The OpenJS Foundation's CVE Numbering Authority (CNA)
Published CVEs for security vulnerabilities in OpenJS hosted projects. Subscribe via RSS to get notified of new advisories.
| Date | CVE ID | Advisory | Project | Title |
|---|---|---|---|---|
| 2026-08-03 | CVE-2026-18248 | Advisory | @fastify/aws-lambda | @fastify/aws-lambda vulnerable to Lambda event spoofing via client-controlled x-apigateway-event header |
| 2026-07-31 | CVE-2026-18446 | Advisory | fast-uri | fast-uri vulnerable to host confusion via backslash authority introducer |
| 2026-07-29 | CVE-2026-15157 | Advisory | undici | undici vulnerable to CRLF Injection via blob-like body 'type' property |
| 2026-07-29 | CVE-2026-14643 | Advisory | undici | undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives |
| 2026-07-29 | CVE-2026-16728 | Advisory | undici | undici vulnerable to downstream response desynchronization via retry interceptor |
| 2026-07-29 | CVE-2026-16729 | Advisory | undici | undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields |
| 2026-07-29 | CVE-2026-13697 | Advisory | undici | undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives |
| 2026-07-29 | CVE-2026-15144 | Advisory | @fastify/rate-limit | @fastify/rate-limit vulnerable to rate-limit bypass via IPv6 address rotation |
| 2026-07-29 | CVE-2026-18174 | Advisory | @fastify/forwarded | @fastify/forwarded vulnerable to improper input validation via unstripped tab characters in X-Forwarded-For |
| 2026-07-23 | CVE-2026-15074 | Advisory | @fastify/static | @fastify/static vulnerable to route guard bypass via path traversal |
| 2026-07-23 | CVE-2026-7120 | Advisory | @fastify/static | @fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths |
| 2026-07-19 | CVE-2026-16221 | Advisory | fast-uri | fast-uri vulnerable to host confusion via literal backslash authority delimiter |
| 2026-07-18 | CVE-2026-16117 | Advisory | @fastify/http-proxy | @fastify/http-proxy vulnerable to prefix escape via URL-encoded characters |
| 2026-07-18 | CVE-2026-15631 | Advisory | @fastify/http-proxy | @fastify/http-proxy vulnerable to prefix escape via WebSocket path traversal |
| 2026-07-18 | CVE-2026-16158 | Advisory | @fastify/reply-from | @fastify/reply-from vulnerable to cross-upstream request routing via URL cache key collision |
| 2026-07-09 | CVE-2026-12590 | Advisory | body-parser | body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement |
| 2026-07-03 | CVE-2026-14631 | Advisory | webpack-dev-server | webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header |
| 2026-07-03 | CVE-2026-14620 | Advisory | webpack-dev-server | webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints |
| 2026-07-01 | CVE-2026-14181 | Advisory | @fastify/middie | @fastify/middie standalone engine vulnerable to Denial of Service via malformed percent-encoded paths |
| 2026-07-01 | CVE-2026-14198 | Advisory | @fastify/middie | @fastify/middie vulnerable to authorization bypass via encoded slash in path parameter values |
| 2026-06-30 | CVE-2026-6556 | Advisory | @fastify/express | @fastify/express vulnerable to middleware bypass via non-string mount paths in prefixed plugins |
| 2026-06-29 | CVE-2026-13676 | Advisory | fast-uri | fast-uri vulnerable to host confusion via failed IDN canonicalization |
| 2026-06-17 | CVE-2026-11525 | Advisory | undici | undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching |
| 2026-06-17 | CVE-2026-6733 | Advisory | undici | undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse |
| 2026-06-17 | CVE-2026-9678 | Advisory | undici | undici vulnerable to cross-user information disclosure via shared cache whitespace bypass |
| 2026-06-17 | CVE-2026-9679 | Advisory | undici | undici vulnerable to HTTP header injection via Set-Cookie percent-decoding |
| 2026-06-17 | CVE-2026-9697 | Advisory | undici | undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent |
| 2026-06-17 | CVE-2026-6734 | Advisory | undici | undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse |
| 2026-06-17 | CVE-2026-9675 | Advisory | undici | undici WebSocket client vulnerable to denial of service via cumulative fragment bypass |
| 2026-06-17 | CVE-2026-12151 | Advisory | undici | undici WebSocket client vulnerable to denial of service via fragment count bypass |
| 2026-06-15 | CVE-2026-9595 | Advisory | webpack-dev-server | webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies |
| 2026-06-15 | CVE-2026-5038 | Advisory | multer | multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads |
| 2026-06-15 | CVE-2026-5079 | Advisory | multer | multer vulnerable to Denial of Service via deeply nested field names |
| 2026-06-04 | CVE-2026-10796 | Advisory | nvm | nvm vulnerable to OS command injection via crafted version strings from a malicious Node.js mirror |
| 2026-06-03 | CVE-2026-5078 | Advisory | morgan | morgan vulnerable to Log Forging via unneutralized control characters in :remote-user |
| 2026-05-12 | CVE-2026-8162 | Advisory | multiparty | multiparty vulnerable to Denial of Service via Uncaught Exception in filename* parameter parsing |
