Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-42039Axios: unbounded recursion in toFormData causes DoS via deeply nested request datanpm · axios · fixed in 1.15.1, 0.31.1
- CVE-2026-42036Axios: HTTP adapter streamed responses bypass maxContentLengthnpm · axios · fixed in 1.15.1, 0.31.1
- CVE-2026-42034Axios: HTTP adapter streamed uploads bypass maxBodyLength when maxRedirects: 0npm · axios · fixed in 1.15.1, 0.31.1
- CVE-2026-42037Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStreamnpm · axios · fixed in 1.15.1
- CVE-2026-42038Axios: no_proxy bypass via IP alias allows SSRFnpm · axios · fixed in 1.15.1, 0.31.1
- CVE-2026-42041Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategynpm · axios · fixed in 1.15.1, 0.31.1
- CVE-2026-42043Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0npm · axios · fixed in 1.15.1, 0.31.1
- CVE-2026-42044Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`npm · axios · fixed in 1.15.2
- CVE-2026-42040Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParamsnpm · axios · fixed in 1.15.1, 0.31.1
- CVE-2026-42035Axios: Header Injection via Prototype Pollutionnpm · axios · fixed in 1.15.1, 0.31.1
- CVE-2026-42033Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijackingnpm · axios · fixed in 1.15.1, 0.31.1
- CVE-2026-41680Marked: OOM Denial of Service via Infinite Recursion in marked Tokenizernpm · marked · fixed in 18.0.2
- CVE-2026-41322@astrojs/node: Cache Poisoning due to incorrect error handling when if-match header is malformednpm · @astrojs/node · fixed in 10.0.5
- CVE-2026-41321@astrojs/cloudflare: SSRF via redirect following in Cloudflare image-binding-transform endpointnpm · @astrojs/cloudflare · fixed in 13.1.10
- CVE-2026-41067Astro: XSS via incomplete `</script>` sanitization in `define:vars` allows case-insensitive and whitespace-based bypassnpm · astro · fixed in 6.1.6
- CVE-2026-40897Math.js: Unsafe object property setter in mathjsnpm · mathjs · fixed in 15.2.0
- CVE-2026-41324basic-ftp vulnerable to denial of service via unbounded memory consumption in Client.list()npm · basic-ftp · fixed in 5.3.0
- CVE-2026-41305PostCSS has XSS via Unescaped </style> in its CSS Stringify Outputnpm · postcss · fixed in 8.5.10
- CVE-2026-33318Actual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated Serversnpm · @actual-app/sync-server · fixed in 26.4.0
- CVE-2026-41361OpenClaw < 2026.3.28 - SSRF Guard Bypass via IPv6 Special-Use Rangesnpm · openclaw · fixed in 2026.3.28
- CVE-2026-41360OpenClaw < 2026.4.2 - Approval Integrity Bypass in pnpm dlx Local Script Bindingnpm · openclaw · fixed in 2026.4.2
- CVE-2026-41359OpenClaw < 2026.3.28 - Privilege Escalation via operator.write to Admin-Class Telegram Config and Cron Persistencenpm · openclaw · fixed in 2026.3.28
- CVE-2026-41358OpenClaw < 2026.4.2 - Sender Allowlist Bypass via Slack Thread Contextnpm · openclaw · fixed in 2026.4.2
- CVE-2026-41357OpenClaw < 2026.3.31 - Unsanitized Environment Variable Leakage in SSH Sandbox Backendsnpm · openclaw · fixed in 2026.3.31
- CVE-2026-41356OpenClaw < 2026.3.31 - Incomplete WebSocket Session Termination in device.token.rotatenpm · openclaw · fixed in 2026.3.31
- CVE-2026-41355OpenClaw < 2026.3.28 - Arbitrary Code Execution via Mirror Mode Sandbox File Conversionnpm · openclaw · fixed in 2026.3.28
- CVE-2026-41354OpenClaw < 2026.4.2 - Insufficient Scope in Zalo Webhook Replay Dedupe Keysnpm · openclaw · fixed in 2026.4.2
- CVE-2026-41353OpenClaw < 2026.3.22 - allowProfiles Bypass via Profile Mutation and Runtime Selectionnpm · openclaw · fixed in 2026.3.22
- CVE-2026-41352OpenClaw < 2026.3.31 - Remote Code Execution via Node Scope Gate Bypassnpm · openclaw · fixed in 2026.3.31
- CVE-2026-41351OpenClaw < 2026.3.31 - Webhook Replay Detection Bypass via Base64 Signature Re-encodingnpm · openclaw · fixed in 2026.3.31