ag-psd can exhaust memory when parsing crafted PSD dimensions

GHSA-qfx6-q44v-9qqw CVE-2026-62297 HIGH about 4 hours ago

### Summary readPsd() commits the image/layer buffers from the declared header geometry (width x height x channels x depth, and per-layer rectangle...

npm

No PRs yet

SvelteKit: adapter-node crashes with an unhandled URIError when `reroute` rewrites malformed pathnames

GHSA-mw6w-2fmv-pvw3 CVE-2026-128117 MODERATE about 7 hours ago

When `reroute` turned an invalid percent-encoded path into a valid path, it could potentially trigger a comparison that would crash the server.

npm

No PRs yet

SvelteKit: Prerendered paths are interpreted as regular expressions in Vercel route config generated by @sveltejs/adapter-vercel and @sveltejs/adapter-static

GHSA-jf9x-2fg2-hx4w CVE-2026-128121 MODERATE about 7 hours ago

If an attacker could influence a link that was crawled during the prerender phase, that link could later be interpreted as a regex in the Vercel ro...

npm

No PRs yet

SvelteKit: Prerendered redirect paths can inject arbitrary rules into the `_redirects` file generated by `@sveltejs/adapter-cloudflare`

GHSA-5wg4-q3ww-283h CVE-2026-128122 MODERATE about 7 hours ago

If an attacker can influence the links crawled during prerendering, they can influence the redirects entries that are added to the Cloudflare platf...

npm

No PRs yet

SvelteKit: `@sveltejs/adapter-node` crashes when proxying certain requests via `fetch`

GHSA-rqw3-x7hx-mm3p CVE-2026-128123 MODERATE about 7 hours ago

In affected versions, `@sveltejs/adapter-node` can attempt to add a header to an immutable request in a context that causes the server to crash, de...

npm

No PRs yet

Nuxt: Incomplete fix for GHSA-9v7c-q64q-vv33: a leading `//` in the request path bypasses `server/middleware` path checks and server route rules on page routes

GHSA-r99w-jh2x-3mg9 CVE-2026-128077 MODERATE about 8 hours ago

### Summary Since `4.6.0`, Nuxt parses a request path that starts with `//` as a URL with a host before rendering a page, so `//x/admin` renders t...

npm

No PRs yet

OpenTelemetry JavaScript: Insertion of Sensitive Information into Log File and Exposure of Sensitive Information to an Unauthorized Actor in @opentelemetry/instrumentation-http

GHSA-3v2p-hm54-8qcq CVE-2026-128080 MODERATE about 8 hours ago

### Summary `@opentelemetry/instrumentation-http` redacts sensitive URL query parameters on **outgoing (client) spans** but not on **incoming (ser...

npm

No PRs yet

Astro: XSS via attribute injection in dynamic tag names

GHSA-mh32-jxcr-mh9f CVE-2026-126361 LOW about 9 hours ago

## Summary When a dynamic tag (`const Tag = ...; <Tag />`) resolves to a string, Astro renders it as a raw HTML element name. The name was filtere...

npm

No PRs yet

Astro: Image endpoint in @astrojs/node can read files from a case-variant sibling of the output directory on case-sensitive filesystems

GHSA-r3h5-4585-7x3w CVE-2026-126364 MODERATE about 9 hours ago

## Summary The `/_image` endpoint used by the `@astrojs/node` adapter checks that a requested local image is inside the build output directory bef...

npm

No PRs yet

Nuxt dev server serves files from a parent directory with a stray lockfile or workspace file

GHSA-mjrq-cffv-q4qc CVE-2026-128070 MODERATE about 9 hours ago

### Summary Nuxt can pick a parent directory that does not declare a workspace as its default `workspaceDir`: the farthest directory with a lockfi...

npm

No PRs yet

Hono: `csrf()` does not check requests sent by hyperlink auditing (`text/ping`)

GHSA-46wx-v44x-9hh2 CVE-2026-126355 MODERATE 1 day ago

### Summary `csrf()` validates a request only when its `Content-Type` is one of the three types an HTML form can send. Chromium's hyperlink auditi...

npm

6

Dependabot PRs

Hono: `validator('form')` skips validation for `multipart/form-data` requests with extra parameters

GHSA-4h7h-rv7c-7m2v CVE-2026-126356 MODERATE 1 day ago

### Summary `validator('form')` only recognizes a `multipart/form-data` `Content-Type` that carries nothing but a single `boundary` parameter. A r...

