https://vulnogram.org/ Most recent CVEs assigned by OpenJS Foundation (openjs). https://vulnogram.org/seaview/icons/openjs.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-112712 https://vulnogram.org/CVE-2026-112712 @fastify/middie is the Express-style middleware engine for Fastify. In versions from 9.0.0 through 9.3.5, the use() function joined a path-scoped middleware's mount path to the plugin scope prefix in a way that could diverge from the path Fastify's r… Critical Tue, 20 Oct 2026 20:43:48 GMT https://vulnogram.org/CVE-2026-110725 https://vulnogram.org/CVE-2026-110725 fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, when serialize(), normalize(), or resolve() are called with the non-default option referen… Low Tue, 20 Oct 2026 07:06:29 GMT https://vulnogram.org/CVE-2026-110306 https://vulnogram.org/CVE-2026-110306 fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, fast-uri percent-decodes the scheme component with the legacy global unescape() function b… Medium Tue, 20 Oct 2026 07:03:47 GMT https://vulnogram.org/CVE-2026-110180 https://vulnogram.org/CVE-2026-110180 fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions from 2.4.2 through 2.4.7, from 3.1.3 through 3.1.8, and from 4.0.1 through 4.2.2, for HTTP-family schemes the canonicalizeHost() function passes the parsed host… Medium Tue, 20 Oct 2026 07:00:42 GMT https://vulnogram.org/CVE-2026-110095 https://vulnogram.org/CVE-2026-110095 fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, the normalize() and serialize() functions apply RFC 3986 dot-segment removal to the path o… Low Tue, 20 Oct 2026 06:56:56 GMT https://vulnogram.org/CVE-2026-110008 https://vulnogram.org/CVE-2026-110008 @fastify/oauth2 is a Fastify wrapper for OAuth2 login flows. In versions 7.2.0 through 8.3.1, the state and code-verifier cookies are set without a Path attribute at a login route with two or more path segments, while the clearing step at the OAuth c… Medium Mon, 19 Oct 2026 13:24:27 GMT https://vulnogram.org/CVE-2026-110024 https://vulnogram.org/CVE-2026-110024 @fastify/jwt is a JWT utility plugin for Fastify. In versions prior to 10.2.5, the top-level sign and verify methods replace the globally configured defaults with the per-call options instead of merging them, so passing any per-call option silently d… Medium Sun, 18 Oct 2026 14:31:38 GMT https://vulnogram.org/CVE-2026-87029 https://vulnogram.org/CVE-2026-87029 undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its decompress interceptor forwards decompressed response data to the downstream handler from zlib stream event callbacks without catching excep… Medium Thu, 15 Oct 2026 18:48:36 GMT https://vulnogram.org/CVE-2026-109932 https://vulnogram.org/CVE-2026-109932 undici is an HTTP client library for Node.js. In versions 5.15.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its WebSocket client, including the bundled WebSocket exposed by Node.js, can be driven to exhaust process memory by a ma… Medium Thu, 15 Oct 2026 18:44:22 GMT https://vulnogram.org/CVE-2026-87018 https://vulnogram.org/CVE-2026-87018 undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different… High Thu, 15 Oct 2026 18:38:25 GMT https://vulnogram.org/CVE-2026-109383 https://vulnogram.org/CVE-2026-109383 undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before forwarding them to each per-ori… High Thu, 15 Oct 2026 18:34:01 GMT https://vulnogram.org/CVE-2026-109829 https://vulnogram.org/CVE-2026-109829 undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a shared cache store, the cache builds its key from the… High Thu, 15 Oct 2026 18:28:04 GMT https://vulnogram.org/CVE-2026-109841 https://vulnogram.org/CVE-2026-109841 undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch() implementation verifies Subresource Integrity metadata by matching the algorithm token against a lowercase-only set, even though the… Medium Thu, 15 Oct 2026 18:22:06 GMT