Skip to content
Fencer Intel

All · npm

Newest first, late arrivals on top. Also a feed.

  1. 9.1
    CVE-2026-112362 @fastify/express vulnerable to path-scoped middleware bypass via absolute-form request targets
    npm maintainer advisory
  2. 3.7
    CVE-2026-110910 qs.stringify with allowEmptyArrays does not encode the keys of empty arrays, allowing query string parameter injection
    npm maintainer advisory
  3. 3.7
    CVE-2026-118775 Forge: ASN.1 OID first arc truncation in asn1.oidToDer
    npm
  4. 3.7
    CVE-2026-118774 Forge: Certificate signature verified with the issuer's RSA signature scheme
    npm
  5. 4.8
    CVE-2026-118777 Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie
    npm
  6. 3.7
    CVE-2026-118776 Forge: Incomplete PKCS#7 padding validation in AES/DES CBC and ECB decryption
    npm
  7. 5.9
    CVE-2026-118778 Forge: TLS client crash when the server sends no certificate
    npm
  8. 7.5
    CVE-2026-118779 Forge: Regular expression denial of service in PEM decoding (pem.decode)
    npm
  9. 2.9
    CVE-2026-118781 Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)
    npm
  10. 3.7
    CVE-2026-118780 Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store
    npm
  11. 5.9
    CVE-2026-119186 Forge: AES-GCM authentication bypass via unvalidated tagLength option
    npm
  12. 7.5
    CVE-2026-118782 Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count
    npm
  13. 7.5
    CVE-2026-119188 Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message
    npm
  14. 7.5
    CVE-2026-119187 Forge: Denial of service in TLS record processing via call stack exhaustion
    npm
  15. 5.9
    CVE-2026-119189 Forge: X.509 pathLenConstraint not enforced by verifyCertificateChain() for CA certificates without keyUsage
    npm
  16. 7.4
    CVE-2026-119190 Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13
    npm
  17. 7.5
    CVE-2026-119191 Forge: ASN.1 resource exhaustion via BIT STRING decoding in asn1.fromDer
    npm
  18. 7.5
    CVE-2026-119192 Forge: RSA PKCS#1 v1.5 signature forgery via non-canonical DigestInfo encoding
    npm
  19. 7.5
    GHSA-2g46-22mc-6gwp RSA PKCS#1 v1.5 signature forgery via extra elements in nested DigestAlgorithm
    npm unreviewed · maintainers only
  20. 4.8
    CVE-2026-119201 Nuxt dev server exposes generated appSecret through Vite file serving
    npm
  21. 3.7
    GHSA-2fxj-c3j7-rr69 Server island endpoint does not apply `redirect` route rules to `.server.vue` pages
    npm unreviewed · maintainers only
  22. 6.5
    CVE-2026-119200 Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes
    npm
  23. 5.9
    CVE-2026-119198 Nuxt dev server arbitrary file read through client error reports
    npm
  24. 5.9
    CVE-2026-119199 Nuxt dev server exposes private runtime config through the Nitro dev bundle
    npm
  25. —
    GHSA-3qg4-7mq2-gm93 EXIF parser copies unbounded per-entry component arrays, causing quadratic-time DoS on a crafted image
    npm unreviewed · maintainers only
  26. 7.5
    GHSA-gvwc-5hr5-44p8 probe-image-size EXIF sub-IFD fan-out blocks the event loop (9.6 KB JPEG, 23 s)
    npm unreviewed · maintainers only
  27. 3.7
    GHSA-5jh3-w3fj-6758 probe-image-size SVG doctype regex is quadratic (incomplete fix of GHSA-gjj5-9665-rwrc)
    npm unreviewed · maintainers only
  28. 3.7
    GHSA-5v8x-rm7w-m4c7 probe-image-size WebP stream parser buffers an attacker-declared EXIF chunk without limit
    npm unreviewed · maintainers only
  29. 3.7
    GHSA-7pqp-3q23-mwr8 probe-image-size AVIF stream parser buffers an attacker-declared ftyp box without limit
    npm unreviewed · maintainers only
  30. 6.3
    CVE-2026-116575 Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (_build_session_scope)
    pypinpm