• Project runs on Bun 1.4.3 or earlier (or ships a bun build --compile executable built with such a version).
• The bundled brotli version is affected (1.0.3 to 1.2.0, excluding 1.0.10 and 1.1.1).
• The application passes attacker-supplied brotli data to the decoder via fetch (with default decompression, from a malicious server or over an unencrypted connection), node:zlib brotli decompress APIs, or DecompressionStream with the brotli format.

Affected

bun >=1.0.21 <1.4.4

Fixed in

1.4.4

ID

GHSA-663w-cv8g-jj2p

• Project runs Bun 1.4.3 or earlier, or ships a bun build --compile executable built with such a version.
• Project makes TLS client connections (fetch, bun install, bunx, node:https, node:tls, WebSocket, Bun.connect, HTTP/3 fetch) using Bun's default trust store, or runs a TLS server with requestCert: true and no ca option.
• No explicit ca / cafile excluding the emSign roots is configured for the affected connection or install.
• An attacker is positioned in the network path between the Bun process and the server.

Affected

bun <1.4.4

Fixed in

1.4.4

ID

GHSA-26q8-h657-pf84

• Project uses multer below version 2.5.0.
• multer is configured with an asynchronous fileFilter.
• The multer upload endpoint accepts requests from untrusted (including unauthenticated) clients.

Affected

multer >=2.0.0 <2.5.0

Fixed in

2.5.0

ID

GHSA-q7qp-rjg7-q26m

• Project uses MCP Inspector v2 (@modelcontextprotocol/inspector) at version 2.7.0 or earlier.
• The Inspector Node backend's POST /api/fetch proxy route is in use for MCP traffic or OAuth work.
• Inspector connects to (or is redirected during OAuth/CIMD to) an untrusted or misbehaving server that can return a very large or unbounded response body.

Affected

@modelcontextprotocol/inspector >=2.0.0 <=2.11.0 · @modelcontextprotocol/inspector >=0.21.2 <=1.0.2 · @modelcontextprotocol/inspector-server >=0.21.2 <=1.0.2

Fixed in

2.12.0 · 1.0.3

ID

GHSA-m5pj-3536-3xcp

• Project runs the MCP Inspector (@modelcontextprotocol/inspector) proxy/web app, e.g. version 2.2.0, with the CVE-2025-49596 fix (auth token + Origin check).
• Inspector is served on loopback (default port 6274) with default config.
• Inspector does not validate the Host header on its routes.
• GET / or the SPA fallback route serves HTML with the injected API token without authentication.
• The developer visits an attacker-controlled web page while the Inspector is running.
• The developer's browser lacks DNS-rebinding / Private Network Access mitigations.

Affected

@modelcontextprotocol/inspector >=2.0.0 <=2.11.0

Fixed in

2.12.0

ID

GHSA-vcc9-3xgm-p9v4

• Project uses MCP Inspector (CLI, TUI, or web server client) with the npm "open" dependency at v10.x (pinned "^10.2.0"), not v11.
• Inspector runs on Windows, or on WSL outside a container.
• User connects Inspector to a remote MCP server that answers 401 and serves OAuth discovery documents with an attacker-chosen authorization endpoint.
• OAuth auto-open is enabled (MCP_AUTO_OPEN_ENABLED is not "false" and Vitest is not running).
• stderr is a TTY (Inspector run interactively).

Affected

@modelcontextprotocol/inspector >=2.0.0 <=2.11.0

Fixed in

2.12.0

ID

GHSA-q978-78c7-phqw

• Project uses @modelcontextprotocol/inspector (tested version 0.21.2).
• The MCP Inspector client has a proxy session token (MCP_PROXY_AUTH_TOKEN) configured, e.g. prefilled by default at startup.
• The user opens a crafted Inspector URL whose MCP_PROXY_FULL_ADDRESS query parameter points to an attacker-controlled HTTP endpoint.

Affected

@modelcontextprotocol/inspector >=0.14.1 <=1.0.2 · @modelcontextprotocol/inspector-client >=0.14.1 <=1.0.2

Fixed in

1.0.3

ID

GHSA-2rq8-f55p-j2jp

• Project runs MCP Inspector v1.0.0 or later, which includes the hand-rolled /fetch proxy redirect loop from commit d40c1c94.
• The Inspector proxy's /fetch endpoint is used to reach remote resources such as OAuth discovery/token endpoints.
• Proxied requests carry Authorization headers or Cookie headers.
• The user connects the Inspector to a malicious or compromised remote MCP server that can return a 3xx redirect to a different origin.

Affected

@modelcontextprotocol/inspector >=1.0.0 <=1.0.2 · @modelcontextprotocol/inspector-server >=1.0.0 <=1.0.2

Fixed in

1.0.3

ID

GHSA-f6mc-jg3x-vq53

Source summary

Details The tool injects the MCP App contents into a "sandbox". This sandbox can exec JS. And this sandbox's location is http://127.0.0.1: /sandbox . Proxy Server Protections Proxy has 2 layers of defence - 1. Origin check to block DNS Rebinding. It only adds client UI port in allowed origins. 2. Auth token validation with x-mcp-proxy-auth header. The origin check is a non blocker - since the malicious MCP app is running on proxy port, its "same origin" as proxy server. Browser's don't send origin header in same origin requests. js if (origin && !allowedOrigins.includes(origin)) { console.erro

Affected

@modelcontextprotocol/inspector >=0.20.0 <=1.0.2 · @modelcontextprotocol/inspector-client >=0.20.0 <=1.0.2 · @modelcontextprotocol/inspector-server >=0.20.0 <=1.0.2

Fixed in

1.0.3

ID

GHSA-6x67-4w4w-9f3w

Source summary

Summary A malicious remote MCP server can abuse the OAuth callback to switch MCP Inspector from the original remote HTTP transport to stdio and execute an arbitrary local command. Details 1. The user connects to an attacker-controlled remote MCP server. 2. The server returns an OAuth challenge and points Inspector to an attacker-controlled authorization server. 3. After authorization, the attacker redirects the browser to Inspector’s callback URL and appends Inspector configuration parameters: text /oauth/callback ?code=valid-code &state=valid-state &transport=stdio &serverCommand= &serverArgs

Affected

@modelcontextprotocol/inspector >=0.13.0 <=1.0.2 · @modelcontextprotocol/inspector-client >=0.13.0 <=1.0.2

Fixed in

1.0.3

ID

GHSA-4fc4-wcmh-4g86

• Project runs @modelcontextprotocol/inspector (confirmed vulnerable: 0.14.3, 1.0.2, or 2.5.0).
• Inspector is started with authentication disabled via DANGEROUSLY_OMIT_AUTH=true.
• Attacker can send direct non-browser HTTP requests without an Origin header to the Inspector server (port 6277 /stdio in v1, port 6274 /api/mcp/connect in v2).

Affected

@modelcontextprotocol/inspector >=0.14.1 <=1.0.2 · @modelcontextprotocol/inspector-server >=0.14.1 <=1.0.2

Fixed in

1.0.3

ID

GHSA-wmjf-2m46-2352

• Project runs the MCP Inspector proxy (server/src/index.ts with the SSE transport branch that logs forwarded headers).
• Inspector is used to connect to an upstream MCP server over the SSE transport (not streamable-http).
• The upstream SSE MCP server requires authentication via an Authorization bearer token or custom auth headers (x-custom-auth-header(s)).
• The Inspector proxy's stdout/logs are readable by someone other than the credential holder (terminal scrollback, Docker/Kubernetes logs, CI/devcontainer logs, support bundles).

Affected

@modelcontextprotocol/inspector >=0.14.2 <=1.0.2 · @modelcontextprotocol/inspector-server >=0.14.2 <=1.0.2

Fixed in

1.0.3

ID

GHSA-8qgq-27v6-55w3

• Vite v6 dev server is in use (v6.4.4 line, which back-ported PR 20410 without PR 22160).
• Vite dev server is explicitly exposed to the network via --host or the server.host config option.
• The sensitive file exists within the directories allowed by server.fs.allow.
• The sensitive file is matched by a pattern in server.fs.deny (e.g., .env, .crt).

