Security vulnerabilities and automated fixes for dependency upgrade issues
23 posts found
A critical vulnerability in JS-YAML versions 3.x and 4.x allowed attackers to trigger quadratic CPU consumption through maliciously crafted YAML input using the `!!omap` tag resolver. The vulnerability stems from inefficient array operations in the ordered map resolution logic, which could be exploited for denial-of-service attacks. Upgrading to JS-YAML 4.3.1 or 3.15.1 patches this attack surface by optimizing the computational complexity of ordered map processing.
A high-severity flaw in Electron (CVE-2026-70608) allowed sandboxed iframes to bypass the `allow-popups` sandbox restriction through the internal OpenURL navigation path, letting malicious or compromised embedded content spawn unauthorized popup windows. The fix upgrades Electron from 40.10.6 to 41.10.3 (also patched in 42.0.1 and 39.8.10), closing the navigation-layer gap without requiring any application code changes.
A high-severity Denial of Service vulnerability (CVE-2026-59869) in the js-yaml parser allowed specially crafted YAML documents to exhaust CPU and memory when loaded by apps/dsa-desktop. The fix upgrades js-yaml to a patched release via the package-lock.json dependency tree, closing off the unbounded resource consumption path before it reached production.
CVE-2026-69192 reveals a critical inconsistency in the `ip-address` library where Address4 decodes leading-zero octets as decimal while DNS resolvers interpret them as octal, creating a dangerous parsing divergence. This mismatch allows attackers to bypass IP-based access controls and perform Server-Side Request Forgery (SSRF) attacks. The fix upgrades `ip-address` from 9.0.5 to 10.3.1, aligning parsing behavior with standard resolver implementations.
The `ip-address` npm package (version 10.2.0) parsed IPv4 addresses with leading-zero octets as decimal numbers, while operating system resolvers interpret them as octal. This inconsistency (CVE-2026-69192) allows attackers to bypass SSRF protections and trust-boundary checks by crafting IP addresses that appear safe to the library but resolve to internal network addresses. The fix upgrades `ip-address` to version 10.3.1, which correctly rejects or normalizes ambiguous octal notation.
CVE-2026-28292 is a critical Remote Code Execution vulnerability in the `simple-git` Node.js library that allowed attackers to bypass previously applied security fixes. Applications using `simple-git` versions below 3.32.3 remained exposed even after earlier patches, and upgrading to 3.32.3 — which introduced hardened argument parsing via new `@simple-git/argv-parser` and `@simple-git/args-pathspec` sub-packages — closes the bypass. This fix is especially urgent because the vulnerability affects
A high-severity vulnerability in `golang.org/x/crypto/ssh` (CVE-2026-39828) allowed attackers to execute unauthorized commands by exploiting discarded SSH permissions. The fix involved upgrading `golang.org/x/crypto` from v0.51.0 to v0.52.0 in `go.mod`, closing an authentication bypass that could be triggered remotely in any Go service using the SSH package.
CVE-2026-64642 is a high-severity authentication bypass vulnerability in Next.js that affects App Router applications using Turbopack with a single locale configuration. The flaw allows attackers to circumvent middleware and proxy security controls, potentially gaining unauthorized access to protected routes. Upgrading from Next.js 16.2.7 to 16.2.11 closes the vulnerability entirely.
CVE-2026-32285 is a high-severity Denial of Service vulnerability in the Go library `github.com/buger/jsonparser` v1.1.1, triggered by crafted malformed JSON input. The fix is a dependency upgrade to v1.1.2 in `go.mod` and `go.sum`, which tightens input handling without affecting valid JSON processing. Any Go application that parses untrusted JSON through this library is potentially exposed until the upgrade is applied.
CVE-2026-56852 is a high-severity Denial of Service vulnerability in `golang.org/x/text` where `norm.Iter` can enter an infinite loop when processing invalid UTF-8 input, potentially hanging any Go application that normalizes untrusted text. The fix upgrades `golang.org/x/text` from v0.34.0 to v0.39.0 in `parser/go.mod`, closing the loop condition that malformed byte sequences could exploit. Developers using any version of `golang.org/x/text` below 0.39.0 should upgrade immediately.
CVE-2026-21884 is a high-severity cross-site scripting (XSS) vulnerability in React Router's ScrollRestoration component that affects server-side rendering (SSR) implementations. The vulnerability was introduced through unsafe handling of scroll position data that could be influenced by untrusted input. This fix upgrades react-router from version 7.9.5 to 8.3.0, replacing the vulnerable `cookie` dependency with `cookie-es` and removing the `set-cookie-parser` dependency entirely.
A high-severity path traversal vulnerability (CVE-2026-15074) in @fastify/static version 9.0.0 allowed attackers to bypass route guards and access restricted files. The agentchatbus-ts service was upgraded from @fastify/static 9.0.0 to 10.1.2, which includes proper path normalization to prevent directory traversal attacks.