Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-102266PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validationPyPI · pyjwt · fixed in 2.14.0
- CVE-2026-101918PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)PyPI · pyjwt · fixed in 2.15.0
- CVE-2026-101917PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)PyPI · pyjwt · fixed in 2.14.0
- CVE-2026-101916@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorizednpm · @grpc/grpc-js · fixed in 1.13.6, 1.14.5
- CVE-2026-101915@grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messagesnpm · @grpc/grpc-js · fixed in 1.13.6, 1.14.5
- CVE-2026-96760Authlib library contains a signature‑verification bypass vulnerabilityPyPI · authlib · fixed in 1.9.0
- CVE-2026-101914@grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matchesnpm · @grpc/grpc-js-xds · fixed in 1.13.1, 1.14.1
- CVE-2026-101913ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hostsnpm · ip-address · fixed in 10.5.1
- CVE-2026-55156Token Optimizer MCP: Unauthenticated Path Traversal in Dashboard Session Log API Endpointsnpm · @ooples/token-optimizer-mcp · fixed in 5.1.0
- CVE-2026-55157Token Optimizer MCP: OS command injection in smart_user via username in get-user-infonpm · @ooples/token-optimizer-mcp · fixed in 5.1.0
- CVE-2026-101912ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its rangenpm · ip-address · fixed in 10.7.1
- CVE-2026-101911ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the processnpm · ip-address · fixed in 10.7.1
- CVE-2026-101910ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypassnpm · ip-address · fixed in 10.5.1
- CVE-2026-101909Axios: Prototype Pollution Gadget in axios toFormData Optionsnpm · axios · fixed in 0.34.0, 1.20.0
- CVE-2026-101908Axios: Prototype pollution gadget in fetch adapter can alter outbound requestsnpm · axios · fixed in 1.20.0
- CVE-2026-101907Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRFnpm · axios · fixed in 1.20.0
- CVE-2026-101906Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Locationnpm · axios · fixed in 1.20.0
- CVE-2026-101905Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnectionnpm · axios · fixed in 1.20.0
- CVE-2026-101904Axios: Header Injection via Inherited headers After Minimal Interceptornpm · axios · fixed in 1.20.0
- CVE-2026-101903Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)npm · axios · fixed in 1.20.0
- CVE-2026-101902Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Methodnpm · axios · fixed in 0.34.0, 1.20.0
- CVE-2026-101901Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initializationnpm · axios · fixed in 1.20.0
- CVE-2026-101900Axios: Fetch Adapter Header Injection via Inherited FormData getHeadersnpm · axios · fixed in 1.20.0
- CVE-2026-101898Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controlsnpm · axios · fixed in 1.20.0
- CVE-2026-101894@xhmikosr/decompress: Path traversal via symlink chainnpm · @xhmikosr/decompress, decompress · fixed in 11.1.4, 10.2.2
- CVE-2026-94194Mint HTTP/1 client applies chunked framing when chunked is not the final transfer coding, enabling response smuggling through intermediariesHex · mint · fixed in 1.10.2
- CVE-2026-92103Mint HTTP/2 client buffers oversized frames up to 16 MiB before enforcing max_frame_sizeHex · mint · fixed in 1.10.2
- CVE-2026-91043HPACK-indexed cookie fields in Mint HTTP/2 responses bypass max_header_list_size and exhaust client memoryHex · mint · fixed in 1.10.2
- CVE-2026-100909OctoberCMS ResizeImages.php getSourcePathForResize server-side request forgeryPackagist · october/october · fixed in 4.3.5
- CVE-2026-101090Nezha through 2.2.3 Host Header Injection via OAuth2 redirect_uriGo · github.com/nezhahq/nezha