Logo

The OpenJS Foundation's CVE Numbering Authority (CNA)

Security Advisories

Published CVEs for security vulnerabilities in OpenJS hosted projects. Subscribe via RSS to get notified of new advisories.

Date CVE ID Advisory Project Title
2026-08-03 CVE-2026-18248 Advisory @fastify/aws-lambda @fastify/aws-lambda vulnerable to Lambda event spoofing via client-controlled x-apigateway-event header
2026-07-31 CVE-2026-18446 Advisory fast-uri fast-uri vulnerable to host confusion via backslash authority introducer
2026-07-29 CVE-2026-15157 Advisory undici undici vulnerable to CRLF Injection via blob-like body 'type' property
2026-07-29 CVE-2026-14643 Advisory undici undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives
2026-07-29 CVE-2026-16728 Advisory undici undici vulnerable to downstream response desynchronization via retry interceptor
2026-07-29 CVE-2026-16729 Advisory undici undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields
2026-07-29 CVE-2026-13697 Advisory undici undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives
2026-07-29 CVE-2026-15144 Advisory @fastify/rate-limit @fastify/rate-limit vulnerable to rate-limit bypass via IPv6 address rotation
2026-07-29 CVE-2026-18174 Advisory @fastify/forwarded @fastify/forwarded vulnerable to improper input validation via unstripped tab characters in X-Forwarded-For
2026-07-23 CVE-2026-15074 Advisory @fastify/static @fastify/static vulnerable to route guard bypass via path traversal
2026-07-23 CVE-2026-7120 Advisory @fastify/static @fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths
2026-07-19 CVE-2026-16221 Advisory fast-uri fast-uri vulnerable to host confusion via literal backslash authority delimiter
2026-07-18 CVE-2026-16117 Advisory @fastify/http-proxy @fastify/http-proxy vulnerable to prefix escape via URL-encoded characters
2026-07-18 CVE-2026-15631 Advisory @fastify/http-proxy @fastify/http-proxy vulnerable to prefix escape via WebSocket path traversal
2026-07-18 CVE-2026-16158 Advisory @fastify/reply-from @fastify/reply-from vulnerable to cross-upstream request routing via URL cache key collision
2026-07-09 CVE-2026-12590 Advisory body-parser body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement
2026-07-03 CVE-2026-14631 Advisory webpack-dev-server webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header
2026-07-03 CVE-2026-14620 Advisory webpack-dev-server webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints
2026-07-01 CVE-2026-14181 Advisory @fastify/middie @fastify/middie standalone engine vulnerable to Denial of Service via malformed percent-encoded paths
2026-07-01 CVE-2026-14198 Advisory @fastify/middie @fastify/middie vulnerable to authorization bypass via encoded slash in path parameter values
2026-06-30 CVE-2026-6556 Advisory @fastify/express @fastify/express vulnerable to middleware bypass via non-string mount paths in prefixed plugins
2026-06-29 CVE-2026-13676 Advisory fast-uri fast-uri vulnerable to host confusion via failed IDN canonicalization
2026-06-17 CVE-2026-11525 Advisory undici undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching
2026-06-17 CVE-2026-6733 Advisory undici undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse
2026-06-17 CVE-2026-9678 Advisory undici undici vulnerable to cross-user information disclosure via shared cache whitespace bypass
2026-06-17 CVE-2026-9679 Advisory undici undici vulnerable to HTTP header injection via Set-Cookie percent-decoding
2026-06-17 CVE-2026-9697 Advisory undici undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent
2026-06-17 CVE-2026-6734 Advisory undici undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse
2026-06-17 CVE-2026-9675 Advisory undici undici WebSocket client vulnerable to denial of service via cumulative fragment bypass
2026-06-17 CVE-2026-12151 Advisory undici undici WebSocket client vulnerable to denial of service via fragment count bypass
2026-06-15 CVE-2026-9595 Advisory webpack-dev-server webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies
2026-06-15 CVE-2026-5038 Advisory multer multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads
2026-06-15 CVE-2026-5079 Advisory multer multer vulnerable to Denial of Service via deeply nested field names
2026-06-04 CVE-2026-10796 Advisory nvm nvm vulnerable to OS command injection via crafted version strings from a malicious Node.js mirror
2026-06-03 CVE-2026-5078 Advisory morgan morgan vulnerable to Log Forging via unneutralized control characters in :remote-user
2026-05-12 CVE-2026-8162 Advisory multiparty multiparty vulnerable to Denial of Service via Uncaught Exception in filename* parameter parsing
