Microsoft Security Advisory CVE-2026-120792 - Aspire Information Disclosure Vulnerability

GHSA-q6jf-24jf-m3cg CVE-2026-120792 HIGH 1 day ago

## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in the Aspire CLI. This advisory p...

npm nuget

No PRs yet

Microsoft Security Advisory CVE-2026-120778 - Aspire Elevation of Privilege Vulnerability

GHSA-m63f-xhvm-6mv5 CVE-2026-120778 HIGH 1 day ago

## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in the Aspire CLI. This advisory p...

npm nuget

No PRs yet

React: Unauthenticated Remote Code Execution in React Server Components

GHSA-xqc2-xf4c-x3h3 CVE-2026-126187 CRITICAL 1 day ago

### Impact Crafted payloads targeting frameworks supporting React Server Components can lead to remote code execution. This only affects extremely...

npm

No PRs yet

Forge: Ed25519 signature verification accepts small-order public keys

GHSA-6889-vf6x-f3g5 CVE-2026-125335 LOW 1 day ago

### Summary `ed25519.verify()` does not reject public keys of small order, such as the identity point. Under such a key, a signature with `S = 0` a...

npm

No PRs yet

Forge: TLS client crash on an unsupported ServerHello compression method

GHSA-w4xr-hqv8-ch44 CVE-2026-125332 MODERATE 1 day ago

### Summary A `forge.tls` client accepts any compression method in the ServerHello, although it only offers no compression. An unknown method makes...

npm

3

Dependabot PRs

Forge: ReDoS in forge.http response header and cookie trimming

GHSA-6cv4-p8m7-4r25 CVE-2026-125333 MODERATE 1 day ago

`forge.http` trims response header and `Set-Cookie` values with the regular expression `/\s*$/`, which takes quadratic time on a long run of whites...

npm

3

Dependabot PRs

Forge: TLS client crash on a handshake record received without a session

GHSA-j8rw-jp99-435v CVE-2026-125334 MODERATE 1 day ago

### Summary A `forge.tls` client throws an uncaught `TypeError` from `connection.process()` when it receives a ServerHello while it has no session:...

npm

3

Dependabot PRs

fast-xml-parser: Quadratic CPU consumption scanning unterminated stop-node tags

GHSA-474x-hrwr-fgx4 CVE-2026-126066 LOW 1 day ago

### Summary With the non-default stopNodes option, a stop node's body with many "<a " fragments and no closing ">" anywhere after makes readStopNo...

npm

No PRs yet

Mongoose: Discriminator key values matching inherited properties (e.g. __t: 'constructor') bypass schema casting and can poison collections

GHSA-wr5m-5jph-8m96 CVE-2026-125116 MODERATE 1 day ago

### Summary Mongoose chooses which discriminator model or schema to use by looking up the discriminator key value (`__t` by default) in a plain ob...

npm

No PRs yet

Mongoose walks into inherited properties when hydrating, setting, and merging, allowing overwrites of built-in functions (denial of service) and shared schema state

GHSA-8332-j7wj-wjw4 CVE-2026-125117 HIGH 1 day ago

### Summary Three Mongoose code paths copy data into objects by property name without checking whether the property is the object's own or inherit...

npm

No PRs yet

Mongoose: Prototype pollution via Schema.prototype.virtual()

GHSA-6972-9mcm-vhwj CVE-2026-125118 MODERATE 1 day ago

### Summary Prototype pollution via Schema.prototype.virtual() — the 2022 fix for CVE-2022-2564 / CVE-2022-24304 protected Schema.path()/add() but...

npm

No PRs yet

Mongoose: Connection-level sanitizeFilter not applied

GHSA-gg4r-jv3p-qx3c CVE-2026-125119 HIGH 1 day ago

### Summary sanitizeFilter exists to stop query selector injection: it wraps operator objects such as `{ $ne: null }` in filter values in `$eq`, s...

npm

No PRs yet

Mongoose: sanitizeFilter not applied on countDocuments

GHSA-pcrw-h46h-c93h CVE-2026-125120 CRITICAL 1 day ago

### Impact `sanitizeFilter` is Mongoose's mechanism for protecting against query selector injection attacks. In older versions of Mongoose, `sanit...

