Skip to content
Fencer Intel

All · npm

Newest first, late arrivals on top. Also a feed.

  1. 9.6
    CVE-2026-61559 @zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery
    npm
  2. 9.6
    CVE-2026-61568 @zereight/mcp-gitlab: DNS rebinding reaches local Streamable HTTP MCP transport
    npm
  3. 8.1
    GHSA-5648-rgj9-v224 @zereight/mcp-gitlab has multiple safety-control bypasses: execute_graphql read-only + allow-list bypass, unauthenticated transports, session-exhaustion DoS
    npm
  4. 6.5
    GHSA-96h4-vgxj-gvm2 Nest: Unbounded memory growth in the NestJS TCP microservice transport
    npm
  5. 7.4
    GHSA-9c5c-9qcx-q35q @nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets
    npm
  6. 7.5
    CVE-2026-102281 Nest: Remote process termination via a deeply nested microservice message pattern
    npm
  7. 4.8
    CVE-2026-86472 fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets
    npm
  8. 4.8
    CVE-2026-86818 fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization
    npm
  9. 9.1
    CVE-2026-90711 proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet
    npm
  10. 6.3
    CVE-2026-101912 ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range
    npm
  11. 6.3
    CVE-2026-101911 ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process
    npm
  12. 5.9
    CVE-2026-17495 moment vulnerable to Path Traversal via crafted non-string locale name
    npm
  13. 5.3
    CVE-2026-102277 brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service
    npm
  14. 7.5
    CVE-2026-102278 brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion
    npm
  15. 7.5
    CVE-2026-102276 brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion
    npm
  16. 7.9
    CVE-2026-114085 Trigger.dev through 4.7.6 Missing Authentication in Supervisor Workload API
    npm maintainer advisory
  17. 7.1
    CVE-2026-92773 Trigger.dev before 4.6.0 GitHub App Installation Takeover
    npm maintainer advisory
  18. 5.3
    CVE-2026-88932 multer vulnerable to Denial of Service via orphaned disk writes on aborted uploads
    npm
  19. 7.5
    CVE-2026-102599 Socket.IO: Engine.IO Protocol Revision Mismatch DoS
    npm
  20. 8.8
    GHSA-rw75-cc5p-q7c9 Import-time code execution in @orval/fetch via unescaped OpenAPI response status key emitted into a generated TypeScript type
    npm unreviewed · maintainers only
  21. 9.8
    GHSA-v263-cp2v-vrrx Import-time RCE in @orval/zod via unvalidated schema type emitted as a Zod method name
    npm unreviewed · maintainers only
  22. 8.8
    GHSA-4j53-7m38-656f @orval/axios: code injection via unescaped OpenAPI response status key in generated empty-response condition
    npm unreviewed · maintainers only
  23. 3.7
    CVE-2026-90771 joi before 17.13.8 and 18.2.9 Prototype Pollution via messages
    npm
  24. 6.3
    GHSA-j3h4-m3m2-7p7j Untrusted WebAuthn attestation certificates can trigger server-side HTTP requests
    npm unreviewed · maintainers only
  25. 5.4
    GHSA-2g3p-m8c9-hhwh Rejected WebAuthn registrations can poison the process-wide CRL cache
    npm unreviewed · maintainers only
  26. 10.0
    GHSA-x4fj-j9hr-ccr6 Import-time code execution in @orval/core via unescaped array-items object const in generated TypeScript models
    npm unreviewed · maintainers only
  27. 9.6
    GHSA-w68h-2r38-4cqq Code execution in @orval/mock enum generation via unescaped OpenAPI property name (enumGenerationType 'enum')
    npm unreviewed · maintainers only
  28. 5.3
    CVE-2026-100699 Nodemailer before 10.0.9 Malformed Envelope Recipient via RFC 5322 Comment
    npm
  29. 7.5
    CVE-2026-111759 markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes
    npm
  30. 9.1
    CVE-2026-61534 Yayson: Prototype pollution in the Store/LegacyStore deserialization
    npm