Security vulnerabilities and automated fixes for cve issues
70 posts found
CVE-2026-28292 is a critical Remote Code Execution vulnerability in the `simple-git` Node.js library that allowed attackers to bypass previously applied security fixes. Applications using `simple-git` versions below 3.32.3 remained exposed even after earlier patches, and upgrading to 3.32.3 — which introduced hardened argument parsing via new `@simple-git/argv-parser` and `@simple-git/args-pathspec` sub-packages — closes the bypass. This fix is especially urgent because the vulnerability affects
A high-severity vulnerability in `golang.org/x/crypto/ssh` (CVE-2026-39828) allowed attackers to execute unauthorized commands by exploiting discarded SSH permissions. The fix involved upgrading `golang.org/x/crypto` from v0.51.0 to v0.52.0 in `go.mod`, closing an authentication bypass that could be triggered remotely in any Go service using the SSH package.
CVE-2026-59873 is a critical Denial of Service vulnerability in the node-tar package, where a specially crafted gzip bomb can exhaust server resources during archive extraction. The fix upgrades tar from version 7.5.16 to 7.5.22 (pinned at `^7.5.19`) in the `@xen-orchestra/backups` package, closing the attack surface against resource exhaustion attacks targeting backup workflows.
A critical Denial of Service vulnerability (CVE-2026-59873) was discovered in node-tar versions prior to 7.5.19, allowing attackers to craft malicious gzip archives that expand to consume excessive memory or CPU, crashing the host process. The fix upgrades the `tar` dependency from 7.5.16 to 7.5.19 in both `package.json` and `package-lock.json`, closing the attack surface for any application that processes user-supplied or remotely fetched archives.
CVE-2026-15074 is a high-severity path traversal vulnerability in `@fastify/static` versions prior to 10.1.1 that allowed remote attackers to bypass route guards by manipulating URL paths. The fix upgrades the package from 9.3.0 to 10.1.1, closing the path traversal vector that could expose protected routes and sensitive files. Because this plugin runs in a production web service handling real user requests, the risk of exploitation was assessed as likely.
CVE-2026-25896 is a critical Cross-Site Scripting vulnerability in fast-xml-parser caused by improper handling of DOCTYPE entity declarations, allowing attackers to inject malicious scripts through crafted XML input. The fix upgrades the library from vulnerable versions (4.5.3 and 5.2.3) to patched releases (4.5.7 and 5.10.1), closing the attack vector in production code. This matters because fast-xml-parser is widely used to process user-supplied XML in Node.js applications, making any XSS flaw
CVE-2026-35209 is a high-severity prototype pollution vulnerability in the `defu` JavaScript library (versions prior to 6.1.5), where a crafted `__proto__` key in the defaults argument can corrupt the global Object prototype. The fix upgrades `defu` from 6.1.4 to 6.1.5 in `pnpm-lock.yaml` and enforces the version via a workspace override, closing the attack surface in production code that depends on `defu` for deep object merging.
CVE-2026-50146 is a reflected cross-site scripting (XSS) vulnerability in Astro versions prior to 6.3.3, where unescaped slot names could be injected into rendered HTML. The fix upgrades Astro from 5.18.1 to 6.3.3 (along with related packages `@astrojs/starlight` and `starlight-blog`), closing a code path that allowed attacker-controlled input to reach the browser without sanitization. Any Astro-based site that renders dynamic slot names from untrusted sources was potentially exposed to session
CVE-2026-64642 is a high-severity authentication bypass vulnerability in Next.js that affects App Router applications using Turbopack with a single locale configuration. The flaw allows attackers to circumvent middleware and proxy security controls, potentially gaining unauthorized access to protected routes. Upgrading from Next.js 16.2.7 to 16.2.11 closes the vulnerability entirely.
CVE-2026-13676 is a high-severity vulnerability in the `fast-uri` npm package where improper handling of Unicode hostnames during URI parsing could allow attackers to bypass security policies. By upgrading `fast-uri` from 3.1.2 to 3.1.3 (or 2.4.2 / 4.0.1 depending on the major version in use), the canonicalization logic is corrected to ensure that Unicode hostnames are normalized consistently before any policy checks are applied. This fix matters because URI parsing libraries are foundational co
CVE-2026-56852 is a high-severity denial-of-service vulnerability in `golang.org/x/text` where a `norm.Iter` iterator can enter an infinite loop when processing specially crafted Unicode input, hanging the process indefinitely. The `fe-tool` module was pinned to `v0.27.0`, which contains the flaw, and was upgraded to `v0.39.0` to eliminate the risk. Because `fe-tool` handles file-format parsing (7-Zip archives and Electron ASAR bundles), any user-supplied filename or archive content could have t
A vulnerability in the `tmp` Node.js package (CVE-2026-44705) was discovered lurking as a transitive dependency via `tmp-promise@3.0.3`, leaving applications exposed to unsafe temporary file handling. The fix pins `tmp` to version `0.2.7` using a pnpm override across `package.json`, `dist/cli.js`, and `pnpm-lock.yaml`, eliminating the vulnerable code path without affecting any valid application behavior.