Skip to content
Fencer Intel

All · npm

Newest first, late arrivals on top. Also a feed.

  1. 8.8
    GHSA-cr3w-v879-f973 Prototype pollution in convertTokenData via nested constructor.prototype/__proto__ keys
    npm unreviewed · maintainers only
  2. 8.8
    GHSA-5pgh-4v89-hfqj GHSA-vj5c-m527-mpff fix is incomplete: prototype pollution via `constructor.prototype` still works in 5.4.4 and 5.5.0
    npm unreviewed · maintainers only
  3. 6.2
    CVE-2026-114129 stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service
    npm
  4. 7.5
    CVE-2026-104845 Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization
    npm
  5. 9.8
    CVE-2026-104846 Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of CVE-2026-59940)
    npm
  6. 7.5
    GHSA-4p2c-m292-ghmh Denial of Service in RPCHandler via untrusted `meta` types in StandardRPCJsonSerializer deserialization
    npm unreviewed · maintainers only
  7. 4.3
    GHSA-6w75-8r53-g8jx @orval/mock: prototype-chain read via unguarded ALL_FORMAT[format] lookup emits non-string into generated mocks (build-time DoS)
    npm unreviewed · maintainers only
  8. 7.5
    CVE-2026-92708 devalue: Cross-request process memory disclosure in devalue when `stringify` / `uneval` serialize Node Buffers
    npm
  9. 7.5
    CVE-2026-123566 Devalue before 5.9.3 CPU Amplification Denial of Service via uneval
    npm
  10. 7.5
    CVE-2026-123565 Devalue before 5.9.3 Quadratic Expansion Denial of Service via uneval
    npm
  11. 7.5
    CVE-2026-123564 Sveltejs devalue before 5.9.3 Memory Exhaustion via uneval Sparse Arrays
    npm
  12. 7.5
    CVE-2026-123563 Devalue before 5.9.3 Typed-Array Allocation Validation Bypass via parse
    npm
  13. 7.5
    CVE-2026-123562 Devalue 5.8.0 before 5.9.3 Denial of Service via stringifyAsync Unhandled Rejection
    npm
  14. 3.7
    CVE-2026-123561 Sveltejs devalue before 5.9.3 __proto__ Rejection Bypass via Property-Key Coercion
    npm
  15. 5.3
    GHSA-gcqx-w48m-w2h4 deepmerge mergeObject() allows prototype poisoning of returned objects
    npm
  16. 7.5
    CVE-2026-93749 source-map-js through 1.2.1 Event Loop Denial of Service
    npm
  17. 8.2
    CVE-2026-91127 File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer
    npm
  18. 6.1
    CVE-2026-84992 md-editor-v3: XSS via fenced-code language rendering bypass
    npm
  19. 6.5
    CVE-2026-105847 Payload: Polymorphic join queries could disclose hidden fields
    npm
  20. 9.6
    CVE-2026-105848 Payload: Insufficient Access Control in Stripe REST Proxy
    npm
  21. 8.3
    CVE-2026-105849 Payload: API key disclosure through ordinary document reads
    npm
  22. 8.2
    CVE-2026-105850 Payload: Order confirmation validation issue in Payload Ecommerce
    npm
  23. 7.5
    CVE-2026-105852 Payload relationship-query authorization bypass
    npm
  24. 6.5
    CVE-2026-105853 Payload: Token refresh and password reset responses may expose restricted user fields
    npm
  25. 7.5
    CVE-2026-105854 Payload: ReDoS in Multipart Content-Type Validation
    npm
  26. 7.1
    CVE-2026-105855 Payload: Field-level password update restrictions were not enforced
    npm
  27. 8.3
    CVE-2026-105856 Payload: SQL injection in SQLite/Postgres
    npm maintainer advisory
  28. 8.1
    CVE-2026-105858 Payload: Remote Code Execution through first-register
    npm
  29. 7.1
    CVE-2026-105860 Payload: Tenant authorization bypass in Multi-Tenant Plugin
    npm
  30. 8.2
    CVE-2026-105861 Payload external upload trust validation issue
    npm