2026-05-12 CVE-2026-8161 Advisory multiparty multiparty vulnerable to Denial of Service via Prototype Pollution leading to Uncaught Exception
2026-05-12 CVE-2026-8159 Advisory multiparty multiparty vulnerable to ReDoS via filename parsing
2026-05-12 CVE-2026-6402 Advisory webpack-dev-server webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins
2026-05-05 CVE-2026-6322 Advisory fast-uri fast-uri vulnerable to host confusion via percent-encoded authority delimiters
2026-05-04 CVE-2026-6321 Advisory fast-uri fast-uri vulnerable to path traversal via percent-encoded dot segments
2026-05-04 CVE-2026-7768 Advisory @fastify/accepts-serializer @fastify/accepts-serializer vulnerable to Denial of Service via Unbounded Accept Header Cache Growth
2026-04-16 CVE-2026-33804 Advisory @fastify/middie @fastify/middie vulnerable to middleware bypass via deprecated ignoreDuplicateSlashes option
2026-04-16 CVE-2026-6270 Advisory @fastify/middie @fastify/middie vulnerable to middleware authentication bypass in child plugin scopes
2026-04-16 CVE-2026-6410 Advisory @fastify/static @fastify/static vulnerable to path traversal in directory listing
2026-04-16 CVE-2026-6414 Advisory @fastify/static @fastify/static vulnerable to route guard bypass via encoded path separators
2026-04-15 CVE-2026-33805 Advisory @fastify/reply-from @fastify/reply-from vulnerable to connection header abuse enabling stripping of proxy-added headers
2026-04-15 CVE-2026-33805 Advisory @fastify/http-proxy @fastify/reply-from vulnerable to connection header abuse enabling stripping of proxy-added headers
2026-04-15 CVE-2026-33807 Advisory @fastify/express @fastify/express vulnerable to middleware path doubling causing authentication bypass in child plugin scopes
2026-04-15 CVE-2026-33808 Advisory @fastify/express @fastify/express vulnerable to middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons)
2026-04-14 CVE-2026-33806 Advisory fastify fastify vulnerable to Body Schema Validation Bypass via Leading Space in Content-Type Header
2026-03-31 CVE-2026-4800 Advisory lodash Incomplete fix for CVE-2021-23337 allows code injection via _.template imports key names
2026-03-31 CVE-2026-2950 Advisory lodash lodash vulnerable to Prototype Pollution via array path bypass in _.unset and _.omit
2026-03-26 CVE-2026-4926 Advisory path-to-regexp path-to-regexp vulnerable to Denial of Service via sequential optional groups
2026-03-26 CVE-2026-4923 Advisory path-to-regexp ReDoS possible with multiple wildcards
2026-03-26 CVE-2026-4867 Advisory path-to-regexp path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters
2026-03-23 CVE-2026-3635 Advisory fastify Fastify request.protocol and request.host spoofable via X-Forwarded-Proto/Host from untrusted connections when trustProxy uses restrictive trust function
2026-03-12 CVE-2026-2581 Advisory undici Unbounded Memory Consumption in Undici's DeduplicationHandler via Response Buffering leads to DoS
2026-03-12 CVE-2026-1527 Advisory undici CRLF Injection in undici via upgrade option
2026-03-12 CVE-2026-1528 Advisory undici Malicious WebSocket 64-bit length overflows undici parser and crashes the client
2026-03-12 CVE-2026-2229 Advisory undici Unhandled Exception in undici WebSocket Client Due to Invalid server_max_window_bits Validation
2026-03-12 CVE-2026-1526 Advisory undici Unbounded Memory Consumption in undici WebSocket permessage-deflate Decompression
2026-03-12 CVE-2026-1525 Advisory undici Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling) in undici
2026-03-05 CVE-2026-3419 Advisory fastify Fastify vulnerable to missing end anchor in subtypeNameReg Allows Malformed Content-Types to Pass Validation
2026-03-04 CVE-2026-3520 Advisory multer Multer vulnerable to Denial of Service via uncontrolled recursion
2026-02-27 CVE-2026-2880 Advisory @fastify/middie @fastify/middie has an improper path normalization vulnerability
2026-02-27 CVE-2026-3304 Advisory multer Multer vulnerable to Denial of Service via incomplete cleanup
2026-02-27 CVE-2026-2359 Advisory multer multer vulnerable to Denial of Service via resource exhaustion
2026-01-21 CVE-2025-13465 Advisory lodash Prototype Pollution Vulnerability in Lodash `_.unset` and `_.omit` functions
2025-11-24 CVE-2025-13466 Advisory body-parser body-parser vulnerable to denial of service when url encoding is used
2025-07-17 CVE-2025-7339 Advisory on-headers on-headers vulnerable to http response header manipulation
2025-07-17 CVE-2025-7338 Advisory multer Multer vulnerable to Denial of Service via unhandled exception from malformed request