| axios |
GHSA-gcfj-64vw-6mp9 |
高危 |
1.16.1 |
0.33.0, 1.18.0 |
Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning
漏洞详情: https://github.com/advisories/GHSA-gcfj-64vw-6mp9
镜像层: sha256:167b165efefd0eda6a5c24b4f82c20cd256be65921048b132681baad305739c0
发布日期: 2026-07-20 22:40 修改: 2026-07-20 22:40
|
| brace-expansion |
CVE-2026-13149 |
高危 |
1.1.13 |
5.0.7, 1.1.16, 2.1.2 |
brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-13149
镜像层: sha256:167b165efefd0eda6a5c24b4f82c20cd256be65921048b132681baad305739c0
发布日期: 2026-06-30 10:16 修改: 2026-07-08 12:17
|
| brace-expansion |
CVE-2026-13149 |
高危 |
2.0.3 |
5.0.7, 1.1.16, 2.1.2 |
brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-13149
镜像层: sha256:167b165efefd0eda6a5c24b4f82c20cd256be65921048b132681baad305739c0
发布日期: 2026-06-30 10:16 修改: 2026-07-08 12:17
|
| brace-expansion |
CVE-2026-13149 |
高危 |
5.0.5 |
5.0.7, 1.1.16, 2.1.2 |
brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-13149
镜像层: sha256:167b165efefd0eda6a5c24b4f82c20cd256be65921048b132681baad305739c0
发布日期: 2026-06-30 10:16 修改: 2026-07-08 12:17
|
| fast-uri |
CVE-2026-13676 |
高危 |
3.1.2 |
4.0.1, 3.1.3, 2.4.2 |
fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-13676
镜像层: sha256:167b165efefd0eda6a5c24b4f82c20cd256be65921048b132681baad305739c0
发布日期: 2026-06-29 14:16 修改: 2026-07-21 12:17
|
| fast-uri |
CVE-2026-16221 |
高危 |
3.1.2 |
2.4.3, 3.1.4, 4.1.1 |
Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x ...
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-16221
镜像层: sha256:167b165efefd0eda6a5c24b4f82c20cd256be65921048b132681baad305739c0
发布日期: 2026-07-19 15:16 修改: 2026-07-21 18:31
|
| fast-xml-parser |
GHSA-8r6m-32jq-jx6q |
高危 |
5.9.3 |
5.10.1 |
fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits
漏洞详情: https://github.com/advisories/GHSA-8r6m-32jq-jx6q
镜像层: sha256:167b165efefd0eda6a5c24b4f82c20cd256be65921048b132681baad305739c0
发布日期: 2026-07-21 22:06 修改: 2026-07-21 22:06
|
| js-yaml |
CVE-2026-59869 |
高危 |
4.1.1 |
3.15.0, 4.3.0 |
js-yaml: js-yaml: Denial of Service via crafted YAML documents
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-59869
镜像层: sha256:167b165efefd0eda6a5c24b4f82c20cd256be65921048b132681baad305739c0
发布日期: 2026-07-08 16:16 修改: 2026-07-13 15:05
|
| js-yaml |
CVE-2026-59869 |
高危 |
4.1.1 |
3.15.0, 4.3.0 |
js-yaml: js-yaml: Denial of Service via crafted YAML documents
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-59869
镜像层: sha256:5a13fd1f840e8da3513e40502b75d96cd5cbb627c3c368bf490b499d970a600d
发布日期: 2026-07-08 16:16 修改: 2026-07-13 15:05
|
| sharp |
GHSA-f88m-g3jw-g9cj |
高危 |
0.34.5 |
0.35.0 |
sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591
漏洞详情: https://github.com/advisories/GHSA-f88m-g3jw-g9cj
镜像层: sha256:167b165efefd0eda6a5c24b4f82c20cd256be65921048b132681baad305739c0
发布日期: 2026-07-21 22:07 修改: 2026-07-21 22:07
|
| svgo |
GHSA-2p49-hgcm-8545 |
高危 |
4.0.1 |
2.8.3, 3.3.4, 4.0.2 |
SVGO removeScripts plugin leaves some executable scripts intact
漏洞详情: https://github.com/advisories/GHSA-2p49-hgcm-8545
镜像层: sha256:167b165efefd0eda6a5c24b4f82c20cd256be65921048b132681baad305739c0
发布日期: 2026-07-21 19:42 修改: 2026-07-21 19:42
|
| systeminformation |
CVE-2026-50289 |
高危 |
5.31.6 |
5.31.7 |
systeminformation is a System and OS information library for node.js. ...
