Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-112954ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST APInpm · apostrophe · fixed in 4.34.0
- CVE-2026-112953ApostropheCMS: Exposure of Sensitive Information via predictable export filenamesnpm · @apostrophecms/import-export · fixed in 3.7.1
- CVE-2026-112952ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated usernpm · apostrophe · fixed in 4.34.0
- CVE-2026-112951ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefixnpm · apostrophe · fixed in 4.34.0
- CVE-2026-112950Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fixnpm · @vitest/mocker · fixed in 4.1.12, 5.0.3
- CVE-2026-112949Vitest: Code injection via unauthenticated manual mock registrationnpm · @vitest/mocker · fixed in 4.1.12, 5.0.3
- CVE-2026-112948Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token filenpm · @vitest/browser, @vitest/ui +1 · fixed in 5.0.5, 1.3.0
- CVE-2026-112947Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`npm · vite, vite-plus · fixed in 8.3.3, 8.2.4, 1.1.0
- CVE-2026-112946Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machinenpm · vite, vite-plus · fixed in 8.3.3, 8.2.4, 8.1.6 and more
- CVE-2026-112945Vite: Cross origin script execution through Vite custom middlewarenpm · vite, vite-plus · fixed in 8.3.3, 8.2.4, 8.1.6 and more
- CVE-2026-112944launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editorsnpm · launch-editor, vite +1 · fixed in 2.14.2, 8.3.3, 8.2.4 and more
- CVE-2026-112943launch-editor: escapeCmdArgs() omits % escaping on Windowsnpm · launch-editor, vite +1 · fixed in 2.14.2, 8.3.3, 8.2.4 and more
- CVE-2026-112942launch-editor: `fs.existsSync()` existence check can be bypassed on Windowsnpm · launch-editor, vite +1 · fixed in 2.14.2, 8.3.3, 8.2.4 and more
- CVE-2026-110725fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix referencesnpm · fast-uri · fixed in 2.4.8, 3.1.9, 4.2.3
- CVE-2026-110306fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decodingnpm · fast-uri · fixed in 2.4.8, 3.1.9, 4.2.3
- CVE-2026-110180fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalizationnpm · fast-uri · fixed in 2.4.8, 3.1.9, 4.2.3
- CVE-2026-110095fast-uri vulnerable to improper path equivalence in relative reference normalizationnpm · fast-uri · fixed in 2.4.8, 3.1.9, 4.2.3
- CVE-2026-111766markdown-it: Quadratic-time denial of service in inline HTML parsing with html enablednpm · markdown-it · fixed in 14.3.3, 15.0.3
- CVE-2026-111759markdown-it: Quadratic complexity in smartquotes with unmatched closing quotesnpm · markdown-it · fixed in 15.0.2, 14.3.2
- CVE-2026-111757Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static pathsnpm · hono · fixed in 4.13.11
- CVE-2026-111755follow-redirects sensitiveHeaders regex escaping can expose credential headersnpm · follow-redirects · fixed in 1.16.1
- CVE-2026-111997ip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall) via many % charactersnpm · ip-address · fixed in 10.7.4
- CVE-2026-109461Microsoft Authentication Library (MSAL) for Node.js Information Disclosure Vulnerabilitynpm · @azure/msal-node · fixed in 7.1.0
- CVE-2026-109932undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG bufferingnpm · undici · fixed in 6.29.1, 7.30.1, 8.12.2
- CVE-2026-104150AdonisJS HTTP Server: Uncontrolled Resource Consumption and Inefficient Regular Expression Complexitynpm · @adonisjs/http-server · fixed in 9.1.1, 8.2.2
- CVE-2026-87018undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiationnpm · undici · fixed in 6.29.1, 7.30.1, 8.12.2
- CVE-2026-109383undici vulnerable to TLS certificate validation bypass via dropped tls options in Agentnpm · undici · fixed in 6.29.1, 7.30.1, 8.12.2
- CVE-2026-109829undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirectsnpm · undici · fixed in 7.30.1, 8.12.2
- CVE-2026-109841undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokensnpm · undici · fixed in 7.30.1, 8.12.2
- CVE-2026-109924undici vulnerable to Denial of Service via unbounded memory in the EventSource parsernpm · undici · fixed in 6.29.1, 7.30.1, 8.12.2