Affected

vite 6.4.4

Fixed in

6.4.5

ID

GHSA-8g5g-mxqh-grgj

• Project uses launch-editor directly, via launch-editor-middleware, or via Vite.
• An attacker can create a file or directory whose name starts with + or - in the working directory.
• The editor used or specified is Vim/gVim, MacVim, Emacs/Emacsclient, or Notepad++ with a plugin exposing dangerous operations via plugin messages.
• For direct launch-editor use: the first argument passed to launchEditor can start with + or -, or the user is on WSL.
• For launch-editor-middleware: launch-editor older than v2.2.0 is used, or the user is on WSL.
• For Vite (2.0.0+): the user is running under WSL.

Affected

vite >=8.3.0 <=8.3.2 · vite >=8.2.0 <=8.2.3 · vite >=8.0.0 <=8.1.5 · vite >=7.0.0 <=7.3.6 · vite <=6.4.3

Fixed in

8.3.3 · 8.2.4 · 8.1.6 · 7.3.7 · 6.4.4

ID

GHSA-r825-w8mm-5pxw

• Project uses launch-editor (or launch-editor-middleware) at an affected version.
• The app runs on Windows.
• An attacker can control the file argument passed to launch-editor.

Affected

vite >=8.3.0 <=8.3.2 · vite >=8.2.0 <=8.2.3 · vite >=8.0.0 <=8.1.5 · vite >=7.0.0 <=7.3.6 · vite <=6.4.3

Fixed in

8.3.3 · 8.2.4 · 8.1.6 · 7.3.7 · 6.4.4

ID

GHSA-587h-7wmj-h5pm

• Self-hosted Supabase Realtime deployment serving multiple tenants.
• Clients or users can choose their own tenant external id (e.g. user-defined project names) through the management API.
• An attacker can create a tenant whose external id equals the victim's tenant id followed by "-private".
• The victim tenant uses private (RLS-protected) broadcast channels.

Affected

in the source

Fixed in

no fix yet

ID

GHSA-2rcv-vpjw-5g6c

• Project uses launch-editor (version without % escaping in escapeCmdArgs).
• Application runs on Windows, where launch-editor invokes .bat/.cmd editors via cmd.exe.
• An attacker can place a file whose filename contains & or %.
• An attacker can inject an environment variable with a malicious value, or can add an NTFS alternate data stream to the placed file.
• An attacker can control the filename argument passed to launchEditor.

Affected

vite >=8.3.0 <=8.3.2 · vite >=8.2.0 <=8.2.3 · vite >=8.0.0 <=8.1.5 · vite >=7.0.0 <=7.3.6 · vite <=6.4.3

Fixed in

8.3.3 · 8.2.4 · 8.1.6 · 7.3.7 · 6.4.4

ID

GHSA-698v-4r3x-3vcv

• Project uses undici 6.x before 6.29.1, 7.x before 7.30.1, or 8.x before 8.12.2.
• Application calls undici's fetch() against servers that may be attacker-controlled or malicious.
• The server responds with more than five content codings and closes the connection before sending the body.

Affected

undici >=6.23.0 <6.29.1 · undici >=7.18.0 <7.30.1 · undici >=8.0.0 <8.12.2

Fixed in

6.29.1 · 7.30.1 · 8.12.2

ID

GHSA-xjj6-f33q-929c

• Project uses undici's EventSource client.
• undici version is below 6.29.1, 7.30.1, or 8.12.2 in the respective major line.
• The application maintains an EventSource connection to an untrusted or potentially compromised Server-Sent Events peer that controls the response.

Affected

undici >=6.5.0 <6.29.1 · undici >=7.0.0 <7.30.1 · undici >=8.0.0 <8.12.2

Fixed in

6.29.1 · 7.30.1 · 8.12.2

ID

GHSA-4qv8-2p9j-2685

• Project uses undici at version 7.15.0 or later, below the patched releases 7.30.1 / 8.12.2.
• Application calls undici's fetch() with Subresource Integrity (integrity) metadata.
• The integrity metadata uses an uppercase or mixed-case algorithm token (e.g. SHA256- or Sha256-).
• An attacker can control the response body returned by the server.

Affected

undici >=7.15.0 <7.30.1 · undici >=8.0.0 <8.12.2

Fixed in

7.30.1 · 8.12.2

ID

GHSA-f72v-6w45-q472

Source summary

Impact When an originless Agent composes the redirect and cache interceptors as compose(redirect(), cache()) with a shared cache ( type: 'shared' ), the cache builds its key from the original request URL before the redirect handler changes the origin. The response produced after a redirect is then stored under the original key, even when the redirect crossed to a different origin. An attacker who controls the target of a redirect from a trusted URL can have their response cached under that trusted URL. A later caller requesting the trusted URL receives the attacker's body from the shared cache

Affected

undici >=7.0.0 <7.30.1 · undici >=8.0.0 <8.12.2

Fixed in

7.30.1 · 8.12.2

ID

GHSA-4w7w-5xrc-9h26

Source summary

Impact undici's Agent passes its constructor options through a JSON-based deep clone ( JSON.parse(JSON.stringify(...)) ) before forwarding them to each per-origin Pool . JSON cannot represent functions, so a caller-supplied tls option containing a checkServerIdentity callback is silently dropped before it reaches the TLS layer. As a result, a TLS peer whose certificate a custom checkServerIdentity was written to reject, but which passes Node's default hostname and chain checks, is silently accepted when the request is made through Agent . Because Agent is the default dispatcher behind request

Affected

undici >=4.0.0 <6.29.1 · undici >=7.0.0 <7.30.1 · undici >=8.0.0 <8.12.2

Fixed in

6.29.1 · 7.30.1 · 8.12.2

ID

GHSA-2m5v-pch6-74hx

Source summary

Impact undici crashes the client process when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trusted certificate whose hostname does not match the requested host. Node.js re-runs hostname verification on the renegotiated handshake and destroys the socket with ERR TLS CERT ALTNAME INVALID . undici's established socket error handler asserted that this error code could never occur, so the peer-controlled error became an uncaught AssertionError that terminates the Node.js process. Both the HTTP/1.1 and HTTP/2 paths are affected. A malicious or compro

Affected

undici >=4.2.1 <6.29.1 · undici >=7.0.0 <7.30.1 · undici >=8.0.0 <8.12.2

Fixed in

6.29.1 · 7.30.1 · 8.12.2

ID

GHSA-qrxm-fqhp-jwvm

Source summary

Impact undici's WebSocket client (including Node.js's bundled globalThis.WebSocket ) can be driven to exhaust process memory by a malicious or compromised WebSocket server. For every PING frame received, the receiver automatically writes a PONG response to the socket and ignores the false return value from socket.write() , which is a backpressure signal, so a server that streams small PING frames while never reading the client's PONGs makes the outbound write queue and heap grow without bound until the Node.js process runs out of memory and terminates. The attack is remote and unauthenticated,

Affected

undici >=5.15.0 <6.29.1 · undici >=7.0.0 <7.30.1 · undici >=8.0.0 <8.12.2

Fixed in

6.29.1 · 7.30.1 · 8.12.2

ID

GHSA-9fm3-97px-rjf6

Source summary

Impact undici's decompress interceptor forwards decompressed response data to the downstream handler from zlib stream event callbacks without catching exceptions those callbacks may throw. undici's engine converts a synchronous throw from a downstream handler into a per-request failure, but that protection is not in place when the throw happens asynchronously from a zlib callback. As a result, a downstream handler that throws by design, for example the built-in dump interceptor which throws when a response exceeds its maxSize , escapes as an uncaught exception and terminates the Node.js proces

Affected

undici >=7.15.0 <7.30.1 · undici >=8.0.0 <8.12.2

Fixed in

7.30.1 · 8.12.2

ID

GHSA-55wc-3pg8-jfw6

Source summary

Summary In affected versions, servers put no limit on how many array elements and object keys they validated in one request. One HTTP request within the default 4 MiB size limit could exhaust the server's memory, and the process aborted with JavaScript heap out of memory . No credentials are needed, unless you authenticate requests before they reach the SDK. Am I affected? Yes, if clients you do not fully trust can reach your server over HTTP. The risk is highest for McpServer tools whose input contains an array or a record. stdio-only servers are not affected. Affected versions: - @modelconte

