Skip to content

Commit 5641393

Browse files
authored
chore: update CVE overview (#10057)
2 parents 65a48d9 + 49647eb commit 5641393

1 file changed

Lines changed: 18 additions & 21 deletions

File tree

docs/CVE_OVERVIEW.md

Lines changed: 18 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,9 @@
88

99
| Severity | v4 | v3 | v2 | v1 |
1010
| -------- | --: | --: | --: | --: |
11-
| critical | 0 | 1 | 0 | 0 |
12-
| high | 0 | 1 | 0 | 6 |
13-
| moderate | 0 | 2 | 0 | 9 |
11+
| critical | 0 | 0 | 0 | 0 |
12+
| high | 0 | 0 | 0 | 6 |
13+
| moderate | 0 | 0 | 0 | 10 |
1414
| low | 0 | 0 | 0 | 0 |
1515
| info | 0 | 0 | 0 | 0 |
1616
| unknown | 0 | 0 | 0 | 0 |
@@ -19,10 +19,8 @@
1919

2020
| Package | Severity | CVE | Affected Versions | Description |
2121
| -------------------- | -------- | ------------------- | ----------------- | --------------------------------------------------------------------------------- |
22-
| protobufjs | critical | CVE-2026-41242 | v3 | Arbitrary code execution in protobufjs |
2322
| basic-ftp | high | GHSA-6v7q-wjvx-w8wg | v1 | basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Exe |
24-
| basic-ftp | high | GHSA-rp42-5vxx-qpwr | v1 | basic-ftp vulnerable to denial of service via unbounded memory consumption in Cl |
25-
| fastify | high | CVE-2026-33806 | v3 | Fastify has a Body Schema Validation Bypass via Leading Space in Content-Type He |
23+
| basic-ftp | high | CVE-2026-41324 | v1 | basic-ftp vulnerable to denial of service via unbounded memory consumption in Cl |
2624
| lodash.pick | high | CVE-2020-8203 | v1 | Prototype Pollution in lodash |
2725
| minimatch | high | CVE-2026-27903 | v1 | minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adja |
2826
| minimatch | high | CVE-2026-27904 | v1 | minimatch ReDoS: nested \*() extglobs generate catastrophically backtracking regu |
@@ -33,8 +31,8 @@
3331
| dompurify | moderate | CVE-2026-41240 | v1 | DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry |
3432
| dompurify | moderate | CVE-2026-41239 | v1 | DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode |
3533
| dompurify | moderate | CVE-2026-41238 | v1 | DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallbac |
36-
| follow-redirects | moderate | GHSA-r4q5-vmmm-2653 | v3, v1 | follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Ta |
37-
| hono | moderate | GHSA-458j-xx4x-4375 | v3 | hono Improperly Handles JSX Attribute Names Allows HTML Injection in hono/jsx SS |
34+
| follow-redirects | moderate | GHSA-r4q5-vmmm-2653 | v1 | follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Ta |
35+
| postcss | moderate | CVE-2026-41305 | v1 | PostCSS has XSS via Unescaped </style> in its CSS Stringify Output |
3836
| serialize-javascript | moderate | CVE-2026-34043 | v1 | Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like |
3937
| uuid | moderate | GHSA-w5hq-g745-h8pq | v1 | uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided |
4038

