Changes

2026-10

• 

  undici: Use of Insufficiently Random Values in undici

  npm · undici✕security
  Quote

  “Use of Insufficiently Random Values in undici”

  osv.dev ›
• 

  undici: undici Denial of Service attack via bad certificate data

  npm · undici✕security
  Quote

  “undici Denial of Service attack via bad certificate data”

  osv.dev ›
• 

  undici: Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client

  npm · undici✕security
  Quote

  “Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client”

  osv.dev ›
• 

  undici: undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching

  npm · undici✕security
  Quote

  “undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching”

  osv.dev ›
• 

  undici: Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion

  npm · undici✕security
  Quote

  “Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion”

  osv.dev ›
• 

  undici: undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives

  npm · undici✕security
  Quote

  “undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives”

  osv.dev ›
• 

  undici: Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline

  npm · undici✕security
  Quote

  “Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline”

  osv.dev ›
• 

  undici: undici vulnerable to CRLF Injection via blob-like body 'type' property

  npm · undici✕security
  Quote

  “undici vulnerable to CRLF Injection via blob-like body 'type' property”

  osv.dev ›
• 

  undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding

  npm · undici✕security
  Quote

  “undici vulnerable to HTTP header injection via Set-Cookie percent-decoding”

  osv.dev ›
• 

  undici: undici vulnerable to Denial of Service via orphaned RetryHandler response body

  npm · undici✕security
  Quote

  “undici vulnerable to Denial of Service via orphaned RetryHandler response body”

  osv.dev ›
• 

  undici: undici vulnerable to downstream response splitting via retry interceptor

  npm · undici✕security
  Quote

  “undici vulnerable to downstream response splitting via retry interceptor”

  osv.dev ›
• 

  undici: Regular Expression Denial of Service in Headers

  npm · undici✕security
  Quote

  “Regular Expression Denial of Service in Headers”

  osv.dev ›
• 

  undici: undici vulnerable to Denial of Service via unrequested WebSocket subprotocol

  npm · undici✕security
  Quote

  “undici vulnerable to Denial of Service via unrequested WebSocket subprotocol”

  osv.dev ›
• 

  undici: undici vulnerable to Denial of Service via WebSocketStream unclean close

  npm · undici✕security
  Quote

  “undici vulnerable to Denial of Service via WebSocketStream unclean close”

  osv.dev ›
• 

  undici: undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields

  npm · undici✕security
  Quote

  “undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields”

  osv.dev ›
• 

  undici: Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation

  npm · undici✕security
  Quote

  “Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation”

  osv.dev ›
• 

  undici: Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression

  npm · undici✕security
  Quote

  “Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression”

  osv.dev ›
• 

  undici: undici WebSocket client vulnerable to denial of service via fragment count bypass

  npm · undici✕security
  Quote

  “undici WebSocket client vulnerable to denial of service via fragment count bypass”

  osv.dev ›
• 

  undici: undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool

  npm · undici✕security
  Quote

  “undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool”

  osv.dev ›
• 

  undici: Undici's cookie header not cleared on cross-origin redirect in fetch

  npm · undici✕security
  Quote

  “Undici's cookie header not cleared on cross-origin redirect in fetch”

  osv.dev ›
• 

  vite: Vite has an `server.fs.deny` bypass with an invalid `request-target`

  npm · vite✕security
  Quote

  “Vite has an server.fs.deny bypass with an invalid request-target”

  osv.dev ›
• 

  vite: Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query

  npm · vite✕security
  Quote

  “Vite has a server.fs.deny bypassed for inline and raw with ?import query”

  osv.dev ›
• 

  vite: Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling

  npm · vite✕security
  Quote

  “Vite Vulnerable to Path Traversal in Optimized Deps .map Handling”

  osv.dev ›
• 

  vite: launch-editor: `fs.existsSync()` existence check can be bypassed on Windows

  npm · vite✕security
  Quote

  “launch-editor: fs.existsSync() existence check can be bypassed on Windows”

  osv.dev ›
• 

  vite: Vite DOM Clobbering gadget found in vite bundled scripts that leads to XSS

  npm · vite✕security
  Quote

  “Vite DOM Clobbering gadget found in vite bundled scripts that leads to XSS”

  osv.dev ›
• 

  vite: launch-editor: escapeCmdArgs() omits % escaping on Windows

  npm · vite✕security
  Quote

  “launch-editor: escapeCmdArgs() omits % escaping on Windows”

  osv.dev ›
• 

  vite: Vite's server.fs.deny bypassed with /. for files under project root

  npm · vite✕security
  Quote

  “Vite's server.fs.deny bypassed with /. for files under project root”

  osv.dev ›
• 

  vite: vite allows server.fs.deny bypass via backslash on Windows

  npm · vite✕security
  Quote

  “vite allows server.fs.deny bypass via backslash on Windows”

  osv.dev ›
• 

  vite: Vite's `server.fs.deny` is bypassed when using `?import&raw`

  npm · vite✕security
  Quote

  “Vite's server.fs.deny is bypassed when using ?import&raw”

  osv.dev ›
• 

  vite: Vite: Cross origin script execution through Vite custom middleware

  npm · vite✕security
  Quote

  “Vite: Cross origin script execution through Vite custom middleware”

  osv.dev ›
• 

  vite: launch-editor vulnerable to command injection via the crafted request on Windows

