Conoce las vulnerabilidades. Protege tus aplicaciones.

Alta 20.10.2026

CVE-2026-111768

MCP TypeScript SDK: Una solicitud HTTP dentro del límite de tamaño predeterminado podía agotar la memoria del servidor durante la validación

En las versiones afectadas del SDK de TypeScript para MCP, una solicitud HTTP dentro del límite de tamaño predeterminado puede agotar la memoria del servidor durante la validación, lo que permite provocar una denegación de servicio y bloquear el proceso.

npm

@modelcontextprotocol/sdk, @modelcontextprotocol/server

Alta 20.10.2026

CVE-2026-111770

MCP TypeScript server SDK: Instancias compartidas de transporte o servidor entregaban mensajes de un cliente HTTP a otro

Una vulnerabilidad en el SDK de servidor MCP TypeScript provoca que se entreguen respuestas y notificaciones al cliente HTTP equivocado si se comparten instancias de servidor o transporte.

npm

@modelcontextprotocol/server

Crítica 08.10.2026

CVE-2026-107722

fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion

npm

fast-jwt

Media 05.10.2026

CVE-2026-74866

@fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name

npm

@fastify/busboy

Alta 02.10.2026

CVE-2026-19481

@fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header

npm

@fastify/busboy

Alta 02.10.2026

CVE-2026-19484

@fastify/busboy vulnerable to Denial of Service via oversized multipart boundary

npm

@fastify/busboy

Media 30.09.2026

CVE-2026-92081

fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses

npm

fastify

Alta 30.09.2026

CVE-2026-84504

fastify vulnerable to request body replacement via an async validation result collision

npm

fastify

Alta 30.09.2026

CVE-2026-76169

fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers

npm

fastify

Alta 30.09.2026

CVE-2026-84469

fastify vulnerable to request validation bypass via skipped boolean false schemas

npm

fastify

Alta 30.09.2026

CVE-2026-84428

fastify vulnerable to header validation bypass via incomplete schema case normalization

npm

fastify

Alta 30.09.2026

ghsa-9c5c-9qcx-q35q

@nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets

npm

@nestjs/platform-fastify

Media 22.09.2026

CVE-2026-58271

@sync-in/server vulnerable to TOTP Brute-Force via `POST /api/app/sync/register`

npm

@sync-in/server

Alta 09.09.2026

CVE-2026-59179

@openhop/server: Path Traversal in Flow ID File Operations

npm

@openhop/server

Media 02.09.2026

CVE-2026-16732

fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count

npm

fastify

Media 02.09.2026

CVE-2026-18504

fastify vulnerable to schema validation bypass via root primitive coercion mismatch

npm

fastify

Media 24.07.2026

CVE-2026-7120

@fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths

npm

@fastify/static

Alta 24.07.2026

CVE-2026-15074

@fastify/static vulnerable to route guard bypass via path traversal

npm

@fastify/static

Alta 18.06.2026

CVE-2026-55388

piscina: Prototype Pollution Gadget → RCE via inherited options.filename

npm

piscina

Alta 15.06.2026

CVE-2026-54281

Nest: Middleware Bypass on Fastify via Trailing Slash

npm

@nestjs/platform-fastify

Alta 15.06.2026

CVE-2026-49982

tmp: Type-confusion bypass of _assertPath allows path traversal via non-string prefix/postfix/template

npm

tmp

Media 22.05.2026

CVE-2026-8723

qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set

npm

qs

Alta 08.05.2026

CVE-2026-7768

@fastify/accepts-serializer Vulnerable to Denial of Service via Unbounded Accept Header Cache Growth

npm

@fastify/accepts-serializer

Media 05.05.2026

CVE-2026-42039

Axios: unbounded recursion in toFormData causes DoS via deeply nested request data

npm

axios