Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-53602nebula-mesh - Host revocation is not durable: blocked/offboarded hosts can regain a valid certificateGo · github.com/forgekeep/nebula-mesh · fixed in 0.3.7
- CVE-2026-53760Admidio: CSRF on Plugin Install, Uninstall, and Update via Unprotected GET RequestsPackagist · admidio/admidio
- CVE-2026-50553Note Mark: Path traversal via unsanitized book/note slug in migrate export (sibling of GHSA-g49p)Go · github.com/enchant97/note-mark/backend · fixed in 0.0.0-20260601210719-67b7de04308a
- CVE-2026-18149undici vulnerable to Denial of Service via orphaned RetryHandler response bodynpm · undici · fixed in 7.29.1, 8.10.2
- CVE-2026-18540undici vulnerable to downstream response splitting via retry interceptornpm · undici · fixed in 6.28.1, 7.29.1, 8.10.2
- CVE-2026-19534undici vulnerable to Denial of Service via unrequested WebSocket subprotocolnpm · undici · fixed in 6.28.1, 7.29.1, 8.10.2
- CVE-2026-84890undici vulnerable to Denial of Service via unbounded decompression of compressed responsesnpm · undici · fixed in 7.29.1, 8.10.2
- CVE-2026-84933undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared cachesnpm · undici · fixed in 7.29.1, 8.10.2
- CVE-2026-84947undici vulnerable to response truncation via oversized chunked responses in the dump interceptornpm · undici · fixed in 7.29.1, 8.10.2
- CVE-2026-84961undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPoolnpm · undici · fixed in 7.29.1, 8.10.2
- CVE-2026-85008undici vulnerable to caching and replay of unsafe HTTP method responsesnpm · undici · fixed in 7.29.1, 8.10.2
- CVE-2026-85152undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptorsnpm · undici · fixed in 8.10.2
- CVE-2026-85014undici vulnerable to Denial of Service via WebSocketStream unclean closenpm · undici · fixed in 7.29.1, 8.10.2
- CVE-2026-85024undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompressionnpm · undici · fixed in 6.28.1, 7.29.1, 8.10.2
- CVE-2026-85730smol-toml: Denial of Service via malformed TOML documentsnpm · smol-toml · fixed in 1.7.1
- CVE-2026-85651Trigger.dev before 4.5.2 Unauthorized Environment Access via Run Replaynpm · trigger.dev · fixed in 4.5.2
- CVE-2026-85650Trigger.dev before 4.5.2 Server-Side Request Forgery via webhook alert-channelnpm · trigger.dev · fixed in 4.5.2
- CVE-2026-84428fastify vulnerable to header validation bypass via incomplete schema case normalizationnpm · fastify · fixed in 5.12.2
- CVE-2026-84469fastify vulnerable to request validation bypass via skipped boolean false schemasnpm · fastify · fixed in 5.12.2
- CVE-2026-76169fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlersnpm · fastify · fixed in 5.12.2
- CVE-2026-84504fastify vulnerable to request body replacement via an async validation result collisionnpm · fastify · fixed in 5.12.2
- CVE-2026-77465toml-node: Uncontrolled Recursionnpm · toml · fixed in 4.2.0
- CVE-2026-63376toml-node: Prototype Pollution Leads to `Object.prototype` Corruption via `__proto__` Key-Path Desynchronizationnpm · toml · fixed in 4.1.2
- CVE-2026-85063node-csv: Prototype replacement still reachable via columns pathnpm · csv-parse · fixed in 7.0.2
- CVE-2026-85062Colord: Slow rejection of oversized malformed color stringsnpm · colord · fixed in 2.9.4
- CVE-2026-85061MapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize() via Live NamedNodeMap Removal Skipnpm · maplibre-gl · fixed in 6.4.1
- CVE-2026-71429stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS)npm · stream-json · fixed in 3.5.0
- CVE-2026-53728Medplum - Improper Validation of Redirect URI in External Auth Callback allows Authorization Code Leakagenpm · @medplum/core · fixed in 5.1.6
- CVE-2026-85396rubyzip before 3.4.0 Path Traversal in Zip::Entry#extract via Sibling-Directory PrefixRubyGems · rubyzip · fixed in 3.4.0
- CVE-2026-85394python-jose through 3.5.0 Algorithm Confusion via DER-encoded Public Key as HMAC SecretPyPI · python-jose · fixed in 3.4.0