Security Advisories

high2026-09-30

CVE-2026-84504-fastify vulnerable to request body replacement via an async validation result collision

View chart

fastify/fastify · GHSA-667r-xxjv-c9mm

high2026-09-30

CVE-2026-76169-fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers

View chart

fastify/fastify · GHSA-p68q-wchp-6fh7

high2026-09-30

CVE-2026-84469-fastify vulnerable to request validation bypass via skipped boolean false schemas

View chart

fastify/fastify · GHSA-hwr6-493r-vm6h

high2026-09-30

CVE-2026-84428-fastify vulnerable to header validation bypass via incomplete schema case normalization

View chart

fastify/fastify · GHSA-9q9j-q6p8-xq58

medium2026-09-30

CVE-2026-102820-pageant: Out-of-bounds read / oversized allocation in `pageant` MemoryMap::read via a malicious Pageant agent (Windows)

View chart

eugeny/russh · GHSA-g4mp-vgx3-xrvm

medium2026-09-30

CVE-2026-102821-Russh: Unbounded memory exhaustion via CHANNEL_OPEN flood during a client-stalled rekey

View chart

eugeny/russh · GHSA-35g8-35p8-c8fw

medium2026-09-30

CVE-2026-102983-Astro: Netlify Image CDN allowlist bypass enables SSRF

View chart

withastro/astro · GHSA-4233-jc72-56c5

high2026-09-30

CVE-2026-102984-Astro: Malformed port in the Host header can crash the Node adapter

View chart

withastro/astro · GHSA-qh8j-hqjv-7m4x

high2026-09-30

CVE-2026-87819-GitPython: Denial of Service via catastrophic backtracking (ReDoS) in Actor.name_email_regex — commit author/committer field parsing

View chart

gitpython-developers/gitpython · GHSA-g5vv-9gxw-82hx

medium2026-09-30

GitPython: --no-index bypasses diff unsafe-option protections and enables a blind local-file content oracle

View chart

gitpython-developers/gitpython · GHSA-whh4-5q6c-9v3x

high2026-09-30

CVE-2026-87817-GitPython: Repository content can impersonate the git directory, leading to arbitrary code execution

View chart

gitpython-developers/gitpython · GHSA-239g-whfq-7xj9

low2026-09-30

CVE-2026-102822-russh: negotiating a MAC-requiring block cipher (CTR/CBC) with mac=none causes a slice-index-out-of-range panic

View chart

eugeny/russh · GHSA-p8qx-h547-fjw9

high2026-09-30

CVE-2026-102823-russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never opened

View chart

eugeny/russh · GHSA-47hw-gvq5-r2gm

medium2026-09-30

CVE-2026-102824-Russh: Missing X25519 zero-point validation in hybrid ML-KEM key exchange

View chart

eugeny/russh · GHSA-w3jg-pjxf-73p4

low2026-09-30

CVE-2026-102825-Russh: Configured server auth-attempt cap is not enforced in the USERAUTH_REQUEST runtime path

View chart

eugeny/russh · GHSA-g6xm-f9xp-qq35

medium2026-09-30

CVE-2026-84377-LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters

View chart

berriai/litellm · GHSA-3cv6-jpf6-8222

medium2026-09-30

CVE-2026-101918-PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)

View chart

jpadilla/pyjwt · GHSA-42vr-xj54-vc7v

high2026-09-30

CVE-2026-101896-Angular Server-Side Rendering (SSR): Denial of Service via Numeric URL Matrix Parameters

View chart

angular/angular · GHSA-ff3f-86qr-9cv3

low2026-09-30

CVE-2026-97711-Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodies

View chart

yahoo/serialize-javascript · GHSA-gfhx-hw2g-v5hg

low2026-09-30

DOMPurify: IN_PLACE: node-removing afterSanitize hook leaves detached subtree event handlers armed, causing DOM XSS

View chart

cure53/dompurify · GHSA-p98j-92pf-mc4p