Nest: Remote process termination via a deeply nested microservice message pattern

CVE-2026-102281

| Field | Value | | --- | --- | | Ecosystem | npm | | Package | `@nestjs/microservices` | | Affected versions | `>= 12.0

历史摘要 · 未重新核验 · GitHub Advisory

fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets

CVE-2026-86472

### Impact `fast-uri` folds the host to lowercase before it percent-decodes the host, so a percent-encoded uppercase un

历史摘要 · 未重新核验 · GitHub Advisory

fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization

CVE-2026-86818

### Impact `fast-uri`'s `mailto` scheme parser compares each query field name to the reserved names (`to`, `subject`, `

历史摘要 · 未重新核验 · GitHub Advisory

@xhmikosr/decompress: Path traversal via symlink chain

CVE-2026-101894

### Impact When extracting an untrusted archive with the default `decompress(input, output)` API, a crafted archive con

历史摘要 · 未重新核验 · GitHub Advisory

ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside...

CVE-2026-101912

### Summary `isInSubnet()` and `isHostInSubnet()` accept an address of either family and compare masked binary strings

历史摘要 · 未重新核验 · GitHub Advisory

ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process

CVE-2026-101911

### Summary `new Address6()` and `Address6.isValid()` place no bound on the length of the string they parse. When the s

历史摘要 · 未重新核验 · GitHub Advisory

moment vulnerable to Path Traversal via crafted non-string locale name

CVE-2026-17495

### Impact moment before 2.31.0 is vulnerable to path traversal in `moment.locale()`. When an application passes a non-

历史摘要 · 未重新核验 · GitHub Advisory

brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service

CVE-2026-102277

### Summary Expanding `{a},b}`-shaped input takes time quadratic in the number of literal `}` characters, blocking the

历史摘要 · 未重新核验 · GitHub Advisory

brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion

CVE-2026-102278

### Summary `expand_()` recurses once per level of brace *nesting*. Deeply nested input exhausts the native stack and c

历史摘要 · 未重新核验 · GitHub Advisory

brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion

CVE-2026-102276

### Summary `parseCommaParts()` can exhaust the native stack and crash the process. There are two distinct ways to trig

历史摘要 · 未重新核验 · GitHub Advisory

Socket.IO: Engine.IO Protocol Revision Mismatch DoS

CVE-2026-102599

### Impact A denial-of-service vulnerability exists in Engine.IO / Socket.IO servers that allow transport upgrades. Th

历史摘要 · 未重新核验 · GitHub Advisory

Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing

## Summary Nodemailer's address parser can produce an unexpected recipient address when an RFC 5322 comment follows the

历史摘要 · 未重新核验 · GitHub Advisory

Nodemailer: Quadratic backtracking in the addressparser free-text fallback allows remote denial of service

### Summary When `addressparser` finds no address by its strict reading, it falls back to pulling one out of the free t

历史摘要 · 未重新核验 · GitHub Advisory

adm-zip: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different content

### Summary A ZIP file can contain two entries with the identical name. adm-zip keeps both in its internal entry list,

历史摘要 · 未重新核验 · GitHub Advisory

adm-zip: getDataAsync() bypasses the maxOutputLength size guard enforced by the synchronous getData() path

### Summary adm-zip enforces a `maxOutputLength` guard against decompression bombs on its synchronous `getData()` path,

历史摘要 · 未重新核验 · GitHub Advisory

adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process (DoS)

## Summary Denial of Service in `adm-zip`'s async decompression API allows an unauthenticated attacker to crash the ent

历史摘要 · 未重新核验 · GitHub Advisory

adm-zip: Decompression-bomb protection (fix for CVE-2026-39244) can be bypassed by declaring uncompressed size as 0

**Affected package:** adm-zip (npm) **Affected version:** 0.6.0 ## Summary The fix shipped for CVE-2026-39244 (`method

历史摘要 · 未重新核验 · GitHub Advisory

adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation

CVE-2026-102282

## Summary adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via `fs.chmodS

历史摘要 · 未重新核验 · GitHub Advisory

Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoS

## Submission metadata | Field | Value | |---|---| | Ecosystem | npm | | Package | `nodemailer` | | Repository | https:

历史摘要 · 未重新核验 · GitHub Advisory

Nodemailer: Process-global DNS cache reuses TLS `servername` across transports, enabling cross-tenant SMTP credential disclosure

### Summary Nodemailer's process-global DNS cache is keyed only by `host`, but each cache entry also stores the caller-

历史摘要 · 未重新核验 · GitHub Advisory