| GHSA-cg2g-xh64-v4q7 | CRITICAL | dompurify | 3.4.16 | 3.4.17 | DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes |
| CVE-2026-105482 | HIGH | nodejs-22 | 22.23.2-r1 | 22.23.4-r0 | nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character |
| CVE-2026-106069 | HIGH | nodejs-22 | 22.23.2-r1 | 22.23.4-r0 | nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames |
| CVE-2026-109383 | HIGH | undici | 6.28.1 | 6.29.1, 7.30.1, 8.12.2 | undici: undici: Certificate validation bypass via dropped TLS options in Agent |
| CVE-2026-109383 | HIGH | undici | 7.29.1 | 6.29.1, 7.30.1, 8.12.2 | undici: undici: Certificate validation bypass via dropped TLS options in Agent |
| CVE-2026-109383 | HIGH | undici | 8.10.2 | 6.29.1, 7.30.1, 8.12.2 | undici: undici: Certificate validation bypass via dropped TLS options in Agent |
| CVE-2026-109829 | HIGH | undici | 7.29.1 | 7.30.1, 8.12.2 | undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching |
| CVE-2026-109829 | HIGH | undici | 8.10.2 | 7.30.1, 8.12.2 | undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching |
| CVE-2026-109869 | HIGH | undici | 6.28.1 | 6.29.1, 7.30.1, 8.12.2 | undici: undici: Denial of Service via unhandled stream error on excessive content encodings |
| CVE-2026-109869 | HIGH | undici | 7.29.1 | 6.29.1, 7.30.1, 8.12.2 | undici: undici: Denial of Service via unhandled stream error on excessive content encodings |
| CVE-2026-109869 | HIGH | undici | 8.10.2 | 6.29.1, 7.30.1, 8.12.2 | undici: undici: Denial of Service via unhandled stream error on excessive content encodings |
| CVE-2026-111181 | HIGH | body-parser | 1.20.6 | 2.4.0, 1.20.9 | body-parser: body-parser: Denial of Service via unhandled decompression stream error |
| CVE-2026-111181 | HIGH | body-parser | 1.20.8 | 2.4.0, 1.20.9 | body-parser: body-parser: Denial of Service via unhandled decompression stream error |
| CVE-2026-113872 | HIGH | multer | 2.4.0 | 2.5.0 | multer: multer: Denial of Service via aborted request during asynchronous file filtering |
| CVE-2026-87018 | HIGH | undici | 6.28.1 | 6.29.1, 7.30.1, 8.12.2 | undici: undici: Denial of Service via TLS renegotiation with mismatched certificate |
| CVE-2026-87018 | HIGH | undici | 7.29.1 | 6.29.1, 7.30.1, 8.12.2 | undici: undici: Denial of Service via TLS renegotiation with mismatched certificate |
| CVE-2026-87018 | HIGH | undici | 8.10.2 | 6.29.1, 7.30.1, 8.12.2 | undici: undici: Denial of Service via TLS renegotiation with mismatched certificate |
| GHSA-mrv2-3pqr-j5jr | HIGH | dompurify | 3.4.16 | 3.4.17 | DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p) |
| CVE-2026-19693 | HIGH | extract-zip | 2.0.1 | — غير قابلة للإصلاح | extract-zip: extract-zip: Arbitrary file write via symlink in archive |
| CVE-2026-56876 | HIGH | extract-zip | 2.0.1 | — غير قابلة للإصلاح | extract-zip: github.com/maxogden/extract-zip: extract-zip: Arbitrary file write and information disclosure via symlink validation bypass |
| CVE-2026-105481 | MEDIUM | nodejs-22 | 22.23.2-r1 | 22.23.4-r0 | nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse |
| CVE-2026-106072 | MEDIUM | nodejs-22 | 22.23.2-r1 | 22.23.4-r0 | nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification |
| CVE-2026-106074 | MEDIUM | nodejs-22 | 22.23.2-r1 | 22.23.4-r0 | nodejs: nodejs: predictable random values via snapshot entropy cache reuse |
