harborist

Latest CVEs · RSS

• CVE-2026-110816 2026-10-14 · CVSS 5.3
  ### Summary `qs.stringify` with `arrayFormat: 'comma'` throws `TypeError: Cannot convert object to primitive value` when an array element cannot be coerced t
• CVE-2026-107353 2026-10-07 · CVSS 6.9
  traverse (npm) versions 0.3.6 through 0.3.9, 0.4.0 through 0.4.6, 0.5.0 through 0.5.2, and 0.6.0 through 0.6.11 allow prototype pollution through set(). When th
• CVE-2026-12171 2026-10-05 · CVSS 8.4
  auto-changelog before 2.6.1 merges configuration from inside the target repository (the .auto-changelog file and the auto-changelog key in package.json) into it
• CVE-2026-102422 2026-09-29 · CVSS 8.1
  shell-quote's `quote()` function emits a `{ comment }` token as `#` followed by its text, which comments out the rest of the shell line, including the opening q
• CVE-2026-102414 2026-09-29 · CVSS 6.3
  pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback (lib/sync.js). A password longer than
• CVE-2026-94185 2026-09-21 · CVSS 5.5
  nvm resolves a requested version or alias by treating it as a filename under $NVM_DIR/alias. Before 0.40.8, nvm_alias() concatenated the requested name onto tha
• CVE-2026-82562 2026-08-29 · CVSS 3.7
  ### Summary When `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comma-separated value under a bracket-push key (`a[]=1,2,3,4`) i
• CVE-2026-82417 2026-08-29 · CVSS 5.3
  ### Summary `qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member. `
• CVE-2026-15921 2026-07-15 · CVSS 2.1
  Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.32.1 through 0.40.5, `nvm ls-remote` (and o
• CVE-2026-13311 2026-06-25 · CVSS 8.7
  shell-quote prior to 1.8.5 finalizes parsed tokens in parse() using Array.prototype.concat as a reduce accumulator, which reallocates and copies the entire grow
• CVE-2026-12143 2026-06-12 · CVSS 8.7
  form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename
• CVE-2026-9277 2026-05-22 · CVSS 8.1
  shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-escaped charac
• CVE-2026-8723 2026-05-16 · CVSS 5.3
  ### Summary `qs.stringify` throws `TypeError` when called with `arrayFormat: 'comma'` and `encodeValuesOnly: true` on an array containing `null` or `undefine
• CVE-2026-2391 2026-02-12 · CVSS 6.3
  ### Summary The `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to cause denial-o
• CVE-2025-15284 2025-12-29 · CVSS 6.3
  Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1. Summary The arrayLimit option in qs did not en
• CVE-2025-9288 2025-08-20 · CVSS 9.1
  Improper Input Validation vulnerability in sha.js allows Input Data Manipulation.This issue affects sha.js: through 2.4.11.
• CVE-2025-9287 2025-08-20 · CVSS 9.1
  Improper Input Validation vulnerability in cipher-base allows Input Data Manipulation.This issue affects cipher-base: through 1.0.4.
• CVE-2025-7783 2025-07-18 · CVSS 9.4
  Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/fo
• CVE-2025-6547 2025-06-23 · CVSS 9.1
  Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation.This issue affects pbkdf2: <=3.1.2.
• CVE-2025-6545 2025-06-23 · CVSS 9.1
  Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation. This vulnerability is associated with program files lib/to-b