https://vulnogram.org/CVE-2026-109924 https://vulnogram.org/CVE-2026-109924 undici is an HTTP client library for Node.js. In versions 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its EventSource client can be driven to exhaust process memory by a malicious or compromised Server-Sent Events peer. By s… Medium Thu, 15 Oct 2026 18:16:48 GMT https://vulnogram.org/CVE-2026-109869 https://vulnogram.org/CVE-2026-109869 undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1, its fetch() implementation crashes the Node.js process when a malicious server returns a response with more than five co… High Thu, 15 Oct 2026 18:08:31 GMT https://vulnogram.org/CVE-2026-109855 https://vulnogram.org/CVE-2026-109855 undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket client, which is enabled by default when HTTP/2 is allowed, mishandles a failed WebSocket handshake over HTTP/2: the request is already marked com… High Thu, 15 Oct 2026 08:12:51 GMT https://vulnogram.org/CVE-2026-107832 https://vulnogram.org/CVE-2026-107832 fastify is a fast and low overhead web framework for Node.js. In versions 5.12.2 through 5.12.5, the routine that lowercases header names declared in a route schema does not lowercase the enum or const header names nested inside a propertyNames subsc… Low Tue, 13 Oct 2026 13:23:24 GMT https://vulnogram.org/CVE-2026-107318 https://vulnogram.org/CVE-2026-107318 @fastify/reply-from is a Fastify plugin that forwards requests to an upstream HTTP or HTTPS server. In versions prior to 12.7.0, all of the built-in HTTPS transports override the secure default and set rejectUnauthorized to false, so the proxy does n… High Thu, 08 Oct 2026 20:32:03 GMT https://vulnogram.org/CVE-2026-107275 https://vulnogram.org/CVE-2026-107275 @fastify/jwt is a JSON Web Token plugin for the Fastify web framework. In versions before 10.2.3, a time span passed to expiresIn, notBefore, or maxAge that the plugin's parser cannot read, such as a compound span, a month unit, an ISO 8601 duration,… Medium Thu, 08 Oct 2026 11:05:40 GMT https://vulnogram.org/CVE-2026-90982 https://vulnogram.org/CVE-2026-90982 @fastify/static is a Fastify plugin that serves static files from a configured root directory. In versions before 10.1.4, on a case-insensitive filesystem such as Windows or the default macOS volume, a route guard or allowedPath restriction can be by… Medium Thu, 17 Sep 2026 06:55:42 GMT https://vulnogram.org/CVE-2026-92395 https://vulnogram.org/CVE-2026-92395 @fastify/proxy-addr is a Fastify plugin that determines a request's client address behind trusted reverse proxies, and it backs Fastify request.ip and request.ips. In versions 3.0.0 through 5.1.0, a trust subnet written in IPv4-mapped IPv6 notation w… Critical Wed, 16 Sep 2026 14:35:05 GMT https://vulnogram.org/CVE-2026-92087 https://vulnogram.org/CVE-2026-92087 @fastify/auth is a Fastify plugin that composes multiple authentication and authorization strategies into a single route guard. In versions 5.0.0 through 5.1.0, when strategies are composed with the relation "or" option together with the run "all" op… High Wed, 16 Sep 2026 14:21:23 GMT https://vulnogram.org/CVE-2026-92081 https://vulnogram.org/CVE-2026-92081 fastify is a fast and low-overhead web framework for Node.js. In versions before 5.12.5, when a route registers a response trailer via reply.trailer() and is served over HTTP/2, fastify unconditionally sets the Transfer-Encoding: chunked header, whic… Medium Wed, 16 Sep 2026 08:52:49 GMT https://vulnogram.org/CVE-2026-86818 https://vulnogram.org/CVE-2026-86818 fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv, that added a mailto scheme parser in version 4.1.3. In versions 4.1.3 and 4.1.4, the mailto parser compares each query field name to the reserved names to, subjec… Medium Tue, 15 Sep 2026 10:40:38 GMT https://vulnogram.org/CVE-2026-86472 https://vulnogram.org/CVE-2026-86472 fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv. In