| CVE-2026-106445 | CRITICAL | handlebars | 4.7.9 | 4.7.10 | handlebars: Handlebars: JavaScript Injection via Own Property Check Bypass |
| CVE-2026-106446 | CRITICAL | handlebars | 4.7.9 | 4.7.10 | handlebars: Handlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams) |
| CVE-2026-111497 | CRITICAL | libbrotlicommon1 | 1.2.0-r5 | 1.2.0-r7 | brotli: Out-of-Bounds Write in Google Brotli Decoder |
| CVE-2026-111497 | CRITICAL | libbrotlidec1 | 1.2.0-r5 | 1.2.0-r7 | brotli: Out-of-Bounds Write in Google Brotli Decoder |
| CVE-2026-111497 | CRITICAL | libbrotlienc1 | 1.2.0-r5 | 1.2.0-r7 | brotli: Out-of-Bounds Write in Google Brotli Decoder |
| CVE-2026-91403 | CRITICAL | ca-certificates-bundle | 20260909-r2 | 20260909-r3 | OpenJDK: Distrust eMudhra intermediate CA certificates due to security concerns |
| GHSA-cg2g-xh64-v4q7 | CRITICAL | dompurify | 3.4.16 | 3.4.17 | DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes |
| CVE-2026-105482 | HIGH | nodejs-22 | 22.23.2-r1 | 22.23.4-r0 | nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character |
| CVE-2026-106069 | HIGH | nodejs-22 | 22.23.2-r1 | 22.23.4-r0 | nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames |
| CVE-2026-111755 | HIGH | follow-redirects | 1.16.0 | 1.16.1 | follow-redirects: follow-redirects: Information disclosure via improper regular expression escaping in sensitive header filtering |
| CVE-2026-111756 | HIGH | follow-redirects | 1.16.0 | 1.16.1 | follow-redirects: follow-redirects: Information disclosure via array-formatted headers during cross-origin redirects |
| CVE-2026-111943 | HIGH | ca-certificates-bundle | 20260909-r2 | 20260909-r3 | crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates |
| CVE-2026-116689 | HIGH | follow-redirects | 1.16.0 | 1.16.2 | follow-redirects: follow-redirects: Information disclosure via cross-origin redirects |
| CVE-2026-118664 | HIGH | decode-uri-component | 0.5.0 | 0.5.1 | decode-uri-component: decode-uri-component: Denial of Service via malformed percent-encoded input |
| CVE-2026-118772 | HIGH | joi | 18.2.9 | 17.13.9, 18.3.1 | joi: joi: Denial of Service via inefficient regular expression in email validation |
| CVE-2026-118779 | HIGH | node-forge | 1.4.0 | 1.4.1 | Forge (also called node-forge) is a native implementation of Transport ... |
| CVE-2026-118782 | HIGH | node-forge | 1.4.0 | 1.4.1 | Forge (also called node-forge) is a native implementation of Transport ... |
| CVE-2026-119187 | HIGH | node-forge | 1.4.0 | 1.4.1 | node-forge: node-forge: Denial of Service via call stack exhaustion in TLS record processing |
| CVE-2026-119188 | HIGH | node-forge | 1.4.0 | 1.4.1 | node-forge: node-forge: Denial of Service via interleaved record during fragmented TLS handshake |
| CVE-2026-119190 | HIGH | node-forge | 1.4.0 | 1.4.1 | Forge (also called node-forge) is a native implementation of Transport ... |
| CVE-2026-119202 | HIGH | @hapi/content | 6.0.2 | 6.0.3 | @hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service |
| GHSA-mrv2-3pqr-j5jr | HIGH | dompurify | 3.4.16 | 3.4.17 | DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p) |
| CVE-2026-85393 | HIGH | node-forge | 1.4.0 | — not fixable | node-forge: node-forge: Signature forgery vulnerability in RSA PKCS#1 v1.5 verification |
| CVE-2026-105481 | MEDIUM | nodejs-22 | 22.23.2-r1 | 22.23.4-r0 | nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse |
| CVE-2026-106072 | MEDIUM | nodejs-22 | 22.23.2-r1 | 22.23.4-r0 | nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification |
| CVE-2026-106074 | MEDIUM | nodejs-22 | 22.23.2-r1 | 22.23.4-r0 | nodejs: nodejs: predictable random values via snapshot entropy cache reuse |
| CVE-2026-106444 | MEDIUM | handlebars | 4.7.9 | 4.7.10 | handlebars: Handlebars: Cross-Site Scripting via unescaped closing script tags in precompiled templates |
| CVE-2026-110180 | MEDIUM | fast-uri | 3.1.8 | 2.4.8, 3.1.9, 4.2.3 | fast-uri: fast-uri: Security policy bypass via improper host canonicalization |
| CVE-2026-110306 | MEDIUM | fast-uri | 3.1.8 | 2.4.8, 3.1.9, 4.2.3 | fast-uri: fast-uri: Cross-Site Scripting via improper URI scheme decoding |
| CVE-2026-111997 | MEDIUM | ip-address | 10.7.1 | 10.7.4 | ip-address: ip-address: Denial of Service via excessive percent characters in IPv6 address input |
| CVE-2026-118764 | MEDIUM | minimatch | 10.2.5 | 11.0.1 | minimatch: minimatch: Denial of Service via crafted glob pattern expansion |
| CVE-2026-118764 | MEDIUM | minimatch | 3.1.5 | 11.0.1 | minimatch: minimatch: Denial of Service via crafted glob pattern expansion |
| CVE-2026-118773 | MEDIUM | glob | 11.1.0 | 14.0.2 | glob: glob: Denial of Service (DoS) via incomplete traversal cancellation |
| CVE-2026-118777 | MEDIUM | node-forge | 1.4.0 | 1.4.1 | Forge (also called node-forge) is a native implementation of Transport ... |
| CVE-2026-118778 | MEDIUM | node-forge | 1.4.0 | 1.4.1 | node-forge: node-forge: Denial of Service via missing TLS server certificate |
| CVE-2026-119186 | MEDIUM | node-forge | 1.4.0 | 1.4.1 | Forge (also called node-forge) is a native implementation of Transport ... |
| CVE-2026-106073 | LOW | nodejs-22 | 22.23.2-r1 | 22.23.4-r0 | nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() |
| CVE-2026-110095 | LOW | fast-uri | 3.1.8 | 2.4.8, 3.1.9, 4.2.3 | fast-uri: fast-uri: Path traversal via improper relative URI normalization |
| CVE-2026-110725 | LOW | fast-uri | 3.1.8 | 2.4.8, 3.1.9, 4.2.3 | fast-uri: fast-uri: Cross-site scripting via unescaped colon in relative URI paths |
| CVE-2026-115897 | LOW | serialize-javascript | 7.0.5 | 7.1.3 | serialize-javascript: serialize-javascript: Cross-Site Scripting via improper function escaping |
| CVE-2026-118775 | LOW | node-forge | 1.4.0 | 1.4.1 | Forge (also called node-forge) is a native implementation of Transport ... |
| CVE-2026-118780 | LOW | node-forge | 1.4.0 | 1.4.1 | Forge (also called node-forge) is a native implementation of Transport ... |
| CVE-2026-118781 | LOW | node-forge | 1.4.0 | 1.4.1 | Forge (also called node-forge) is a native implementation of Transport ... |
| GHSA-c6gr-qvv4-5v3f | LOW | dompurify | 3.4.16 | 3.4.17 | DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml |