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-50289
镜像层: sha256:167b165efefd0eda6a5c24b4f82c20cd256be65921048b132681baad305739c0
发布日期: 2026-07-17 20:17 修改: 2026-07-20 17:17
|
| axios |
GHSA-pmv8-rq9r-6j72 |
中危 |
1.16.1 |
0.33.0, 1.18.0 |
Axios: Deep formToJSON Key Recursion Can Cause Denial of Service
漏洞详情: https://github.com/advisories/GHSA-pmv8-rq9r-6j72
镜像层: sha256:167b165efefd0eda6a5c24b4f82c20cd256be65921048b132681baad305739c0
发布日期: 2026-07-20 17:48 修改: 2026-07-20 17:48
|
| axios |
GHSA-xj6q-8x83-jv6g |
中危 |
1.16.1 |
1.18.0 |
Axios: Prototype pollution auth subfields can inject Basic auth
漏洞详情: https://github.com/advisories/GHSA-xj6q-8x83-jv6g
镜像层: sha256:167b165efefd0eda6a5c24b4f82c20cd256be65921048b132681baad305739c0
发布日期: 2026-07-20 17:51 修改: 2026-07-20 17:51
|
| @hono/node-server |
GHSA-frvp-7c67-39w9 |
中危 |
1.19.10 |
2.0.5 |
Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)
漏洞详情: https://github.com/advisories/GHSA-frvp-7c67-39w9
镜像层: sha256:167b165efefd0eda6a5c24b4f82c20cd256be65921048b132681baad305739c0
发布日期: 2026-07-21 18:17 修改: 2026-07-21 18:17
|
| @opentelemetry/core |
CVE-2026-54285 |
中危 |
2.0.1 |
2.8.0 |
@opentelemetry/core: opentelemetry-js: @opentelemetry/core: Denial of Service via oversized baggage HTTP headers
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-54285
镜像层: sha256:167b165efefd0eda6a5c24b4f82c20cd256be65921048b132681baad305739c0
发布日期: 2026-06-22 18:16 修改: 2026-06-23 16:17
|
| @opentelemetry/core |
CVE-2026-54285 |
中危 |
2.1.0 |
2.8.0 |
@opentelemetry/core: opentelemetry-js: @opentelemetry/core: Denial of Service via oversized baggage HTTP headers
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-54285
镜像层: sha256:167b165efefd0eda6a5c24b4f82c20cd256be65921048b132681baad305739c0
发布日期: 2026-06-22 18:16 修改: 2026-06-23 16:17
|
| brace-expansion |
CVE-2026-45149 |
中危 |
5.0.5 |
5.0.6 |
brace-expansion: brace-expansion: Denial of Service due to excessive memory allocation when expanding large numeric ranges
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-45149
镜像层: sha256:167b165efefd0eda6a5c24b4f82c20cd256be65921048b132681baad305739c0
发布日期: 2026-05-29 20:16 修改: 2026-07-22 06:10
|
| @hono/node-server |
CVE-2026-39406 |
中危 |
1.19.10 |
1.19.13 |
@hono/node-server: Middleware bypass via repeated slashes in serveStatic
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-39406
镜像层: sha256:167b165efefd0eda6a5c24b4f82c20cd256be65921048b132681baad305739c0
发布日期: 2026-04-08 15:16 修改: 2026-06-17 10:42
|
| axios |
GHSA-42h9-826w-cgv3 |
中危 |
1.16.1 |
0.33.0, 1.18.0 |
Axios: Excessive recursion in formDataToJSON can cause denial of service
漏洞详情: https://github.com/advisories/GHSA-42h9-826w-cgv3
镜像层: sha256:167b165efefd0eda6a5c24b4f82c20cd256be65921048b132681baad305739c0
发布日期: 2026-07-20 17:58 修改: 2026-07-20 17:58
|
| axios |
GHSA-7q8q-rj6j-mhjq |
中危 |
1.16.1 |
0.33.0, 1.18.0 |
Axios: Nested axios option objects can consume polluted prototype values
