joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service

CVE-2026-118772

### Summary `Joi.string().email({ multiple: true })` takes quadratic time to split a value that contains a long run of

来源摘录 · GitHub Advisory

@hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service

CVE-2026-119202

### Summary `Content.disposition()` takes quadratic time when a `Content-Disposition` parameter contains a long token w

来源摘录 · GitHub Advisory

minimatch has potential denial of service via globparts amplification

CVE-2026-118764

minimatch 10.2.6 contains an attacker-controlled pattern amplification in firstPhasePreProcess() when optimizationLevel

来源摘录 · GitHub Advisory

Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal

CVE-2026-118773

### Summary In glob 13.0.6, an aborted async walk rejects or emits an error but continues recursively reading directori

来源摘录 · GitHub Advisory

Forge: ASN.1 OID first arc truncation in asn1.oidToDer

CVE-2026-118775

### Summary `asn1.oidToDer()` did not range-check the first two arcs of an OID string, so an OID such as `0.42.840.1135

来源摘录 · GitHub Advisory

Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie

CVE-2026-118777

### Summary The `forge.http` client stored cookies from `Set-Cookie` response headers in a plain object keyed by cookie

来源摘录 · GitHub Advisory

Forge: TLS client crash when the server sends no certificate

CVE-2026-118778

### Summary The forge TLS client's check for a missing server certificate read the wrong property and never ran. A malic

来源摘录 · GitHub Advisory

Forge: Regular expression denial of service in PEM decoding (pem.decode)

CVE-2026-118779

### Summary `pem.decode()`, which every node-forge API that parses PEM input uses, split messages with a regular express

来源摘录 · GitHub Advisory

Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)

CVE-2026-118781

### Summary `BigInteger.prototype.modInverse()` in node-forge's bundled jsbn library enters an infinite loop when the v

来源摘录 · GitHub Advisory

Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store

CVE-2026-118780

### Summary When a CA store created by `pki.createCaStore()` holds two or more certificates with the same subject name,

来源摘录 · GitHub Advisory

Forge: AES-GCM authentication bypass via unvalidated tagLength option

CVE-2026-119186

### Summary The AES-GCM mode in forge.cipher does not validate the tagLength option passed to start(). With a tagLength

来源摘录 · GitHub Advisory

Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count

CVE-2026-118782

### Summary forge.pkcs12.pkcs12FromAsn1() accepts a PKCS#12 MAC iteration count of zero (or less) from the input, and t

来源摘录 · GitHub Advisory

Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message

CVE-2026-119188

### Summary A connection created with `forge.tls.createConnection()` throws an uncaught `TypeError` from `process()` wh

来源摘录 · GitHub Advisory

Forge: Denial of service in TLS record processing via call stack exhaustion

CVE-2026-119187

### Summary Connections created with `forge.tls.createConnection()` processed received TLS records recursively, one sta

来源摘录 · GitHub Advisory

Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13

CVE-2026-119190

### Summary node-forge parses certificate extensions with the deprecated OIDs `2.5.29.10` and `2.5.29.13` as `basicConst

来源摘录 · GitHub Advisory

signalk-server has SSRF via absolute signalk.appIcon URL in the app store icon fetcher

### Summary The app store icon code (`dist/appstore/icon-probe.js` around line 200 and `icon-bytes.js` around line 138)

来源摘录 · GitHub Advisory

Signal K resources API path traversal can disclose the JWT signing secret and enable remote code execution

### Summary Path traversal in the Signal K resources and applicationData APIs lets an unauthenticated or low-privileged

来源摘录 · GitHub Advisory

@hapi/content provides HTTP Content-* header parsing. From 3.0.6 until 6.0.3, Content.disposition() uses an unanchored parameter-name expression in a global regular-expression s...

CVE-2026-119202

@hapi/content provides HTTP Content-* header parsing. From 3.0.6 until 6.0.3, Content.disposition() uses an unanchored p

来源摘录 · NVD / GitHub Advisory / OSV.dev

Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, nuxt dev stores a generated appSecret in <buildDir>/app-secret, by default .nuxt/app-secret,...

CVE-2026-119201

Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, nuxt dev stores a generated appSecr

来源摘录 · NVD / GitHub Advisory

Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, Nuxt resolves literal or percent-encoded dot segments before rendering a page while Nitro ro...

CVE-2026-119200

Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, Nuxt resolves literal or percent-en

来源摘录 · NVD / GitHub Advisory