OpenAPI3 version value escapes `emitterOutputDir` and overwrites YAML/JSON outside the output tree

### Summary The `@typespec/openapi3` emitter retains the value of a `@versioned` enum member and interpolates it into t

历史摘要 · 未重新核验 · GitHub Advisory

multer vulnerable to Denial of Service via crafted multipart field names

CVE-2026-77078

### Impact A vulnerability in multer allows a remote, unauthenticated attacker to crash the Node.js process with a sing

历史摘要 · 未重新核验 · GitHub Advisory

multer vulnerable to Denial of Service via file descriptor leak on aborted uploads

CVE-2026-77037

### Impact A vulnerability in multer `2.2.0` allows an attacker to trigger a Denial of Service (DoS) by aborting or tru

历史摘要 · 未重新核验 · GitHub Advisory

multer vulnerable to file size limit bypass via async fileFilter race condition

CVE-2026-77063

### Impact When `multer` is configured with an asynchronous `fileFilter`, the `limits.fileSize` limit can be bypassed.

历史摘要 · 未重新核验 · GitHub Advisory

multer vulnerable to Denial of Service via oversized array index in field names

CVE-2026-82333

### Impact multer is vulnerable to a Denial of Service (DoS) via a crafted array index in multipart field names. The `a

历史摘要 · 未重新核验 · GitHub Advisory

morgan vulnerable to Log Forging via unescaped Unicode line separators

CVE-2026-15603

### Impact Morgan writes attacker-controlled request data to the access log through its tokens. The 1.11.0 fix neutrali

历史摘要 · 未重新核验 · GitHub Advisory

Astro: Remote code execution through AVIF image optimization

A vulnerability in `libheif`, used by the default Sharp image service in Astro, can lead to remote code execution when a

历史摘要 · 未重新核验 · GitHub Advisory

Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base

CVE-2026-84376

## Summary Astro stripped a configured `base` path from request pathnames using a string-prefix check that did not veri

历史摘要 · 未重新核验 · GitHub Advisory

sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545

### Impact A number of vulnerabilities, two rated as "Critical" severity using CVSSv3, have been discovered and fixed in

历史摘要 · 未重新核验 · GitHub Advisory

js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

CVE-2026-84375

## Summary `maxTotalMergeKeys` does not count empty mappings. An attacker can repeatedly merge a large sequence of them

历史摘要 · 未重新核验 · GitHub Advisory

Tiptap: Quadratic ReDoS in block and inline Markdown attribute parsing

## Summary `@tiptap/core` contains two quadratic regular-expression denial-of-service paths in its default Markdown att

历史摘要 · 未重新核验 · GitHub Advisory

Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory

CVE-2026-84365

### Summary The fix released for CVE-2026-39408 does not cover every traversal sequence. `toSSG()` can still write file

历史摘要 · 未重新核验 · GitHub Advisory

Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion

CVE-2026-84364

### Summary When `parseBody()` expands dot-separated form field names into nested objects, it does not limit the nestin

历史摘要 · 未重新核验 · GitHub Advisory

Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

CVE-2026-84363

### Summary Hono's query parsing does not stop at the URL fragment: a `?` appearing after a `#` is treated as the start

历史摘要 · 未重新核验 · GitHub Advisory

Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

A vulnerability in the underlying `libheif` library used by `sharp` which Next.js uses for image optimization can lead t

历史摘要 · 未重新核验 · GitHub Advisory

SVGO: removeScripts allows executable links through namespace and control-character bypasses

CVE-2026-84370

## Summary SVGO's opt-in `removeScripts` plugin failed to remove some executable links. Namespace-prefixed SVG anchors

历史摘要 · 未重新核验 · GitHub Advisory

SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements

CVE-2026-84369

## Summary SVGO's opt-in `removeScripts` plugin did not inspect executable HTML content inside SVG `` elements. Applica

历史摘要 · 未重新核验 · GitHub Advisory

Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disableUrlAccess when called with the legacy signature

### Summary Nodemailer's `disableFileAccess` / `disableUrlAccess` options are a security sandbox that lets an applicati

历史摘要 · 未重新核验 · GitHub Advisory

xmldom: Processing Instruction Target Injection Bypasses requireWellFormed

CVE-2026-83616

## Summary `Document.createProcessingInstruction()` in `@xmldom/xmldom` performs no validation on the `target` paramete

历史摘要 · 未重新核验 · GitHub Advisory

xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator

CVE-2026-83617

## Summary An embedded line terminator bypasses the `requireWellFormed` serializer check for element and attribute name

历史摘要 · 未重新核验 · GitHub Advisory