Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-45674Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME RecordsMaven · io.netty:netty-resolver-dns · fixed in 4.2.15.Final, 4.1.135.Final
- CVE-2026-47141vm2: NodeVM observability builtins leak host process and HTTP request datanpm · vm2 · fixed in 3.11.4
- CVE-2026-47210vm2 sandbox escape via JSPI-backed Promise `.finally()` species bypassnpm · vm2 · fixed in 3.11.4
- CVE-2026-47208vm2: Sandbox Breakout Using Promise Speciesnpm · vm2 · fixed in 3.11.4
- CVE-2026-47140vm2: NodeVM builtin denylist bypass via process and inspector/promises allows host code executionnpm · vm2 · fixed in 3.11.4
- CVE-2026-45673Netty: DNS Cache Poisoning due to Predictable PRNG and Default Static Source PortMaven · io.netty:netty-resolver-dns · fixed in 4.2.15.Final, 4.1.135.Final
- CVE-2026-47139vm2: NodeVM network builtin exclusions bypass via internal _http_client and _http_servernpm · vm2 · fixed in 3.11.4
- CVE-2026-47137vm2: GHSA-8hg8-63c5-gwmx patch bypass: nesting:true without explicit require still allows full RCEnpm · vm2 · fixed in 3.11.4
- CVE-2026-47135vm2: Sandbox escape via unblocked cross-realm Symbol.for keys + missing bridge write-trap symbol checksnpm · vm2 · fixed in 3.11.4
- CVE-2026-47131vm2: Sandbox Escapenpm · vm2 · fixed in 3.11.4
- CVE-2026-47209vm2: Bridge Proxy set trap ignores receiver parameter, enabling host object property injection via prototype chainnpm · vm2 · fixed in 3.11.4
- CVE-2026-45536Netty: Unix-socket fd receive leaks descriptors when peer sends two at onceMaven · io.netty:netty-transport-native-epoll, io.netty:netty-transport-native-kqueue · fixed in 4.2.15.Final, 4.1.135.Final
- CVE-2026-45416Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytesMaven · io.netty:netty-handler · fixed in 4.2.15.Final, 4.1.135.Final
- CVE-2026-44894Netty's Default QUIC token handler accepts any client-supplied tokenMaven · io.netty:netty-codec-classes-quic · fixed in 4.2.15.Final
- CVE-2026-44893Netty: HAProxy SSL TLV parsing leaks retained slice on invalid TLV lengthMaven · io.netty:netty-codec-haproxy · fixed in 4.2.15.Final, 4.1.135.Final
- CVE-2026-54133jmespath.php has CompilerRuntime code injection via unescaped function namesPackagist · mtdowling/jmespath.php · fixed in 2.9.1
- CVE-2026-53722Nuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URLnpm · nuxt · fixed in 4.4.7, 3.21.7
- CVE-2026-53721Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matchernpm · nuxt · fixed in 4.4.7, 3.21.7
- CVE-2026-47200Nuxt: Route middleware not enforced when rendering `.server.vue` pages via `/__nuxt_island/page_*`npm · @nuxt/nitro-server, nuxt · fixed in 3.21.6, 4.4.6
- CVE-2026-49993@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g)npm · @nuxt/rspack-builder, @nuxt/webpack-builder · fixed in 4.4.7, 3.21.7
- CVE-2026-45669Nuxt: Reflected XSS in `navigateTo()` external redirectnpm · nuxt · fixed in 3.21.6, 4.4.6
- CVE-2026-45670Nuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99)npm · @nuxt/rspack-builder, @nuxt/webpack-builder · fixed in 3.21.6, 4.4.6
- CVE-2026-46342Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoningnpm · @nuxt/nitro-server, nuxt · fixed in 3.21.6, 4.4.6
- CVE-2026-50645Apache CXF: No restriction on attachment headers per messageMaven · org.apache.cxf:cxf-core · fixed in 4.2.2, 4.1.7, 3.6.12
- CVE-2026-50634Apache CXF: WS JSON request filter trusts metadata from an unvalidated first signature entryMaven · org.apache.cxf:cxf-rt-rs-security-jose-jaxrs · fixed in 4.2.2, 4.1.7
- CVE-2026-50633Apache CXF: JNDI Injection vulnerability in DispatchMDBMessageListenerImplMaven · org.apache.cxf:cxf-integration-jca · fixed in 4.2.2, 4.1.7
- CVE-2026-50632Apache CXF: JNDI Injection Vulnerability in JMSConfigFactoryMaven · org.apache.cxf:cxf-rt-transports-jms · fixed in 4.2.2, 4.1.7, 3.6.12
- CVE-2026-50631Apache CXF: OAuth2: TOCTOU Race Condition in Refresh Token ProcessingMaven · org.apache.cxf:cxf-rt-rs-security-oauth2 · fixed in 4.2.2, 4.1.7
- CVE-2026-50630Apache CXF: OAuth2: HTTP Response Splitting via WWW-Authenticate Realm InjectionMaven · org.apache.cxf:cxf-rt-rs-security-oauth2 · fixed in 4.2.2, 4.1.7
- CVE-2026-50629Apache CXF: OAuth2: Log Injection via Unsanitized Client IdentifierMaven · org.apache.cxf:cxf-rt-rs-security-oauth2 · fixed in 4.2.2, 4.1.7