tag
Express
Critical
Mongoose `populate()` Match `$where` Bypass Command Injection (CVE-2025-23061)
CVE-2025-23061·
Mongoose (Node.js MongoDB ODM)
unpatched
High
Sequelize ORM JSON Cast SQL Injection — CVE-2026-30951
CVE-2026-30951·
Sequelize ORM v6 (Node.js)
patched
Critical
Node.js protobufjs Dynamic Type Compilation RCE (CVE-2026-41242)
CVE-2026-41242·
Node.js application using protobufjs (Root.fromJSON + dynamic decode)
unpatched
High
Multer Orphaned Temporary File Disk-Exhaustion DoS — CVE-2026-3304
CVE-2026-3304·
Multer (Node.js multipart/form-data middleware for Express)
patched
Critical
Handlebars AST Injection Remote Code Execution — CVE-2026-33937
CVE-2026-33937·
Handlebars (Node.js templating engine)
patched