Affected

@modelcontextprotocol/sdk >=1.3.0 <1.32.0 · @modelcontextprotocol/server >=2.0.0 <2.3.0

Fixed in

1.32.0 · 2.3.0

ID

GHSA-46jr-4wx8-v453

Source summary

Summary In affected versions, an MCP server reached over HTTP could deliver one client's responses and notifications to another client. This happened when clients shared one stateless transport, or one McpServer or Server instance. Messages were matched to a connection by JSON-RPC id alone. SDK clients number requests from 0, so ids collide in normal use. Am I affected? Yes, if more than one client can reach your HTTP endpoint and your code creates the transport or the server once at startup, instead of once per request or per session. Until this release, the README examples of @modelcontextpr

Affected

@modelcontextprotocol/server >=2.0.0 <2.3.0

Fixed in

2.3.0

ID

GHSA-jm63-cq47-j5jp

Source summary

Summary In affected versions, MCP servers reachable over HTTP put no limit on the size of a POST body or on the number of messages in a JSON-RPC batch. Large requests could exhaust the server's memory, and one long batch could block it from serving anyone else. No credentials were needed, unless your application authenticates requests before they reach the SDK. Am I affected? Yes, if clients you do not fully trust can reach your server over Streamable HTTP. A body parser such as express.json() does not protect you, because it does not limit batch length. Servers that only use stdio are not aff

Affected

@modelcontextprotocol/sdk >=1.10.0 <1.30.1 · @modelcontextprotocol/server >=2.0.0 <2.1.0 · @modelcontextprotocol/node >=2.0.0 <2.1.0 · @modelcontextprotocol/hono >=2.0.0 <2.0.1

Fixed in

1.30.1 · 2.1.0 · 2.0.1

ID

GHSA-f897-62hf-6gxq

Source summary

Impact Crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process. Workarounds No workaround exists besides upgrading. Applications using Pages Router or not using Server Actions are not vulnerable.

Affected

next >=13.0.0 <=15.5.27 · next >=16.0.0 <=16.4.0

Fixed in

15.5.28 · 16.4.1

ID

GHSA-p3m5-59mp-jv5r

Source summary

Impact A vulnerability in applications using App router with Cache Component can lead to remote code execution. The application needs to have a use cache function that returns multiple typed arrays. Workaround There is no known workaround for affected applications with such use cache functions. You should upgrade immediately even if your application does not have similar functions.

Affected

next >=16.0.0 <=16.4.0

Fixed in

16.4.1

ID

GHSA-673q-mjm6-r5xr

Source summary

Impact A memory-related vulnerability has been discovered in an upstream library used for Image Optimization can lead to possible remote code execution (RCE) when Next.js runs on glibc-based Linux. Workaround Ensure the version of sharp used by Next.js is greater than or equal to 0.35.5 . Fresh installs automatically get a fixed version of sharp . Upgrading Next.js to the patched versions will ensure package managers automatically provide a fixed version of sharp to Next.js.

Affected

next >=10.0.0 <=15.5.27 · next >16.0.0 <=16.4.0 · next >=16.0.0 <=16.4.0

Fixed in

15.5.28 · 16.4.1

ID

GHSA-2464-fhr4-w9xw

Source summary

Impact Crafted payloads targeting frameworks supporting React Server Components can lead to remote code execution. This only affects extremely rare cases where responses transport multiple typed arrays and an attacker-controlled value. We recommend updating immediately. The vulnerability exists in versions 19.0.0 through 19.0.8, 19.1.0 through 19.1.9, 19.2.0 through 19.2.8 and 19.3.0 of: - react-server-dom-webpack - react-server-dom-parcel - react-server-dom-turbopack Patches Fixes were back ported to versions 19.0.09, 19.1.10, 19.2.9, and 19.3.1. If you are using any of the above packages ple

Affected

react-server-dom-parcel 19.0.0 19.0.1 19.0.2 19.0.3 19.0.4 19.0.5 19.0.6 19.0.7 19.0.8 19.1.0 19.1.1 19.1.2 19.1.3 19.1.4 19.1.5 19.1.6 19.1.7 19.1.8 19.1.9 19.2.0 19.2.1 19.2.2 19.2.3 19.2.4 19.2.5 19.2.6 19.2.7 19.2.8 19.3.0 · react-server-dom-turbopack 19.0.0 19.0.1 19.0.2 19.0.3 19.0.4 19.0.5 19.0.6 19.0.7 19.0.8 19.1.0 19.1.1 19.1.2 19.1.3 19.1.4 19.1.5 19.1.6 19.1.7 19.1.8 19.1.9 19.2.0 19.2.1 19.2.2 19.2.3 19.2.4 19.2.5 19.2.6 19.2.7 19.2.8 19.3.0 · react-server-dom-webpack 19.0.0 19.0.1 19.0.2 19.0.3 19.0.4 19.0.5 19.0.6 19.0.7 19.0.8 19.1.0 19.1.1 19.1.2 19.1.3 19.1.4 19.1.5 19.1.6 19.1.7 19.1.8 19.1.9 19.2.0 19.2.1 19.2.2 19.2.3 19.2.4 19.2.5 19.2.6 19.2.7 19.2.8 19.3.0

Fixed in

19.0.9

ID

GHSA-xqc2-xf4c-x3h3

Source summary

Impact A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to out-of-memory exceptions or excessive CPU usage. We recommend updating immediately. The vulnerability exists in versions 19.0.0 through 19.0.7, 19.1.0 through 19.1.8, and 19.2.0 through 19.2.7 of: - react-server-dom-webpack - react-server-dom-parcel - react-server-dom-turbopack Patches Fixes were back ported to versions 19.0.9, 19.1.10, 19.2.9, and 19.3.1. If you are using any of the above packages please upgrade to any of the fixed versions im

Affected

react-server-dom-parcel 19.0.0 19.0.1 19.0.2 19.0.3 19.0.4 19.0.5 19.0.6 19.0.7 19.0.8 19.1.0 19.1.1 19.1.2 19.1.3 19.1.4 19.1.5 19.1.6 19.1.7 19.1.8 19.1.9 19.2.0 19.2.1 19.2.2 19.2.3 19.2.4 19.2.5 19.2.6 19.2.7 19.2.8 19.3.0 · react-server-dom-turbopack 19.0.0 19.0.1 19.0.2 19.0.3 19.0.4 19.0.5 19.0.6 19.0.7 19.0.8 19.1.0 19.1.1 19.1.2 19.1.3 19.1.4 19.1.5 19.1.6 19.1.7 19.1.8 19.1.9 19.2.0 19.2.1 19.2.2 19.2.3 19.2.4 19.2.5 19.2.6 19.2.7 19.2.8 19.3.0 · react-server-dom-webpack 19.0.0 19.0.1 19.0.2 19.0.3 19.0.4 19.0.5 19.0.6 19.0.7 19.0.8 19.1.0 19.1.1 19.1.2 19.1.3 19.1.4 19.1.5 19.1.6 19.1.7 19.1.8 19.1.9 19.2.0 19.2.1 19.2.2 19.2.3 19.2.4 19.2.5 19.2.6 19.2.7 19.2.8 19.3.0

Fixed in

19.0.9

ID

GHSA-h3gv-c5rc-p453

Source summary

Impact undici's experimental WebSocket client (enabled by default via allowH2: true ) crashes the Node.js process when it connects to a malicious server over HTTP/2. If the server answers the WebSocket upgrade with a response that fails handshake validation, undici aborts the request, but the abort is a no-op because the request is already marked completed, so the underlying ClientHttp2Stream is left open with no error listener. When the server then destroys the connection, the orphaned stream emits an unhandled error and the process exits. A remote, unauthenticated server can therefore deny s

Affected

undici >=8.11.0 <8.11.2

Fixed in

8.11.2

ID

GHSA-qq8j-7v2v-3rwp

Source summary

Root cause astro/app/node exports two request builders with opposite security postures: - createRequest() (line 123) validates the Host header against security.allowedDomains and falls back to localhost when it does not match, with the comment "Otherwise, fall back to 'localhost' to prevent SSRF attacks." - createRequestFromNodeRequest() (line 51) takes req.headers.host verbatim as the URL authority. No validation of any kind. @astrojs/node uses the unvalidated one on every request, in both serving modes: packages/integrations/node/src/serve-app.ts:99 createRequestFromNodeRequest(req, {...}) p

