Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`

## Summary axios’ fetch adapter does not enforce `maxBodyLength` for live WHATWG `ReadableStream` request bodies whose

历史摘要 · 未重新核验 · GitHub Advisory

Axios: Prototype pollution gadgets can alter axios request construction

## Summary axios is vulnerable to read-side prototype-pollution gadgets when `Object.prototype` has already been pollut

历史摘要 · 未重新核验 · GitHub Advisory

Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios

## Summary Axios versions containing `lib/helpers/shouldBypassProxy.js` do not treat `0.0.0.0` as a local address when

历史摘要 · 未重新核验 · GitHub Advisory

File Browser: Colliding username normalization gives two users the same home directory

CVE-2026-62685

## Summary FileBrowser confines each user to a *scope*: a home directory that acts as the boundary for everything they

历史摘要 · 未重新核验 · GitHub Advisory

File Browser: Share API exposes the password hash and bypass token

CVE-2026-62684

## Summary When a user creates a password-protected share or lists existing shares, the JSON response includes the full

历史摘要 · 未重新核验 · GitHub Advisory

File Browser: Archive builder turns backslash filenames into path traversal (zip-slip)

CVE-2026-62843

## Summary The fix for `GHSA-gxjx-7m74-hcq8` / `CVE-2026-54093` (shipped in v2.63.6) added a `strings.ReplaceAll(nameIn

历史摘要 · 未重新核验 · GitHub Advisory

protobufjs: Text Format string map parsing can mutate returned map object prototype

CVE-2026-59876

## Summary The protobuf.js text format extension parsed string-keyed map entries using ordinary property assignment. A

历史摘要 · 未重新核验 · GitHub Advisory

protobufjs: Denial of Service via infinite loop in .proto option parsing

CVE-2026-59877

## Summary protobufjs parsed option names by advancing through schema tokens until it reached an `=` token, without che

历史摘要 · 未重新核验 · GitHub Advisory

webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header

CVE-2026-14631

### Impact An unauthenticated peer that can reach the `webpack-dev-server` process can terminate it by sending either a

历史摘要 · 未重新核验 · GitHub Advisory

webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints

CVE-2026-14620

### Impact The internal `/webpack-dev-server/open-editor` and `/webpack-dev-server/invalidate` endpoints perform state-

历史摘要 · 未重新核验 · GitHub Advisory

Guzzle: Cookie Disclosure and Injection via IP-Address Domains

CVE-2026-59883

### Impact `CookieJar` does not restrict a cookie scoped to an IP address to the exact host that set it. When a stored

历史摘要 · 未重新核验 · GitHub Advisory

Astro: Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch

CVE-2026-59731

# Astro 6.4.7 Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch ## Summary As

历史摘要 · 未重新核验 · GitHub Advisory

Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files

CVE-2026-59946

## Summary A Composer package declares its executables in the `bin` field of its `composer.json`. When Composer install

历史摘要 · 未重新核验 · GitHub Advisory

Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure)

CVE-2026-59947

## Summary When Composer is run with -vvv (debug verbosity), it could print a credential that was embedded directly in

历史摘要 · 未重新核验 · GitHub Advisory

node-tar: Process crash via PAX numeric path type confusion

CVE-2026-59871

### Summary A crafted 2.5KB tar archive crashes any Node.js process that extracts it. The PAX header parser coerces all

历史摘要 · 未重新核验 · GitHub Advisory

node-tar: Decompression/parse DoS via unlimited input

CVE-2026-59873

### Summary A **Decompression/parse DoS via unlimited input** vulnerability in `node-tar` allows an attacker to exhaust

历史摘要 · 未重新核验 · GitHub Advisory

node-tar: Negative tar entry size causes infinite loop in archive replace

CVE-2026-59874

### Summary A checksum-valid tar archive with a negative base-256 encoded entry size can make `tar.replace()` loop fore

历史摘要 · 未重新核验 · GitHub Advisory

node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records

CVE-2026-59875

## Summary `node-tar` strips trailing `NUL` bytes from long-name (`L`) and long-linkpath (`K`) GNU extended headers but

历史摘要 · 未重新核验 · GitHub Advisory

Socket.IO: Engine.IO Polling Transport Connection Exhaustion

CVE-2026-59725

### Impact An unauthenticated remote attacker can cause a denial of service in affected versions of **engine.io** by op

历史摘要 · 未重新核验 · GitHub Advisory

shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)

CVE-2026-13311

### Summary `shell-quote`'s `parse()` finalizes its token list with a `reduce` that uses `Array.prototype.concat` as the

历史摘要 · 未重新核验 · GitHub Advisory