undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering

CVE-2026-109932

### Impact undici's WebSocket client (including Node.js's bundled `globalThis.WebSocket`) can be driven to exhaust proc

历史摘要 · 未重新核验 · GitHub Advisory

undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor

CVE-2026-87029

## Impact undici's `decompress` interceptor forwards decompressed response data to the downstream handler from zlib str

历史摘要 · 未重新核验 · GitHub Advisory

MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length

### Summary In affected versions, MCP servers reachable over HTTP put no limit on the size of a POST body or on the numb

历史摘要 · 未重新核验 · GitHub Advisory

qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)

CVE-2026-110816

## Summary `qs.stringify(obj, { arrayFormat: 'comma' })` throws an uncaught `TypeError: Cannot convert object to primit

历史摘要 · 未重新核验 · GitHub Advisory

undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake

CVE-2026-109855

### Impact undici's experimental WebSocket client (enabled by default via `allowH2: true`) crashes the Node.js process

历史摘要 · 未重新核验 · GitHub Advisory

MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint

CVE-2026-109461

### Impact Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attack

历史摘要 · 未重新核验 · GitHub Advisory

undici vulnerable to Denial of Service via unhandled error on excessive content-encodings

CVE-2026-109869

### Impact undici's `fetch()` crashes the Node.js process when a malicious server returns a response with more than fiv

历史摘要 · 未重新核验 · GitHub Advisory

undici vulnerable to Denial of Service via unbounded memory in the EventSource parser

CVE-2026-109924

### Impact undici's `EventSource` client can be driven to exhaust process memory by a malicious or compromised Server-S

历史摘要 · 未重新核验 · GitHub Advisory

undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens

CVE-2026-109841

### Impact undici's `fetch()` verifies Subresource Integrity (SRI) metadata by looking up the algorithm token in a lowe

历史摘要 · 未重新核验 · GitHub Advisory

Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body

CVE-2026-115897

### Impact `serialize-javascript` escapes its output so it is safe to embed inside a `` element. Before 7.1.3 that guar

历史摘要 · 未重新核验 · GitHub Advisory

multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown

CVE-2026-113872

### Impact When `multer` is configured with an asynchronous `fileFilter`, a single request can crash the Node.js proces

历史摘要 · 未重新核验 · GitHub Advisory

Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution

CVE-2026-115895

## Summary The ESM compiler in `happy-dom@20.14.5` does not validate imported local binding aliases before interpolatin

历史摘要 · 未重新核验 · GitHub Advisory

Fallow: A `.*` glob segment let an analyzed repository make Fallow test paths in the parent of the project root

### Impact Fallow expands some globs from the analyzed repository on disk. Before 3.34.0, a segment such as `.*`, `.?`

历史摘要 · 未重新核验 · GitHub Advisory

Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root

CVE-2026-115569

### Impact Fallow reads the Jest and Vitest configs of the repository that it analyzes. A Jest `projects` entry or a Vi

历史摘要 · 未重新核验 · GitHub Advisory

postal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded words

### Impact Decoding a header that holds a long run of joinable RFC 2047 base64 encoded words, such as `=?utf-8?B?QUJD?=

历史摘要 · 未重新核验 · GitHub Advisory

Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient

### Vulnerability summary RFC 5322 comments nest. addressparser ended a comment at the first `)`, including the one tha

历史摘要 · 未重新核验 · GitHub Advisory

Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient

### Vulnerability summary addressparser ends an RFC 5322 group at the first `;`, including one inside a quoted display

历史摘要 · 未重新核验 · GitHub Advisory

Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name

### Vulnerability summary addressparser ends an angle-addr at the first `>` it sees, including one inside a quoted loca

历史摘要 · 未重新核验 · GitHub Advisory

fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding

CVE-2026-110306

### Impact `fast-uri` percent-decodes the scheme component with the legacy global `unescape()` before validating it, so

历史摘要 · 未重新核验 · GitHub Advisory

fast-uri vulnerable to improper path equivalence in relative reference normalization

CVE-2026-110095

### Impact `fast-uri`'s `normalize()` and `serialize()` apply RFC 3986 dot-segment removal (`remove_dot_segments`) to t

历史摘要 · 未重新核验 · GitHub Advisory