Security Advisories | GitStock

high2026-09-30

CVE-2026-97689-urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory

urllib3/urllib3 · GHSA-vxq7-64xx-v4gw

high2026-09-30

CVE-2026-97687-urllib3: HTTPS proxy TLS configuration may be ignored or overridden

urllib3/urllib3 · GHSA-8988-9cw3-xx77

medium2026-09-30

Nest: Unbounded memory growth in the NestJS TCP microservice transport

nestjs/nest · GHSA-96h4-vgxj-gvm2

high2026-09-30

@nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets

nestjs/nest · GHSA-9c5c-9qcx-q35q

high2026-09-30

CVE-2026-90776-Nodemailer addressparser: O(n^2) on comment-joined addresses enables a remote DoS (reachable via mailparser)

nodemailer/nodemailer · GHSA-prgh-xp8r-p3m5

medium2026-09-30

CVE-2026-102270-PyJWT: ReDoS vulnerability when calling the `is_pem_format` function.

jpadilla/pyjwt · GHSA-jwrc-g2q2-pq5p

high2026-09-29

CVE-2026-102281-Nest: Remote process termination via a deeply nested microservice message pattern

nestjs/nest · GHSA-m8vh-jmq9-5rjg

medium2026-09-29

CVE-2026-86472-fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets

fastify/fast-uri · GHSA-hrr3-gc8f-f4qj

medium2026-09-29

CVE-2026-86818-fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization

fastify/fast-uri · GHSA-jvvf-x445-j334

critical2026-09-29

CVE-2026-101894-@xhmikosr/decompress: Path traversal via symlink chain

xhmikosr/decompress · GHSA-hrh2-vp3x-79xf

medium2026-09-29

CVE-2026-101912-ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range

beaugunderson/ip-address · GHSA-j6r3-76f7-8jcv

medium2026-09-29

CVE-2026-101911-ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process

beaugunderson/ip-address · GHSA-h3mg-xc3c-68pw

medium2026-09-29

CVE-2026-17495-moment vulnerable to Path Traversal via crafted non-string locale name

moment/moment · GHSA-4p3w-j4w9-5jqw

medium2026-09-29

CVE-2026-102277-brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service

juliangruber/brace-expansion · GHSA-q2hr-2g5m-vwhr

high2026-09-29

CVE-2026-102278-brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion

juliangruber/brace-expansion · GHSA-qhr7-859c-m2p7

high2026-09-29

CVE-2026-102276-brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion

juliangruber/brace-expansion · GHSA-6j4f-fj2g-mc7p

high2026-09-29

CVE-2026-102599-Socket.IO: Engine.IO Protocol Revision Mismatch DoS

socketio/socket.io · GHSA-2gc4-cqfq-p2gv

medium2026-09-29

Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing

nodemailer/nodemailer · GHSA-g57g-f23g-4646

high2026-09-29

Nodemailer: Quadratic backtracking in the addressparser free-text fallback allows remote denial of service

nodemailer/nodemailer · GHSA-v53p-9fqp-m79j

high2026-09-29

CVE-2026-102266-PyJWT: PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation

jpadilla/pyjwt · GHSA-9j54-fg26-wv3r

← Previous 1 47 48 49 50 51 1536 Next →