| CVE-2026-115905 | CRITICAL | zip | 8.2.0 | 9.0.5 | zip is a zip library for Rust that supports reading and writing simple ... |
| CVE-2026-109383 | HIGH | undici | 6.28.1 | 6.29.1, 7.30.1, 8.12.2 | undici: undici: Certificate validation bypass via dropped TLS options in Agent |
| CVE-2026-109383 | HIGH | undici | 7.29.1 | 6.29.1, 7.30.1, 8.12.2 | undici: undici: Certificate validation bypass via dropped TLS options in Agent |
| CVE-2026-109461 | HIGH | @azure/msal-node | 5.1.5 | 7.1.0 | MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint |
| CVE-2026-109461 | HIGH | @azure/msal-node | 6.0.1 | 7.1.0 | MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint |
| CVE-2026-109829 | HIGH | undici | 7.29.1 | 7.30.1, 8.12.2 | undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching |
| CVE-2026-109869 | HIGH | undici | 6.28.1 | 6.29.1, 7.30.1, 8.12.2 | undici: undici: Denial of Service via unhandled stream error on excessive content encodings |
| CVE-2026-109869 | HIGH | undici | 7.29.1 | 6.29.1, 7.30.1, 8.12.2 | undici: undici: Denial of Service via unhandled stream error on excessive content encodings |
| CVE-2026-111181 | HIGH | body-parser | 2.3.0 | 2.4.0, 1.20.9 | body-parser: body-parser: Denial of Service via unhandled decompression stream error |
| CVE-2026-113872 | HIGH | multer | 2.4.0 | 2.5.0 | multer: multer: Denial of Service via aborted request during asynchronous file filtering |
| CVE-2026-114141 | HIGH | toml | 4.2.0 | 5.0.1 | toml: toml: Denial of Service via crafted array-of-tables headers |
| CVE-2026-114142 | HIGH | toml | 4.2.0 | 5.0.1 | toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype |
| CVE-2026-114143 | HIGH | toml | 4.2.0 | 5.0.1 | toml: toml-node: Denial of Service via long dotted keys in TOML input |
| CVE-2026-114144 | HIGH | toml | 4.2.0 | 5.0.1 | toml: toml-node: Denial of Service via unbounded integer parsing |
| CVE-2026-87018 | HIGH | undici | 6.28.1 | 6.29.1, 7.30.1, 8.12.2 | undici: undici: Denial of Service via TLS renegotiation with mismatched certificate |
| CVE-2026-87018 | HIGH | undici | 7.29.1 | 6.29.1, 7.30.1, 8.12.2 | undici: undici: Denial of Service via TLS renegotiation with mismatched certificate |
| GHSA-f897-62hf-6gxq | HIGH | @modelcontextprotocol/node | 2.0.0 | 2.1.0 | MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length |
| CVE-2026-109841 | MEDIUM | undici | 7.29.1 | 7.30.1, 8.12.2 | undici: undici: Subresource Integrity bypass via non-lowercase algorithm tokens |
| CVE-2026-109924 | MEDIUM | undici | 6.28.1 | 6.29.1, 7.30.1, 8.12.2 | undici: undici: Denial of Service via memory exhaustion in EventSource client |
| CVE-2026-109924 | MEDIUM | undici | 7.29.1 | 6.29.1, 7.30.1, 8.12.2 | undici: undici: Denial of Service via memory exhaustion in EventSource client |
| CVE-2026-109932 | MEDIUM | undici | 6.28.1 | 6.29.1, 7.30.1, 8.12.2 | undici: undici: Denial of Service via unbounded WebSocket PONG buffering |
| CVE-2026-109932 | MEDIUM | undici | 7.29.1 | 6.29.1, 7.30.1, 8.12.2 | undici: undici: Denial of Service via unbounded WebSocket PONG buffering |
| CVE-2026-110816 | MEDIUM | qs | 6.16.0 | 6.16.1 | qs: qs: Denial of Service via unhandled exception during array serialization |
| CVE-2026-114129 | MEDIUM | stream-json | 3.6.0 | 3.7.0 | stream-json: stream-json: Denial of Service via deeply nested JSON documents |
| CVE-2026-118663 | MEDIUM | @hono/node-server | 2.0.10 | 2.1.3 | @hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths |
| CVE-2026-87029 | MEDIUM | undici | 7.29.1 | 7.30.1, 8.12.2 | undici: undici: Denial of Service via unhandled exception in decompress interceptor |
| GHSA-4ffr-jq9g-5ffx | MEDIUM | nodemailer | 10.0.10 | 10.0.13 | Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service |
| GHSA-85x2-q946-cp5h | MEDIUM | nodemailer | 10.0.10 | 10.1.4 | Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name |
| GHSA-8c8m-p3m8-cjg8 | MEDIUM | nodemailer | 10.0.10 | 10.1.4 | Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient |
| GHSA-g73g-hqqh-jr95 | MEDIUM | nodemailer | 10.0.10 | 10.0.13 | Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped |
| GHSA-m943-m63m-w62w | MEDIUM | nodemailer | 10.0.10 | 10.1.4 | Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient |
| CVE-2024-1899 | MEDIUM | showdown | 2.1.0 | — not fixable | Showdown vulnerable to Regular Expression Denial of Service (ReDoS) in link/anchor parsing |
| CVE-2025-57665 | MEDIUM | element-plus | 2.4.3 | — not fixable | Element Plus Link component (el-link) implements insufficient input validation for the href attribute |
| CVE-2026-59710 | MEDIUM | showdown | 2.1.0 | — not fixable | showdown: Showdown: Stored Cross-Site Scripting via unescaped table header ID attributes in markdown |
| CVE-2026-59711 | MEDIUM | showdown | 2.1.0 | — not fixable | showdown: Showdown: Cross-site scripting via unescaped metadata title allows arbitrary code execution |
| CVE-2026-93753 | LOW | deepmerge | 4.3.1 | — not fixable | deepmerge: deepmerge: Prototype Poisoning via mergeObject function |
