Changes

2026-10

• 

  axios: Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream

  npm · axios✕security
  Quote

  “Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream”

  osv.dev ›
• 

  axios: Axios is vulnerable to DoS attack through lack of data size check

  npm · axios✕security
  Quote

  “Axios is vulnerable to DoS attack through lack of data size check”

  osv.dev ›
• 

  axios: Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0

  npm · axios✕security
  Quote

  “Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0”

  osv.dev ›
• 

  axios: Axios: unbounded recursion in toFormData causes DoS via deeply nested request data

  npm · axios✕security
  Quote

  “Axios: unbounded recursion in toFormData causes DoS via deeply nested request data”

  osv.dev ›
• 

  axios: Axios: Header Injection via Prototype Pollution

  npm · axios✕security
  Quote

  “Axios: Header Injection via Prototype Pollution”

  osv.dev ›
• 

  axios: Axios: Nested axios option objects can consume polluted prototype values

  npm · axios✕security
  Quote

  “Axios: Nested axios option objects can consume polluted prototype values”

  osv.dev ›
• 

  axios: axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions

  npm · axios✕security
  Quote

  “axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions”

  osv.dev ›
• 

  axios: Server-Side Request Forgery in axios

  npm · axios✕security
  Quote

  “Server-Side Request Forgery in axios”

  osv.dev ›
• 

  axios: Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method

  npm · axios✕security
  Quote

  “Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method”

  osv.dev ›
• 

  axios: Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain

  npm · axios✕security
  Quote

  “Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain”

  osv.dev ›
• 

  axios: Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection

  npm · axios✕security
  Quote

  “Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection”

  osv.dev ›
• 

  axios: Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection

  npm · axios✕security
  Quote

  “Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection”

  osv.dev ›
• 

  axios: Axios: Header Injection via Inherited headers After Minimal Interceptor

  npm · axios✕security
  Quote

  “Axios: Header Injection via Inherited headers After Minimal Interceptor”

  osv.dev ›
• 

  axios: axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL

  npm · axios✕security
  Quote

  “axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL”

  osv.dev ›
• 

  axios: Axios: no_proxy bypass via IP alias allows SSRF

  npm · axios✕security
  Quote

  “Axios: no_proxy bypass via IP alias allows SSRF”

  osv.dev ›
• 

  axios: Axios: Prototype pollution gadgets can alter axios request construction

  npm · axios✕security
  Quote

  “Axios: Prototype pollution gadgets can alter axios request construction”

  osv.dev ›
• 

  axios: Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter

  npm · axios✕security
  Quote

  “Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter”

  osv.dev ›
• 

  axios: Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking

  npm · axios✕security
  Quote

  “Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking”

  osv.dev ›
• 

  axios: axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)

  npm · axios✕security
  Quote

  “axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)”

  osv.dev ›
• 

  axios: Axios: Deep formToJSON Key Recursion Can Cause Denial of Service

  npm · axios✕security
  Quote

  “Axios: Deep formToJSON Key Recursion Can Cause Denial of Service”

  osv.dev ›
• 

  axios: Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0

  npm · axios✕security
  Quote

  “Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0”

  osv.dev ›
• 

  axios: Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking

  npm · axios✕security
  Quote

  “Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking”

  osv.dev ›
• 

  axios: Axios: HTTP adapter streamed responses bypass maxContentLength

  npm · axios✕security
  Quote

  “Axios: HTTP adapter streamed responses bypass maxContentLength”

  osv.dev ›
• 

  axios: Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy

  npm · axios✕security
  Quote

  “Axios: Authentication Bypass via Prototype Pollution Gadget in validateStatus Merge Strategy”

  osv.dev ›
• 

  axios: Axios Cross-Site Request Forgery Vulnerability

  npm · axios✕security
  Quote

  “Axios Cross-Site Request Forgery Vulnerability”

  osv.dev ›
• 

  axios: Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams

  npm · axios✕security
  Quote

  “Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams”

  osv.dev ›
• 

  axios: Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion

  npm · axios✕security
  Quote

  “Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in withXSRFToken Boolean Coercion”

  osv.dev ›
• 

  babel-traverse: Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code

  npm · babel-traverse✕security
  Quote

  “Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code”

  osv.dev ›
• 

  base-x: Homograph attack allows Unicode lookalike characters to bypass validation.

  npm · base-x✕security
  Quote

  “Homograph attack allows Unicode lookalike characters to bypass validation.”