Affected

@astrojs/node <=11.1.6

Fixed in

11.1.7

ID

GHSA-m8p5-r7qv-cx4c

Source summary

Summary Astro's JSX and MDX rendering pipeline treated string children of , an attacker-controlled value containing or could terminate the element and inject arbitrary HTML and JavaScript. Other JSX expression contexts escaped dynamic strings automatically. This behavior was limited to passed to was emitted without escaping. The browser interpreted the first closing tag as markup and executed the injected script. The fix preserves raw rendering for literal script and style content while escaping dynamic string children like other JSX expression values. Impact Affected applications could be vul

Affected

astro <7.3.2

Fixed in

7.3.2

ID

GHSA-98hj-9722-w3j8

Source summary

Summary Astro's server-side View Transition CSS generator did not keep string animation properties within their generated CSS declarations. In an application that passes attacker-controlled data into an animation property such as duration , a value containing CSS delimiters could terminate the declaration and rule, then add attacker-selected CSS to the server-rendered page. The injected content remains inside the generated element. It cannot terminate that element or inject HTML or JavaScript because Astro escapes element. CSS delimiters such as ; , { , and } remained active, allowing a value

Affected

astro >=7.1.0 <=7.3.2

Fixed in

7.3.3

ID

GHSA-mpr7-6m5w-76rw

Source summary

The plugin install flow in Claude Code and Claude Desktop checked out a marketplace's pinned commit SHA using git checkout without verifying that the resulting HEAD matched the pinned SHA. An attacker controlling a plugin's upstream repository could create a branch named identically to the pinned 40-character SHA, causing the checkout to silently resolve to the attacker's branch tip instead of the reviewed commit, resulting in attacker-controlled code being installed bypassing the pinned hash. Exploitation required a user to install a malicious plugin, pin to a safe hash, and for the plugin so

Affected

@anthropic-ai/claude-code <2.1.179

Fixed in

2.1.179

ID

GHSA-pq7j-f95f-qfcv

Source summary

Next.js plans to publish an out-of-band security update next Wednesday, October 14, 2026, addressing two Critical and one High severity vulnerabilities in upstream dependencies.

Affected

in the source

Fixed in

no fix yet

ID

WATCH-next-upcoming-nextjs-security-update-october-2026

Source summary

Summary When accessing a malicious site while a dev server using Vite is running, that site was able to load scripts in a page served by the dev server. Impact Only apps that match the following conditions are affected: - the dev server passes an unchanged browser request URL to server.transformIndexHtml : this is normally used for server.middlewareMode: true or appType: 'custom' . The internal call for appType: 'spa' and appType: 'mpa' does not match this. - the transformed HTML contains an inline module script - from the script in the page served by the dev server, the app stores sensitive v

Affected

vite >=8.3.0 <=8.3.2 · vite >=8.2.0 <=8.2.3 · vite >=8.0.0 <=8.1.5 · vite >=7.0.0 <=7.3.6 · vite <=6.4.3 · vite-plus <=1.0.0

Fixed in

8.3.3 · 8.2.4 · 8.1.6 · 7.3.7 · 6.4.4 · 1.1.0

ID

GHSA-9jrq-w75r-8gcw

Source summary

Summary The first 4 bytes of files outside of server.fs setting can be returned to the browser by a request containing ?vite-wasm-instance . Impact Only apps that match one of the following conditions are affected: - explicitly expose the Vite dev server to the network using --host or the [ server.host ](https://vite.dev/config/server-options server-host) option - there's a file that has a sensitive information in the first 4 bytes - uses Node.js or Deno to run Vite (if Bun is used, it is not affected) Details Requests containing the ?vite-wasm-instance query are handled by the internal Wasm p

Affected

vite >=8.3.0 <=8.3.2 · vite >=8.2.0 <=8.2.3 · vite-plus >=0.2.8 <=1.0.0

Fixed in

8.3.3 · 8.2.4 · 1.1.0

ID

GHSA-vfpm-58rq-9qcg

Source summary

Summary The content of files outside server.fs setting can be returned to the browser if the project imports a file path concatenated with the root . For example, if the project references /etc/hosts , the content of /etc/hosts was possible to be returned. The content of files outside the server.fs.allow option can be returned to the browser when a project imports a file whose root-relative path matches an absolute path on the host. For example, referencing /etc/hosts could make Vite return the host's /etc/hosts file. Impact Only apps that meet all of the following conditions are affected: - e

Affected

vite >=8.3.0 <=8.3.2 · vite >=8.2.0 <=8.2.3 · vite >=8.0.0 <=8.1.5 · vite >=7.0.0 <=7.3.6 · vite <=6.4.3 · vite-plus <=1.0.0

Fixed in

8.3.3 · 8.2.4 · 8.1.6 · 7.3.7 · 6.4.4 · 1.1.0

ID

GHSA-rq7h-c2jc-7f22

Source summary

Summary In affected versions, the SDK's server-side bearer authentication had no way to check that a token was issued for your server (its audience). Where one authorization server issues tokens for several services, a valid token for another service was also accepted by your MCP server. Am I affected? Yes, if your HTTP server uses requireBearerAuth() or verifyBearerToken() , its authorization server also issues tokens for other services, and your verifyAccessToken() does not check the token's audience ( aud ) itself. Affected versions: - @modelcontextprotocol/sdk 1.6.0 through 1.31.0 - @model

Affected

@modelcontextprotocol/sdk >=1.6.0 <1.32.0 · @modelcontextprotocol/server >=2.0.0 <2.3.0 · @modelcontextprotocol/express >=2.0.0 <2.0.2 · @modelcontextprotocol/server-legacy >=2.0.0 <2.3.1

Fixed in

1.32.0 · 2.3.0 · 2.0.2 · 2.3.1

ID

GHSA-rvq5-wwqv-78pq

Source summary

Claude Code validated that a target file path resided within the project working directory at permission-check time, but re-resolved the path at write time without repeating that validation. This time-of-check to time-of-use (TOCTOU) gap allowed an attacker who could write to the workspace to atomically replace a project file with a symlink, causing Claude Code to follow the symlink and write its output to an arbitrary file outside the project sandbox. Exploitation required the ability to win a race condition against the write operation and write access to the shared workspace, enabling a lowe

Affected

@anthropic-ai/claude-code <2.1.129

Fixed in

2.1.129

ID

GHSA-5j29-h97v-84ch

Source summary

Source: amazon-inspector (36596ba9b9d8c0f994abe3cd87783f4f0dc880e63d55374d3555347ce349fab2) Package is published as css-scroll-anchor-polyfill but its index.js is empty and its contents impersonate internal Wix thunderbolt registry module names (thunderboltRegistry, siteAssetsRegistry, documentManagementRegistry, editorRegistry, corvidRegistry, and others) with a shipped registry-manifest.min.json mapping them to parastorage.com URLs. The declared purpose (a CSS scroll-anchor polyfill) is unrelated to the shipped code. thunderboltRegistry.js contains a top-level IIFE that executes on require:

Affected

css-scroll-anchor-polyfill 1.0.0

Fixed in

no fix yet

ID

GHSA-wqfg-33rw-c9rw

Source summary

Source: amazon-inspector (bd0a6c8e1448ffd9abb3732872ea3d49280a422d49524aaa57d0b89a73812f05) The package advertises itself as a CSS anchor-position polyfill but on require executes an IIFE in thunderboltRegistry.js that runs id , whoami , uname -a , ifconfig / ip addr , and reads /etc/hosts , then POSTs the collected output along with hostname, platform, and Node version via fetch to the hardcoded external endpoint http://dxpoc.gt.tc/callback.php/. The module also exports keys named after Wix thunderbolt internal registries (thunderboltRegistry, siteAssetsRegistry, documentManagementRegistry, e

