Changes

2026-10

• 

  sha.js: sha.js is missing type checks leading to hash rewind and passing on crafted data

  npm · sha.js✕security
  Quote

  “sha.js is missing type checks leading to hash rewind and passing on crafted data”

  osv.dev ›
• 

  sharp: sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591

  npm · sharp✕security
  Quote

  “sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591”

  osv.dev ›
• 

  sharp: sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545

  npm · sharp✕security
  Quote

  “sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545”

  osv.dev ›
• 

  sharp: sharp : Vulnerability in librsvg dependency CVE-2026-96889

  npm · sharp✕security
  Quote

  “sharp : Vulnerability in librsvg dependency CVE-2026-96889”

  osv.dev ›
• 

  shell-quote: shell-quote: `quote()` command injection via a line terminator in a token after a `{ comment }` token

  npm · shell-quote✕security
  Quote

  “shell-quote: quote() command injection via a line terminator in a token after a { comment } token”

  osv.dev ›
• 

  socket.io-parser: Socket.IO: Zero-attachment Memory Exhaustion

  npm · socket.io-parser✕security
  Quote

  “Socket.IO: Zero-attachment Memory Exhaustion”

  osv.dev ›
• 

  socket.io-parser: socket.io allows an unbounded number of binary attachments

  npm · socket.io-parser✕security
  Quote

  “socket.io allows an unbounded number of binary attachments”

  osv.dev ›
• 

  source-map-js: source-map-js allows event-loop denial of service through indexed source-map section offsets

  npm · source-map-js✕security
  Quote

  “source-map-js allows event-loop denial of service through indexed source-map section offsets”

  osv.dev ›
• 

  stream-json: stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS)

  npm · stream-json✕security
  Quote

  “stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS)”

  osv.dev ›
• 

  stream-json: stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk

  npm · stream-json✕security
  Quote

  “stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk”

  osv.dev ›
• 

  stream-json: stream-json has a prototype pollution issue: Assembler writes this.current[this.key] on plain objects

  npm · stream-json✕security
  Quote

  “stream-json has a prototype pollution issue: Assembler writes this.current[this.key] on plain objects”

  osv.dev ›
• 

  svgo: SVGO removeScripts plugin leaves some executable scripts intact

  npm · svgo✕security
  Quote

  “SVGO removeScripts plugin leaves some executable scripts intact”

  osv.dev ›
• 

  svgo: SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements

  npm · svgo✕security
  Quote

  “SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements”

  osv.dev ›
• 

  svgo: SVGO: removeScripts allows executable links through namespace and control-character bypasses

  npm · svgo✕security
  Quote

  “SVGO: removeScripts allows executable links through namespace and control-character bypasses”

  osv.dev ›
• 

  systeminformation: systeminformation vulnerable to Windows command injection in services() through Unicode quotation marks

  npm · systeminformation✕security
  Quote

  “systeminformation vulnerable to Windows command injection in services() through Unicode quotation marks”

  osv.dev ›
• 

  tar-fs: tar-fs can extract outside the specified dir with a specific tarball

  npm · tar-fs✕security
  Quote

  “tar-fs can extract outside the specified dir with a specific tarball”

  osv.dev ›
• 

  tar-fs: tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File

  npm · tar-fs✕security
  Quote

  “tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File”

  osv.dev ›
• 

  tar-fs: tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball

  npm · tar-fs✕security
  Quote

  “tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball”

  osv.dev ›
• 

  tar: node-tar: Decompression/parse DoS via unlimited input

  npm · tar✕security
  Quote

  “node-tar: Decompression/parse DoS via unlimited input”

  osv.dev ›
• 

  tar: node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal

  npm · tar✕security
  Quote

  “node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal”

  osv.dev ›
• 

  tar: Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction

  npm · tar✕security
  Quote

  “Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction”

  osv.dev ›
• 

  tar: node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization

  npm · tar✕security
  Quote

  “node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization”

  osv.dev ›
• 

  tar: node-tar: Negative tar entry size causes infinite loop in archive replace

  npm · tar✕security
  Quote

  “node-tar: Negative tar entry size causes infinite loop in archive replace”

  osv.dev ›
• 

  tar: node-tar Symlink Path Traversal via Drive-Relative Linkpath

  npm · tar✕security
  Quote

  “node-tar Symlink Path Traversal via Drive-Relative Linkpath”

  osv.dev ›
• 

  tar: Denial of service while parsing a tar file due to lack of folders count validation

  npm · tar✕security
  Quote

  “Denial of service while parsing a tar file due to lack of folders count validation”

  osv.dev ›
• 

  tar: node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records

  npm · tar✕security
  Quote

  “node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records”

  osv.dev ›
• 

  tar: tar has Hardlink Path Traversal via Drive-Relative Linkpath

  npm · tar✕security
  Quote

  “tar has Hardlink Path Traversal via Drive-Relative Linkpath”

  osv.dev ›
• 

  tar: node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection

  npm · tar✕security
  Quote

  “node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection”