npm

No PRs yet

NocoBase: @nocobase/plugin-action-custom-request allows server-side request forgery through runtime URL overrides

GHSA-wrr5-j383-f7h2 CVE-2026-79914 MODERATE 1 day ago

### Summary A Server-Side Request Forgery vulnerability exists in NocoBase v2.1.10 in the `@nocobase/plugin-action-custom-request` plugin. A low-...

npm

No PRs yet

OHIF Viewers: DOM-Based Cross Site Scripting (XSS) through MIME type of document

GHSA-xwgp-w3pj-q5h3 CVE-2026-118670 HIGH 1 day ago

### Summary An XSS (Cross-Site Scripting) vulnerability occurs when an attacker is able to inject their own JavaScript code into a web page's sourc...

npm

No PRs yet

Forge: Certificate signature verified with the issuer's RSA signature scheme

GHSA-9wg5-mj3p-v49q CVE-2026-118774 LOW 1 day ago

### Summary When verifying a certificate, node-forge chose the RSA padding scheme (PKCS#1 v1.5 or RSASSA-PSS) and PSS parameters from the issuer c...

npm

No PRs yet

Forge: Incomplete PKCS#7 padding validation in AES/DES CBC and ECB decryption

GHSA-2vgq-wchc-25w7 CVE-2026-118776 LOW 1 day ago

### Summary `decipher.finish()` in CBC and ECB mode accepted malformed PKCS#7 padding: only the last byte was checked, against a limit of four bloc...

npm

No PRs yet

Forge: X.509 pathLenConstraint not enforced by verifyCertificateChain() for CA certificates without keyUsage

GHSA-h46v-rmh6-fq4f CVE-2026-119189 MODERATE 1 day ago

### Summary `forge.pki.verifyCertificateChain()` enforces the `pathLenConstraint` of a CA certificate's `basicConstraints` extension only when that...

npm

No PRs yet

Forge: ASN.1 resource exhaustion via BIT STRING decoding in asn1.fromDer

GHSA-rhr8-3pm8-cq29 CVE-2026-119191 HIGH 1 day ago

### Summary `asn1.fromDer()` decodes the contents of BIT STRINGs as ASN.1 by default. That decode ignored the `maxDepth` recursion limit (an incomp...

npm

No PRs yet

Forge: RSA PKCS#1 v1.5 signature forgery via non-canonical DigestInfo encoding

GHSA-6qrw-m8cv-hcxf CVE-2026-119192 HIGH 1 day ago

### Summary RSASSA-PKCS1-v1_5 signature verification (`publicKey.verify()` with the default scheme, also used by X.509 certificate and PKCS#7 verif...

npm

1

Dependabot PRs

Effect: Cookie attribute injection via domain, path, and name fields in @effect/platform makeCookie()

GHSA-chp3-j5qr-2vfr CVE-2026-115779 MODERATE 1 day ago

### Impact The `name`, `domain`, and `path` fields of `makeCookie()` were validated with a regex that allows `;`, the attribute separator in `Set-...

npm

No PRs yet

Altair: DOM-based XSS via attacker-controlled script URLs in the iframe sandbox

GHSA-752m-7p75-49gf CVE-2026-110802 MODERATE 1 day ago

### Summary Altair `8.5.7` accepts plugin configuration directly from the `iframe-sandbox` query string. When `plugin_sandbox_opts` contains `type...

npm

No PRs yet

bitcoinjs-lib: Undetected merkle node duplication in block root computation validates a forged transaction list

GHSA-8vv3-6qpc-gpw6 CVE-2026-107846 CRITICAL 1 day ago

### Summary `fastMerkleRoot` pads an odd level by hashing the last node with itself. It does not report that it did so, and `checkTxRoots` never lo...

npm

No PRs yet

Nuxt Content: Unauthenticated SQLite Function DoS via Content Query API

GHSA-xxrh-5hgg-gj4h CVE-2026-102650 HIGH 1 day ago

### Summary The `POST /__nuxt_content/:collection/query` endpoint in `@nuxt/content` accepts an attacker-controlled `sql` field from the HTTP requ...

npm

No PRs yet

node-opcua: Namespace-Level RBAC Fail-Open - Anonymous Write/Call Bypass via Unbound `DefaultRolePermissions