  npm · vite✕security
  Quote

  “launch-editor vulnerable to command injection via the crafted request on Windows”

  osv.dev ›
• 

  vite: vite: `server.fs.deny` bypass on Windows alternate paths

  npm · vite✕security
  Quote

  “vite: server.fs.deny bypass on Windows alternate paths”

  osv.dev ›
• 

  vite: Vite middleware may serve files starting with the same name with the public directory

  npm · vite✕security
  Quote

  “Vite middleware may serve files starting with the same name with the public directory”

  osv.dev ›
• 

  vite: Vite's `server.fs` settings were not applied to HTML files

  npm · vite✕security
  Quote

  “Vite's server.fs settings were not applied to HTML files”

  osv.dev ›
• 

  vite: Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket

  npm · vite✕security
  Quote

  “Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket”

  osv.dev ›
• 

  vite: launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors

  npm · vite✕security
  Quote

  “launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors”

  osv.dev ›
• 

  vite: Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine

  npm · vite✕security
  Quote

  “Vite: Files outside server.fs.allow could be served when project paths match system paths on non-Windows machine”

  osv.dev ›
• 

  vite: Vite: `server.fs.deny` bypassed with queries

  npm · vite✕security
  Quote

  “Vite: server.fs.deny bypassed with queries”

  osv.dev ›
• 

  vite: launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows

  npm · vite✕security
  Quote

  “launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows”

  osv.dev ›
• 

  vite: Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`

  npm · vite✕security
  Quote

  “Vite: First 4 bytes of files outside of server.fs setting is exposed by ?vite-wasm-instance”

  osv.dev ›
• 

  vite: Websites were able to send any requests to the development server and read the response in vite

  npm · vite✕security
  Quote

  “Websites were able to send any requests to the development server and read the response in vite”

  osv.dev ›
• 

  vite: Vite bypasses server.fs.deny when using ?raw??

  npm · vite✕security
  Quote

  “Vite bypasses server.fs.deny when using ?raw??”

  osv.dev ›
• 

  vite: Vite allows server.fs.deny to be bypassed with .svg or relative paths

  npm · vite✕security
  Quote

  “Vite allows server.fs.deny to be bypassed with .svg or relative paths”

  osv.dev ›
• 

  vitest: When Vitest UI server is listening, arbitrary file can be read and executed

  npm · vitest✕security
  Quote

  “When Vitest UI server is listening, arbitrary file can be read and executed”

  osv.dev ›
• 

  vitest: Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock

  npm · vitest✕security
  Quote

  “Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock”

  osv.dev ›
• 

  web3-core-method: web3-core-method is vulnerable to prototype pollution

  npm · web3-core-method✕security
  Quote

  “web3-core-method is vulnerable to prototype pollution”

  osv.dev ›
• 

  web3-core-subscriptions: web3-core-subscriptions has a Prototype Pollution vulnerability

  npm · web3-core-subscriptions✕security
  Quote

  “web3-core-subscriptions has a Prototype Pollution vulnerability”

  osv.dev ›
• 

  web3: Insecure Credential Storage in web3

  npm · web3✕security
  Quote

  “Insecure Credential Storage in web3”

  osv.dev ›
• 

  webpack: webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects → SSRF + cache persistence

  npm · webpack✕security
  Quote

  “webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects → SSRF + cache persistence”

  osv.dev ›
• 

  webpack: Webpack's AutoPublicPathRuntimeModule has a DOM Clobbering Gadget that leads to XSS

  npm · webpack✕security
  Quote

  “Webpack's AutoPublicPathRuntimeModule has a DOM Clobbering Gadget that leads to XSS”

  osv.dev ›
• 

  webpack: webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior

  npm · webpack✕security
  Quote

  “webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior”

  osv.dev ›
• 

  websocket-driver: websocket-driver: Resource limit bypass via message compression

  npm · websocket-driver✕security
  Quote

  “websocket-driver: Resource limit bypass via message compression”

  osv.dev ›
• 

  websocket-driver: websocket-driver: Message corruption via abuse of protocol length headers

  npm · websocket-driver✕security
  Quote

  “websocket-driver: Message corruption via abuse of protocol length headers”

  osv.dev ›
• 

  ws: ws affected by a DoS when handling a request with many HTTP headers

  npm · ws✕security
  Quote

  “ws affected by a DoS when handling a request with many HTTP headers”

  osv.dev ›
• 

  ws: ws: Uninitialized memory disclosure

  npm · ws✕security
  Quote

  “ws: Uninitialized memory disclosure”

  osv.dev ›

2026-11

• 

  undici: undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens

  npm · undici✕security
  Quote

  “undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens”

  osv.dev ›
• 

  undici: undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation

  npm · undici✕security
  Quote

  “undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation”

  osv.dev ›
• 

  undici: undici vulnerable to Denial of Service via unhandled error on excessive content-encodings

  npm · undici✕security
  Quote

  “undici vulnerable to Denial of Service via unhandled error on excessive content-encodings”

  osv.dev ›
• 

  uuid: uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided

  npm · uuid✕security
  Quote

  “uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided”

  osv.dev ›
• 

  word-wrap: word-wrap vulnerable to Regular Expression Denial of Service

  npm · word-wrap✕security
  Quote

  “word-wrap vulnerable to Regular Expression Denial of Service”

  osv.dev ›