MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint

GHSA-xcx6-jx8p-x3h5 CVE-2026-109461 HIGH about 4 hours ago

### Impact Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information ...

npm

No PRs yet

undici vulnerable to Denial of Service via unhandled error on excessive content-encodings

GHSA-xjj6-f33q-929c CVE-2026-109869 HIGH about 4 hours ago

### Impact undici's `fetch()` crashes the Node.js process when a malicious server returns a response with more than five content codings and close...

npm

1

Dependabot PRs

undici vulnerable to Denial of Service via unbounded memory in the EventSource parser

GHSA-4qv8-2p9j-2685 CVE-2026-109924 MODERATE about 4 hours ago

### Impact undici's `EventSource` client can be driven to exhaust process memory by a malicious or compromised Server-Sent Events peer. By sending...

npm

1

Dependabot PRs

undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens

GHSA-f72v-6w45-q472 CVE-2026-109841 MODERATE about 4 hours ago

### Impact undici's `fetch()` verifies Subresource Integrity (SRI) metadata by looking up the algorithm token in a lowercase-only set, but the SRI...

npm

1

Dependabot PRs

Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body

GHSA-m5mm-p8h7-m29v CVE-2026-115897 LOW about 4 hours ago

### Impact `serialize-javascript` escapes its output so it is safe to embed inside a `<script>` element. Before 7.1.3 that guarantee did not hold ...

npm

No PRs yet

multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown

GHSA-q7qp-rjg7-q26m CVE-2026-113872 HIGH about 4 hours ago

### Impact When `multer` is configured with an asynchronous `fileFilter`, a single request can crash the Node.js process. If a request is aborted ...

npm

No PRs yet

Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution

GHSA-834v-8h66-3h79 CVE-2026-115895 HIGH about 5 hours ago

## Summary The ESM compiler in `happy-dom@20.14.5` does not validate imported local binding aliases before interpolating them into generated JavaS...

npm

No PRs yet

Fallow: A `.*` glob segment let an analyzed repository make Fallow test paths in the parent of the project root

GHSA-h4fr-cmh5-qr62 LOW about 5 hours ago

### Impact Fallow expands some globs from the analyzed repository on disk. Before 3.34.0, a segment such as `.*`, `.?` or `..*` in such a glob als...

cargo npm

No PRs yet

Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root

GHSA-jfwm-3p3c-6hx5 CVE-2026-115569 LOW about 5 hours ago

### Impact Fallow reads the Jest and Vitest configs of the repository that it analyzes. A Jest `projects` entry or a Vitest `test.projects` entry ...

cargo npm

No PRs yet

postal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded words

GHSA-f2hq-32vh-53cc HIGH about 5 hours ago

### Impact Decoding a header that holds a long run of joinable RFC 2047 base64 encoded words, such as `=?utf-8?B?QUJD?=` repeated tens of thousand...

npm

No PRs yet

Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient

GHSA-8c8m-p3m8-cjg8 MODERATE about 5 hours ago

### Vulnerability summary RFC 5322 comments nest. addressparser ended a comment at the first `)`, including the one that closes a nested comment, ...

npm

No PRs yet

Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient

GHSA-m943-m63m-w62w MODERATE about 5 hours ago

### Vulnerability summary addressparser ends an RFC 5322 group at the first `;`, including one inside a quoted display name or a comment. The text...

npm

No PRs yet

Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name

GHSA-85x2-q946-cp5h MODERATE about 5 hours ago

### Vulnerability summary addressparser ends an angle-addr at the first `>` it sees, including one inside a quoted local part, a comment or a doma...

npm

No PRs yet

fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding

GHSA-w74x-v6f9-j3xg CVE-2026-110306 MODERATE about 5 hours ago

### Impact `fast-uri` percent-decodes the scheme component with the legacy global `unescape()` before validating it, so an input whose decoded sch...

npm

2

Dependabot PRs

fast-uri vulnerable to improper path equivalence in relative reference normalization

GHSA-xhq7-xmqj-769h CVE-2026-110095 LOW about 5 hours ago

### Impact `fast-uri`'s `normalize()` and `serialize()` apply RFC 3986 dot-segment removal (`remove_dot_segments`) to the path of a relative-path ...

npm

2

Dependabot PRs

fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization

GHSA-wjr9-j795-jxcr CVE-2026-110180 MODERATE about 5 hours ago

### Impact `fast-uri` versions `>= 2.4.2, <= 2.4.7`, `>= 3.1.3, <= 3.1.8`, and `>= 4.0.1, <= 4.2.2` can silently rewrite the host of an HTTP-famil...

npm

2

Dependabot PRs

fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references

GHSA-333x-w4r6-6crp CVE-2026-110725 LOW about 5 hours ago

### Impact `fast-uri`'s `serialize()`, `normalize()`, and `resolve()`, when called with the non-default option `reference: 'suffix'` on a referenc...