versions before 2.4.7, from 3.0.0 through 3.1.7, and from 4.0.0 through 4.1.4, fast-uri folds the host to lowercase before it percent-decodes the host, so a pe… Medium Tue, 15 Sep 2026 10:29:50 GMT https://vulnogram.org/CVE-2026-90711 https://vulnogram.org/CVE-2026-90711 proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized… Critical Tue, 15 Sep 2026 06:19:46 GMT https://vulnogram.org/CVE-2026-17495 https://vulnogram.org/CVE-2026-17495 moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a specially crafted non-string object passed to moment.locale() can bypass the locale-name path-traversal guard. The g… Medium Tue, 15 Sep 2026 05:40:55 GMT https://vulnogram.org/CVE-2026-88932 https://vulnogram.org/CVE-2026-88932 multer is a Node.js middleware for handling multipart/form-data uploads. In versions 2.2.0 through 2.3.0, when a request using disk storage is aborted mid-upload, file writes that complete after multer has already run its abort cleanup are not remove… Medium Mon, 14 Sep 2026 08:46:12 GMT https://vulnogram.org/CVE-2026-87776 https://vulnogram.org/CVE-2026-87776 compression is a Node.js and Express compression middleware. In versions before 1.8.2, when a client aborts the connection while a compressed response is still being sent, the zlib stream created to compress that response is never destroyed, so each… High Fri, 11 Sep 2026 11:24:55 GMT https://vulnogram.org/CVE-2026-87123 https://vulnogram.org/CVE-2026-87123 hbs is an Express view engine wrapper for Handlebars. Version 4.3.0 can crash the Node.js process during output escaping when an async helper, registered with registerAsyncHelper, resolves to an object whose toHTML property is truthy but not callable… Medium Fri, 11 Sep 2026 09:50:27 GMT https://vulnogram.org/CVE-2026-87859 https://vulnogram.org/CVE-2026-87859 morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField() function does not escape the double quote character, which delimits the quoted fields of the Apache combined log format that morgan emits. An una… Medium Fri, 11 Sep 2026 09:15:19 GMT https://vulnogram.org/CVE-2026-87908 https://vulnogram.org/CVE-2026-87908 multiparty is a Node.js library for parsing multipart/form-data request bodies. In versions from 2.1.0 up to but not including 4.3.1, the parser does not bound the amount of memory used while accumulating the headers of a single multipart part. An un… High Fri, 11 Sep 2026 06:37:51 GMT https://vulnogram.org/CVE-2026-88038 https://vulnogram.org/CVE-2026-88038 cookies is a Node.js library for reading and writing HTTP cookies, used by Koa via ctx.cookies. In versions before 0.9.2 the library validates the cookie name and value against character sets that reject the semicolon separator, but the domain and pa… Medium Thu, 10 Sep 2026 12:11:58 GMT https://vulnogram.org/CVE-2026-75021 https://vulnogram.org/CVE-2026-75021 fastify-cli starts the Node.js Inspector when a debug flag is used, but it ignores the explicit bind address the user supplies and binds the Inspector to a broadly reachable address instead of the intended loopback. As a result the debugging interfac… High Tue, 08 Sep 2026 12:50:23 GMT https://vulnogram.org/CVE-2026-18149 https://vulnogram.org/CVE-2026-18149 undici's retry handler can leave an already-exposed response body pending forever. When a server returns a successful response that declares a Content-Length, sends only part of the body, and closes the connection, the retry handler retries the reque… Medium Fri, 04 Sep 2026 17:21:46 GMT https://vulnogram.org/CVE-2026-18540 https://vulnogram.org/CVE-2026-18540 undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers. This happens when an upstream server delivers par… Low Fri, 04 Sep 2026 17:15:50 GMT https://vulnogram.org/CVE-2026-19534 https://vulnogram.org/CVE-2026-19534 undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response… High Fri, 04 Sep 2026 17:10:05 GMT