Skip to content
Fencer Intel

All · npm

Newest first, late arrivals on top. Also a feed.

  1. 8.1
    CVE-2026-84504 fastify vulnerable to request body replacement via an async validation result collision
    npm
  2. 7.5
    CVE-2026-76169 fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers
    npm
  3. 7.5
    CVE-2026-84469 fastify vulnerable to request validation bypass via skipped boolean false schemas
    npm
  4. 7.5
    CVE-2026-84428 fastify vulnerable to header validation bypass via incomplete schema case normalization
    npm
  5. 9.1
    CVE-2026-85184 @fastify/middie vulnerable to path-scoped middleware bypass via absolute-form request target
    npm maintainer advisory
  6. —
    GHSA-2976-96r3-qc9r Code injection vulnerability in Orval
    npm unreviewed · maintainers only
  7. 10.0
    CVE-2026-93606 vm2 before 3.12.1 Sandbox Escape via Promise Symbol.species
    npm maintainer advisory
  8. 7.2
    CVE-2026-93604 vm2 3.11.8 Sandbox Escape via crypto.setFips
    npm maintainer advisory
  9. 10.0
    CVE-2026-93603 vm2 before 3.12.1 Sandbox Escape RCE via Non-Strict Host Function
    npm maintainer advisory
  10. 5.9
    CVE-2026-104844 PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion
    npm
  11. 7.5
    CVE-2026-85124 @fastify/http-proxy vulnerable to prefix escape via backslash dot-segments
    npm maintainer advisory
  12. 6.3
    CVE-2026-104871 Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows
    npm
  13. 3.7
    CVE-2026-105800 i18next-http-backend incomplete URL validation permits SSRF
    npm
  14. 7.5
    CVE-2026-84292 fast-uri vulnerable to authority injection via an unvalidated port in serialize
    npm
  15. 7.5
    CVE-2026-84394 fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority
    npm
  16. 5.0
    CVE-2026-92587 n8n before 1.123.76 Sandbox Escape via Git Relative URL
    npm maintainer advisory
  17. 4.4
    CVE-2026-92588 n8n before 1.123.76 Improper Authorization via Source Control Push
    npm maintainer advisory
  18. 7.5
    CVE-2026-92599 Joi before 17.13.7 and 18.2.6 ReDoS via isoDate
    npm
  19. 5.9
    CVE-2026-92595 Nodemailer before 9.1.1 Security Sandbox Bypass via resolveContent
    npm
  20. 6.5
    CVE-2026-92598 Nodemailer before 9.1.0 IDN/Punycode Domain Allow-list Bypass
    npm
  21. 6.5
    CVE-2026-92597 Nodemailer before 9.1.0 Email Domain Validation Bypass via RFC 5322 Comment
    npm
  22. 7.5
    CVE-2026-92596 Nodemailer before 9.1.0 Denial of Service via addressparser
    npm
  23. 9.0
    GHSA-gmm9-qwx3-2m3h Remote Code Execution via Unescaped Schema Defaults and Property Names
    npm unreviewed · maintainers only
  24. 9.3
    CVE-2026-103922 Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path
    npmswiftmaven
  25. 5.4
    CVE-2026-81888 @hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking
    npm
  26. 5.8
    CVE-2026-104872 Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute
    npm
  27. —
    GHSA-jggr-w7fw-pc2j fast-copy: Stack exhaustion in fast-copy when copying deeply-nested values
    npm
  28. 7.2
    GHSA-g2v6-rqmx-r4w6 @vue/server-renderer: XSS via missing CR in attribute-name blacklist
    npm
  29. 9.5
    CVE-2026-104848 Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution
    npm
  30. 9.5
    CVE-2026-104849 Tinypool: Prototype Pollution Gadget to RCE in run() options
    npm