npm

2

Dependabot PRs

SvelteKit: URL redirection to untrusted site via enhanced form submission

GHSA-pfhg-q3qv-9q6r CVE-2026-114060 LOW about 6 hours ago

### Impact Applications using enhanced form actions (`use:enhance`) on routes that accept paths beginning with `//`, such as catch-all routes, may ...

npm

No PRs yet

odf-kit has HTML injection leading to XSS in odsToHtml() via unescaped style attribute values

GHSA-2rqm-h6hv-g79v MODERATE about 6 hours ago

### Summary ODF style values are interpolated into `style="..."` attributes without HTML-escaping in odf-kit's ODS to-HTML renderer (`odsToHtml()`...

npm

No PRs yet

Electron: Mitigation for compromised eMudhra intermediate certificates

GHSA-jr5w-w6x2-84p9 CVE-2026-115570 HIGH about 6 hours ago

### Impact A set of eMudhra intermediate certificates were compromised and are being blocked by browsers and other TLS clients. This Electron upda...

npm

No PRs yet

body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body

GHSA-27r3-jxmh-p828 CVE-2026-111181 HIGH about 6 hours ago

### Impact A single request can crash any application using `body-parser` with default options. When a request carries a `Content-Encoding` (for e...

npm

1

Dependabot PRs

Strands Agents SDK: Exposure of data element to wrong session in the A2A Server

GHSA-4v6f-7vjh-6x4m CVE-2026-115419 HIGH about 6 hours ago

**Summary** Strands Agents SDK is an open-source SDK, available for Python (strands-agents) and TypeScript (@strands-agents/sdk), for building an...

npm pypi

No PRs yet

SvelteKit : XSS via untrusted cache-control header in prerendered page

GHSA-27mw-82g8-phjj CVE-2026-114061 LOW about 6 hours ago

### Impact Applications that prerender pages and use `setHeaders` to set a `cache-control` header from an untrusted source are vulnerable to cross...

npm

No PRs yet

obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes

GHSA-r3g7-r4hr-m258 CVE-2026-115478 HIGH about 8 hours ago

### Summary `create_entity`, `link_entities`, `rename_entity`, `unlink_entities` and `delete_entity` regenerate a memory note's body from SQLite at...

npm

No PRs yet

obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopback

GHSA-pqh8-4pj7-32xx CVE-2026-77363 CRITICAL about 8 hours ago

### Impact The Streamable HTTP transport was constructed without `enableDnsRebindingProtection`/`allowedHosts`/`allowedOrigins` and performed no `O...

npm

No PRs yet

obsidian-tc Bridge tools leak denied-note data via unfiltered sibling fields

GHSA-43r2-c7g8-prc8 CVE-2026-77362 MODERATE about 8 hours ago

### Impact Bridge tool results filtered only the `items` array against the read ACL and passed sibling fields through unfiltered: `tasks_filter` em...

npm

No PRs yet

obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTP

GHSA-737x-cwfr-5vvc CVE-2026-115477 HIGH about 9 hours ago

### Summary On a Streamable HTTP deployment with `auth.jwtSecret` configured, serving a 2026-07-28-era client that declared `elicitation.form` supp...

npm

No PRs yet

obsidian-tc tokens can access arbitrary configured vaults

GHSA-84c9-qqpq-2pq5 CVE-2026-77366 CRITICAL about 9 hours ago

### Impact Tool dispatch did not check the caller-supplied `input.vault` against the caller's bound vault (`ctx.vaultId`); the folder ACL was a sin...

npm

No PRs yet

obsidian-tc: Default folder ACL is fail-open; .obsidian plugin secrets are readable by default

GHSA-cvp8-vvgf-69q4 CVE-2026-77364 MODERATE about 9 hours ago

### Impact With a default configuration, an undefined `readPaths`/`writePaths` meant allow-all, the `strictReadDefault` flag was inert, and the `.o...

npm

No PRs yet

obsidian-tc : Symlink read-ACL scope bypass via lexical path checks

GHSA-c5xx-h28h-f682 CVE-2026-77361 MODERATE about 9 hours ago

### Impact ACL checks ran on the lexical vault-relative path while containment used the realpath. An in-vault symlink placed under an allowed glob,...

npm

No PRs yet

Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive

GHSA-vjh5-4x84-xrqp CVE-2026-114132 MODERATE 1 day ago

## Impact With the default `router.options.sensitive: false`, Nuxt's page router resolves routes case-insensitively, so `/Admin` renders the same ...

npm

No PRs yet

Nuxt server islands render `useHeadSafe` input without sanitisation

GHSA-xfq5-w38q-pc2x CVE-2026-114133 MODERATE 1 day ago

## Impact `useHeadSafe` restricts head input to an allowlist of safe tags and attributes. For example, `bodyAttrs` is limited to `class` and `styl...

npm

No PRs yet

Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled

GHSA-jjm6-p2m9-9w4x CVE-2026-114130 LOW 1 day ago

## Impact An application that renders `<NuxtLink :to="...">` with a value it does not control can be made to render an anchor whose `href` execute...