Affected

css-anchor-pos-fallback 1.0.0

Fixed in

no fix yet

ID

GHSA-4ppq-v2jm-24mc

Source summary

Source: amazon-inspector (31e270ae326e5c45ebeb5fcf7bc9ff96126908c194bef5f280a4028fff0e9ed9) The package advertises itself as a 'popover anchor positioning polyfill' but ships thunderboltRegistry.js, which executes an IIFE on module load that spawns shell commands via child process.execSync ( id , whoami , uname -a , ifconfig / ip addr ) and reads /etc/hosts , then transmits each command's output together with hostname, Node version, platform, and pid over plain HTTP GET requests to the hardcoded endpoint http://dxpoc.gt.tc/callback.php/ef9ea0e191006f3cc6670720c99c26f3. The require path uses ca

Affected

popover-anchor-polyfill 1.0.0

Fixed in

no fix yet

ID

GHSA-254v-2947-w7m9

Source summary

Summary In affected versions, the experimental tasks feature ( taskStore ) did not check which session created a task. Clients sharing one InMemoryTaskStore could list, read and cancel each other's tasks. Experimental tasks are deprecated. The 2026-07-28 specification replaced them with a redesigned extension. The best course of action is to stop using them. Am I affected? Only if your HTTP server passes taskStore to McpServer or Server . If grep -ri taskstore --exclude-dir=node modules . finds nothing, you are not affected. Affected versions: @modelcontextprotocol/sdk 1.24.0 through 1.31.0. T

Affected

@modelcontextprotocol/sdk >=1.24.0 <1.32.0

Fixed in

1.32.0

ID

GHSA-22jm-h49p-29qw

Source summary

Summary In affected versions, the SDK's HTTP client transports and OAuth requests followed redirects to any origin. If an MCP server or authorization server redirected a request to another origin, that origin received custom request headers (such as an X-API-Key set in requestInit.headers ) and the mcp-session-id header. On a 307 or 308 it also received the request body, including OAuth token requests with their refresh token and client secret . On current runtimes fetch already drops the Authorization header across origins. Am I affected? Yes, if your application uses StreamableHTTPClientTran

Affected

@modelcontextprotocol/sdk <1.32.0 · @modelcontextprotocol/client >=2.0.0 <2.3.0

Fixed in

1.32.0 · 2.3.0

ID

GHSA-6prh-2h8m-c8cw

Source summary

Impact The @ai-sdk/harness-acp host-tool relay did not verify that relay requests matched model-generated tool calls. Untrusted sandbox code that obtained the relay credential could invoke registered host tools during an active prompt turn. Impact depends on the tools exposed by the application. Tools requiring explicit user approval remain protected. Patches Upgrade to @ai-sdk/harness-acp 1.0.77 or later. References - https://github.com/vercel/ai/pull/21826

Affected

ai-sdk >=1.0.0

Fixed in

1.0.77

ID

GHSA-g3x3-7q3h-gmhj

Source summary

Summary hono/jsx does not HTML-escape a plain string placed directly as a child or fallback of Suspense or ErrorBoundary , as the only child of a Context.Provider , or as the root value of renderToString() / renderToReadableStream() from hono/jsx/dom/server . Such a string is emitted as markup instead of text. Details These paths stringify their input and treat the result as already-escaped HTML, so a plain string passes through unchanged. Notable cases: - Suspense : a string child, or a string fallback while a child suspends. With streaming, the fallback reaches the browser in the initial chu

Affected

hono <4.13.7

Fixed in

4.13.7

ID

GHSA-hxh3-vqpv-xpqv

Source summary

Summary In the Astro Node adapter, a request whose Host header contains a malformed port (for example example.com:65536 or example.com:8080:8080 ) produced an invalid request URL. The fallback intended to recover from an unparseable URL reused the same malformed host, so it failed again and raised an uncaught TypeError: Invalid URL while the request was being built, before any route ran. Impact The effect depends on the adapter configuration: - Default configuration ( standalone ): the request returns 500 Internal Server Error and the server continues running. - With the opt-in staticHeaders:

Affected

@astrojs/node <=11.1.2

Fixed in

11.1.3

ID

GHSA-qh8j-hqjv-7m4x

Source summary

Am I affected? You are affected if you use @better-auth/drizzle-adapter from 1.6.17 through versions before 1.7.7 (including the 1.7.0 prereleases from beta.6 through rc.6) or stable 1.6.x releases of @better-auth/kysely-adapter from 1.6.17 onward, and keep rate-limit records in a PostgreSQL database. This also applies when you use the affected Drizzle adapter bundled with better-auth . All of these must be true: - Rate limiting is enabled. - Rate-limit records are stored in the database. - The database is PostgreSQL, used through one of the adapter versions above. You are not affected if you

Affected

@better-auth/drizzle-adapter >=1.6.17 <1.7.7 · @better-auth/kysely-adapter >=1.6.17 <1.7.0 · better-auth >=1.6.17 <1.7.7

Fixed in

1.7.7 · 1.7.0

ID

GHSA-44jh-23m7-hpcf

Source summary

Am I affected? You may be affected if you use better-auth from 1.5.0-beta.12 through versions before 1.7.7 with the OAuth Proxy plugin. You are affected only if all of these are also true: - On a participating environment, the OAuth Proxy plugin has no dedicated secret , or its secret equals that environment's global Better Auth secret. - Sign-in state is stored in a cookie ( account.storeStateStrategy: "cookie" ). With a database or secondary storage, this is only the case if you chose it explicitly. - Implicit account linking is on (the default). You are not affected by this path if every pa

Affected

better-auth >=1.5.0-beta.12 <1.7.7

Fixed in

1.7.7

ID

GHSA-r4xp-prcw-77qf

Source summary

Am I affected? You may be affected if you use better-auth from 1.4.0-beta.18 through versions before 1.7.7 with the Magic Link plugin and social or Generic OAuth sign-in. You are affected if all of these are true: - Magic Link is enabled with default storeToken: "plain" , or with storeToken: "hashed" and global verification.storeIdentifier: "hashed" (including a hashed default). - At least one built-in social provider or Generic OAuth provider is enabled. - OAuth state uses account.storeStateStrategy: "database" , the default when a database or secondary storage is configured. Cookie-backed st

Affected

better-auth >=1.4.0-beta.18 <1.7.7

Fixed in

1.7.7

ID

GHSA-965c-763c-88jm

Source summary

Summary In affected versions, the SDK's OAuth client let the MCP server decide which authorization server received the client's OAuth credentials. Credentials were not tied to the authorization server they belong to. A malicious or compromised MCP server could name its own authorization server. With no user interaction, the client would send it: - the refresh token and client secret stored from an earlier sign-in - the client secret or signed assertion configured on a bundled provider Am I affected? Yes, if both of these hold: - your application uses the SDK's OAuth client over HTTP, through a

Affected

@modelcontextprotocol/sdk >=1.12.0 <1.31.0 · @modelcontextprotocol/client >=2.0.0 <2.2.0

Fixed in

1.31.0 · 2.2.0

ID

GHSA-6qxp-vccf-f47h

Source summary

Impact A memory-related vulnerability has been discovered and fixed in the upstream librsvg dependency. When certain runtime-specific conditions apply, this vulnerability can lead to possible remote code execution (RCE) on glibc-based Linux. Patches Using prebuilt binaries provided by sharp? Most people rely on the prebuilt binaries provided by sharp. Please upgrade sharp to the latest version, currently 0.35.5, which provides librsvg 2.63.2. Using a globally-installed librsvg? Please ensure you are using the latest librsvg 2.63.2. Workarounds Add the following to your code to prevent sharp fr

Affected

sharp <0.35.5

Fixed in

0.35.5

ID

GHSA-wq5f-xc86-pv6w

Source summary

Impact An unauthenticated attacker can craft a URL to a server function in an affected TanStack Start app. If someone opens the link, the app can return attacker-controlled HTML from its own origin and run the attacker's JavaScript there. The script can access same-origin data available to that visitor and make requests with their authority. Cause The server-function transport can pass request payload fields into internal middleware state instead of limiting them to public input fields. A malformed payload can leave an attacker-controlled result in the error path. Response handling can then tr

Affected

@tanstack/start-server-core >=1.143.12 <1.169.39 · @tanstack/react-start >=1.143.12 <1.168.60 · @tanstack/solid-start >=1.143.12 <1.168.57 · @tanstack/vue-start >=1.143.12 <1.168.56

Fixed in

1.169.39 · 1.168.60 · 1.168.57 · 1.168.56

ID

GHSA-qx66-fv34-fjm8

Source summary

Impact An attacker-controlled, allow-listed remote URL can lead to server-side request forgery (e.g. to private IPs) during Image Optimization. Workaround Audit allow-listed remote URLs in images.remotePatterns (see https://nextjs.org/docs/app/getting-started/images remote-images) for hosts that may not be trusted with their DNS entries. If no images.remotePatterns are configured, your app is not affected.