npm

30

Dependabot PRs

Hono: `mount()` and `app.mount()` can forward a path that bypasses middleware scoped inside the mount prefix

GHSA-4m76-xfj5-7975 CVE-2026-126357 MODERATE 1 day ago

### Summary `mount()` and `app.mount()` remove the mount prefix from the request path and forward the rest to the mounted application. Two mistake...

npm

6

Dependabot PRs

Hono: RegExpRouter skips wildcard middleware for some route sets and for paths with an encoded line terminator

GHSA-h7mg-cq63-vhpq CVE-2026-126358 MODERATE 1 day ago

### Summary RegExpRouter, which the default `SmartRouter` selects for most applications, skipped wildcard middleware in three cases, so a route ha...

npm

6

Dependabot PRs

Hono: `css` helper does not escape a closing tag split between the template and an interpolated value, allowing HTML injection

GHSA-3gg2-335m-rxc6 CVE-2026-126359 LOW 1 day ago

### Summary The `css` helper in `hono/css` escapes a `/` that follows `<` inside an interpolated value so that a value cannot close the `<style>` ...

npm

6

Dependabot PRs

@grpc/grpc-js: safe_regex incorrectly applies partial string matching for patterns with alternation

GHSA-r7hq-q2xm-6c5m CVE-2026-126367 MODERATE 1 day ago

### Summary The StringMatcher/PathMatcher for `safe_regex` builds its RE2 as `^${regex}$` with no surrounding group. Because alternation has the l...

npm

No PRs yet

@grpc/grpc-js: RBAC override configs in VirtualHost and Route resources are not applied

GHSA-gg5j-6742-v827 CVE-2026-128065 MODERATE 1 day ago

### Summary `XdsServer` in `@grpc/grpc-js-xds` does not apply `RBACPerRoute` overrides from matching Route or VirtualHost resources. When a truste...

npm

No PRs yet

Astro: Reflected XSS via unescaped slot names in @astrojs/solid-js

GHSA-jmv2-qgxf-f995 CVE-2026-126363 LOW 1 day ago

## Summary The `@astrojs/solid-js` renderer wraps named slot content passed to Solid components in an `<astro-slot>` element, and writes the slot ...

npm

No PRs yet

Astro: Reflected XSS via unescaped slot names in @astrojs/svelte

GHSA-f4j9-crrj-867q CVE-2026-126362 LOW 1 day ago

## Summary The `@astrojs/svelte` renderer wraps slotted content passed to Svelte components in an `<astro-slot>` element, and writes the slot name...

npm

No PRs yet

basic-ftp: Uncaught exception crashes the Node.js process when a password (or resumed-download path) contains CR/LF

GHSA-r4jh-29pc-gfqr CVE-2026-126346 MODERATE 1 day ago

### Summary Client.login() calls FTPContext.send() from inside the control-socket data event handler. send() throws on CR, LF or NUL, and nothing ...

npm

1

Dependabot PRs

basic-ftp: Uncaught TypeError in MLSD directory-listing parser via __proto__ fact name causes DoS in Client.list()

GHSA-5pm8-86m8-9m6r CVE-2026-126345 MODERATE 1 day ago

### Summary basic-ftp's MLSD directory-listing parser (src/parseListMLSD.ts) looks up fact-handler functions in a plain object literal keyed direc...

npm

3

Dependabot PRs

@hono/node-server: Unhandled `ECONNRESET` on the socket during an asynchronous WebSocket upgrade crashes the process

GHSA-qv5m-9pm6-hqp3 CVE-2026-126343 MODERATE 1 day ago

### Summary While `@hono/node-server` waits for the Hono application to handle a WebSocket upgrade request, the socket has no error listener. If t...

npm

30

Dependabot PRs

@hono/node-server: Backslash in the request path is parsed as a path separator, bypassing path-based access control at a reverse proxy

GHSA-jpvv-r467-5p4w CVE-2026-126210 MODERATE 1 day ago

### Summary `@hono/node-server` passes the raw request-target to the WHATWG URL parser, which treats a backslash in the path as `/` and then resol...

npm

33

Dependabot PRs

Signal K Server: Buffered logs exposed to unauthenticated WebSocket clients

GHSA-7m8x-x364-m26j MODERATE 1 day ago

### Summary An unauthenticated WebSocket client can subscribe to the log path and receive buffered server logs. WebSocket connections are intenti...

npm

No PRs yet

Microsoft Security Advisory CVE-2026-120792 - Aspire Information Disclosure Vulnerability