@@ -44,9 +42,9 @@
4442

4543
| Severity | v4 | v3 | v2 | v1 |
4644
| -------- | --: | --: | --: | --: |
47-
| critical | 5 | 6 | 5 | 3 |
48-
| high | 39 | 34 | 45 | 31 |
49-
| moderate | 21 | 24 | 38 | 16 |
45+
| critical | 5 | 5 | 5 | 3 |
46+
| high | 36 | 33 | 45 | 31 |
47+
| moderate | 22 | 23 | 39 | 17 |
5048
| low | 4 | 4 | 9 | 1 |
5149
| info | 0 | 0 | 0 | 0 |
5250
| unknown | 0 | 0 | 0 | 0 |
@@ -60,7 +58,6 @@
6058
| handlebars | critical | CVE-2026-33937 | v4, v3, v2, v1 | Handlebars.js has JavaScript Injection via AST Type Confusion |
6159
| locutus | critical | CVE-2026-25521 | v4, v3, v2, v1 | locutus is vulnerable to Prototype Pollution |
6260
| locutus | critical | CVE-2026-32304 | v4, v3, v2, v1 | Locutus vulnerable to RCE via unsanitized input in create_function() |
63-
| protobufjs | critical | CVE-2026-41242 | v3 | Arbitrary code execution in protobufjs |
6461
| @angular/common | high | CVE-2025-66035 | v1 | Angular is Vulnerable to XSRF Token Leakage via Protocol-Relative URLs in Angula |
6562
| @angular/compiler | high | CVE-2025-66412 | v1 | Angular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML Attribute |
6663
| @angular/compiler | high | CVE-2026-22610 | v1 | Angular has XSS Vulnerability via Unsanitized SVG Script Attributes |
@@ -69,20 +66,19 @@
6966
| @angular/core | high | CVE-2026-27970 | v1 | Angular i18n vulnerable to Cross-Site Scripting |
7067
| @angular/core | high | CVE-2026-32635 | v1 | Angular vulnerable to XSS in i18n attribute bindings |
7168
| @hono/node-server | high | CVE-2026-29087 | v2 | @hono/node-server has authorization bypass for protected static paths via encode |
72-
| @xmldom/xmldom | high | CVE-2026-34601 | v4 | xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled |
7369
| @xmldom/xmldom | high | CVE-2026-41673 | v4 | xmldom: Uncontrolled recursion in XML serialization leads to DoS |
7470
| @xmldom/xmldom | high | CVE-2026-41674 | v4 | xmldom has XML injection through unvalidated DocumentType serialization |
7571
| @xmldom/xmldom | high | CVE-2026-41675 | v4 | xmldom has XML node injection through unvalidated processing instruction seriali |
7672
| @xmldom/xmldom | high | CVE-2026-41672 | v4 | xmldom has XML node injection through unvalidated comment serialization |
73+
| @xmldom/xmldom | high | CVE-2026-34601 | v4 | xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled |
7774
| axios | high | CVE-2026-25639 | v3, v2 | Axios is Vulnerable to Denial of Service via **proto** Key in mergeConfig |
7875
| basic-ftp | high | GHSA-6v7q-wjvx-w8wg | v4, v3, v2, v1 | basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Exe |
79-
| basic-ftp | high | GHSA-rp42-5vxx-qpwr | v4, v3, v2, v1 | basic-ftp vulnerable to denial of service via unbounded memory consumption in Cl |
76+
| basic-ftp | high | CVE-2026-41324 | v4, v3, v2, v1 | basic-ftp vulnerable to denial of service via unbounded memory consumption in Cl |
8077
| braces | high | CVE-2024-4068 | v3, v2, v1 | Uncontrolled resource consumption in braces |
8178
| express-rate-limit | high | CVE-2026-30827 | v2 | express-rate-limit: IPv4-mapped IPv6 addresses bypass per-client rate limiting o |
8279
| fast-xml-parser | high | CVE-2026-25128 | v4, v3, v2 | fast-xml-parser has RangeError DoS Numeric Entities Bug |
8380
| fast-xml-parser | high | CVE-2026-26278 | v4, v3, v2 | fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansio |
8481
| fast-xml-parser | high | CVE-2026-33036 | v4, v3, v2 | fast-xml-parser affected by numeric entity expansion bypassing all entity expans |
85-
| fastify | high | CVE-2026-33806 | v3 | Fastify has a Body Schema Validation Bypass via Leading Space in Content-Type He |
8682
| flatted | high | CVE-2026-32141 | v4, v3, v2 | flatted vulnerable to unbounded recursion DoS in parse() revive phase |
8783
| flatted | high | CVE-2026-33228 | v4, v3, v2 | Prototype Pollution via parse() in NodeJS flatted |
8884
| handlebars | high | CVE-2026-33938 | v4, v3, v2, v1 | Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @part |
@@ -110,9 +106,9 @@
110106
| svgo | high | CVE-2026-29074 | v4, v3, v2, v1 | SVGO DoS through entity expansion in DOCTYPE (Billion Laughs) |
111107
| tar | high | CVE-2026-24842 | v1 | node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Trave |
112108
| tar | high | CVE-2026-23745 | v1 | node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Ins |
113-
| tar | high | CVE-2026-26960 | v4, v1 | Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in no |
114-