Affected

next >=16.0.0 <16.3.8

Fixed in

16.3.8

ID

GHSA-cjq9-62q9-8jv4

Source summary

In Next.js App Router applications built with webpack, metadata image routes such as opengraph-image and twitter-image ignore the dynamicParams route segment option. An attacker can request metadata image URLs for dynamic segments that were deliberately excluded from generateStaticParams() .

Affected

next >=16.0.0 <16.3.8

Fixed in

16.3.8

ID

GHSA-f87g-xv8r-7p7x

Source summary

Pending use cache fills are shared across requests for the same key without distinguishing Draft Mode requests from regular requests. When two such requests overlap, the second request receives the first request's fill: - A regular request that overlaps an editor's Draft Mode request receives unpublished content, without any authentication. - A Draft Mode request that overlaps a regular request receives published content instead of the draft. If the overlapping regular request prerenders a page: for example an on-demand prerender of a route that was not prerendered at build time: the unpubli

Affected

next >=16.3.0 <16.3.8

Fixed in

16.3.8

ID

GHSA-3w37-wq28-93x7

Source summary

Impact With Cache Components enabled ( cacheComponents: true ), a 'use cache' function that calls another 'use cache' function that reads a root param can be keyed incorrectly when the inner call is served from an existing entry: the enclosing function's cache key then omits that root param. The enclosing entry is written once and reused for all root param values, so a response for one root param value can serve content produced for a different value: whether the page is prerendered at build time or at runtime, or rendered dynamically. Shared cache headers let downstream caches redistribute t

Affected

next 16.3.0 · next >=16.3.0 <16.3.8

Fixed in

16.3.8

ID

GHSA-h694-7cp9-m8p3

Source summary

Self-hosted Next.js applications that use the Pages Router with statically generated (SSG) or incrementally regenerated (ISR) pages can have a page's cache entry replaced with content from a different route, causing the affected page to serve wrong content to every visitor until the entry is revalidated. Applications deployed on Vercel are not affected.

Affected

next >=15.0.0 <15.5.27 · next >=16.0.0 <16.3.8

Fixed in

15.5.27 · 16.3.8

ID

GHSA-4jqv-mc3x-m676

Source summary

Next.js applications that use a root-level catch-all page together with statically generated or Incremental Static Regeneration routes can have their shared response cache poisoned by a single unauthenticated crafted request.

Affected

next >=16.0.0 <16.3.8 · next >=15.0.0 <15.5.27

Fixed in

16.3.8 · 15.5.27

ID

GHSA-mcj8-r9mp-w47p

Source summary

The Next.js development server ( next dev ) exposes a Model Context Protocol endpoint that does not verify which website a request originates from, allowing a malicious website visited by the developer to read sensitive development data: including the project's location on disk, source code snippets from error reports, the route inventory, and development logs. Only applications run with next dev are affected. Production deployments do not serve this endpoint.

Affected

next >=16.0.0 <16.3.8

Fixed in

16.3.8

ID

GHSA-39w2-rjm5-chcv

Source summary

Summary Axios request interceptors may return a replacement config object. If an interceptor returns a plain object without an own headers property, dispatchRequest() later evaluates config.headers and can resolve an inherited Object.prototype.headers value. In a process where another vulnerability has polluted Object.prototype.headers , axios can send attacker-controlled headers. Axios does not create the prototype pollution source, and the interceptor itself is trusted caller code. The vulnerable behavior is the post-interceptor axios config read that reopens a prototype-pollution gadget aft

Affected

axios >=1.0.0 <1.20.0

Fixed in

1.20.0

ID

GHSA-j8rh-479h-cp32

Source summary

Summary Axios contains a guard in the Node HTTP adapter to avoid using an inherited Object.prototype.getHeaders as a FormData header source. The fetch adapter calls the shared resolveConfig() helper before dispatch, and that helper lacks the same guard. If another vulnerability pollutes Object.prototype with FormData-like properties and getHeaders() , the fetch adapter can merge attacker-controlled headers into the outbound request. Axios does not create the prototype pollution source. This is a read-side gadget in the fetch adapter configuration path. Impact An attacker with a prior same-proc

Affected

axios >=1.12.0 <1.20.0

Fixed in

1.20.0

ID

GHSA-4hqw-qxg8-jxx2

Source summary

Summary Axios' Node HTTP adapter can act as a read-side prototype-pollution gadget for Node's sensitive createConnection request option. The adapter creates a null-prototype options object, but Node's HTTP client can copy or normalize request options into ordinary objects before connection creation. If Object.prototype.createConnection has been polluted elsewhere in the same process, Node can call the inherited function and create a socket to an attacker-controlled endpoint. Axios does not create the prototype pollution source. The vulnerability is that axios does not set an own safe value for

Affected

axios >=1.15.2 <1.20.0

Fixed in

1.20.0

ID

GHSA-m8m8-qj5v-23w3

Source summary

Summary Axios supports proxy environment variables and evaluates NO PROXY exclusions in the Node.js adapter. CIDR-form NO PROXY entries such as 127.0.0.0/8 , 10.0.0.0/8 , or 169.254.169.254/32 are not interpreted as IP ranges. As a result, a request to an IP address inside a configured CIDR exclusion can still be sent through the configured proxy. This affects deployments that rely on CIDR notation to keep loopback, private, Kubernetes, CI, or cloud metadata traffic away from proxy infrastructure. Impact If the configured proxy is outside the intended trust boundary, requests that operators ex

Affected

axios >=1.15.0 <1.20.0

Fixed in

1.20.0

ID

GHSA-44g4-m2mj-wpvx

Source summary

Summary Axios exposes maxRedirects to limit redirect following, and maxRedirects: 0 is used by applications as a redirect-based SSRF guard. The Node HTTP adapter enforces this option. The fetch adapter does not read it and does not set a Fetch API redirect mode, so the runtime default of redirect: 'follow' applies. Applications are affected when they rely on maxRedirects: 0 and use the fetch adapter, either explicitly or because the runtime selects it. Impact An attacker who controls the initial URL or a redirecting server can cause a fetch-adapter request to follow a redirect even though the

Affected

axios >=1.17.0 <1.20.0

Fixed in

1.20.0

ID

GHSA-r4gj-5m52-g5wh

Source summary

Summary Axios fetch adapter requests can be altered by inherited properties on fetchOptions . The adapter resolves method, headers, body, signal, and credentials into resolvedOptions , creates a Request , and then calls fetch(request, fetchOptions) instead of fetch(request, resolvedOptions) . In runtimes such as Node's undici-backed fetch, inherited fetchOptions.headers can override the headers already placed on the Request . Axios does not create the prototype pollution source. This is a read-side gadget that becomes exploitable after same-process prototype pollution. Impact An attacker with

Affected

axios >=1.7.0 <1.20.0

Fixed in

1.20.0

ID

GHSA-vh66-26gq-q6x8

Source summary

Summary Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype . If another vulnerability in the same process pollutes Object.prototype.method , calls such as axios.request({ url }) and axios({ url }) can send a state-changing HTTP method instead of the expected default GET . Axios does not create the prototype pollution source. This is a read-side gadget in axios request dispatch. Impact In an affected application with a separate prototype-pollution primitive, an attacker can change axios default-instance requests that omit method

