A flaw was found in brace-expansion. A remote attacker can exploit this vulnerability by providing specially crafted input to the expand() function, which can lead to excessive memory consumption. This can cause a denial of service (DoS) b…

▾ TwilightRed Hat · Red Hat Enterprise Linux AppStream (v. 8)EPSS 0.64%via CSAF

CVE-2026-53666Medium· 6.1

2mo ago

React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration

▾ Sunlitreact-router · react-routerEPSS 0.42%via GHSA

CVE-2026-53667Medium· 6.9

2mo ago

React Router: RSCErrorHandler Missing Protocol Validation (XSS)

▾ Sunlitreact-router · react-routerEPSS 0.36%via GHSA

CVE-2026-53668Medium· 6.9

2mo ago

React Router: Open redirect leading to XSS

▾ Sunlitreact-router · react-routerEPSS 0.34%via GHSA

CVE-2026-53669Medium

2mo ago

React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)

▾ Sunlitreact-router · react-routerEPSS 0.32%via GHSA

GHSA-x445-f3h2-j279Medium· 6.8

2mo ago

Auth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them

▾ Sunlitauth · @auth/corevia GHSA

Tagged “npm”

Budibase: NoSQL Injection via JSON Parameter Interpolation in MongoDB Query Execution

Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector

@fastify/static vulnerable to route guard bypass via path traversal

@fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths

AWS CDK CodeBuild S3 Log Encryption Boolean Inversion

React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response

js-yaml: Exponential parsing time in flow collections leads to denial of service

Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution

@better-auth/scim: account takeover and stale access via SCIM provider-id collision

@better-auth/stripe: cross-organization billing tampering in organization subscription actions

Better Auth: Account takeover via pre-account hijacking on magic-link and email-OTP sign-in

SvelteKit: Big remote form function payloads can cause Node process to crash

SvelteKit: Prototype pollution in file input deletion path in remote-function forms

Valibot: record() issue paths can make flatten() throw for inherited Object property names

Trix: Stored XSS via HTMLParser attribute injection on paste

@backstage/plugin-auth-backend: Unauthenticated OAuth account takeover via `redirect_uri` allowlist bypass

Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of GHSA-j658-c2gf-x6pq fix)

Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)

Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer

PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure

node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection

electron-updater: Uncontrolled search path elements within `AppImage` built by `app-builder-lib`

electron-updater: Cross-origin redirect leaks `PRIVATE-TOKEN` and mixed-case `Authorization` credentials in `builder-util-runtime`

LiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforce

brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)

React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration

React Router: RSCErrorHandler Missing Protocol Validation (XSS)

React Router: Open redirect leading to XSS

React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)

Auth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them

Mongoose: Prototype pollution in mongoose update casting via proto-prefixed dotted path (Schema._getSchema/path getter)