tag
Nodejs
React Server Components Flight-Protocol Prototype Pollution RCE — "React2Shell" (CVE-2025-55182)
CVE-2025-55182, dubbed "React2Shell", is a critical unauthenticated remote code execution vulnerability in React Server Components' Flight protocol deserialization. The Flight protocol serializes/deserializes component data exchanged between client and…
Mongoose `populate()` Match `$where` Bypass Command Injection (CVE-2025-23061)
CVE-2025-23061 is an incomplete-fix bypass of CVE-2024-53900, a NoSQL/command injection vulnerability in the Mongoose ODM for Node.js. The original fix blocked $where operators submitted directly inside a populate() match filter, but failed to sanitize $where…
WebSocket Authentication Brute-Force via Missing Rate Limiting (CVE-2026-27778)
This repository is a hands-on simulator for CVE-2026-27778 (CWE-307: Improper Restriction of Excessive Authentication Attempts) built around a small Node.js/Express server that accepts WebSocket AUTHREQ messages containing a password guess and replies with…
Supply Chain Command Injection in AWS CDK's NodejsFunction — CVE-2026-11417
The AWS CDK NodejsFunction construct bundles Lambda handlers with esbuild during cdk synth, and prior to 2.245.0 it built the esbuild invocation by directly interpolating several user/construct-controlled properties (externalModules, loader, define, inject,…
Sequelize ORM JSON Cast SQL Injection — CVE-2026-30951
Sequelize v6's JSON/JSONB where-clause processing treats the portion of a JSON path key following a :: delimiter as a SQL cast type, inserting it into the generated SQL query without validation. If an application allows attacker-controlled JSON object keys to…
Postiz Arbitrary File Upload to Stored XSS / Account Takeover (CVE-2026-40487)
Postiz accepts file uploads for post media and validates the file type solely from the client-supplied Content-Type header, with no inspection of the actual file bytes. An attacker can upload an SVG (or HTML) file containing embedded JavaScript while…
PolarLearn Forum Vote Count Manipulation (CVE-2026-25126)
CVE-2026-25126 is a business logic flaw in PolarLearn's forum voting API. The POST /api/v1/forum/vote endpoint declares a TypeScript type for the direction field but never validates it at runtime, so the server accepts arbitrary string values instead of only…
Orval OpenAPI Codegen Arbitrary Code Execution via Malicious Spec (CVE-2026-23947)
Orval generates TypeScript client code from OpenAPI specifications, and it copies certain vendor-extension fields — specifically x-enumDescriptions and x-enumNames — directly into generated source as comments/string literals without escaping. By crafting an…
oRPC OpenAPI Reference Plugin Stored XSS via Unescaped Spec Embedding (CVE-2026-33331)
oRPC's OpenAPI reference plugin renders the generated API docs page by embedding the OpenAPI spec directly into an inline <script id="spec" type="application/json"> block using JSON.stringify(spec), with no HTML-context encoding. Because JSON.stringify() does…
npm `tar` Package Unicode-Normalization Race Condition / File Collision (CVE-2026-2395)
The tar npm package's parallel-extraction mode (jobs > 1) is vulnerable to a race condition rooted in Unicode normalization differences: filenames like collisionss and collisionß can be treated as the same target path due to case/normalization handling, even…
Node.js protobufjs Dynamic Type Compilation RCE (CVE-2026-41242)
The demo Express service accepts a JSON protobuf descriptor from an HTTP request body and passes it straight to protobuf.Root.fromJSON(), then looks up and decodes a message type from that attacker-controlled descriptor. Because protobufjs compiles field/type…
Node.js `tar` Package Symlink Path Traversal — CVE-2026-29786
The tar package's extraction engine does not sufficiently validate destination paths when an archive entry is of type symlink. An attacker can craft a tarball containing a symlink entry that points outside the intended extraction directory (e.g. to…
node-tar Hardlink/Symlink Path Traversal Arbitrary File Overwrite (CVE-2026-23745)
node-tar fails to sanitize absolute paths supplied in the linkpath field of hardlink and symlink tar entries. In src/unpack.ts, the library resolves the link target with path.resolve(this.cwd, String(entry.linkpath)), but path.resolve() ignores the base cwd…