GHSA-q6jf-24jf-m3cg CVE-2026-120792 HIGH 3 days ago

## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in the Aspire CLI. This advisory p...

npm nuget

No PRs yet

Microsoft Security Advisory CVE-2026-120778 - Aspire Elevation of Privilege Vulnerability

GHSA-m63f-xhvm-6mv5 CVE-2026-120778 HIGH 3 days ago

## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in the Aspire CLI. This advisory p...

npm nuget

No PRs yet

React: Unauthenticated Remote Code Execution in React Server Components

GHSA-xqc2-xf4c-x3h3 CVE-2026-126187 CRITICAL 3 days ago

### Impact Crafted payloads targeting frameworks supporting React Server Components can lead to remote code execution. This only affects extremely...

npm

No PRs yet

Forge: Ed25519 signature verification accepts small-order public keys

GHSA-6889-vf6x-f3g5 CVE-2026-125335 LOW 3 days ago

### Summary `ed25519.verify()` does not reject public keys of small order, such as the identity point. Under such a key, a signature with `S = 0` a...

npm

No PRs yet

Forge: TLS client crash on an unsupported ServerHello compression method

GHSA-w4xr-hqv8-ch44 CVE-2026-125332 MODERATE 3 days ago

### Summary A `forge.tls` client accepts any compression method in the ServerHello, although it only offers no compression. An unknown method makes...

npm

13

Dependabot PRs

Forge: ReDoS in forge.http response header and cookie trimming

GHSA-6cv4-p8m7-4r25 CVE-2026-125333 MODERATE 3 days ago

`forge.http` trims response header and `Set-Cookie` values with the regular expression `/\s*$/`, which takes quadratic time on a long run of whites...

npm

13

Dependabot PRs

Forge: TLS client crash on a handshake record received without a session

GHSA-j8rw-jp99-435v CVE-2026-125334 MODERATE 3 days ago

### Summary A `forge.tls` client throws an uncaught `TypeError` from `connection.process()` when it receives a ServerHello while it has no session:...

npm

13

Dependabot PRs

fast-xml-parser: Quadratic CPU consumption scanning unterminated stop-node tags

GHSA-474x-hrwr-fgx4 CVE-2026-126066 LOW 3 days ago

### Summary With the non-default stopNodes option, a stop node's body with many "<a " fragments and no closing ">" anywhere after makes readStopNo...

npm

No PRs yet

Mongoose: Discriminator key values matching inherited properties (e.g. __t: 'constructor') bypass schema casting and can poison collections

GHSA-wr5m-5jph-8m96 CVE-2026-125116 MODERATE 3 days ago

### Summary Mongoose chooses which discriminator model or schema to use by looking up the discriminator key value (`__t` by default) in a plain ob...

npm

No PRs yet

Mongoose walks into inherited properties when hydrating, setting, and merging, allowing overwrites of built-in functions (denial of service) and shared schema state

GHSA-8332-j7wj-wjw4 CVE-2026-125117 HIGH 3 days ago

### Summary Three Mongoose code paths copy data into objects by property name without checking whether the property is the object's own or inherit...

npm

No PRs yet

Mongoose: Prototype pollution via Schema.prototype.virtual()

GHSA-6972-9mcm-vhwj CVE-2026-125118 MODERATE 3 days ago

### Summary Prototype pollution via Schema.prototype.virtual() — the 2022 fix for CVE-2022-2564 / CVE-2022-24304 protected Schema.path()/add() but...

npm

No PRs yet

Mongoose: Connection-level sanitizeFilter not applied

GHSA-gg4r-jv3p-qx3c CVE-2026-125119 HIGH 3 days ago

### Summary sanitizeFilter exists to stop query selector injection: it wraps operator objects such as `{ $ne: null }` in filter values in `$eq`, s...

npm

No PRs yet

Mongoose: sanitizeFilter not applied on countDocuments

GHSA-pcrw-h46h-c93h CVE-2026-125120 CRITICAL 3 days ago

### Impact `sanitizeFilter` is Mongoose's mechanism for protecting against query selector injection attacks. In older versions of Mongoose, `sanit...

npm

No PRs yet

NocoBase: @nocobase/plugin-action-custom-request allows server-side request forgery through runtime URL overrides

GHSA-wrr5-j383-f7h2 CVE-2026-79914 MODERATE 3 days ago

### Summary A Server-Side Request Forgery vulnerability exists in NocoBase v2.1.10 in the `@nocobase/plugin-action-custom-request` plugin. A low-...