漏洞详情: https://github.com/advisories/GHSA-7q8q-rj6j-mhjq
镜像层: sha256:167b165efefd0eda6a5c24b4f82c20cd256be65921048b132681baad305739c0
发布日期: 2026-07-20 22:37 修改: 2026-07-20 22:37
|
| hono |
CVE-2026-59895 |
中危 |
4.12.25 |
4.12.27 |
Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-59895
镜像层: sha256:167b165efefd0eda6a5c24b4f82c20cd256be65921048b132681baad305739c0
发布日期: 2026-07-08 17:17 修改: 2026-07-10 19:53
|
| hono |
CVE-2026-59896 |
中危 |
4.12.25 |
4.12.27 |
hono/jsx does not isolate context per request, leading to cross-request data disclosure
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-59896
镜像层: sha256:167b165efefd0eda6a5c24b4f82c20cd256be65921048b132681baad305739c0
发布日期: 2026-07-08 17:17 修改: 2026-07-10 19:50
|
| hono |
CVE-2026-59897 |
中危 |
4.12.25 |
4.12.27 |
Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-59897
镜像层: sha256:167b165efefd0eda6a5c24b4f82c20cd256be65921048b132681baad305739c0
发布日期: 2026-07-08 17:17 修改: 2026-07-10 19:50
|
| ip-address |
CVE-2026-42338 |
中危 |
10.1.0 |
10.1.1 |
ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-42338
镜像层: sha256:167b165efefd0eda6a5c24b4f82c20cd256be65921048b132681baad305739c0
发布日期: 2026-05-12 20:16 修改: 2026-07-21 12:18
|
| joi |
CVE-2026-48038 |
中危 |
18.0.1 |
18.2.1, 17.13.4 |
joi: joi: Denial of Service via uncaught RangeError on deeply nested input through recursive link() schemas
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-48038
镜像层: sha256:167b165efefd0eda6a5c24b4f82c20cd256be65921048b132681baad305739c0
发布日期: 2026-07-14 20:17 修改: 2026-07-15 20:22
|
| axios |
GHSA-f4gw-2p7v-4548 |
中危 |
1.16.1 |
1.18.0, 0.33.0 |
Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios
漏洞详情: https://github.com/advisories/GHSA-f4gw-2p7v-4548
镜像层: sha256:167b165efefd0eda6a5c24b4f82c20cd256be65921048b132681baad305739c0
发布日期: 2026-07-20 22:20 修改: 2026-07-20 22:20
|
| axios |
GHSA-hcpx-6fm6-wx23 |
中危 |
1.16.1 |
0.33.0, 1.18.0 |
Axios form serializer maxDepth bypass via {} metatoken
漏洞详情: https://github.com/advisories/GHSA-hcpx-6fm6-wx23
镜像层: sha256:167b165efefd0eda6a5c24b4f82c20cd256be65921048b132681baad305739c0
发布日期: 2026-07-20 22:38 修改: 2026-07-20 22:38
|
| js-yaml |
CVE-2026-53550 |
中危 |
4.1.1 |
4.2.0, 3.15.0 |
js-yaml: js-yaml: Denial of Service via crafted YAML merge keys
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-53550
镜像层: sha256:167b165efefd0eda6a5c24b4f82c20cd256be65921048b132681baad305739c0
发布日期: 2026-06-22 16:16 修改: 2026-07-09 20:33
|
| js-yaml |
CVE-2026-53550 |
中危 |
4.1.1 |
4.2.0, 3.15.0 |
js-yaml: js-yaml: Denial of Service via crafted YAML merge keys
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-53550
镜像层: sha256:5a13fd1f840e8da3513e40502b75d96cd5cbb627c3c368bf490b499d970a600d
发布日期: 2026-06-22 16:16 修改: 2026-07-09 20:33
|
| protobufjs |
CVE-2026-54269 |
中危 |
7.6.1 |
7.6.3, 8.6.0 |
protobufjs: protobufjs-cli: protobufjs: Denial of Service due to name collision with runtime helpers