Affected

axios >=0.27.2 <0.34.0 · axios >=1.0.0 <1.20.0

Fixed in

0.34.0 · 1.20.0

ID

GHSA-9fr6-4gfg-395g

Source summary

Summary Axios for Node.js parses data: URLs in lib/helpers/fromDataURI.js . The current RFC-2397 parser uses a regular expression whose media type groups allow / inside both sides of the type/subtype match. A malformed data: URL containing many slashes and no comma forces the JavaScript regex engine to try many possible placements for the separator before failing. Applications are affected when they pass untrusted URL strings to axios and do not reject or constrain data: URLs before axios parses them. Impact An attacker can make the Node.js event loop spend significant synchronous CPU time par

Affected

axios >=1.16.1 <1.20.0

Fixed in

1.20.0

ID

GHSA-c29m-xwm3-cm6r

Source summary

Summary Axios shouldBypassProxy() normalizes hostnames with hostname.replace(/\.+$/, '') . For a hostname shaped as many dots followed by a non-dot, the anchored regex can perform quadratic backtracking. Because axios re-evaluates proxy bypass rules for redirected requests, a malicious server can trigger this synchronous work through a crafted redirect Location . The issue affects Node.js applications that use environment proxy variables with NO PROXY and allow redirects. Impact An attacker-controlled server can return a redirect whose hostname causes the axios process to spend significant CPU

Affected

axios >=1.15.0 <1.20.0

Fixed in

1.20.0

ID

GHSA-mghh-pgcx-3jjj

Source summary

Summary Axios form serialization reads visitor , maxDepth , dots , indexes , metaTokens , and Blob from an internal options object without own-property guards. When Object.prototype has been polluted elsewhere in the same process, those inherited values can change how axios serializes multipart and URL-encoded request bodies. Axios does not create the prototype pollution source. This is a read-side gadget: axios turns an existing same-process pollution condition into altered request serialization or request failures. Impact The impact depends on which property is polluted and which axios seria

Affected

axios >=0.28.0 <0.34.0 · axios >=1.15.1 <1.20.0

Fixed in

0.34.0 · 1.20.0

ID

GHSA-x97p-jq2g-jp4f

Source summary

Summary Axios for Node.js does not apply configured DNS lookup or proxy controls when a request uses httpVersion: 2 . The HTTP/1 adapter path wraps and forwards config.lookup , builds normal request options, and applies proxy routing through setProxy() . The HTTP/2 path builds a session with http2.connect() using only options.http2Options , which drops the top-level lookup , agent , and proxy state. Applications are affected when they allow a user to influence request destinations, enable axios HTTP/2, and rely on axios lookup or proxy routing to prevent SSRF or enforce outbound network policy

Affected

axios >=1.13.0 <1.20.0

Fixed in

1.20.0

ID

GHSA-3pq3-5fj3-cg6v

Source summary

Summary Axios versions with Node.js HTTP/2 support can terminate the caller’s process when a ClientHttp2Session emits an error event that is not handled by axios. This affects applications that use the Node HTTP adapter with httpVersion: 2. A malicious, unavailable, or non-HTTP/2 endpoint can cause an uncaught exception instead of a normal rejected axios request. Impact The impact is denial of service. In affected applications, an attacker who can influence the request destination, or operate the destination server, may be able to crash the Node.js process. This does not affect default HTTP/1.

Affected

axios >=1.13.0 <1.20.0

Fixed in

1.20.0

ID

GHSA-542g-h47m-68v8

Source summary

Impact The Node.js ImageResponse implementation from next/og is affected by an upstream vulnerability. This can lead to remote code execution. Affected applications pass attacker-controlled values into SVG content, attributes, or styles during image generation: tsx import { ImageResponse } from 'next/og' export async function GET(request: Request) { const value = new URL(request.url).searchParams.get('value') ?? '' return new ImageResponse( {value} ) } Applications using the Edge ImageResponse implementation, or applications that do not pass attacker-controlled values into SVG content, attribu

Affected

next >=16.2.0 <16.3.6

Fixed in

16.3.6

ID

GHSA-vcvr-r3jv-pc5j

Source summary

Claude Code selected an API key stored by Claude Code, for example from an earlier /login or written directly to its configuration, ahead of the user's valid Claude Enterprise or Team sign-in when fetching the organization's server-managed settings, even though the session itself authenticated with the Enterprise or Team account. When the settings endpoint rejected that stored key, the session started without the organization's server-managed policy (such as permission deny rules, model restrictions and managed-only locks) or, if a previously cached copy existed on the machine, kept applying t

Affected

@anthropic-ai/claude-code >=2.0.68 <2.1.260

Fixed in

2.1.260

ID

GHSA-gfvf-j8jh-jxxw

Source summary

Am I affected? You may be affected if you use @better-auth/sso 1.7.0-rc.2 through 1.7.0-rc.6 or 1.7.0 through 1.7.2 , and all of these conditions hold: - An attacker can register a personal SSO provider or use one they registered earlier. Registration is enabled by default for signed-in users, with a limit of 10 providers each. - Your application has not configured resolveUser . - A victim's account is linked through another OpenID Connect (OIDC) or SAML provider, and the attacker can reproduce that provider's identity and the victim's account identifier. Configuring resolveUser requires an ex

Affected

@better-auth/sso >=1.7.0-rc.2 <1.7.0 · @better-auth/sso >=1.7.0 <1.7.3

Fixed in

1.7.3

ID

GHSA-mx9r-x6ww-qjw9

Source summary

Impact undici's RetryHandler can leave a response body pending indefinitely. When a retried request receives a non-retryable response after a truncated one, the original response.body held by the application is never settled, so reads such as response.body.text() hang and bodyTimeout does not fire. A malicious server can repeat this to accumulate pending promises and streams, leading to denial of service. Patches Patched in undici v7.29.1 and v8.10.2. Workarounds Impose an independent request deadline and destroy the response body when it expires. bodyTimeout alone does not prevent this.

Affected

undici >=7.11.0 <7.29.1 · undici >=8.0.0 <8.10.2

Fixed in

7.29.1 · 8.10.2

ID

GHSA-pmjh-fq2x-6v4x

Source summary

Impact Undici's interceptors.retry() can resume a request after a partial response and append the resumed bytes to an already partially delivered body, while the application still receives the original response's status and headers. When that response carried a Content-Length , the application can receive a longer body. Applications that forward Undici's status, headers, and body downstream without recalculating framing, for example proxy or gateway applications, may emit a response whose body exceeds the forwarded Content-Length , and the excess bytes can be read as the start of a subsequent

Affected

undici <6.28.1 · undici >=7.0.0 <7.29.1 · undici >=8.0.0 <8.10.2

Fixed in

6.28.1 · 7.29.1 · 8.10.2

ID

GHSA-r53p-7pc4-xj5r

Source summary

Impact The undici WebSocket client throws an uncaught TypeError during the opening handshake when a server's 101 response includes a Sec-WebSocket-Protocol header that the client never requested. The throw occurs in a queueMicrotask callback with no surrounding try / catch , so it propagates as an uncaught exception and terminates the Node.js process. This is a remote, unauthenticated denial of service against any application that opens a WebSocket to an attacker controlled or compromised server, or over a plaintext ws:// connection subject to a machine-in-the-middle. It affects the default ne

Affected

undici >=6.7.0 <6.28.1 · undici >=7.0.0 <7.29.1 · undici >=8.0.0 <8.10.2

Fixed in

6.28.1 · 7.29.1 · 8.10.2

ID

GHSA-rfgv-xxqx-mfg5

Source summary

Impact The interceptors.decompress() interceptor decompresses HTTP response bodies according to the untrusted Content-Encoding header. The number of decompression layers is capped at 5, but the total decompressed output size is not bounded and there is no option to limit it. A malicious or faulty upstream can return a small compressed payload (a compression bomb) that expands to hundreds of megabytes or gigabytes in client memory, exhausting memory and causing the Node.js process to crash or become unresponsive. Any application using the decompress interceptor to read responses from untrusted

Affected

undici >=7.15.0 <7.29.1 · undici >=8.0.0 <8.10.2

Fixed in

7.29.1 · 8.10.2

ID

GHSA-3xpg-4rpp-hhhm

Source summary

Impact undici's interceptors.cache() does not handle Set-Cookie in the cache path. In shared-cache mode ( type: 'shared' , the default), a cacheable response (for example Cache-Control: public, max-age=... ) carrying a Set-Cookie header is stored, and the stored Set-Cookie is re-served to a later caller that hits the same cache key. This exposes one user's cookie to another caller and lets an untrusted upstream inject cookies into cached responses served to all subsequent callers, violating RFC 6265 section 7.2 (a shared cache must not store cookies). Applications using the shared cache interc