npm

No PRs yet

OHIF Viewers: DOM-Based Cross Site Scripting (XSS) through MIME type of document

GHSA-xwgp-w3pj-q5h3 CVE-2026-118670 HIGH 3 days ago

### Summary An XSS (Cross-Site Scripting) vulnerability occurs when an attacker is able to inject their own JavaScript code into a web page's sourc...

npm

No PRs yet

Forge: Certificate signature verified with the issuer's RSA signature scheme

GHSA-9wg5-mj3p-v49q CVE-2026-118774 LOW 3 days ago

### Summary When verifying a certificate, node-forge chose the RSA padding scheme (PKCS#1 v1.5 or RSASSA-PSS) and PSS parameters from the issuer c...

npm

No PRs yet

Forge: Incomplete PKCS#7 padding validation in AES/DES CBC and ECB decryption

GHSA-2vgq-wchc-25w7 CVE-2026-118776 LOW 3 days ago

### Summary `decipher.finish()` in CBC and ECB mode accepted malformed PKCS#7 padding: only the last byte was checked, against a limit of four bloc...

npm

No PRs yet

Forge: X.509 pathLenConstraint not enforced by verifyCertificateChain() for CA certificates without keyUsage

GHSA-h46v-rmh6-fq4f CVE-2026-119189 MODERATE 3 days ago

### Summary `forge.pki.verifyCertificateChain()` enforces the `pathLenConstraint` of a CA certificate's `basicConstraints` extension only when that...

npm

No PRs yet

Forge: ASN.1 resource exhaustion via BIT STRING decoding in asn1.fromDer

GHSA-rhr8-3pm8-cq29 CVE-2026-119191 HIGH 3 days ago

### Summary `asn1.fromDer()` decodes the contents of BIT STRINGs as ASN.1 by default. That decode ignored the `maxDepth` recursion limit (an incomp...

npm

No PRs yet

Forge: RSA PKCS#1 v1.5 signature forgery via non-canonical DigestInfo encoding

GHSA-6qrw-m8cv-hcxf CVE-2026-119192 HIGH 3 days ago

### Summary RSASSA-PKCS1-v1_5 signature verification (`publicKey.verify()` with the default scheme, also used by X.509 certificate and PKCS#7 verif...

npm

1

Dependabot PRs

Effect: Cookie attribute injection via domain, path, and name fields in @effect/platform makeCookie()

GHSA-chp3-j5qr-2vfr CVE-2026-115779 MODERATE 3 days ago

### Impact The `name`, `domain`, and `path` fields of `makeCookie()` were validated with a regex that allows `;`, the attribute separator in `Set-...

npm

No PRs yet

Altair: DOM-based XSS via attacker-controlled script URLs in the iframe sandbox

GHSA-752m-7p75-49gf CVE-2026-110802 MODERATE 3 days ago

### Summary Altair `8.5.7` accepts plugin configuration directly from the `iframe-sandbox` query string. When `plugin_sandbox_opts` contains `type...

npm

No PRs yet

bitcoinjs-lib: Undetected merkle node duplication in block root computation validates a forged transaction list

GHSA-8vv3-6qpc-gpw6 CVE-2026-107846 CRITICAL 3 days ago

### Summary `fastMerkleRoot` pads an odd level by hashing the last node with itself. It does not report that it did so, and `checkTxRoots` never lo...

npm

No PRs yet

Nuxt Content: Unauthenticated SQLite Function DoS via Content Query API

GHSA-xxrh-5hgg-gj4h CVE-2026-102650 HIGH 3 days ago

### Summary The `POST /__nuxt_content/:collection/query` endpoint in `@nuxt/content` accepts an attacker-controlled `sql` field from the HTTP requ...

npm

No PRs yet

node-opcua: Namespace-Level RBAC Fail-Open - Anonymous Write/Call Bypass via Unbound `DefaultRolePermissions

GHSA-xggf-m53x-jc3f CVE-2026-95860 CRITICAL 3 days ago

## Summary An unauthenticated (**Anonymous**) client can **Write** protected Variables and **Call** privileged Methods on any Node that lacks expl...

npm

No PRs yet

Claude Code: TOCTOU Race in Edit Tool Allows File Writes Outside the Workspace

GHSA-5xjx-9qx6-jcrv CVE-2026-88968 HIGH 4 days ago

Claude Code validated Edit tool targets using point-in-time pathname and symlink resolution that was not bound to the underlying directory inodes o...

npm

No PRs yet