Medium
CVE-2026-86472
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 4,990
Reset filters
Medium
CVE-2026-86818
fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization
Critical
CVE-2026-101894
@xhmikosr/decompress: Path traversal via symlink chain
Medium
CVE-2026-101912
ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range
Medium
CVE-2026-101911
ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process
Medium
CVE-2026-17495
moment vulnerable to Path Traversal via crafted non-string locale name
Medium
CVE-2026-102277
brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service
High
CVE-2026-102278
brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion
High
CVE-2026-102276
brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion
High
CVE-2026-102599
Socket.IO: Engine.IO Protocol Revision Mismatch DoS
Medium
CVE-2026-100699
Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing
High
CVE-2026-100700
Nodemailer: Quadratic backtracking in the addressparser free-text fallback allows remote denial of service
Medium
CVE-2026-114104
adm-zip: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different content
Medium
CVE-2026-114103
adm-zip: getDataAsync() bypasses the maxOutputLength size guard enforced by the synchronous getData() path
High
CVE-2026-114102
adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process (DoS)
High
CVE-2026-92000
adm-zip: Decompression-bomb protection (fix for CVE-2026-39244) can be bypassed by declaring uncompressed size as 0
High
CVE-2026-102282
adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation
Medium
CVE-2026-100702
Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoS
High
CVE-2026-19534
undici vulnerable to Denial of Service via unrequested WebSocket subprotocol
Medium
CVE-2026-84933
undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches
Low
CVE-2026-84947
undici vulnerable to response truncation via oversized chunked responses in the dump interceptor
High
CVE-2026-84961
undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool
Low
CVE-2026-85008
undici vulnerable to caching and replay of unsafe HTTP method responses
High
CVE-2026-85152
undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.