0.2.30, 0.0.15
- CVE-2026-42559RMCP: DNS rebinding vulnerability in rmcp Streamable HTTP server transportnpm · dynoxide · fixed in 0.9.13
- CVE-2026-44437Angular SSR: Open Redirect and Request Steering via Encoded X-Forwarded-Prefixnpm · @angular/ssr · fixed in 22.0.0-next.7, 21.2.9, 20.3.25 and more
- CVE-2026-44372Nitro: Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rulesnpm · nitro, nitropack · fixed in 3.0.260429-beta, 2.13.4
- CVE-2026-44373Nitro: Proxy scope bypass via percent-encoded path traversal in `routeRules`npm · nitro, nitropack · fixed in 3.0.260429-beta, 2.13.4
- CVE-2026-44351fast-jwt: Empty HMAC secret accepted via async key resolver - JWT auth bypassnpm · fast-jwt · fixed in 6.2.4
- CVE-2026-44005vm2: Sandbox escapenpm · vm2 · fixed in 3.11.0
- CVE-2026-45411vm2: Sandbox Breakout Using Async Generatornpm · vm2 · fixed in 3.11.3
- CVE-2026-44009vm2: Sandbox Breakout Through Null Proto Exceptionnpm · vm2 · fixed in 3.11.2
- CVE-2026-44008vm2 has sandbox breakout via `neutralizeArraySpeciesBatch`npm · vm2 · fixed in 3.11.2
- CVE-2026-44007vm2: nesting: true bypasses require: false, allowing sandbox escape to arbitrary OS command executionnpm · vm2 · fixed in 3.11.1
- CVE-2026-44006vm2: Sandbox Escapenpm · vm2 · fixed in 3.11.0
- CVE-2026-44004vm2: Host Process OOM DoS via Buffer.alloc (Timeout Bypass)npm · vm2 · fixed in 3.11.0
- CVE-2026-44003vm2: Transformer Fast-Path Bypass Exposes Internal State Variablenpm · vm2 · fixed in 3.11.0
- CVE-2026-44002vm2: Host File Path Disclosure via Stack Trace Information Leaknpm · vm2 · fixed in 3.11.0
- CVE-2026-44001vm2: Sandbox Escape via Promise Constructor Unhandled Rejection (Process Crash DoS)npm · vm2 · fixed in 3.11.0
- CVE-2026-44000vm2: sandbox boundary bypass via host Promise resolution preserving host object identitynpm · vm2 · fixed in 3.11.0
- CVE-2026-43999vm2: NodeVM builtin allowlist bypass via `module` builtin's `Module._load` allows sandbox escapenpm · vm2 · fixed in 3.11.0
- CVE-2026-43998vm2: NodeVM require.root bypass via symlink traversal allows sandbox escapenpm · vm2 · fixed in 3.11.0
- CVE-2026-43997vm2: Sandbox Escapenpm · vm2 · fixed in 3.11.0
- CVE-2026-45109Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routesnpm · next · fixed in 15.5.18, 16.2.6
- CVE-2026-44582Next.js: Cache poisoning via collisions in React Server Component cache-bustingnpm · next · fixed in 15.5.16, 16.2.5