npm

No PRs yet

Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routes

GHSA-6gq8-jgmh-3ffp CVE-2026-114131 MODERATE 1 day ago

### Summary Nuxt compared `routeRules` keys against the raw request path, without decoding percent-encoding, while the router decodes parameters w...

npm

No PRs yet

Electron: SameSite cookie restrictions are not applied to windows opened from links

GHSA-2p8c-gr87-2676 CVE-2026-113796 MODERATE 1 day ago

### Impact Pages opened into a new window from a link were loaded as if the app itself had navigated there rather than the page that contained the...

npm

No PRs yet

Electron: Pointer lock permission requests can be attributed to the wrong frame

GHSA-x562-297c-g43g CVE-2026-113798 MODERATE 1 day ago

### Impact For `pointerLock` permission requests made from some cross-origin iframes, `session.setPermissionRequestHandler()` was given the top-lev...

npm

No PRs yet

Electron: Extension tabs.query returns tab URLs and titles without the tabs permission

GHSA-98mx-cjp9-gchm CVE-2026-113797 LOW 1 day ago

### Impact `chrome.tabs.query()` returned each tab's `url` and `title` to extensions that held neither the `tabs` permission nor matching host perm...

npm

No PRs yet

Electron: Frame subscription trusts GPU-supplied frame geometry

GHSA-3qxv-5xgr-q7w9 CVE-2026-114122 LOW 1 day ago

### Impact Frame data received from the GPU process for `webContents.beginFrameSubscription` was not fully validated by the main process. A comprom...

npm

No PRs yet

Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry

GHSA-h3v5-h239-pg29 CVE-2026-114124 LOW 1 day ago

### Impact In offscreen rendering mode on macOS, frame data received from the GPU process was not fully validated by the main process. A compromise...

npm

No PRs yet

Electron: openExternal permission requests can be attributed to the wrong origin

GHSA-997q-gvvc-jwmx CVE-2026-114121 MODERATE 1 day ago

### Impact Requests to open external protocol URLs could be attributed to a document other than the one that asked for them, so the `requestingUrl`...

npm

No PRs yet

Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays

GHSA-673q-mjm6-r5xr CRITICAL 1 day ago

## Impact A vulnerability in applications using App router with Cache Component can lead to remote code execution. The application needs to have a...

npm

15

Dependabot PRs

fastify is vulnerable to header validation bypass via case-sensitive propertyNames

GHSA-389g-gv7q-r4x8 CVE-2026-107832 LOW 1 day ago

### Impact Fastify lowercases header names in a `headers` schema before compilation, because Node.js stores request header names in lowercase. Thi...

npm

3

Dependabot PRs

toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype

GHSA-h895-cgqg-jf52 CVE-2026-114142 HIGH 1 day ago

### Summary CVE-2026-63376 described prototype pollution through __proto__ key-path desynchronization and was fixed in 4.1.2 by rewriting the path ...

npm

No PRs yet

toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()

GHSA-4qx8-w7c3-pj3p CVE-2026-114141 HIGH 1 day ago

## Summary `toml.parse()` is vulnerable to a quadratic-complexity (O(n²)) denial-of-service via many array-of-tables (`[[name]]`) headers. `addTab...

npm

No PRs yet

toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()

GHSA-9j65-hcg3-gc64 CVE-2026-114143 HIGH 1 day ago

## Summary `toml.parse()` is vulnerable to a quadratic-complexity (O(n²)) denial-of-service via a single long dotted key, table header, or inline-...

npm

No PRs yet

toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()

GHSA-9qmh-m7c6-f92p CVE-2026-114144 HIGH 1 day ago

### Summary `toml.parse()` converts integer literals (hex, octal, binary, and decimal) to `BigInt` without first bounding the length of the digit s...

npm

No PRs yet

Storybook dev server vulnerable to code injection from the local network

GHSA-px85-f4q5-jh77 CVE-2026-114126 HIGH 1 day ago

**Summary:** The Storybook dev server exposes its WebSocket authentication token to any client that can load its HTML pages. Any host on a LAN can ...

npm

6

Dependabot PRs

Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering

GHSA-98hj-9722-w3j8 CVE-2026-114128 MODERATE 1 day ago

## Summary Astro's JSX and MDX rendering pipeline treated string children of `<script>` and `<style>` elements as trusted HTML. When a dynamic val...

npm

No PRs yet

Astro: Arbitrary CSS injection in Astro View Transitions

GHSA-mpr7-6m5w-76rw CVE-2026-114127 LOW 1 day ago

### Summary Astro's server-side View Transition CSS generator did not keep string animation properties within their generated CSS declarations. In...

npm

1

Dependabot PRs

GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments

GHSA-c4qx-w738-7hr3 CVE-2026-114604 HIGH 1 day ago

## Report metadata | Field | Value | | --- | --- | | Package | `@graphql-tools/utils` (npm, `pkg:github/ardatan/graphql-tools`) | | Repository | h...

npm

No PRs yet