openjs

Latest CVEs · RSS

• CVE-2026-87029 2026-10-15 · CVSS 5.9
  undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its decompress interceptor forwards decompressed respo
• CVE-2026-109932 2026-10-15 · CVSS 5.9
  undici is an HTTP client library for Node.js. In versions 5.15.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its WebSocket client, including
• CVE-2026-87018 2026-10-15 · CVSS 7.5
  undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when
• CVE-2026-109383 2026-10-15 · CVSS 7.4
  undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its
• CVE-2026-109829 2026-10-15 · CVSS 7.4
  undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cach
• CVE-2026-109841 2026-10-15 · CVSS 5.9
  undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch() implementation verifies Subresource Integr
• CVE-2026-109924 2026-10-15 · CVSS 5.9
  undici is an HTTP client library for Node.js. In versions 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its EventSource client can be dr
• CVE-2026-109869 2026-10-15 · CVSS 7.5
  undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1, its fetch() implementation cra
• CVE-2026-109855 2026-10-15 · CVSS 7.5
  undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket client, which is enabled by default when HTTP/2 is allow
• CVE-2026-107832 2026-10-13 · CVSS 3.7
  fastify is a fast and low overhead web framework for Node.js. In versions 5.12.2 through 5.12.5, the routine that lowercases header names declared in a route sc
• CVE-2026-107318 2026-10-08 · CVSS 7.4
  @fastify/reply-from is a Fastify plugin that forwards requests to an upstream HTTP or HTTPS server. In versions prior to 12.7.0, all of the built-in HTTPS trans
• CVE-2026-107275 2026-10-08 · CVSS 6.8
  @fastify/jwt is a JSON Web Token plugin for the Fastify web framework. In versions before 10.2.3, a time span passed to expiresIn, notBefore, or maxAge that the
• CVE-2026-90982 2026-09-17 · CVSS 5.3
  @fastify/static is a Fastify plugin that serves static files from a configured root directory. In versions before 10.1.4, on a case-insensitive filesystem such
• CVE-2026-92395 2026-09-16 · CVSS 9.1
  @fastify/proxy-addr is a Fastify plugin that determines a request's client address behind trusted reverse proxies, and it backs Fastify request.ip and request.i
• CVE-2026-92087 2026-09-16 · CVSS 8.1
  @fastify/auth is a Fastify plugin that composes multiple authentication and authorization strategies into a single route guard. In versions 5.0.0 through 5.1.0,
• CVE-2026-92081 2026-09-16 · CVSS 5.9
  fastify is a fast and low-overhead web framework for Node.js. In versions before 5.12.5, when a route registers a response trailer via reply.trailer() and is se
• CVE-2026-86818 2026-09-15 · CVSS 4.8
  fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv, that added a mailto scheme parser in version 4.1.3. In versions 4.1.3 an
• CVE-2026-86472 2026-09-15 · CVSS 4.8
  fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv. In versions before 2.4.7, from 3.0.0 through 3.1.7, and from 4.0.0 throu
• CVE-2026-90711 2026-09-15 · CVSS 9.1
  proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1
• CVE-2026-17495 2026-09-15 · CVSS 5.9
  moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a specially crafted non-stri
• CVE-2026-88932 2026-09-14 · CVSS 5.3
  multer is a Node.js middleware for handling multipart/form-data uploads. In versions 2.2.0 through 2.3.0, when a request using disk storage is aborted mid-uploa
• CVE-2026-87776 2026-09-11 · CVSS 7.5
  compression is a Node.js and Express compression middleware. In versions before 1.8.2, when a client aborts the connection while a compressed response is still
• CVE-2026-87123 2026-09-11 · CVSS 5.9
  hbs is an Express view engine wrapper for Handlebars. Version 4.3.0 can crash the Node.js process during output escaping when an async helper, registered with r
• CVE-2026-87859 2026-09-11 · CVSS 5.3
  morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField() function does not escape the double quote character, wh
• CVE-2026-87908 2026-09-11 · CVSS 7.5
  multiparty is a Node.js library for parsing multipart/form-data request bodies. In versions from 2.1.0 up to but not including 4.3.1, the parser does not bound