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-54269
镜像层: sha256:167b165efefd0eda6a5c24b4f82c20cd256be65921048b132681baad305739c0
发布日期: 2026-06-22 18:16 修改: 2026-06-24 20:40
|
| protobufjs |
CVE-2026-59877 |
中危 |
7.6.1 |
7.6.5, 8.6.6 |
protobufjs: Denial of Service via infinite loop in .proto option parsing
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-59877
镜像层: sha256:167b165efefd0eda6a5c24b4f82c20cd256be65921048b132681baad305739c0
发布日期: 2026-07-08 16:16 修改: 2026-07-10 18:53
|
| qs |
CVE-2025-15284 |
中危 |
6.13.0 |
6.14.1 |
qs: qs: Denial of Service via improper input validation in array parsing
漏洞详情: https://avd.aquasec.com/nvd/cve-2025-15284
镜像层: sha256:167b165efefd0eda6a5c24b4f82c20cd256be65921048b132681baad305739c0
发布日期: 2025-12-29 23:15 修改: 2026-06-17 08:37
|
| qs |
CVE-2026-8723 |
中危 |
6.13.0 |
6.15.2 |
### Summary `qs.stringify` throws `TypeError` when called with `arr ...
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-8723
镜像层: sha256:167b165efefd0eda6a5c24b4f82c20cd256be65921048b132681baad305739c0
发布日期: 2026-05-17 00:16 修改: 2026-06-17 11:04
|
| qs |
CVE-2026-8723 |
中危 |
6.14.2 |
6.15.2 |
### Summary `qs.stringify` throws `TypeError` when called with `arr ...
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-8723
镜像层: sha256:167b165efefd0eda6a5c24b4f82c20cd256be65921048b132681baad305739c0
发布日期: 2026-05-17 00:16 修改: 2026-06-17 11:04
|
| serialize-javascript |
CVE-2026-34043 |
中危 |
7.0.3 |
7.0.5 |
serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object serialization
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-34043
镜像层: sha256:167b165efefd0eda6a5c24b4f82c20cd256be65921048b132681baad305739c0
发布日期: 2026-03-31 03:15 修改: 2026-06-17 10:38
|
| axios |
GHSA-jqh4-m9w3-8hp9 |
中危 |
1.16.1 |
1.18.0 |
Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`
漏洞详情: https://github.com/advisories/GHSA-jqh4-m9w3-8hp9
镜像层: sha256:167b165efefd0eda6a5c24b4f82c20cd256be65921048b132681baad305739c0
发布日期: 2026-07-20 22:27 修改: 2026-07-20 22:27
|
| srvx |
CVE-2026-33732 |
中危 |
0.8.16 |
0.11.13 |
srvx is vulnerable to middleware bypass via absolute URI in request line
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-33732
镜像层: sha256:167b165efefd0eda6a5c24b4f82c20cd256be65921048b132681baad305739c0
发布日期: 2026-03-26 18:16 修改: 2026-06-17 10:38
|
| axios |
GHSA-mmx7-hfxf-jppx |
中危 |
1.16.1 |
1.18.0, 0.33.0 |
Axios: Prototype pollution gadgets can alter axios request construction
漏洞详情: https://github.com/advisories/GHSA-mmx7-hfxf-jppx
镜像层: sha256:167b165efefd0eda6a5c24b4f82c20cd256be65921048b132681baad305739c0
发布日期: 2026-07-20 22:25 修改: 2026-07-20 22:25
|
| axios |
GHSA-mwf2-3pr3-8698 |
中危 |
1.16.1 |
1.18.0 |
Axios: HTTP/2 streamed uploads bypass `maxBodyLength`
漏洞详情: https://github.com/advisories/GHSA-mwf2-3pr3-8698
镜像层: sha256:167b165efefd0eda6a5c24b4f82c20cd256be65921048b132681baad305739c0
发布日期: 2026-07-20 22:37 修改: 2026-07-20 22:37
|
| uuid |
CVE-2026-41907 |
中危 |
11.1.0 |
11.1.1, 12.0.1, 13.0.1 |
uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-41907
镜像层: sha256:167b165efefd0eda6a5c24b4f82c20cd256be65921048b132681baad305739c0
发布日期: 2026-04-24 19:17 修改: 2026-06-17 10:47
|
| uuid |
CVE-2026-41907 |
中危 |
8.3.2 |
11.1.1, 12.0.1, 13.0.1 |
uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-41907
镜像层: sha256:167b165efefd0eda6a5c24b4f82c20cd256be65921048b132681baad305739c0
发布日期: 2026-04-24 19:17 修改: 2026-06-17 10:47