  osv.dev ›
• 

  tar: Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS

  npm · tar✕security
  Quote

  “Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS”

  osv.dev ›
• 

  tar: node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)

  npm · tar✕security
  Quote

  “node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)”

  osv.dev ›
• 

  tar: node-tar: Process crash via PAX numeric path type confusion

  npm · tar✕security
  Quote

  “node-tar: Process crash via PAX numeric path type confusion”

  osv.dev ›
• 

  toml: toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()

  npm · toml✕security
  Quote

  “toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()”

  osv.dev ›
• 

  toml: toml-node: Uncontrolled Recursion

  npm · toml✕security
  Quote

  “toml-node: Uncontrolled Recursion”

  osv.dev ›
• 

  toml: toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()

  npm · toml✕security
  Quote

  “toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()”

  osv.dev ›
• 

  toml: toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()

  npm · toml✕security
  Quote

  “toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()”

  osv.dev ›
• 

  toml: toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype

  npm · toml✕security
  Quote

  “toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype”

  osv.dev ›
• 

  toml: toml-node: Prototype Pollution Leads to `Object.prototype` Corruption via `__proto__` Key-Path Desynchronization

  npm · toml✕security
  Quote

  “toml-node: Prototype Pollution Leads to Object.prototype Corruption via __proto__ Key-Path Desynchronization”

  osv.dev ›
• 

  underscore: Arbitrary Code Execution in underscore

  npm · underscore✕security
  Quote

  “Arbitrary Code Execution in underscore”

  osv.dev ›
• 

  underscore: Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack

  npm · underscore✕security
  Quote

  “Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack”

  osv.dev ›
• 

  undici: undici vulnerable to response truncation via oversized chunked responses in the dump interceptor

  npm · undici✕security
  Quote

  “undici vulnerable to response truncation via oversized chunked responses in the dump interceptor”

  osv.dev ›
• 

  undici: undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches

  npm · undici✕security
  Quote

  “undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches”

  osv.dev ›
• 

  undici: Undici has an HTTP Request/Response Smuggling issue

  npm · undici✕security
  Quote

  “Undici has an HTTP Request/Response Smuggling issue”

  osv.dev ›
• 

  undici: undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse

  npm · undici✕security
  Quote

  “undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse”

  osv.dev ›
• 

  undici: Undici proxy-authorization header not cleared on cross-origin redirect in fetch

  npm · undici✕security
  Quote

  “Undici proxy-authorization header not cleared on cross-origin redirect in fetch”

  osv.dev ›
• 

  undici: undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression

  npm · undici✕security
  Quote

  “undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression”

  osv.dev ›
• 

  undici: undici vulnerable to Denial of Service via unbounded decompression of compressed responses

  npm · undici✕security
  Quote

  “undici vulnerable to Denial of Service via unbounded decompression of compressed responses”

  osv.dev ›
• 

  undici: Undici has CRLF Injection in undici via `upgrade` option

  npm · undici✕security
  Quote

  “Undici has CRLF Injection in undici via upgrade option”

  osv.dev ›
• 

  undici: undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives

  npm · undici✕security
  Quote

  “undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives”

  osv.dev ›
• 

  undici: CRLF Injection in Nodejs ‘undici’ via host

  npm · undici✕security
  Quote

  “CRLF Injection in Nodejs ‘undici’ via host”

  osv.dev ›
• 

  undici: undici vulnerable to caching and replay of unsafe HTTP method responses

  npm · undici✕security
  Quote

  “undici vulnerable to caching and replay of unsafe HTTP method responses”

  osv.dev ›
• 

  undici: undici vulnerable to downstream response desynchronization via retry interceptor

  npm · undici✕security
  Quote

  “undici vulnerable to downstream response desynchronization via retry interceptor”

  osv.dev ›
• 

  undici: Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect

  npm · undici✕security
  Quote

  “Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect”

  osv.dev ›

2026-11

• 

  tmp: tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter

  npm · tmp✕security
  Quote

  “tmp allows arbitrary temporary file / directory write via symbolic link dir parameter”

  osv.dev ›
• 

  tmp: tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape

  npm · tmp✕security
  Quote

  “tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape”

  osv.dev ›
• 

  tough-cookie: tough-cookie Prototype Pollution vulnerability

  npm · tough-cookie✕security
  Quote

  “tough-cookie Prototype Pollution vulnerability”

  osv.dev ›
• 

  undici: undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent

  npm · undici✕security
  Quote

  “undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent”

  osv.dev ›
• 

  undici: undici vulnerable to Denial of Service via unbounded memory in the EventSource parser

  npm · undici✕security
  Quote

  “undici vulnerable to Denial of Service via unbounded memory in the EventSource parser”

  osv.dev ›
• 

  undici: undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects

  npm · undici✕security
  Quote

  “undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects”

  osv.dev ›
• 

  undici: undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor

  npm · undici✕security
  Quote

  “undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor”

  osv.dev ›
• 

  undici: undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering

  npm · undici✕security
  Quote

  “undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering”

  osv.dev ›