Security vulnerabilities and automated fixes for dependency security issues
23 posts found
A high-severity denial-of-service vulnerability in js-yaml (GHSA-5p4m-2wfm-xmqj) caused quadratic CPU consumption when resolving `!!omap` (ordered map) YAML tags, affecting both the 3.x and 4.x release lines. Upgrading to js-yaml 4.3.1 or 3.15.1 closes the gap by fixing the algorithmic inefficiency in `!!omap` duplicate-key detection. Any application that parses untrusted YAML input is at risk of resource exhaustion leading to service unavailability.
A high-severity Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-69192) was discovered in the ip-address package version 10.2.0, where inconsistent IP address parsing allowed attackers to bypass trust boundaries and access internal resources. The fix upgrades ip-address from 10.2.0 to 10.3.1 across the dependency tree, with explicit pinning in package.json and strategic version management in bun.lock to prevent both direct and transitive exploitation paths.
A critical prototype pollution vulnerability in axios versions 1.12.0 and earlier could allow attackers to trigger denial of service attacks by poisoning the configuration object through the `__proto__` key. The vulnerability was fixed by upgrading axios to 1.13.5 and updating related dependencies like follow-redirects to 1.16.0, which implements stricter input validation in the mergeConfig function.
Python-SocketIO versions prior to 5.16.2 contained a critical vulnerability where binary attachments could accumulate without bounds, allowing attackers to exhaust server memory and trigger a denial of service. This vulnerability has been patched through a dependency upgrade that implements proper resource limits on attachment handling.
A high-severity denial-of-service vulnerability (GHSA-5p4m-2wfm-xmqj) in js-yaml versions 4.3.0 and 3.x caused quadratic CPU consumption when resolving `!!omap` (ordered map) types in YAML documents. Attackers who could supply crafted YAML input could cause CPU exhaustion proportional to the square of the input size, potentially grinding Node.js services to a halt. The fix upgrades js-yaml to 4.3.1 and pins the version via a `package.json` overrides block to ensure no transitive dependency can r
A high-severity vulnerability in Nodemailer (GHSA-p6gq-j5cr-w38f) allowed attackers to bypass the `disableFileAccess` and `disableUrlAccess` security controls by using the message-level `raw` option, enabling arbitrary file reads and full-response SSRF in delivered emails. The fix upgrades Nodemailer from version 6.10.1 to 9.0.1, closing this bypass at the library level. This is especially critical for applications that allow any user-influenced content to flow into email composition.
A Denial of Service vulnerability in `golang.org/x/crypto/ssh` (CVE-2026-39830) allowed attackers to exhaust server resources by sending unsolicited SSH responses that were never properly cleaned up. The fix upgrades `golang.org/x/crypto` from `v0.50.0` to `v0.52.0` in `go.mod`, patching the resource leak in the SSH package's response handling logic. Any Go application that uses the `golang.org/x/crypto/ssh` package for SSH client or server functionality was potentially exposed.
A high-severity vulnerability in Nodemailer (versions before 9.0.0) allowed the `raw` message option to completely bypass `disableFileAccess` and `disableUrlAccess` security controls, enabling attackers to read arbitrary files from the server filesystem and perform full-response Server-Side Request Forgery (SSRF) in delivered email messages. Upgrading from `^8.0.10` to `^9.0.4` in `backend/package-lock.json` closes this exploit primitive by enforcing access restrictions consistently across all m
CVE-2026-69192 is a high-severity vulnerability in the `ip-address` npm package (versions before 10.3.1) where IPv4 addresses with leading-zero octets — like `010.0.0.1` — are parsed as decimal by the library but interpreted as octal by OS-level resolvers, creating a dangerous mismatch. This discrepancy can allow attackers to bypass IP-based access controls and trust boundaries, potentially enabling Server-Side Request Forgery (SSRF) attacks. Upgrading to `ip-address@10.3.1` in the SAP BW Query
CVE-2026-41672 is a high-severity XML node injection vulnerability in the `@xmldom/xmldom` package, caused by insufficient validation during comment serialization that allows attackers to inject arbitrary XML nodes into a document. The fix upgrades `@xmldom/xmldom` from version 0.8.12 to 0.8.13 (and 0.9.x to 0.9.10), closing the injection path by tightening how untrusted comment content is handled before it reaches the serializer.
CVE-2026-14257 is a denial-of-service vulnerability in the brace-expansion library that allows attackers to crash applications through unbounded expansion of brace patterns. By upgrading from version 2.1.2 to 2.1.3 and 5.0.6 to 5.0.8, we eliminated the risk of memory exhaustion attacks targeting glob pattern expansion in build tools and scripts.
CVE-2026-59873 is a critical Denial of Service vulnerability in the `node-tar` package (versions before 7.5.19) that allows an attacker to trigger resource exhaustion by supplying a crafted gzip bomb archive. The fix upgrades `tar` from 7.5.16 to 7.5.19 in both `package.json` and `package-lock.json`, closing the attack surface for any Node.js application that processes tar archives. Because this package is used in production code — not just in tests — the exposure was real and immediate.