Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-44581Next.js: Cross-site scripting in App Router applications using CSP noncesnpm · next · fixed in 15.5.16, 16.2.5
- CVE-2026-44580Next.js: Cross-site scripting in beforeInteractive scripts with untrusted inputnpm · next · fixed in 15.5.16, 16.2.5
- CVE-2026-44579Next.js: Denial of Service via connection exhaustion in applications using Cache Componentsnpm · next · fixed in 15.5.16, 16.2.5
- CVE-2026-44578Next.js: Server-side request forgery in applications using WebSocket upgradesnpm · next · fixed in 15.5.16, 16.2.5
- CVE-2026-44577Next.js: Denial of Service in the Image Optimization APInpm · next · fixed in 15.5.16, 16.2.5
- CVE-2026-44576Next.js: Cache poisoning in React Server Component responsesnpm · next · fixed in 15.5.16, 16.2.5
- CVE-2026-44574Next.js: Middleware / Proxy bypass through dynamic route parameter injectionnpm · next · fixed in 15.5.16, 16.2.5
- CVE-2026-44575Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routesnpm · next · fixed in 15.5.16, 16.2.5
- CVE-2026-44573Next.js: Middleware / Proxy bypass in Pages Router applications using i18nnpm · next · fixed in 15.5.16, 16.2.5
- CVE-2026-44572Next.js: Middleware / Proxy redirects can be cache-poisonednpm · next · fixed in 15.5.16, 16.2.5
- CVE-2026-45028Astro: Server island encrypted parameters vulnerable to cross-component replaynpm · astro · fixed in 6.1.10
- CVE-2026-45033GitHub Copilot CLI: Nested Bare Repository Can Execute Arbitrary Commands via core.fsmonitornpm · @github/copilot · fixed in 1.0.43
- CVE-2026-44479Vercel: Non-interactive mode includes CLI arguments in suggested command outputnpm · vercel · fixed in 52.0.1
- CVE-2026-44664fast-xml-builder: Comment Value bypass regexnpm · fast-xml-builder · fixed in 1.1.6
- CVE-2026-44665fast-xml-builder: Attribute values with unwanted quotes can bypass malicious or unwanted attributesnpm · fast-xml-builder · fixed in 1.1.7
- CVE-2026-44459Hono: Improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()npm · hono · fixed in 4.12.18
- CVE-2026-44458Hono: CSS Declaration Injection via Style Object Values in JSX SSRnpm · hono · fixed in 4.12.18
- CVE-2026-44457Hono: Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakagenpm · hono · fixed in 4.12.18
- CVE-2026-44456Hono: bodyLimit() can be bypassed for chunked / unknown-length requestsnpm · hono · fixed in 4.12.16
- CVE-2026-44455Hono: Unvalidated JSX Tag Names in hono/jsx May Allow HTML Injectionnpm · hono · fixed in 4.12.16
- CVE-2026-44295protobufjs-cli: Code injection in pbjs static output from crafted schema namesnpm · protobufjs-cli · fixed in 1.2.1, 2.0.2
- CVE-2026-42290protobufjs-cli: OS Command Injectionnpm · protobufjs-cli · fixed in 1.2.1, 2.0.2
- CVE-2026-45740protobufjs: Denial of Service via unbounded recursive JSON descriptor expansionnpm · protobufjs · fixed in 7.5.8, 8.2.0
- CVE-2026-44294protobufjs: Denial of service from crafted field names in generated codenpm · protobufjs · fixed in 7.5.6, 8.0.2
- CVE-2026-44293protobufjs: Code injection through bytes field defaults in generated toObject codenpm · protobufjs · fixed in 7.5.6, 8.0.2
- CVE-2026-44292protobufjs: Prototype injection in generated message constructorsnpm · protobufjs · fixed in 7.5.6, 8.0.2
- CVE-2026-44291protobufjs: Code generation gadget after prototype pollutionnpm · protobufjs · fixed in 7.5.6, 8.0.2
- CVE-2026-44290protobufjs: Process-wide denial of service through unsafe option pathsnpm · protobufjs · fixed in 7.5.6, 8.0.2
- CVE-2026-44289protobufjs: Denial of service through unbounded protobuf recursionnpm · protobufjs · fixed in 7.5.6, 8.0.2
- CVE-2026-44288protobufjs: Overlong UTF-8 decodingnpm · @protobufjs/utf8, protobufjs · fixed in 1.1.1, 7.5.6, 8.0.2