Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-118666GraphQL Tools: Shared legacy executor routes one subscription's results to a different callernpm · @graphql-tools/executor-legacy-ws · fixed in 1.1.36
- CVE-2026-118665GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authenticationsnpm · @graphql-tools/executor-legacy-ws · fixed in 1.1.36
- CVE-2026-118664decode-uri-component: Denial of service via quadratic replacement of percent-encoded runsnpm · decode-uri-component · fixed in 0.5.1
- CVE-2026-118663@hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static pathsnpm · @hono/node-server · fixed in 2.1.3
- CVE-2026-118662Vite: `server.fs.deny` bypassed with queriesnpm · vite · fixed in 6.4.5
- CVE-2026-118661Happy DOM: Cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookiesnpm · happy-dom · fixed in 20.14.6
- CVE-2026-118660Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTMLnpm · happy-dom · fixed in 21.0.0
- CVE-2026-118658Echo: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-ProtoGo · github.com/labstack/echo/v4, github.com/labstack/echo/v5 · fixed in 4.15.2, 5.1.1
- CVE-2026-118657Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme HeadersGo · github.com/labstack/echo/v4, github.com/labstack/echo/v5 · fixed in 4.16.0, 5.4.0
- CVE-2026-118656Echo: Open Redirect via Control-Character Prefix Defeating sanitizeURIGo · github.com/labstack/echo/v4, github.com/labstack/echo/v5 · fixed in 4.16.0, 5.4.0
- CVE-2026-118655Echo: Static Middleware Double-Unescape Path TraversalGo · github.com/labstack/echo/v4, github.com/labstack/echo/v5 · fixed in 4.15.3, 5.2.0
- CVE-2026-118654Echo static file middleware route protection bypass via encoded dot-dot traversalGo · github.com/labstack/echo/v4, github.com/labstack/echo/v5 · fixed in 4.16.0, 5.4.0
- GHSA-4MFG-R38W-W8FGmcp-sanitizer: URL sanitizer allows localhost/IPv6 loopback SSRF bypass via explicit port or bracketed IPv6npm · mcp-sanitizer · fixed in 1.4.0
- GHSA-7W82-6F9J-V9JPmcp-sanitizer: File Path Sanitizer Permits Arbitrary User-Home Absolute Pathsnpm · mcp-sanitizer · fixed in 1.4.0
- GHSA-473Q-M89C-GHF8MySqlConnector: Account password disclosed to a man-in-the-middle in zero-configuration TLS mode (clear-text password sent before certificatNuGet · mysqlconnector · fixed in 2.6.1
- CVE-2026-54162Ember: Unneutralised terminal escape/control sequences from Caddy logs injected into the operator's TUIGo · github.com/alexandre-daubois/ember · fixed in 1.4.2
- CVE-2026-118653Echo: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default ConfigurationGo · github.com/labstack/echo/v4, github.com/labstack/echo/v5 · fixed in 5.1.0
- CVE-2026-118652Echo: Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlobGo · github.com/labstack/echo/v4, github.com/labstack/echo/v5 · fixed in 4.16.0, 5.4.0
- CVE-2026-118651Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by DefaultGo · github.com/labstack/echo/v4, github.com/labstack/echo/v5 · fixed in 5.4.0
- CVE-2026-118650Echo: middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served pathGo · github.com/labstack/echo/v4, github.com/labstack/echo/v5 · fixed in 4.16.0, 5.4.0
- CVE-2026-118266Echo: CSRF Protection Bypass via MethodOverride Rewriting POST to Safe MethodGo · github.com/labstack/echo/v4, github.com/labstack/echo/v5 · fixed in 4.16.0, 5.4.0
- CVE-2026-118265Echo: X-Real-IP extractor trusts the header value instead of the sending peerGo · github.com/labstack/echo/v5 · fixed in 5.4.1
- CVE-2026-118264Echo: Rejected WebSocket upgrades can bypass Echo route-level access controlsGo · github.com/labstack/echo/v4, github.com/labstack/echo/v5 · fixed in 4.16.1, 5.4.1
- CVE-2026-118263Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requestsGo · github.com/labstack/echo/v5 · fixed in 5.4.1
- CVE-2026-118262Echo: WebSocket proxy can retain connections and handlers after client disconnectGo · github.com/labstack/echo/v4, github.com/labstack/echo/v5 · fixed in 4.16.1, 5.4.1
- CVE-2026-118688Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Sandbox Escape via Symlink Renamecrates.io · wasmtime-wasi · fixed in 36.0.18, 48.0.6, 49.0.3
- CVE-2026-118261Echo: Decompress permits unbounded gzip expansion in v4Go · github.com/labstack/echo/v4 · fixed in 4.16.1
- CVE-2026-118260Echo: BodyDump captures request and response bodies without size limits in v4Go · github.com/labstack/echo/v4 · fixed in 4.16.1
- CVE-2026-118259opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsingMaven · io.opentelemetry:opentelemetry-api · fixed in 1.67.0
- CVE-2026-118258i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query stringnpm · i18next-http-backend · fixed in 4.0.4