Security advisories

critical2026-05-29

CVE-2026-47140-NodeVM builtin denylist bypass via process and inspector/promises allows host code execution

patriksimek/vm2 · GHSA-rp36-8xq3-r6c4

high2026-05-29

CVE-2026-8813-ExifReader is vulnerable to denial of service via crafted ICC `mluc` tag

mattiasw/exifreader · GHSA-h64w-w9pr-82m4

medium2026-05-29

CVE-2026-8814-ExifReader is vulnerable to denial of service via unbounded decompression of image metadata

mattiasw/exifreader · GHSA-rr89-w3h9-m66j

critical2026-05-29

CVE-2026-47210-vm2 sandbox escape via JSPI-backed Promise `.finally()` species bypass

patriksimek/vm2 · GHSA-6j2x-vhqr-qr7q

critical2026-05-29

CVE-2026-47137-vm2 has a CVE-2023-37903 patch bypass: nesting:true without explicit require still allows full RCE

patriksimek/vm2 · GHSA-m4wx-m65x-ghrr

high2026-05-29

CVE-2026-47209-vm2's Bridge Proxy set trap ignores receiver parameter, enabling host object property injection via prototype chain

patriksimek/vm2 · GHSA-c4cf-2hgv-2qv6

high2026-05-29

CVE-2026-47135-vm2 has a sandbox escape via unblocked cross-realm Symbol.for keys + missing bridge write-trap symbol checks

patriksimek/vm2 · GHSA-m5q2-4fm3-vfqp

critical2026-05-29

CVE-2026-47208-vm2 is Vulnerable to Sandbox Breakout Through Promise Species

patriksimek/vm2 · GHSA-76w7-j9cq-rx2j

low2026-05-29

vm2 setup-sandbox.js violates Defense Invariant #11 in stack-trace formatter

patriksimek/vm2 · GHSA-q3fm-4wcw-g57x

critical2026-05-29

CVE-2026-47131-vm2 has a Sandbox Escape issue

patriksimek/vm2 · GHSA-v6mx-mf47-r5wg

medium2026-05-29

CVE-2026-47200-Nuxt's route middleware is not enforced when rendering `.server.vue` pages via `/__nuxt_island/page_*`

nuxt/nuxt · GHSA-hg3f-28rg-4jxj

high2026-05-29

CVE-2026-45742-Gotenberg has a Race Condition via Multipart `downloadFrom` Handling

gotenberg/gotenberg · GHSA-vp73-vjw8-8f32

high2026-05-29

CVE-2026-45741-Gotenberg has an SSRF deny-list bypass in IsPublicIP via IPv6 6to4 / NAT64 / site-local prefixes

gotenberg/gotenberg · GHSA-86m8-88fq-xfxp

high2026-05-29

CVE-2026-44829-Gotenberg has path traversal in zip entry name via Windows-style separators in upload filename

gotenberg/gotenberg · GHSA-hwc4-gmrw-5222

high2026-05-29

CVE-2026-44495-axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

axios/axios · GHSA-3g43-6gmg-66jw

high2026-05-29

CVE-2026-44494-axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

axios/axios · GHSA-35jp-ww65-95wh

high2026-05-29

CVE-2026-44492-axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)

axios/axios · GHSA-pjwm-pj3p-43mv

medium2026-05-29

CVE-2026-44490-axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions

axios/axios · GHSA-898c-q2cr-xwhg

low2026-05-29

CVE-2026-44489-Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix

axios/axios · GHSA-654m-c8p4-x5fp

high2026-05-29

CVE-2026-41237-Froxlor has an incomplete fix for CVE-2026-30932

froxlor/froxlor · GHSA-j6fm-9rfm-j5hx