fastify is vulnerable to header validation bypass via case-sensitive propertyNames

CVE-2026-107832

### Impact Fastify lowercases header names in a `headers` schema before compilation, because Node.js stores request hea

历史摘要 · 未重新核验 · GitHub Advisory

toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype

CVE-2026-114142

### Summary CVE-2026-63376 described prototype pollution through __proto__ key-path desynchronization and was fixed in 4

历史摘要 · 未重新核验 · GitHub Advisory

toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()

CVE-2026-114141

## Summary `toml.parse()` is vulnerable to a quadratic-complexity (O(n²)) denial-of-service via many array-of-tables (`

历史摘要 · 未重新核验 · GitHub Advisory

toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()

CVE-2026-114143

## Summary `toml.parse()` is vulnerable to a quadratic-complexity (O(n²)) denial-of-service via a single long dotted ke

历史摘要 · 未重新核验 · GitHub Advisory

toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()

CVE-2026-114144

### Summary `toml.parse()` converts integer literals (hex, octal, binary, and decimal) to `BigInt` without first boundin

历史摘要 · 未重新核验 · GitHub Advisory

Storybook dev server vulnerable to code injection from the local network

CVE-2026-114126

**Summary:** The Storybook dev server exposes its WebSocket authentication token to any client that can load its HTML pa

历史摘要 · 未重新核验 · GitHub Advisory

Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering

CVE-2026-114128

## Summary Astro's JSX and MDX rendering pipeline treated string children of `` and `` elements as trusted HTML. When a

历史摘要 · 未重新核验 · GitHub Advisory

Astro: Arbitrary CSS injection in Astro View Transitions

CVE-2026-114127

### Summary Astro's server-side View Transition CSS generator did not keep string animation properties within their gen

历史摘要 · 未重新核验 · GitHub Advisory

GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments

CVE-2026-114604

## Report metadata | Field | Value | | --- | --- | | Package | `@graphql-tools/utils` (npm, `pkg:github/ardatan/graphql

历史摘要 · 未重新核验 · GitHub Advisory

DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes

## Summary When DOMPurify is configured with `SAFE_FOR_TEMPLATES: true` together with a DOM-returning mode (`RETURN_DOM

历史摘要 · 未重新核验 · GitHub Advisory

DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)

### Summary The 3.4.16 fix for GHSA-p98j-92pf-mc4p only covers a hook that removes the node it was called for. If an `I

历史摘要 · 未重新核验 · GitHub Advisory

Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file

CVE-2026-112948

### Summary In Vitest 5, Vite's `server.fs.deny` is not applied as intended on Vitest's dev servers. Depending on the s

历史摘要 · 未重新核验 · GitHub Advisory

Vitest: Code injection via unauthenticated manual mock registration

CVE-2026-112949

### Summary `@vitest/mocker`'s `interceptorPlugin` accepts mock registrations on Vite's dev-server WebSocket with no au

历史摘要 · 未重新核验 · GitHub Advisory

Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix

CVE-2026-112950

## Summary The path traversal fix released for [GHSA-82fw-gwwq-j7x9](https://github.com/vitest-dev/vitest/security/advi

历史摘要 · 未重新核验 · GitHub Advisory

ApostropheCMS: Exposure of Sensitive Information via predictable export filenames

CVE-2026-112953

## Summary When a user exports content through `@apostrophecms/import-export`, the module copies the generated archive

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw: Browser CDP discovery could accept blocked WebSocket URLs

CVE-2026-62197

### Summary Browser CDP discovery could accept blocked WebSocket URLs. In affected versions, a lower-trust caller or co

历史摘要 · 未重新核验 · GitHub Advisory

Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites

CVE-2026-114125

**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affect

历史摘要 · 未重新核验 · GitHub Advisory

Electron: HID and USB permission checks can be attributed to the wrong origin

CVE-2026-113800

### Impact For `hid` and `usb` permission checks made from an iframe, `session.setPermissionCheckHandler` was given the

历史摘要 · 未重新核验 · GitHub Advisory

@angular/common: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035)

CVE-2026-111753

An incomplete fix for [GHSA-58c5-g7wp-6w37](https://github.com/angular/angular/security/advisories/GHSA-58c5-g7wp-6w37)

历史摘要 · 未重新核验 · GitHub Advisory

markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)

CVE-2026-111758

### Summary A link reference definition whose label or title is never closed is O(n²) in markdown-it 15.0.2 with defaul

历史摘要 · 未重新核验 · GitHub Advisory