GHSA-xggf-m53x-jc3f CVE-2026-95860 CRITICAL 1 day ago

## Summary An unauthenticated (**Anonymous**) client can **Write** protected Variables and **Call** privileged Methods on any Node that lacks expl...

npm

No PRs yet

Claude Code: TOCTOU Race in Edit Tool Allows File Writes Outside the Workspace

GHSA-5xjx-9qx6-jcrv CVE-2026-88968 HIGH 2 days ago

Claude Code validated Edit tool targets using point-in-time pathname and symlink resolution that was not bound to the underlying directory inodes o...

npm

No PRs yet

Moleculer: Unauthenticated Denial of Service via negative length field in the TCP transporter packet parser

GHSA-h89v-g948-47vp CVE-2026-97705 HIGH 2 days ago

### Summary The TCP transporter's packet parser (`src/transporters/tcp/parser.js`) reads the packet length field with `Buffer.prototype.readInt32B...

npm

No PRs yet

tsParticles: A single anonymous MCP session can monopolize HTTP mode and deny new clients

GHSA-h7c4-q426-7jh9 CVE-2026-76893 MODERATE 2 days ago

## Summary The HTTP mode of `@tsparticles/mcp-server` creates a single stateful `StreamableHTTPServerTransport` instance and reuses it for all cli...

npm

No PRs yet

tsParticles: Malformed JSON requests can terminate the @tsparticles/mcp-server HTTP process

GHSA-4p8p-pjpq-2w7h CVE-2026-76892 HIGH 2 days ago

## Summary The HTTP mode of `@tsparticles/mcp-server` parses incoming `/mcp` request bodies with `JSON.parse()` outside a request-local error boun...

npm

No PRs yet

tsParticles: Unbounded HTTP Request Body Buffering in @tsparticles/mcp-server Leads to Remote DoS

GHSA-447x-qqwf-m7xq CVE-2026-63655 HIGH 2 days ago

### Summary The HTTP server mode of `@tsparticles/mcp-server` accumulates all incoming request body chunks into an in-memory `Buffer[]` array with...

npm

No PRs yet

ag-psd: Uncontrolled Memory Allocation in PSD Layer Decoding (totalMemoryLimit bypass)

GHSA-6w3r-6hpr-hp6p CVE-2026-63501 HIGH 2 days ago

### Summary The `readPsd()` function in `ag-psd` accepts a `totalMemoryLimit` option to cap memory usage when parsing untrusted PSD files, but this...

npm

No PRs yet

isomorphic-git: Path traversal via a ".." tree-entry name writes files outside the working directory on clone/checkout

GHSA-cw2g-2vwq-88w6 CVE-2026-63478 MODERATE 2 days ago

### Summary isomorphic-git's tree parser (`src/models/GitTree.js`) validates each entry name only against the path separators `/` and `\`. It does ...

npm

No PRs yet

isomorphic-git: Circular symbolic references cause non-terminating resolution (DoS)

GHSA-96wc-2m84-2cj7 CVE-2026-63475 MODERATE 2 days ago

### Summary A malicious server can advertise circular `symref=` capabilities (e.g. `a → b` and `b → a`). isomorphic-git writes them to disk as loos...

npm

No PRs yet

isomorphic-git: Arbitrary file write outside of working tree via directory symlink during checkout (potential RCE)

GHSA-9qw7-j9xw-fv9c CVE-2026-63395 HIGH 2 days ago

### Summary `git.checkout` writes working-tree files through a directory **symlink** without checking the leading path, so a malicious repository c...

npm

No PRs yet

filecoin-pin: Unbounded DAG pinning can exhaust server resources

GHSA-m5ph-mmg5-6w5h CVE-2026-62300 MODERATE 6 days ago

## Summary The IPFS Pinning Service API implementation accepts a caller-controlled CID through `POST /pins`, queues background processing, and the...

npm

No PRs yet

@payloadcms/storage-vercel-blob has access control bypass of uploads in Vercel Storage adapter

GHSA-mc8m-rr6c-r5qr CVE-2026-93363 MODERATE 7 days ago

### Impact In affected configurations, client upload access does not consistently align with the associated collection’s access configuration. You...

npm

No PRs yet

odf-kit: HTML injection leading to XSS in odtToHtml() and odsToHtml() via unescaped style attribute values

