Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-109869undici vulnerable to Denial of Service via unhandled error on excessive content-encodingsnpm · undici · fixed in 6.29.1, 7.30.1, 8.12.2
- CVE-2026-100409OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded pathsnpm · @opennextjs/cloudflare · fixed in 1.20.2
- CVE-2026-102527Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routesnpm · nuxt-og-image · fixed in 6.7.0
- CVE-2026-109855undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshakenpm · undici · fixed in 8.11.2
- CVE-2026-110904ApostropheCMS before 4.33.0 allows authentication bypass for REST API page reading, as demonstrated by a /api/v1/@apostrophecms/page?all=1 cnpm · apostrophe · fixed in 4.33.0
- CVE-2026-110872Nodemailer 3.0.0 before 10.0.10 Denial of Service via SMTP Reply Parsingnpm · nodemailer · fixed in 10.0.10
- CVE-2026-110871Nodemailer 3.0.0 before 10.0.10 Quadratic DKIM Header Unfolding Denial of Servicenpm · nodemailer · fixed in 10.0.10
- CVE-2026-110870Nodemailer before 10.0.13 Improper Input Validation via Angle-Bracket Address Commentsnpm · nodemailer · fixed in 10.0.13
- CVE-2026-110869Nodemailer 3.0.0 before 10.0.13 ReDoS via SMTP AUTH Mechanism Detection Regexesnpm · nodemailer · fixed in 10.0.13
- CVE-2026-110864Better Auth 1.5.0-beta.12 before 1.7.7 Authentication Bypass via OAuth Proxynpm · better-auth · fixed in 1.7.7
- CVE-2026-110862Better Auth 1.4.0-beta.18 before 1.7.7 Authentication Bypass via Magic Linknpm · better-auth · fixed in 1.7.7
- CVE-2026-110861Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race Conditionnpm · @better-auth/drizzle-adapter, @better-auth/kysely-adapter +1 · fixed in 1.7.7, 1.7.0
- CVE-2026-110816qs.stringify with arrayFormat comma throws TypeError on array elements that cannot be coerced to a stringnpm · qs · fixed in 6.16.1
- CVE-2026-103975Appium: Symlink based Zip Slip in @appium/support ZIP extractionnpm · @appium/support · fixed in 7.2.6
- CVE-2026-101896Angular: Denial of Service via Numeric URL Matrix Parameters in Server-Side Rendering (SSR)npm · @angular/router · fixed in 22.2.0, 21.2.24, 20.3.32
- CVE-2026-101895Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPEnpm · @angular/platform-server · fixed in 22.1.6, 21.2.23, 20.3.31
- CVE-2026-110634git-diff before 2.0.7 OS Command Injection via gitDiff Input Stringsnpm · git-diff · fixed in 2.0.7
- CVE-2026-102599Socket.IO: Engine.IO Protocol Revision Mismatch DoSnpm · engine.io · fixed in 6.6.10
- CVE-2026-86063Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinningnpm · @anthropic-ai/claude-code · fixed in 2.1.179
- CVE-2026-84994Qwik: Crashing any Qwik Server via Resource thenablenpm · @builder.io/qwik, @qwik.dev/core · fixed in 1.20.0, 2.0.0-beta37
- CVE-2026-102989TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responsesnpm · @tanstack/react-start, @tanstack/solid-start +2 · fixed in 1.168.60, 1.168.57, 1.169.39 and more
- CVE-2026-102672Electron: Local race condition in Squirrel.Mac update installation on macOSnpm · electron · fixed in 39.8.10, 41.10.5, 42.0.0-beta.2
- CVE-2026-101899Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP rangesnpm · axios · fixed in 1.20.0
- CVE-2026-106108Quasar Framework: App Vite SSG page output paths can escape the configured distribution directorynpm · @quasar/app-vite · fixed in 3.3.0
- CVE-2026-77361obsidian-tc symlink path mismatch bypasses read ACL restrictionsnpm · obsidian-tc · fixed in 1.3.1
- CVE-2026-77362obsidian-tc bridge tools expose data outside the read ACLnpm · obsidian-tc · fixed in 1.3.1
- CVE-2026-109955Hono 4.12.4 before 4.13.11 Middleware Bypass via serveStatic Double Decodingnpm · hono · fixed in 4.13.11
- CVE-2026-107832fastify vulnerable to header validation bypass via case-sensitive propertyNamesnpm · fastify · fixed in 5.12.6
- CVE-2026-63316SQL Injection in Payload CMSnpm · @payloadcms/db-d1-sqlite, @payloadcms/db-postgres +2 · fixed in 3.90.0, 4.0.0-canary.34, 3.73.0
- CVE-2026-106495Backstage: Improper access control in backend action invocationnpm · @backstage/backend-defaults · fixed in 0.17.8