|
| uuid |
CVE-2026-41907 |
中危 |
9.0.1 |
11.1.1, 12.0.1, 13.0.1 |
uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-41907
镜像层: sha256:167b165efefd0eda6a5c24b4f82c20cd256be65921048b132681baad305739c0
发布日期: 2026-04-24 19:17 修改: 2026-06-17 10:47
|
| yaml |
CVE-2026-33532 |
中危 |
2.8.1 |
2.8.3, 1.10.3 |
yaml: yaml: Denial of Service via deeply nested YAML document parsing
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-33532
镜像层: sha256:167b165efefd0eda6a5c24b4f82c20cd256be65921048b132681baad305739c0
发布日期: 2026-03-26 20:16 修改: 2026-06-17 10:37
|
| esbuild |
GHSA-g7r4-m6w7-qqqr |
低危 |
0.27.3 |
0.28.1 |
esbuild allows arbitrary file read when running the development server on Windows
漏洞详情: https://github.com/advisories/GHSA-g7r4-m6w7-qqqr
镜像层: sha256:167b165efefd0eda6a5c24b4f82c20cd256be65921048b132681baad305739c0
发布日期: 2026-06-12 20:08 修改: 2026-06-12 20:08
|
| pm2 |
CVE-2025-5891 |
低危 |
6.0.14 |
7.0.0 |
pm2 Regular Expression Denial of Service vulnerability
漏洞详情: https://avd.aquasec.com/nvd/cve-2025-5891
镜像层: sha256:167b165efefd0eda6a5c24b4f82c20cd256be65921048b132681baad305739c0
发布日期: 2025-06-09 19:15 修改: 2026-06-17 09:48
|
| pm2 |
CVE-2025-5891 |
低危 |
6.0.14 |
7.0.0 |
pm2 Regular Expression Denial of Service vulnerability
漏洞详情: https://avd.aquasec.com/nvd/cve-2025-5891
镜像层: sha256:5a13fd1f840e8da3513e40502b75d96cd5cbb627c3c368bf490b499d970a600d
发布日期: 2025-06-09 19:15 修改: 2026-06-17 09:48
|
| @tootallnate/once |
CVE-2026-3449 |
低危 |
1.1.2 |
3.0.1, 2.0.1 |
@tootallnate/once: @tootallnate/once: Denial of Service due to incorrect control flow scoping with AbortSignal
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-3449
镜像层: sha256:167b165efefd0eda6a5c24b4f82c20cd256be65921048b132681baad305739c0
发布日期: 2026-03-03 05:17 修改: 2026-06-17 10:43
|
| @tootallnate/once |
CVE-2026-3449 |
低危 |
2.0.0 |
3.0.1, 2.0.1 |
@tootallnate/once: @tootallnate/once: Denial of Service due to incorrect control flow scoping with AbortSignal
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-3449
镜像层: sha256:167b165efefd0eda6a5c24b4f82c20cd256be65921048b132681baad305739c0
发布日期: 2026-03-03 05:17 修改: 2026-06-17 10:43
|
| body-parser |
CVE-2026-12590 |
低危 |
1.20.3 |
1.20.6, 2.3.0 |
body-parser: body-parser: Denial of Service via invalid limit option
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-12590
镜像层: sha256:167b165efefd0eda6a5c24b4f82c20cd256be65921048b132681baad305739c0
发布日期: 2026-07-09 11:16 修改: 2026-07-10 02:45
|
| body-parser |
CVE-2026-12590 |
低危 |
2.2.2 |
1.20.6, 2.3.0 |
body-parser: body-parser: Denial of Service via invalid limit option
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-12590
镜像层: sha256:167b165efefd0eda6a5c24b4f82c20cd256be65921048b132681baad305739c0
发布日期: 2026-07-09 11:16 修改: 2026-07-10 02:45
|
| qs |
CVE-2026-2391 |
低危 |
6.13.0 |
6.14.2 |
qs: qs's arrayLimit bypass in comma parsing allows denial of service
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-2391
镜像层: sha256:167b165efefd0eda6a5c24b4f82c20cd256be65921048b132681baad305739c0
发布日期: 2026-02-12 05:17 修改: 2026-06-17 10:30
|
| diff |
CVE-2026-24001 |
低危 |
8.0.2 |
8.0.3, 5.2.2, 4.0.4, 3.5.1 |
jsdiff: denial of service vulnerability in parsePatch and applyPatch
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-24001
镜像层: sha256:167b165efefd0eda6a5c24b4f82c20cd256be65921048b132681baad305739c0
发布日期: 2026-01-22 03:15 修改: 2026-07-15 02:18
|