Skip to content
Fencer Intel

All · npm

Newest first, late arrivals on top. Also a feed.

  1. 3.7
    CVE-2026-82562 qs.parse does not enforce arrayLimit on comma groups under bracket-push keys when throwOnLimitExceeded is set (incomplete fix for CVE-2026-2391)
    npm
  2. 5.3
    CVE-2026-82417 qs.stringify throws TypeError on objects with a non-callable constructor.isBuffer property
    npm
  3. 6.7
    CVE-2026-102672 Electron: Local race condition in Squirrel.Mac update installation on macOS
    npm
  4. 6.9
    CVE-2026-101910 ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass
    npm
  5. 6.3
    CVE-2026-101913 ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts
    npm
  6. 8.2
    CVE-2026-102673 Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab
    npm
  7. 8.2
    CVE-2026-102674 Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions
    npm
  8. 7.4
    CVE-2026-102675 Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled
    npm
  9. 8.3
    CVE-2026-102676 Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions
    npm
  10. 7.8
    CVE-2026-102677 Electron: Sandboxed preload code cache can be poisoned by a compromised renderer
    npm
  11. 6.5
    CVE-2026-55855 MariaDB Connector/Node.js: Possible SQL injection in Buffer parameter escaping under big5/gbk/sjis/cp932/gb18030 client charsets
    MariaDBnpmbitnami
  12. 5.9
    CVE-2026-55854 MariaDB Connector/Node.js: Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials in mariadb
    MariaDBnpmbitnami
  13. —
    GHSA-7wjf-49rm-77gx Arbitrary Vercel KV key read, overwrite, and delete via forged session cookie in @vercel/react-router
    npm unreviewed · maintainers only
  14. 7.5
    CVE-2026-77078 multer vulnerable to Denial of Service via crafted multipart field names
    npm
  15. 7.5
    CVE-2026-77037 multer vulnerable to Denial of Service via file descriptor leak on aborted uploads
    npm
  16. 3.7
    CVE-2026-77063 multer vulnerable to file size limit bypass via async fileFilter race condition
    npm
  17. 7.5
    CVE-2026-82333 multer vulnerable to Denial of Service via oversized array index in field names
    npm
  18. 7.5
    CVE-2026-55215 MariaDB Connector/Node.js: Connector leaks the cleartext password to an MitM despite `ssl: true`
    MariaDBnpmbitnami
  19. 4.3
    CVE-2026-106497 Backstage: Inconsistent catalog property permission evaluation
    npm maintainer advisory
  20. 5.3
    CVE-2026-106507 Backstage: TechDocs arbitrary file read via mkdocs snippets
    npm maintainer advisory
  21. 7.7
    CVE-2026-106556 Backstage: Configuration bypass in TechDocs mkdocs.yml sanitization
    npm maintainer advisory
  22. 8.8
    CVE-2026-88064 Backstage: Improper input validation in TechDocs MkDocs configuration
    npm maintainer advisory
    EPSS 1.2% chance of exploitation in 30 days, percentile 68%
  23. 9.2
    CVE-2026-102992 piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env
    npm
  24. 5.3
    CVE-2026-15603 morgan vulnerable to Log Forging via unescaped Unicode line separators
    npm
  25. 6.2
    CVE-2026-104182 stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk
    npm
  26. 5.1
    CVE-2026-104183 stream-json: Prototype pollution: Assembler writes this.current[this.key] on plain objects
    npm
  27. —
    GHSA-253c-mchw-3w2r markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds
    npm
  28. 7.1
    CVE-2026-106100 Payload: Field-level write access bypass in Payload on MongoDB
    npm
  29. 8.2
    CVE-2026-102990 basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)
    npm
  30. 6.5
    CVE-2026-54732 libreoffice-convert: path traversal / arbitrary file write
    npm