ssrfcheck: SSRF Bypass Caused by Failure to Classify Reserved IP Address Space as Invalid

CVE-2025-8267

# SSRF Bypass in `ssrfcheck` - fails to classify reserved IP address space as invalid `ssrfcheck` is an npm package tha

历史摘要 · 未重新核验 · GitHub Advisory

link-preview-js vulnerable to IPv6 and internal loopback attacks

CVE-2026-43897

### Impact The library did not check for IPv6 loopback attacks. There was also a DNS attack, where an address could be r

历史摘要 · 未重新核验 · GitHub Advisory

exiftool-vendored vulnerable to argument injection via newline characters in tag names

CVE-2026-43893

### Impact `exiftool-vendored` starts ExifTool in `-stay_open True -@ -` mode, where arguments are read from stdin one

历史摘要 · 未重新核验 · GitHub Advisory

Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream

CVE-2026-42037

### Summary The `FormDataPart` constructor in `lib/helpers/formDataToStream.js` interpolates `value.type` directly into

历史摘要 · 未重新核验 · GitHub Advisory

Axios: no_proxy bypass via IP alias allows SSRF

CVE-2026-42038

The fix for no_proxy hostname normalization bypass (#10661) is incomplete.When no_proxy=localhost is set, requests to 12

历史摘要 · 未重新核验 · GitHub Advisory

Axios: unbounded recursion in toFormData causes DoS via deeply nested request data

CVE-2026-42039

### Summary toFormData recursively walks nested objects with no depth limit, so a deeply nested value passed as request

历史摘要 · 未重新核验 · GitHub Advisory

Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0

CVE-2026-42034

### Summary For stream request bodies, maxBodyLength is bypassed when maxRedirects is set to 0 (native http/https trans

历史摘要 · 未重新核验 · GitHub Advisory

Axios: HTTP adapter streamed responses bypass maxContentLength

CVE-2026-42036

### Summary When responseType: 'stream' is used, Axios returns the response stream without enforcing maxContentLength.

历史摘要 · 未重新核验 · GitHub Advisory

Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking

CVE-2026-42033

## Summary When `Object.prototype` has been polluted by any co-dependency with keys that axios reads without a `hasOwnP

历史摘要 · 未重新核验 · GitHub Advisory

Axios: Header Injection via Prototype Pollution

CVE-2026-42035

### Summary A prototype pollution gadget exists in the Axios HTTP adapter (lib/adapters/http.js) that allows an attacke

历史摘要 · 未重新核验 · GitHub Advisory

Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion

CVE-2026-42042

# Vulnerability Disclosure: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Co

历史摘要 · 未重新核验 · GitHub Advisory

Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy

CVE-2026-42041

# Vulnerability Disclosure: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy ##

历史摘要 · 未重新核验 · GitHub Advisory

Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0

CVE-2026-42043

**1. Executive Summary** This report documents an **incomplete security patch** for the previously disclosed vulnerabili

历史摘要 · 未重新核验 · GitHub Advisory

Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`

CVE-2026-42044

# Vulnerability Disclosure: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver` ## Summa

历史摘要 · 未重新核验 · GitHub Advisory

Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking

CVE-2026-42264

## Summary Five config properties in the HTTP adapter are read via direct property access without `hasOwnProperty` guar

历史摘要 · 未重新核验 · GitHub Advisory

Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams

CVE-2026-42040

# Vulnerability Disclosure: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams ## Summary The `encode()`

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw's Gateway Control UI bootstrap config required Gateway auth

## Summary Gateway Control UI bootstrap config required Gateway auth. ## Affected Packages / Versions - Package: opencl

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw: OpenShell FS bridge reads pin and verify the opened file before returning bytes

## Summary OpenShell FS bridge reads pin and verify the opened file before returning bytes ## Affected Packages / Versi

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw: OpenShell FS bridge writes stay pinned to the sandbox mount root

## Summary OpenShell FS bridge writes stay pinned to the sandbox mount root. ## Affected Packages / Versions - Package:

历史摘要 · 未重新核验 · GitHub Advisory

Signal K Server's WebSocket Login Endpoint Lacks Rate Limiting (Credential Brute-Force)

CVE-2026-41893

## Summary The HTTP login endpoints (`POST /login` and `POST /signalk/v1/auth/login`) are protected by `express-rate-li

历史摘要 · 未重新核验 · GitHub Advisory