GHSA-3cgg-c5pp-57h6 CVE-2026-113787 MODERATE 7 days ago

### Summary ODF style attribute values are interpolated into `style="..."` attributes without HTML-escaping in **both** of odf-kit's to-HTML rende...

npm

No PRs yet

Elo JavaScript emitter has sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access

GHSA-33r5-xmm8-v6x5 CVE-2026-44267 CRITICAL 8 days ago

### Summary An unauthenticated attacker who controls a string passed to any Elo JavaScript-emission path — `defaultFormats.elo.parse()`, the `bin/...

npm

No PRs yet

Elo Ruby backend has Remote Code Execution via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels

GHSA-7w38-ggh5-v542 CVE-2026-44266 CRITICAL 8 days ago

### Summary Elo's Ruby backend emits attacker-controlled text into Ruby double-quoted strings without escaping the `#` character. Because `#` begi...

npm

No PRs yet

Elo backends have code injection via unvalidated emission of programmatic AST fields

GHSA-x9rp-7wh3-2rj5 CVE-2026-44265 HIGH 8 days ago

### Summary Elo's programmatic AST API accepts arbitrary values in many node fields without runtime type or syntax validation. Each backend's emit...

npm

No PRs yet

DBHub: MySQL and MariaDB comment interpretation bypasses read-only SQL validation

GHSA-j656-3hf2-fvjc MODERATE 9 days ago

The read-only mode can be bypassed on the MySQL and MariaDB connectors. In read-only mode a caller can still execute arbitrary write and DDL statem...

npm

No PRs yet

SD JWT JS: Tampered disclosures silently dropped instead of rejected

GHSA-f9j6-8p6x-r9j6 CVE-2026-62374 HIGH 9 days ago

## Summary When one Disclosure in an SD-JWT presentation is tampered so its digest no longer matches the Issuer-signed `_sd` array, `@sd-jwt/decod...

npm

No PRs yet

joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service

GHSA-4528-x5fx-h6hg CVE-2026-118772 HIGH 12 days ago

### Summary `Joi.string().email({ multiple: true })` takes quadratic time to split a value that contains a long run of whitespace. One request wit...

npm

1

Dependabot PRs

@hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service

GHSA-8494-f6mr-cjpv CVE-2026-119202 HIGH 12 days ago

### Summary `Content.disposition()` takes quadratic time when a `Content-Disposition` parameter contains a long token without `=`. One unauthentic...

npm

No PRs yet

minimatch has potential denial of service via globparts amplification

GHSA-g3hv-75wg-m249 CVE-2026-118764 MODERATE 12 days ago

minimatch 10.2.6 contains an attacker-controlled pattern amplification in firstPhasePreProcess() when optimizationLevel >= 2. researcher: Reid Dow...

npm

4

Dependabot PRs

Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal

GHSA-3g3m-2fjr-6pw4 CVE-2026-118773 MODERATE 12 days ago

### Summary In glob 13.0.6, an aborted async walk rejects or emits an error but continues recursively reading directories in the background. The ...

npm

1

Dependabot PRs

Forge: ASN.1 OID first arc truncation in asn1.oidToDer

GHSA-4642-5mcj-2rqw CVE-2026-118775 LOW 12 days ago

### Summary `asn1.oidToDer()` did not range-check the first two arcs of an OID string, so an OID such as `0.42.840.113549.1.1.1` or `4294977127.18...

npm

No PRs yet

Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie

GHSA-6wvx-3r32-xmcg CVE-2026-118777 MODERATE 12 days ago

### Summary The `forge.http` client stored cookies from `Set-Cookie` response headers in a plain object keyed by cookie name and path. A malicious ...

npm

No PRs yet

Forge: TLS client crash when the server sends no certificate

GHSA-525v-9gp9-w22h CVE-2026-118778 MODERATE 12 days ago

### Summary The forge TLS client's check for a missing server certificate read the wrong property and never ran. A malicious TLS server, or an on-p...

npm

No PRs yet

Forge: Regular expression denial of service in PEM decoding (pem.decode)

GHSA-7wch-p9px-956x CVE-2026-118779 HIGH 12 days ago

### Summary `pem.decode()`, which every node-forge API that parses PEM input uses, split messages with a regular expression that takes polynomial t...

npm

14

Dependabot PRs