| CVE-2026-109841 | MEDIUM | undici | 7.29.1 | 7.30.1, 8.12.2 | undici: undici: Subresource Integrity bypass via non-lowercase algorithm tokens |
| CVE-2026-109841 | MEDIUM | undici | 8.10.2 | 7.30.1, 8.12.2 | undici: undici: Subresource Integrity bypass via non-lowercase algorithm tokens |
| CVE-2026-109924 | MEDIUM | undici | 6.28.1 | 6.29.1, 7.30.1, 8.12.2 | undici: undici: Denial of Service via memory exhaustion in EventSource client |
| CVE-2026-109924 | MEDIUM | undici | 7.29.1 | 6.29.1, 7.30.1, 8.12.2 | undici: undici: Denial of Service via memory exhaustion in EventSource client |
| CVE-2026-109924 | MEDIUM | undici | 8.10.2 | 6.29.1, 7.30.1, 8.12.2 | undici: undici: Denial of Service via memory exhaustion in EventSource client |
| CVE-2026-109932 | MEDIUM | undici | 6.28.1 | 6.29.1, 7.30.1, 8.12.2 | undici: undici: Denial of Service via unbounded WebSocket PONG buffering |
| CVE-2026-109932 | MEDIUM | undici | 7.29.1 | 6.29.1, 7.30.1, 8.12.2 | undici: undici: Denial of Service via unbounded WebSocket PONG buffering |
| CVE-2026-109932 | MEDIUM | undici | 8.10.2 | 6.29.1, 7.30.1, 8.12.2 | undici: undici: Denial of Service via unbounded WebSocket PONG buffering |
| CVE-2026-110180 | MEDIUM | fast-uri | 3.1.8 | 2.4.8, 3.1.9, 4.2.3 | fast-uri: fast-uri: Security policy bypass via improper host canonicalization |
| CVE-2026-110306 | MEDIUM | fast-uri | 3.1.8 | 2.4.8, 3.1.9, 4.2.3 | fast-uri: fast-uri: Cross-Site Scripting via improper URI scheme decoding |
| CVE-2026-110816 | MEDIUM | qs | 6.16.0 | 6.16.1 | qs: qs: Denial of Service via unhandled exception during array serialization |
| CVE-2026-87029 | MEDIUM | undici | 7.29.1 | 7.30.1, 8.12.2 | undici: undici: Denial of Service via unhandled exception in decompress interceptor |
| CVE-2026-87029 | MEDIUM | undici | 8.10.2 | 7.30.1, 8.12.2 | undici: undici: Denial of Service via unhandled exception in decompress interceptor |
| GHSA-4ffr-jq9g-5ffx | MEDIUM | nodemailer | 10.0.10 | 10.0.13 | Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service |
| GHSA-85x2-q946-cp5h | MEDIUM | nodemailer | 10.0.10 | 10.1.4 | Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name |
| GHSA-8c8m-p3m8-cjg8 | MEDIUM | nodemailer | 10.0.10 | 10.1.4 | Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient |
| GHSA-g73g-hqqh-jr95 | MEDIUM | nodemailer | 10.0.10 | 10.0.13 | Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped |
| GHSA-m943-m63m-w62w | MEDIUM | nodemailer | 10.0.10 | 10.1.4 | Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient |
| GHSA-984p-xq9m-4rjw | MEDIUM | express-brute | 1.0.1 | — غير قابلة للإصلاح | Rate Limiting Bypass in express-brute |
| CVE-2026-106073 | LOW | nodejs-22 | 22.23.2-r1 | 22.23.4-r0 | nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() |
| CVE-2026-110095 | LOW | fast-uri | 3.1.8 | 2.4.8, 3.1.9, 4.2.3 | fast-uri: fast-uri: Path traversal via improper relative URI normalization |
| CVE-2026-110725 | LOW | fast-uri | 3.1.8 | 2.4.8, 3.1.9, 4.2.3 | fast-uri: fast-uri: Cross-site scripting via unescaped colon in relative URI paths |
| GHSA-c6gr-qvv4-5v3f | LOW | dompurify | 3.4.16 | 3.4.17 | DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml |
| CVE-2026-93753 | LOW | deepmerge | 4.3.1 | — غير قابلة للإصلاح | deepmerge: deepmerge: Prototype Poisoning via mergeObject function |