| tar | high | CVE-2026-29786 | v4, v1 | tar has Hardlink Path Traversal via Drive-Relative Linkpath |
115-
| tar | high | CVE-2026-31802 | v4, v1 | node-tar Symlink Path Traversal via Drive-Relative Linkpath |
109+
| tar | high | CVE-2026-26960 | v1 | Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in no |
110+
| tar | high | CVE-2026-29786 | v1 | tar has Hardlink Path Traversal via Drive-Relative Linkpath |
111+
| tar | high | CVE-2026-31802 | v1 | node-tar Symlink Path Traversal via Drive-Relative Linkpath |
116112
| tar | high | CVE-2026-23950 | v1 | Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on |
117113
| undici | high | CVE-2026-1528 | v4, v3, v2 | Undici: Malicious WebSocket 64-bit length overflows parser and crashes the clien |
118114
| undici | high | CVE-2026-1526 | v4, v3, v2 | Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompre |
@@ -133,24 +129,25 @@
133129
| fast-xml-parser | moderate | CVE-2026-33349 | v4, v3, v2 | Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evalua |
134130
| fast-xml-parser | moderate | CVE-2026-41650 | v4, v3, v2 | fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimi |
135131
| file-type | moderate | CVE-2026-31808 | v4 | file-type affected by infinite loop in ASF parser on malformed input with zero-s |
136-
| follow-redirects | moderate | GHSA-r4q5-vmmm-2653 | v3, v1 | follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Ta |
132+
| follow-redirects | moderate | GHSA-r4q5-vmmm-2653 | v1 | follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Ta |
137133
| handlebars | moderate | CVE-2026-33916 | v4, v3, v2, v1 | Handlebars.js has Prototype Pollution Leading to XSS through Partial Template In |
138134
| handlebars | moderate | GHSA-7rx3-28cr-v5wh | v4, v3, v2, v1 | Handlebars.js has a Prototype Method Access Control Gap via Missing \_\_lookupSett |
139135
| hono | moderate | CVE-2026-29086 | v2 | Hono Vulnerable to Cookie Attribute Injection via Unsanitized domain and path in |
140136
| hono | moderate | CVE-2026-29085 | v2 | Hono Vulnerable to SSE Control Field Injection via CR/LF in writeSSE() |
141137
| hono | moderate | GHSA-v8w9-8mx6-g223 | v2 | Hono vulnerable to Prototype Pollution possible through **proto** key allowed in |
142138
| hono | moderate | GHSA-26pp-8wgv-hjvm | v2 | Hono missing validation of cookie name on write path in setCookie() |
143139
| hono | moderate | CVE-2026-39410 | v2 | Hono: Non-breaking space prefix bypass in cookie name handling in getCookie() |
144-
| hono | moderate | CVE-2026-39409 | v2 | Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses |
145140
| hono | moderate | CVE-2026-39408 | v2 | Hono: Path traversal in toSSG() allows writing files outside the output director |
146141
| hono | moderate | CVE-2026-39407 | v2 | Hono: Middleware bypass via repeated slashes in serveStatic |
147-
| hono | moderate | GHSA-458j-xx4x-4375 | v3, v2 | hono Improperly Handles JSX Attribute Names Allows HTML Injection in hono/jsx SS |
142+
| hono | moderate | GHSA-458j-xx4x-4375 | v2 | hono Improperly Handles JSX Attribute Names Allows HTML Injection in hono/jsx SS |
143+
| hono | moderate | CVE-2026-39409 | v2 | Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses |
148144
| js-yaml | moderate | CVE-2025-64718 | v2 | js-yaml has prototype pollution in merge (<<) |
149145
| locutus | moderate | CVE-2026-33993 | v4, v3, v2, v1 | Locutus has Prototype Pollution via **proto** Key Injection in unserialize() |
150146
| lodash | moderate | CVE-2026-2950 | v4, v3 | lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and |
151147
| micromatch | moderate | CVE-2024-4067 | v3, v2, v1 | Regular Expression Denial of Service (ReDoS) in micromatch |
152148
| nanoid | moderate | CVE-2024-55565 | v2 | Predictable results in nanoid generation when given non-integer values |
153149
| path-to-regexp | moderate | CVE-2026-4923 | v2 | path-to-regexp vulnerable to Regular Expression Denial of Service via multiple w |
150+
| postcss | moderate | CVE-2026-41305 | v4, v3, v2, v1 | PostCSS has XSS via Unescaped </style> in its CSS Stringify Output |
154151
| qs | moderate | CVE-2025-15284 | v2 | qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion |
155152
| serialize-javascript | moderate | CVE-2026-34043 | v4, v3, v2, v1 | Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like |
156153
| serialize-javascript | moderate | CVE-2024-11831 | v2 | Cross-site Scripting (XSS) in serialize-javascript |

0 commit comments

Comments
 (0)