Next.js Vendored picomatch Vulnerable Dependency — CVE-2026-33671
Next.js 16.2.4 vendors a copy of the picomatch glob-matching library inside its own compiled output at nodemodules/next/dist/compiled/picomatch/, pinned to version 4.0.3, which is affected by CVE-2026-33671. Because the vendored copy has its package.json…
Multiparty Denial of Service via Prototype-Pollution Field Name (CVE-2026-8161)
multiparty@4.2.3 and earlier store parsed multipart field names and files in plain JavaScript objects and rely on ordinary property lookup (fields[name], files[name]) to detect whether a field has been seen before. Because plain-object lookups traverse the…
Multer Orphaned Temporary File Disk-Exhaustion DoS — CVE-2026-3304
Multer versions before 2.1.0 can leave temporary uploaded files permanently on disk when a multipart request is malformed in a specific way while using an asynchronous fileFilter callback (e.g., one deferred via setImmediate). When a valid file part is…
MikroORM Custom Type Raw SQL Injection (CVE-2026-34220)
CVE-2026-34220 is a SQL injection vulnerability in MikroORM's handling of Custom Type columns. When a client-supplied JSON value contains a raw property, MikroORM's internal isRaw() check treats it as a trusted, framework-generated Raw SQL expression rather…
Math.js Expression Parser Sandbox Bypass RCE (CVE-2026-40897)
Math.js exposes an expression-evaluation API (math.evaluate) intended to run untrusted mathematical expressions inside a restricted sandbox that blocks access to dangerous properties such as constructor. The isSafeProperty guard only inspects direct property…
LiquidJS Template Engine Path Traversal — CVE-2026-30952
LiquidJS's layout, render, and include tags can resolve absolute file paths even when a root directory restriction is configured, because the library's fallback path-resolution logic does not properly verify that the resolved path stays within the configured…
HAXcms Node.js Private Key Disclosure via Broken HMAC (CVE-2026-46395)
The hmacBase64() function in HAXcms's Node.js backend contains two cryptographic flaws: it signs data with the hard-coded literal key "0" instead of the real signing key, and then appends the real key (privateKey + salt) in plaintext onto the returned token.…
Handlebars AST Injection Remote Code Execution — CVE-2026-33937
Handlebars' Handlebars.compile() accepts either a plain template string or a pre-parsed AST object; when given an AST object directly, the normal template-parsing phase (which would otherwise escape/validate literal values) is skipped entirely. Inside the…
Ghost CMS Theme JSONPath Remote Code Execution — CVE-2026-29053
Ghost CMS uses the jsonpath package, which internally relies on static-eval to interpret JSONPath filter expressions embedded in Handlebars theme templates. static-eval is explicitly documented upstream as unsafe for untrusted input, yet Ghost passes…
exiftool-vendored.js Argument Injection via Newline-Delimited Tag Names (CVE-2026-43893)
exiftool-vendored sends caller-supplied strings (tag names in the object passed to exiftool.write(), filenames, and other options) to the underlying ExifTool process via stdin, one argument per line, without filtering embedded newline/carriage-return/NUL…
DbGate `loadReader` `functionName` Injection RCE (CVE-2026-48017)
DbGate's POST /runners/load-reader endpoint takes a functionName parameter and concatenates it directly into a JavaScript template string that is later executed in a forked runner process, without sanitization or validation. An authenticated attacker can…
AdonisJS bodyparser Path Traversal to Arbitrary File Write (CVE-2026-21440)
CVE-2026-21440 is a path-traversal vulnerability in @adonisjs/bodyparser's MultipartFile.move() method. When an application calls file.move(location) without explicitly supplying a sanitized name option, the library falls back to the client-supplied original…
NodeBB ActivityPub attributedTo Local UID Spoof
NodeBB's ActivityPub inbox authenticates the top-level signed actor of an incoming activity via HTTP Signatures, but never checks that the embedded Note.attributedTo field — used later as the internal local user id for chat message and post authorship —…