https://vulnogram.org/CVE-2026-84890 https://vulnogram.org/CVE-2026-84890 undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header. While the number of content-encoding layers is capped, the total decompressed output size is unbounded and there is no configuration opti… Medium Fri, 04 Sep 2026 17:04:28 GMT https://vulnogram.org/CVE-2026-84933 https://vulnogram.org/CVE-2026-84933 undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. In shared cache mode, which is the default, an otherwise cacheable response that carries a Se… Medium Fri, 04 Sep 2026 16:59:08 GMT https://vulnogram.org/CVE-2026-84947 https://vulnogram.org/CVE-2026-84947 undici's dump interceptor reads and discards a response body up to a configurable maximum size. When a response declares a Content-Length that exceeds the maximum, the interceptor aborts cleanly, but when a response has no Content-Length and is chunk… Low Fri, 04 Sep 2026 16:53:11 GMT https://vulnogram.org/CVE-2026-84961 https://vulnogram.org/CVE-2026-84961 undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied check… High Fri, 04 Sep 2026 16:47:55 GMT https://vulnogram.org/CVE-2026-85008 https://vulnogram.org/CVE-2026-85008 undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is built by subtracting the configured methods from the set of safe methods, so an unsafe method such as POST, PUT, or DELETE is never placed i… Low Fri, 04 Sep 2026 16:42:40 GMT https://vulnogram.org/CVE-2026-85152 https://vulnogram.org/CVE-2026-85152 undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool. Because the internal cache key falls back to an empty origin string, a cach… High Fri, 04 Sep 2026 16:36:28 GMT https://vulnogram.org/CVE-2026-85014 https://vulnogram.org/CVE-2026-85014 undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection without a WebSocket close handshake. On an unclean close the internal socket-close handler calls abort on the writable stream… Medium Fri, 04 Sep 2026 16:30:07 GMT https://vulnogram.org/CVE-2026-85024 https://vulnogram.org/CVE-2026-85024 undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error listener, while that stream can still emit. When a remote peer sends a compressed payload t… Medium Fri, 04 Sep 2026 16:20:34 GMT https://vulnogram.org/CVE-2026-84428 https://vulnogram.org/CVE-2026-84428 fastify versions before 5.12.2 implement the case-insensitive nature of HTTP header names by lowercasing names in a route's header schema before compiling it, but the transformation is incomplete: it lowercases the properties keys and the root-level… High Fri, 04 Sep 2026 10:24:27 GMT https://vulnogram.org/CVE-2026-84469 https://vulnogram.org/CVE-2026-84469 fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthiness, but JSON Schema Draft 7 defines the boolean false as a valid schema that rejects every instance. When an application assigns false to a route's… High Fri, 04 Sep 2026 09:59:36 GMT https://vulnogram.org/CVE-2026-76169 https://vulnogram.org/CVE-2026-76169 fastify versions >= 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix to the custom not-found handler of a different sibling plugin, and invoke it without the preHandler hook declared for that handler. The internal not-fo… High Fri, 04 Sep 2026 09:51:03 GMT https://vulnogram.org/CVE-2026-84504 https://vulnogram.org/CVE-2026-84504 fastify versions before 5.12.2 treat the object resolved by a successful Ajv async validator as the value result protocol used by custom validator compilers. If a request that passes its route schema contains a property named value at the root, fasti… High Fri, 04 Sep 2026 09:40:18 GMT https://vulnogram.org/CVE-2026-85184 https://vulnogram.org/CVE-2026-85184 @fastify/middie versions >= 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by matching against the raw request target, while the Fastify router resolves an absolute-form request target to its path before dispatching. Because the… Critical Fri, 04 Sep 2026 09:15:51 GMT