Critical
CVE-2026-92938
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,626
Reset filters
Critical
CVE-2026-92944
vm2 sandbox escape on Node.js 26 through a stale PromiseThenLookupChain protector
Critical
CVE-2026-92941
vm2 NodeVM can replace the host process TLS trust store
Medium
CVE-2026-92945
vm2: External module allowlist uses a raw prefix test, so a prefix-sharing sibling package is treated as allowlisted
Critical
CVE-2026-102992
piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env
High
CVE-2026-102990
basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)
High
CVE-2026-76169
fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers
High
CVE-2026-84428
fastify vulnerable to header validation bypass via incomplete schema case normalization
Medium
CVE-2026-101904
Axios: Header Injection via Inherited headers After Minimal Interceptor
Medium
CVE-2026-101900
Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders
High
CVE-2026-101905
Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection
Medium
CVE-2026-101899
Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges
High
CVE-2026-101907
Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF
Medium
CVE-2026-101902
Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method
High
CVE-2026-101906
Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location
High
CVE-2026-101898
Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls
High
CVE-2026-101901
Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization
Medium
ghsa-96h4-vgxj-gvm2
Nest: Unbounded memory growth in the NestJS TCP microservice transport
High
ghsa-9c5c-9qcx-q35q
@nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets
Critical
CVE-2026-101894
@xhmikosr/decompress: Path traversal via symlink chain
Medium
CVE-2026-101911
ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process
Medium
CVE-2026-102277
brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service
High
CVE-2026-100700
Nodemailer: Quadratic backtracking in the addressparser free-text fallback allows remote denial of service
High
CVE-2026-114102
adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process (DoS)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.