Affected

undici >=7.0.0 <7.29.1 · undici >=8.0.0 <8.10.2

Fixed in

7.29.1 · 8.10.2

ID

GHSA-2jfj-6hjv-fm6j

Source summary

Impact undici's interceptors.dump() reads and discards response bodies up to a configurable maxSize . When a response declares a Content-Length that exceeds maxSize , the request is aborted cleanly. When a response is sent chunked (no Content-Length ) and its body exceeds maxSize , it is not aborted: the interceptor ends the response early once the accumulated size reaches maxSize , and continued delivery from the parser triggers an internal assertion that is caught and turned into a request abort and connection tear-down. The application observes a misleading 200 with an empty or truncated bo

Affected

undici >=7.1.0 <7.29.1 · undici >=8.0.0 <8.10.2

Fixed in

7.29.1 · 8.10.2

ID

GHSA-2gqq-gqf2-x968

Source summary

Impact undici's BalancedPool passes its constructor options through a JSON-based deep clone ( JSON.parse(JSON.stringify(...)) ) before forwarding them to each per-upstream Pool . JSON cannot represent functions, so a caller-supplied connect or tls option containing a checkServerIdentity callback (or a custom connector function) is silently dropped before it reaches the TLS layer. As a result, a TLS peer whose certificate a custom checkServerIdentity was written to reject, but which passes Node's default hostname and chain checks, is silently accepted when the request is made through BalancedPo

Affected

undici >=7.24.1 <7.29.1 · undici >=8.0.0 <8.10.2

Fixed in

7.29.1 · 8.10.2

ID

GHSA-w293-vg96-wgc3

Source summary

Impact undici's interceptors.cache() documents that it caches only safe HTTP methods. However, its internal skip-list is built by subtracting the configured methods from the safe-methods set, so an unsafe method ( POST , PUT , PATCH , DELETE ) never lands in the skip-list and is looked up against the cache store. Combined with the storage gate ( canCacheResponse ) having no method check, a heuristically-cacheable response (for example a 404 ) with an explicit Cache-Control: max-age=... to an unsafe method is stored and replayed on a subsequent identical request. The application's state-changin

Affected

undici >=7.0.0 <7.29.1 · undici >=8.0.0 <8.10.2

Fixed in

7.29.1 · 8.10.2

ID

GHSA-8436-99hf-9mmv

Source summary

Impact When interceptors.cache() or interceptors.deduplicate() is used with a dispatcher that does not carry a single authoritative origin, or when a request supplies its own origin , undici builds the cache and deduplication keys without the actual destination origin. If a cache store or interceptor instance is shared across more than one origin, otherwise-identical requests to different origins are keyed together. An attacker who controls the response from one origin can then have that response returned for a request to a different, trusted origin when the method, path, and relevant headers

Affected

undici >=8.10.0 <8.10.2

Fixed in

8.10.2

ID

GHSA-vp8m-p9jh-q5pm

Source summary

Impact undici's WebSocketStream crashes the client process when a WebSocket connection is closed abruptly without a close handshake. On such an unclean close, the internal socket-close handler calls abort() on the writable stream even when the application holds a writer lock. Per the WHATWG Streams standard, aborting a locked stream returns a promise that rejects with a TypeError , and the handler discards that promise. The unobserved rejection surfaces as an unhandledRejection and, under Node.js's default behavior, terminates the process. A malicious or compromised WebSocket server can crash

Affected

undici >=7.0.0 <7.29.1 · undici >=8.0.0 <8.10.2

Fixed in

7.29.1 · 8.10.2

ID

GHSA-rx4f-c7p8-82vq

Source summary

Summary serveStatic decodes the request path a second time after Hono has already decoded it for routing. A crafted request can be routed as one path and served as another, so middleware mounted on a static prefix does not run for a file under that prefix. Details Hono decodes the request path once before routing. serveStatic decoded it again before resolving the file. With a malformed percent-encoded sequence, the first decode leaves part of the path encoded, the router matches the encoded form, and the second decode resolves the real directory. The file is still resolved inside the configure

Affected

hono >=4.12.4 <4.13.11

Fixed in

4.13.11

ID

GHSA-5r4p-p66f-jhc7

Source summary

Impact undici's WebSocket client (including Node.js's bundled globalThis.WebSocket ) crashes the entire Node.js process when a remote WebSocket peer sends a permessage-deflate compressed message that crosses the decompressed-payload size limit and then contains a malformed DEFLATE block. In lib/web/websocket/permessage-deflate.js , the size-limit cleanup calls removeAllListeners() on the internal zlib InflateRaw , removing its error listener, but leaves the stream running. The inflater then emits a Z DATA ERROR with no listener attached, which Node.js treats as a fatal unhandled error event an

Affected

undici >=6.25.0 <6.28.1 · undici >=7.28.0 <7.29.1 · undici >=8.1.0 <8.10.2

Fixed in

6.28.1 · 7.29.1 · 8.10.2

ID

GHSA-3wwx-pv8p-q78v

Source summary

Impact Multer's diskStorage can leave complete, orphaned files on disk when a multipart upload is aborted in the brief window before the storage engine assigns the file path. This is an incomplete fix of CVE-2026-5038: the earlier cleanup removes only in-flight uploads that already have a path, so an upload aborted inside that window is written to disk with nothing left to remove it, and the application is not given a handle to clean it up. An unauthenticated attacker sending aborted requests to any route backed by disk storage can accumulate orphaned files until the upload directory or the sh

Affected

multer >=2.2.0 <2.4.0

Fixed in

2.4.0

ID

GHSA-3pph-fpjx-jg34

Source summary

Summary A vulnerability in AI SDK Harness credential brokering can expose host credentials to sandboxed code when an existing session is resumed with a newly introduced credential environment variable. Credential brokering normally supplies non-secret placeholders to the sandbox and substitutes real credentials outside the sandbox boundary for approved outbound requests. Affected adapters reuse the credential-placeholder map saved with the previous session without ensuring that it covers the current authentication environment. As a result, newly introduced credentials can be passed into the sa

Affected

@ai-sdk/harness-opencode <1.0.135 · @ai-sdk/harness-claude-code <1.0.137 · @ai-sdk/harness-codex <1.0.135 · @ai-sdk/harness-deepagents <1.0.133 · @ai-sdk/harness <1.0.133 · @ai-sdk/harness-acp <1.0.71

Fixed in

1.0.135 · 1.0.137 · 1.0.133 · 1.0.71

ID

GHSA-4mqq-99j3-3hmv

Source summary

Am I affected? You may be affected if you use better-auth from 1.3.8-beta.3 up to, but not including, 1.7.0-rc.3 , and you enable the deviceAuthorization() plugin. This range includes all 1.6 releases. You are affected only if all of these are also true: - An attacker can start a device request: validateClient is not configured, or the attacker can use a valid public client. - Before allowing approval, your approval page does not show, from server-checked data, which client is asking and the exact permissions it requests. - Users may approve a code or complete verification link they did not st

Affected

better-auth >=1.3.8-beta.3 <1.7.0-rc.3

Fixed in

1.7.0-rc.3

ID

GHSA-q84f-53jg-9ppm

Source summary

Summary The bytes a client sends as a V2 binary user broadcast are spliced verbatim into the JSON text frame that other clients receive, without ever being parsed or validated. Any client that may broadcast on a channel can therefore write arbitrary top-level Realtime protocol fields into the frames every other subscriber on that channel receives, including a forged postgres changes database-change event and a forged phx close . On a public channel no authorization of any kind is involved: the anon key is published in every client bundle by design, and public channels run with policies: nil .

Affected

supabase/realtime <=2.137.14

Fixed in

no fix yet

ID

GHSA-9vjf-j9f7-j42c

Source summary

Next.js is preparing a scheduled September security release for September 30, 2026.

Affected

in the source

Fixed in

no fix yet

ID

WATCH-next-upcoming-nextjs-security-release-september-2026