Security vulnerabilities and automated fixes for denial of service issues
130 posts found
A high-severity Denial of Service vulnerability (CVE-2026-13149) was discovered in the brace-expansion npm package, where maliciously crafted input could trigger exponential-time complexity and crash Node.js applications. The fix upgrades brace-expansion from version 5.0.6 to 5.0.9 using npm overrides to ensure all nested dependencies receive the patched version.
A high-severity Denial of Service vulnerability in the nanoid package (CVE-2026-67213) was discovered in the project's dependency tree, where crafted input could trigger an infinite loop during random ID generation. The fix upgrades nanoid from 3.3.17 to 3.3.18 and adds an npm override to ensure all transitive dependencies use the patched version.
CVE-2026-59873 is a critical Denial of Service vulnerability in the node-tar package, where a specially crafted gzip bomb can exhaust server resources during archive extraction. The fix upgrades tar from version 7.5.16 to 7.5.22 (pinned at `^7.5.19`) in the `@xen-orchestra/backups` package, closing the attack surface against resource exhaustion attacks targeting backup workflows.
A critical Denial of Service vulnerability (CVE-2026-59873) was discovered in node-tar versions prior to 7.5.19, allowing attackers to craft malicious gzip archives that expand to consume excessive memory or CPU, crashing the host process. The fix upgrades the `tar` dependency from 7.5.16 to 7.5.19 in both `package.json` and `package-lock.json`, closing the attack surface for any application that processes user-supplied or remotely fetched archives.
A critical denial-of-service vulnerability in `_workers.js` allowed attackers to send arbitrarily large or deeply nested JSON payloads to the `/api/log-speed` POST endpoint, causing the Cloudflare Worker to exhaust CPU and memory during parsing. The fix adds a Content-Length header check before calling `await request.json()`, rejecting payloads over 10 KB with an HTTP 413 response. This prevents resource exhaustion attacks while preserving all legitimate functionality.
CVE-2026-13149 is a high-severity Denial of Service vulnerability in the `brace-expansion` npm package, where specially crafted brace patterns trigger exponential-time processing that can freeze or crash a Node.js application. The fix upgrades the package from version 1.1.14 to 2.1.2 in the React Native frontend's `package-lock.json`, eliminating the vulnerable code path. Because the affected file is in production code, unpatched applications could be targeted by any attacker able to influence b
Apache Superset's Cypress testing infrastructure depended on `brace-expansion` 5.0.7, a Node.js package vulnerable to denial of service via malformed brace pattern input (CVE-2026-14257). Upgrading to version 5.0.8 in `superset-frontend/cypress-base/package-lock.json` closes the vulnerability. While the affected file is part of the test toolchain, it lives in the production codebase and is flagged by Trivy as likely exploitable.
CVE-2026-13149 is a high-severity Denial of Service vulnerability in the `brace-expansion` npm package caused by exponential-time complexity when processing certain brace patterns. Because `brace-expansion` is a transitive dependency present in many Node.js projects' production dependency trees, an attacker who can influence glob patterns or file path inputs can trigger runaway CPU consumption and crash the service. The fix upgrades the package to patched versions (1.1.16, 2.1.2, or 5.0.7) and p
CVE-2026-14257 is a high-severity denial-of-service vulnerability in the `brace-expansion` npm package (versions through 5.0.7) that allows an attacker to trigger an out-of-memory process crash by supplying a crafted string with deeply nested or exponentially large brace patterns. The fix upgrades the dependency to version 5.0.8 and pins it via a Yarn resolution to ensure no transitive dependency pulls in the vulnerable version. Left unpatched, this vulnerability could be exploited to take down
A critical missing rate-limiting control in `src/sse/handlers/chat.js` allowed any caller to flood the SSE chat endpoint with unlimited requests, risking server resource exhaustion, denial of service, and runaway AI provider API costs. The fix introduces a per-IP sliding-window rate limiter that caps requests at 60 per minute and returns HTTP 429 on violations. Because the endpoint was publicly reachable and only validated API keys — not request frequency — exploitation required nothing more tha
CVE-2026-13149 is a high-severity Denial of Service vulnerability in the `brace-expansion` npm package, where crafted input strings trigger exponential-time processing that can freeze or crash a Node.js application. The fix upgrades `brace-expansion` from `2.0.2` to `2.1.4` and `minimatch` from `5.1.6` to `5.1.9`, along with npm `overrides` to ensure the patched versions are used throughout the entire dependency tree.
CVE-2026-59873 is a critical Denial of Service vulnerability in the `node-tar` npm package (versions before 7.5.19) that allows an attacker to crash or exhaust a Node.js process by supplying a crafted gzip bomb archive. The fix upgrades `tar` from 7.5.16 to 7.5.19 in `frontend/package-lock.json`, closing the decompression resource exhaustion vector without affecting valid archive processing.