Page 16
A high-severity denial-of-service vulnerability (CVE-2025-14874) in Nodemailer versions prior to 7.0.0 allowed attackers to crash Node.js email-sending services by supplying specially crafted email address headers. The fix upgrades the `nodemailer` dependency in `clay-server` from version 6.10.1 to 9.0.5, closing the attack surface against malformed input. Any application that passes user-influenced data into Nodemailer's address parsing logic is affected and should upgrade immediately.
CVE-2024-4068 is a high-severity Regular Expression Denial of Service (ReDoS) vulnerability in the `braces` npm package (versions prior to 3.0.3) that allows an attacker to trigger catastrophic CPU consumption by supplying a crafted brace-expansion string with no character limit. The fix upgrades `braces` from 3.0.2 to 3.0.3 and its internal dependency `fill-range` from 7.0.1 to 7.1.1, both of which enforce limits on the size of input they will process. This patch was applied via a Yarn resoluti
A high-severity command injection vulnerability was discovered in `Config/QuickAdd/git-add-new-origin-branch.js`, where user-supplied branch names were interpolated directly into a shell command string passed to `child_process.exec()`. The fix replaces the shell-interpolated `exec()` call with `execFile()`, passing arguments as a discrete array and eliminating the shell entirely. This proactive hardening removes an exploit primitive that could have been chained with other weaknesses to achieve a
A command injection vulnerability in `sitrecServer/windProxy.php` allowed user-controlled input to reach a shell command without proper sanitization, creating a remote code execution risk. The `$cycleHour` parameter was passed directly as a format integer (`%d`) into a `sprintf`-built shell command, bypassing the `escapeshellarg()` protection applied to all other arguments. The fix casts `$cycleHour` to an integer and wraps it with `escapeshellarg()`, closing the injection path entirely.
A Denial of Service vulnerability in nanoid versions prior to 3.3.18 allowed attackers to trigger an infinite loop during random ID generation, potentially hanging Node.js processes indefinitely. The fix upgrades nanoid from 3.3.16 to 3.3.18 in both `package-lock.json` and `package.json`, and adds an `overrides` entry to ensure the patched version is enforced across the entire dependency tree. This is a high-severity issue that any project using nanoid for ID generation—directly or transitively—
CVE-2026-4867 is a Regular Expression Denial of Service (ReDoS) vulnerability in the `path-to-regexp` package (versions prior to 0.1.13) that allows an attacker to craft malformed URL parameters that cause catastrophic backtracking in the regex engine, effectively hanging the Node.js event loop. The fix upgrades `path-to-regexp` from 0.1.12 to 0.1.13 and pins the version via an `overrides` field in `package.json` to ensure the patched version is used throughout the entire dependency tree. Any Ex
A high-severity Denial of Service vulnerability (CVE-2026-67213) was discovered in the `nanoid` package used in the `docs-site` component, where a flaw in random ID generation could trigger an infinite loop under certain inputs, exhausting CPU resources. The fix upgrades `nanoid` from version 3.3.15 to 3.3.18 (and 5.x to 5.1.6) in `docs-site/package-lock.json`, closing the attack surface without affecting valid ID generation. This kind of dependency vulnerability is easy to overlook but can have
CVE-2026-39244 is a high-severity Denial of Service vulnerability in adm-zip versions prior to 0.6.0, where a specially crafted ZIP file can trigger excessive memory allocation and crash a Node.js application. The vulnerability was present in the deepseek-ivideo plugin's dependency tree and was fixed by pinning adm-zip to version 0.6.0 in both `package.json` and `pnpm-lock.yaml`. Because adm-zip processes ZIP archives that can originate from user-supplied or external sources, this flaw represent
A critical command injection vulnerability (CVE-2026-9277) in the `shell-quote` npm package versions prior to 1.8.4 allowed attackers to execute arbitrary code by injecting unescaped line terminators into shell arguments. The fix upgrades `shell-quote` from 1.8.2 to 1.9.0 and pins the dependency across `package.json`, `package-lock.json`, and `yarn.lock` to ensure no transitive dependency can pull in the vulnerable version.
A path traversal vulnerability in PostCSS versions prior to 8.5.x allowed attackers to craft malicious CSS with attacker-controlled `sourceMappingURL` comments, causing PostCSS to read arbitrary `.map` files from the filesystem and potentially disclose sensitive information. The fix upgrades PostCSS from `8.4.47` to `8.5.23` in `packages/devtools/package-lock.json`, closing the auto-loading attack surface entirely. This change is scoped to the devtools build toolchain but is critical for any env
CVE-2025-7783 is a critical vulnerability in the `form-data` npm package caused by its use of an unsafe random function to generate multipart form boundaries. Versions 2.3.3 and 4.0.5 were affected, and the fix upgrades the package to 4.0.6 (consolidating previously split nested versions) while eliminating the predictable boundary generation. Attackers who could predict or influence multipart boundaries could craft malicious payloads that escape intended field boundaries.
A high-severity denial-of-service vulnerability (GHSA-g2gp-3wwq-f4ph) was discovered in `league/commonmark`, a popular PHP Markdown parsing library. The flaw allows an attacker to craft Markdown input containing adjacent inline attribute blocks that trigger catastrophic processing, potentially exhausting server resources. Upgrading from version 2.7.1 to 2.9.0 resolves the issue by hardening how the parser handles these malformed constructs.