| 2026-05-12 | CVE-2026-8161 | Advisory | multiparty | multiparty vulnerable to Denial of Service via Prototype Pollution leading to Uncaught Exception |
| 2026-05-12 | CVE-2026-8159 | Advisory | multiparty | multiparty vulnerable to ReDoS via filename parsing |
| 2026-05-12 | CVE-2026-6402 | Advisory | webpack-dev-server | webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins |
| 2026-05-05 | CVE-2026-6322 | Advisory | fast-uri | fast-uri vulnerable to host confusion via percent-encoded authority delimiters |
| 2026-05-04 | CVE-2026-6321 | Advisory | fast-uri | fast-uri vulnerable to path traversal via percent-encoded dot segments |
| 2026-05-04 | CVE-2026-7768 | Advisory | @fastify/accepts-serializer | @fastify/accepts-serializer vulnerable to Denial of Service via Unbounded Accept Header Cache Growth |
| 2026-04-16 | CVE-2026-33804 | Advisory | @fastify/middie | @fastify/middie vulnerable to middleware bypass via deprecated ignoreDuplicateSlashes option |
| 2026-04-16 | CVE-2026-6270 | Advisory | @fastify/middie | @fastify/middie vulnerable to middleware authentication bypass in child plugin scopes |
| 2026-04-16 | CVE-2026-6410 | Advisory | @fastify/static | @fastify/static vulnerable to path traversal in directory listing |
| 2026-04-16 | CVE-2026-6414 | Advisory | @fastify/static | @fastify/static vulnerable to route guard bypass via encoded path separators |
| 2026-04-15 | CVE-2026-33805 | Advisory | @fastify/reply-from | @fastify/reply-from vulnerable to connection header abuse enabling stripping of proxy-added headers |
| 2026-04-15 | CVE-2026-33805 | Advisory | @fastify/http-proxy | @fastify/reply-from vulnerable to connection header abuse enabling stripping of proxy-added headers |
| 2026-04-15 | CVE-2026-33807 | Advisory | @fastify/express | @fastify/express vulnerable to middleware path doubling causing authentication bypass in child plugin scopes |
| 2026-04-15 | CVE-2026-33808 | Advisory | @fastify/express | @fastify/express vulnerable to middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons) |
| 2026-04-14 | CVE-2026-33806 | Advisory | fastify | fastify vulnerable to Body Schema Validation Bypass via Leading Space in Content-Type Header |
| 2026-03-31 | CVE-2026-4800 | Advisory | lodash | Incomplete fix for CVE-2021-23337 allows code injection via _.template imports key names |
| 2026-03-31 | CVE-2026-2950 | Advisory | lodash | lodash vulnerable to Prototype Pollution via array path bypass in _.unset and _.omit |
| 2026-03-26 | CVE-2026-4926 | Advisory | path-to-regexp | path-to-regexp vulnerable to Denial of Service via sequential optional groups |
| 2026-03-26 | CVE-2026-4923 | Advisory | path-to-regexp | ReDoS possible with multiple wildcards |
| 2026-03-26 | CVE-2026-4867 | Advisory | path-to-regexp | path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters |
| 2026-03-23 | CVE-2026-3635 | Advisory | fastify | Fastify request.protocol and request.host spoofable via X-Forwarded-Proto/Host from untrusted connections when trustProxy uses restrictive trust function |
| 2026-03-12 | CVE-2026-2581 | Advisory | undici | Unbounded Memory Consumption in Undici's DeduplicationHandler via Response Buffering leads to DoS |
| 2026-03-12 | CVE-2026-1527 | Advisory | undici | CRLF Injection in undici via upgrade option |
| 2026-03-12 | CVE-2026-1528 | Advisory | undici | Malicious WebSocket 64-bit length overflows undici parser and crashes the client |
| 2026-03-12 | CVE-2026-2229 | Advisory | undici | Unhandled Exception in undici WebSocket Client Due to Invalid server_max_window_bits Validation |
| 2026-03-12 | CVE-2026-1526 | Advisory | undici | Unbounded Memory Consumption in undici WebSocket permessage-deflate Decompression |
| 2026-03-12 | CVE-2026-1525 | Advisory | undici | Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling) in undici |
| 2026-03-05 | CVE-2026-3419 | Advisory | fastify | Fastify vulnerable to missing end anchor in subtypeNameReg Allows Malformed Content-Types to Pass Validation |
| 2026-03-04 | CVE-2026-3520 | Advisory | multer | Multer vulnerable to Denial of Service via uncontrolled recursion |
| 2026-02-27 | CVE-2026-2880 | Advisory | @fastify/middie | @fastify/middie has an improper path normalization vulnerability |
| 2026-02-27 | CVE-2026-3304 | Advisory | multer | Multer vulnerable to Denial of Service via incomplete cleanup |
| 2026-02-27 | CVE-2026-2359 | Advisory | multer | multer vulnerable to Denial of Service via resource exhaustion |
| 2026-01-21 | CVE-2025-13465 | Advisory | lodash | Prototype Pollution Vulnerability in Lodash `_.unset` and `_.omit` functions |
| 2025-11-24 | CVE-2025-13466 | Advisory | body-parser | body-parser vulnerable to denial of service when url encoding is used |
| 2025-07-17 | CVE-2025-7339 | Advisory | on-headers | on-headers vulnerable to http response header manipulation |
| 2025-07-17 | CVE-2025-7338 | Advisory | multer | Multer vulnerable to Denial of Service via unhandled exception from malformed request |