Security advisories

medium2026-09-29

CVE-2026-84890-undici vulnerable to Denial of Service via unbounded decompression of compressed responses

View chart →

nodejs/undici · GHSA-3xpg-4rpp-hhhm

medium2026-09-29

CVE-2026-84933-undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches

View chart →

nodejs/undici · GHSA-2jfj-6hjv-fm6j

low2026-09-29

CVE-2026-84947-undici vulnerable to response truncation via oversized chunked responses in the dump interceptor

View chart →

nodejs/undici · GHSA-2gqq-gqf2-x968

high2026-09-29

CVE-2026-84961-undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool

View chart →

nodejs/undici · GHSA-w293-vg96-wgc3

low2026-09-29

CVE-2026-85008-undici vulnerable to caching and replay of unsafe HTTP method responses

View chart →

nodejs/undici · GHSA-8436-99hf-9mmv

high2026-09-29

CVE-2026-85152-undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors

View chart →

nodejs/undici · GHSA-vp8m-p9jh-q5pm

medium2026-09-29

CVE-2026-85014-undici vulnerable to Denial of Service via WebSocketStream unclean close

View chart →

nodejs/undici · GHSA-rx4f-c7p8-82vq

low2026-09-29

CVE-2026-102601-Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter

View chart →

thephpleague/flysystem · GHSA-cxf4-7mrp-vvpr

high2026-09-29

CVE-2026-92599-joi: Quadratic regular-expression backtracking in `Joi.string().isoDate()`

View chart →

hapijs/joi · GHSA-6h2x-m376-mqjq

medium2026-09-29

CVE-2026-102672-Electron: Local race condition in Squirrel.Mac update installation on macOS

View chart →

electron/electron · GHSA-vv43-5jgx-7qv8

high2026-09-29

CVE-2026-102673-Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab

View chart →

electron/electron · GHSA-hq2x-r82h-9wj4

high2026-09-29

CVE-2026-102674-Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions

View chart →

electron/electron · GHSA-gr2m-v5gq-v685

high2026-09-29

CVE-2026-102675-Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled

View chart →

electron/electron · GHSA-j84w-jfhq-vhvj

high2026-09-29

CVE-2026-102676-Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions

View chart →

electron/electron · GHSA-9qh4-3jw8-366w

high2026-09-29

CVE-2026-102677-Electron: Sandboxed preload code cache can be poisoned by a compromised renderer

View chart →

electron/electron · GHSA-qmv3-fv6v-rmhq

medium2026-09-29

CVE-2026-81872-OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full

View chart →

open-telemetry/opentelemetry-go · GHSA-hjf4-fphr-2h65

medium2026-09-29

CVE-2026-81869-OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation

View chart →

open-telemetry/opentelemetry-go · GHSA-p9f8-wvj8-2fg8

medium2026-09-29

markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds

View chart →

markdown-it/markdown-it · GHSA-253c-mchw-3w2r

medium2026-09-29

js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

View chart →

nodeca/js-yaml · GHSA-r3ph-w7gj-g6xm

high2026-09-29

CVE-2026-65954-PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()

View chart →

phpcsstandards/phpcsutils · GHSA-r6hr-vr92-vv28