Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-109841undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokensnpm · undici · fixed in 7.30.1, 8.12.2
- CVE-2026-104827react/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoSPackagist · react/http · fixed in 1.11.1
- CVE-2026-97370Junrar: RarVM VM_JMP maxOpCount bypass causes infinite CPU loop during RAR4 extractionMaven · com.github.junrar:junrar · fixed in 7.6.1
- CVE-2026-109924undici vulnerable to Denial of Service via unbounded memory in the EventSource parsernpm · undici · fixed in 6.29.1, 7.30.1, 8.12.2
- CVE-2026-63430ammonia: mXSS in ammonia via MathML `annotation-xml` encoding stripcrates.io · ammonia · fixed in 3.3.2, 4.0.2, 4.1.3
- CVE-2026-109869undici vulnerable to Denial of Service via unhandled error on excessive content-encodingsnpm · undici · fixed in 6.29.1, 7.30.1, 8.12.2
- CVE-2026-55414NL Portal Backend Libraries: Unauthenticated form resolver forwards the privileged Objecten-API token to a caller-supplied URL (SSRF)Maven · nl.nl-portal:form · fixed in 3.0.4
- CVE-2026-54683NL Portal Backend Libraries: Document contents remained downloadable by any logged-in user until 3.0.3 (incomplete fix of CVE-2026-49463)Maven · nl.nl-portal:documenten-api · fixed in 3.0.3
- CVE-2026-104266tinytag: Infinite loop when parsing certain M4A files containing invalid atomsPyPI · tinytag · fixed in 2.3.0
- CVE-2026-100409OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded pathsnpm · @opennextjs/cloudflare · fixed in 1.20.2
- CVE-2026-102527Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routesnpm · nuxt-og-image · fixed in 6.7.0
- CVE-2026-100353kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filterGo · github.com/getkin/kin-openapi · fixed in 0.149.0
- CVE-2026-100354kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process CrashGo · github.com/getkin/kin-openapi · fixed in 0.149.0
- CVE-2026-100352kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation PathGo · github.com/getkin/kin-openapi · fixed in 0.148.0
- CVE-2026-100351kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusionGo · github.com/getkin/kin-openapi · fixed in 0.147.0
- CVE-2026-100349kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with contentGo · github.com/getkin/kin-openapi · fixed in 0.146.0
- CVE-2026-100350kin-openapi deepObject query decoding repeatedly compiles an invariant regular expressionGo · github.com/getkin/kin-openapi · fixed in 0.146.0
- CVE-2026-100347kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static pathGo · github.com/getkin/kin-openapi · fixed in 0.145.0
- CVE-2026-100348kin-openapi spec loader panics on a self-referential additionalProperties $ref (nil-pointer DoS)Go · github.com/getkin/kin-openapi · fixed in 0.145.0
- CVE-2026-97394kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing itemsGo · github.com/getkin/kin-openapi · fixed in 0.143.0
- CVE-2026-109413Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the ProcessPackagist · symfony/symfony, symfony/yaml · fixed in 5.4.54, 6.4.45, 7.4.18 and more
- CVE-2026-108082Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request HeaderPackagist · symfony/http-foundation, symfony/symfony · fixed in 6.4.46, 7.4.19, 8.1.7 and more
- CVE-2023-32198Steve doesn’t verify a server’s certificate and is susceptible to man-in-the-middle (MitM) attacksGo · github.com/rancher/steve · fixed in 0.2.1, 0.3.3, 0.4.4 and more
- CVE-2024-22031Rancher users who can create Projects can gain access to arbitrary projectsGo · github.com/rancher/rancher · fixed in 2.9.9, 2.10.5, 2.11.1
- CVE-2025-23390Fleet doesn’t validate a server’s certificate when connecting through SSHGo · github.com/rancher/fleet · fixed in 0.10.12, 0.11.7, 0.12.2
- CVE-2026-109855undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshakenpm · undici · fixed in 8.11.2
- CVE-2026-110904ApostropheCMS before 4.33.0 allows authentication bypass for REST API page reading, as demonstrated by a /api/v1/@apostrophecms/page?all=1 cnpm · apostrophe · fixed in 4.33.0
- CVE-2026-110872Nodemailer 3.0.0 before 10.0.10 Denial of Service via SMTP Reply Parsingnpm · nodemailer · fixed in 10.0.10
- CVE-2026-110871Nodemailer 3.0.0 before 10.0.10 Quadratic DKIM Header Unfolding Denial of Servicenpm · nodemailer · fixed in 10.0.10
- CVE-2026-110870Nodemailer before 10.0.13 Improper Input Validation via Angle-Bracket Address Commentsnpm · nodemailer · fixed in 10.0.13