https://vulnogram.org/ Most recent CVEs assigned by Harborist (harborist). https://vulnogram.org/seaview/icons/harborist.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT https://vulnogram.org/CVE-2026-110816 https://vulnogram.org/CVE-2026-110816 ### Summary `qs.stringify` with `arrayFormat: 'comma'` throws `TypeError: Cannot convert object to primitive value` when an array element cannot be coerced to a string, such as an object with an own non-callable `toString` (`{ "toString": "x" }`) or… Medium Network Exploitable Wed, 14 Oct 2026 22:05:24 GMT https://vulnogram.org/CVE-2026-107353 https://vulnogram.org/CVE-2026-107353 traverse (npm) versions 0.3.6 through 0.3.9, 0.4.0 through 0.4.6, 0.5.0 through 0.5.2, and 0.6.0 through 0.6.11 allow prototype pollution through set(). When the path passed to set() crosses a primitive value, the next path segment is resolved on tha… Medium Network Exploitable Wed, 07 Oct 2026 19:35:15 GMT https://vulnogram.org/CVE-2026-12171 https://vulnogram.org/CVE-2026-12171 auto-changelog before 2.6.1 merges configuration from inside the target repository (the .auto-changelog file and the auto-changelog key in package.json) into its options, and honors security-sensitive options from that untrusted source. The handlebar… High Mon, 05 Oct 2026 16:25:19 GMT https://vulnogram.org/CVE-2026-102422 https://vulnogram.org/CVE-2026-102422 shell-quote's `quote()` function emits a `{ comment }` token as `#` followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator (\n, \r, U+2028, U+2029) in that later s… Critical Network Exploitable Tue, 29 Sep 2026 03:47:36 GMT https://vulnogram.org/CVE-2026-102414 https://vulnogram.org/CVE-2026-102414 pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback (lib/sync.js). A password longer than the block size (64 bytes, or 128 bytes for sha384 and sha512) is passed to HMAC as the ke… Medium Network Exploitable Tue, 29 Sep 2026 03:42:04 GMT https://vulnogram.org/CVE-2026-94185 https://vulnogram.org/CVE-2026-94185 nvm resolves a requested version or alias by treating it as a filename under $NVM_DIR/alias. Before 0.40.8, nvm_alias() concatenated the requested name onto that directory and read the result with no containment check, so a name containing a `..` com… Medium Mon, 21 Sep 2026 02:27:00 GMT https://vulnogram.org/CVE-2026-82562 https://vulnogram.org/CVE-2026-82562 ### Summary When `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comma-separated value under a bracket-push key (`a[]=1,2,3,4`) is split into an array without being compared against `arrayLimit`, while the same value under… Medium Network Exploitable Sat, 29 Aug 2026 23:58:31 GMT https://vulnogram.org/CVE-2026-82417 https://vulnogram.org/CVE-2026-82417 ### Summary `qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member. `utils.isBuffer` duck-types buffers by calling `obj.constructor.isBuffer(obj)` after checking… Medium Network Exploitable Sat, 29 Aug 2026 23:51:27 GMT https://vulnogram.org/CVE-2026-15921 https://vulnogram.org/CVE-2026-15921 Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.32.1 through 0.40.5, `nvm ls-remote` (and other commands that refresh remote LTS aliases, such as `nvm install --lts`) parse the node… Low Network Exploitable Wed, 15 Jul 2026 21:16:46 GMT https://vulnogram.org/CVE-2026-13311 https://vulnogram.org/CVE-2026-13311 shell-quote prior to 1.8.5 finalizes parsed tokens in parse() using Array.prototype.concat as a reduce accumulator, which reallocates and copies the entire growing array on every iteration. As a result parse() runs in O(n^2) time relative to the numb… High Network Exploitable Thu, 25 Jun 2026 04:48:36 GMT https://vulnogram.org/CVE-2026-12143 https://vulnogram.org/CVE-2026-12143 form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Disposition` header without escaping… High Network Exploitable Fri, 12 Jun 2026 18:01:30 GMT https://vulnogram.org/CVE-2026-9277 https://vulnogram.org/CVE-2026-9277 shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-escaped character by character using `/(.)/g`, which in JavaScript does not match line terminators (\n,… Critical Network Exploitable Fri, 22 May 2026 13:22:38 GMT https://vulnogram.org/CVE-2026-8723 https://vulnogram.org/CVE-2026-8723 ### Summary `qs.stringify` throws `TypeError` when called with `arrayFormat: 'comma'` and `encodeValuesOnly: true` on an array containing `null` or `undefined`. The throw is synchronous and not handled by any of qs's null-related options (`skipNulls`… Medium Network Exploitable Sat, 16 May 2026 23:21:16 GMT https://vulnogram.org/CVE-2026-2391 https://vulnogram.org/CVE-2026-2391 ### Summary The `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to cause denial-of-service via memory exhaustion. This is a bypass of the array limit enforcement, similar… Medium Network Exploitable Thu, 12 Feb 2026 04:39:42 GMT https://vulnogram.org/CVE-2025-15284 https://vulnogram.org/CVE-2025-15284 Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1. Summary The arrayLimit option in qs did not enforce limits for bracket notation (a[]=1&a[]=2), only for indexed notation (a[0]=1). This is… Medium Network Exploitable Mon, 29 Dec 2025 22:56:45 GMT https://vulnogram.org/CVE-2025-9288 https://vulnogram.org/CVE-2025-9288 Improper Input Validation vulnerability in sha.js allows Input Data Manipulation.This issue affects sha.js: through 2.4.11. Critical Network Exploitable Wed, 20 Aug 2025 21:59:44 GMT https://vulnogram.org/CVE-2025-9287 https://vulnogram.org/CVE-2025-9287 Improper Input Validation vulnerability in cipher-base allows Input Data Manipulation.This issue affects cipher-base: through 1.0.4. Critical Network Exploitable Wed, 20 Aug 2025 21:43:56 GMT https://vulnogram.org/CVE-2025-7783 https://vulnogram.org/CVE-2025-7783 Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js. This issue affects form-data: < 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3. Critical Network Exploitable Fri, 18 Jul 2025 16:34:44 GMT https://vulnogram.org/CVE-2025-6547 https://vulnogram.org/CVE-2025-6547 Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation.This issue affects pbkdf2: <=3.1.2. Critical Network Exploitable Mon, 23 Jun 2025 19:00:45 GMT https://vulnogram.org/CVE-2025-6545 https://vulnogram.org/CVE-2025-6545 Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation. This vulnerability is associated with program files lib/to-buffer.Js. This issue affects pbkdf2: from 3.0.10 through 3.1.2. Critical Network Exploitable Mon, 23 Jun 2025 18:41:18 GMT