  osv.dev ›
• 

  baseline-browser-mapping: baseline-browser-mapping process termination on invalid input causes denial of service

  npm · baseline-browser-mapping✕security
  Quote

  “baseline-browser-mapping process termination on invalid input causes denial of service”

  osv.dev ›
• 

  better-auth: @better-auth/drizzle-adapter: Concurrent requests can exceed rate limits on PostgreSQL

  npm · better-auth✕security
  Quote

  “@better-auth/drizzle-adapter: Concurrent requests can exceed rate limits on PostgreSQL”

  osv.dev ›
• 

  better-auth: better-auth: OAuth state can be used as a Magic Link to sign in as another user

  npm · better-auth✕security
  Quote

  “better-auth: OAuth state can be used as a Magic Link to sign in as another user”

  osv.dev ›
• 

  better-auth: better-auth: OAuth Proxy lets an attacker sign in as another user

  npm · better-auth✕security
  Quote

  “better-auth: OAuth Proxy lets an attacker sign in as another user”

  osv.dev ›
• 

  bigint-buffer: bigint-buffer Vulnerable to Buffer Overflow via toBigIntLE() Function

  npm · bigint-buffer✕security
  Quote

  “bigint-buffer Vulnerable to Buffer Overflow via toBigIntLE() Function”

  osv.dev ›
• 

  bn.js: bn.js affected by an infinite loop

  npm · bn.js✕security
  Quote

  “bn.js affected by an infinite loop”

  osv.dev ›
• 

  body-parser: body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body

  npm · body-parser✕security
  Quote

  “body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body”

  osv.dev ›
• 

  body-parser: body-parser vulnerable to denial of service when url encoding is enabled

  npm · body-parser✕security
  Quote

  “body-parser vulnerable to denial of service when url encoding is enabled”

  osv.dev ›
• 

  body-parser: body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement

  npm · body-parser✕security
  Quote

  “body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement”

  osv.dev ›
• 

  braces: Uncontrolled resource consumption in braces

  npm · braces✕security
  Quote

  “Uncontrolled resource consumption in braces”

  osv.dev ›
• 

  browserify-sign: browserify-sign upper bound check issue in `dsaVerify` leads to a signature forgery attack

  npm · browserify-sign✕security
  Quote

  “browserify-sign upper bound check issue in dsaVerify leads to a signature forgery attack”

  osv.dev ›
• 

  cipher-base: cipher-base is missing type checks, leading to hash rewind and passing on crafted data

  npm · cipher-base✕security
  Quote

  “cipher-base is missing type checks, leading to hash rewind and passing on crafted data”

  osv.dev ›
• 

  colord: Colord: Slow rejection of oversized malformed color strings

  npm · colord✕security
  Quote

  “Colord: Slow rejection of oversized malformed color strings”

  osv.dev ›
• 

  cookie: cookie accepts cookie name, path, and domain with out of bounds characters

  npm · cookie✕security
  Quote

  “cookie accepts cookie name, path, and domain with out of bounds characters”

  osv.dev ›
• 

  crypto-js: crypto-js PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard

  npm · crypto-js✕security
  Quote

  “crypto-js PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard”

  osv.dev ›
• 

  decode-uri-component: decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs

  npm · decode-uri-component✕security
  Quote

  “decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs”

  osv.dev ›
• 

  decode-uri-component: decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input

  npm · decode-uri-component✕security
  Quote

  “decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input”

  osv.dev ›
• 

  decode-uri-component: decode-uri-component vulnerable to Denial of Service (DoS)

  npm · decode-uri-component✕security
  Quote

  “decode-uri-component vulnerable to Denial of Service (DoS)”

  osv.dev ›
• 

  deep-object-diff: deep-object-diff vulnerable to Prototype Pollution

  npm · deep-object-diff✕security
  Quote

  “deep-object-diff vulnerable to Prototype Pollution”

  osv.dev ›

2026-11

• 

  brace-expansion: brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups

  npm · brace-expansion✕security
  Quote

  “brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups”

  osv.dev ›
• 

  brace-expansion: brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion

  npm · brace-expansion✕security
  Quote

  “brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion”

  osv.dev ›
• 

  brace-expansion: brace-expansion: Zero-step sequence causes process hang and memory exhaustion

  npm · brace-expansion✕security
  Quote

  “brace-expansion: Zero-step sequence causes process hang and memory exhaustion”

  osv.dev ›
• 

  brace-expansion: brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash

  npm · brace-expansion✕security
  Quote

  “brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash”

  osv.dev ›
• 

  brace-expansion: brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service

  npm · brace-expansion✕security
  Quote

  “brace-expansion: Quadratic-time expansion of the {a},b} rewrite causes CPU denial of service”

  osv.dev ›
• 

  brace-expansion: brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion

  npm · brace-expansion✕security
  Quote

  “brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion”

  osv.dev ›
• 

  brace-expansion: brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

  npm · brace-expansion✕security
  Quote

  “brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation”

  osv.dev ›
• 

  brace-expansion: brace-expansion Regular Expression Denial of Service vulnerability

  npm · brace-expansion✕security
  Quote

  “brace-expansion Regular Expression Denial of Service vulnerability”

  osv.dev ›
• 

  browserslist: Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)

  npm · browserslist✕security
  Quote

  “Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)”

  osv.dev ›
• 

  browserslist: Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM

  npm · browserslist✕security
  Quote

  “Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM”

  osv.dev ›
• 

  cross-spawn: Regular Expression Denial of Service (ReDoS) in cross-spawn

  npm · cross-spawn✕security
  Quote

  “Regular Expression Denial of Service (ReDoS) in cross-spawn”

  osv.dev ›
• 

  debug: Regular Expression Denial of Service in debug

  npm · debug✕security
  Quote

  “Regular Expression Denial of Service in debug”

  osv.dev ›