Security Research

Security Blog

Page 16

high2 min

How Denial of Service via Crafted Email Headers Happens in Node.js and How to Fix It

A high-severity denial-of-service vulnerability (CVE-2025-14874) in Nodemailer versions prior to 7.0.0 allowed attackers to crash Node.js email-sending services by supplying specially crafted email address headers. The fix upgrades the `nodemailer` dependency in `clay-server` from version 6.10.1 to 9.0.5, closing the attack surface against malformed input. Any application that passes user-influenced data into Nodemailer's address parsing logic is affected and should upgrade immediately.

#security#nodejs#denial-of-service+2 more
A
anupamme
Aug 26, 2026
high8 min

How ReDoS via Unbounded Brace Expansion happens in Node.js and how to fix it

CVE-2024-4068 is a high-severity Regular Expression Denial of Service (ReDoS) vulnerability in the `braces` npm package (versions prior to 3.0.3) that allows an attacker to trigger catastrophic CPU consumption by supplying a crafted brace-expansion string with no character limit. The fix upgrades `braces` from 3.0.2 to 3.0.3 and its internal dependency `fill-range` from 7.0.1 to 7.1.1, both of which enforce limits on the size of input they will process. This patch was applied via a Yarn resoluti

#security#nodejs#javascript+2 more
A
anupamme
Aug 26, 2026
high7 min

How Command Injection happens in Node.js child_process calls and how to fix it

A high-severity command injection vulnerability was discovered in `Config/QuickAdd/git-add-new-origin-branch.js`, where user-supplied branch names were interpolated directly into a shell command string passed to `child_process.exec()`. The fix replaces the shell-interpolated `exec()` call with `execFile()`, passing arguments as a discrete array and eliminating the shell entirely. This proactive hardening removes an exploit primitive that could have been chained with other weaknesses to achieve a

#command-injection#javascript#nodejs+2 more
A
anupamme
Aug 26, 2026
high7 min

How Command Injection happens in PHP shell execution and how to fix it

A command injection vulnerability in `sitrecServer/windProxy.php` allowed user-controlled input to reach a shell command without proper sanitization, creating a remote code execution risk. The `$cycleHour` parameter was passed directly as a format integer (`%d`) into a `sprintf`-built shell command, bypassing the `escapeshellarg()` protection applied to all other arguments. The fix casts `$cycleHour` to an integer and wraps it with `escapeshellarg()`, closing the injection path entirely.

#command-injection#php#shell-exec+2 more
A
anupamme
Aug 26, 2026
high7 min

How Denial of Service via Infinite Loop happens in Node.js and how to fix it

A Denial of Service vulnerability in nanoid versions prior to 3.3.18 allowed attackers to trigger an infinite loop during random ID generation, potentially hanging Node.js processes indefinitely. The fix upgrades nanoid from 3.3.16 to 3.3.18 in both `package-lock.json` and `package.json`, and adds an `overrides` entry to ensure the patched version is enforced across the entire dependency tree. This is a high-severity issue that any project using nanoid for ID generation—directly or transitively—

#security#nodejs#denial-of-service+2 more
A
anupamme
Aug 26, 2026
medium7 min

How Denial of Service via Catastrophic Backtracking happens in Node.js and how to fix it

CVE-2026-4867 is a Regular Expression Denial of Service (ReDoS) vulnerability in the `path-to-regexp` package (versions prior to 0.1.13) that allows an attacker to craft malformed URL parameters that cause catastrophic backtracking in the regex engine, effectively hanging the Node.js event loop. The fix upgrades `path-to-regexp` from 0.1.12 to 0.1.13 and pins the version via an `overrides` field in `package.json` to ensure the patched version is used throughout the entire dependency tree. Any Ex

#security#nodejs#redos+2 more
A
anupamme
Aug 26, 2026
high8 min

How Denial of Service via Infinite Loop happens in JavaScript and how to fix it

A high-severity Denial of Service vulnerability (CVE-2026-67213) was discovered in the `nanoid` package used in the `docs-site` component, where a flaw in random ID generation could trigger an infinite loop under certain inputs, exhausting CPU resources. The fix upgrades `nanoid` from version 3.3.15 to 3.3.18 (and 5.x to 5.1.6) in `docs-site/package-lock.json`, closing the attack surface without affecting valid ID generation. This kind of dependency vulnerability is easy to overlook but can have

#security#javascript#nodejs+2 more
A
anupamme
Aug 26, 2026
high9 min

How Denial of Service via ZIP Parsing happens in Node.js and how to fix it

CVE-2026-39244 is a high-severity Denial of Service vulnerability in adm-zip versions prior to 0.6.0, where a specially crafted ZIP file can trigger excessive memory allocation and crash a Node.js application. The vulnerability was present in the deepseek-ivideo plugin's dependency tree and was fixed by pinning adm-zip to version 0.6.0 in both `package.json` and `pnpm-lock.yaml`. Because adm-zip processes ZIP archives that can originate from user-supplied or external sources, this flaw represent

#security#denial-of-service#nodejs+3 more
A
anupamme
Aug 26, 2026
critical8 min

How Command Injection happens in Node.js shell-quote and how to fix it

A critical command injection vulnerability (CVE-2026-9277) in the `shell-quote` npm package versions prior to 1.8.4 allowed attackers to execute arbitrary code by injecting unescaped line terminators into shell arguments. The fix upgrades `shell-quote` from 1.8.2 to 1.9.0 and pins the dependency across `package.json`, `package-lock.json`, and `yarn.lock` to ensure no transitive dependency can pull in the vulnerable version.

#command-injection#nodejs#npm+2 more
A
anupamme
Aug 26, 2026
high8 min

How Path Traversal happens in PostCSS sourceMappingURL handling and how to fix it

A path traversal vulnerability in PostCSS versions prior to 8.5.x allowed attackers to craft malicious CSS with attacker-controlled `sourceMappingURL` comments, causing PostCSS to read arbitrary `.map` files from the filesystem and potentially disclose sensitive information. The fix upgrades PostCSS from `8.4.47` to `8.5.23` in `packages/devtools/package-lock.json`, closing the auto-loading attack surface entirely. This change is scoped to the devtools build toolchain but is critical for any env

#path-traversal#postcss#nodejs+3 more
A
anupamme
Aug 26, 2026
critical7 min

How Unsafe Random Function Usage Happens in Node.js form-data and How to Fix It

CVE-2025-7783 is a critical vulnerability in the `form-data` npm package caused by its use of an unsafe random function to generate multipart form boundaries. Versions 2.3.3 and 4.0.5 were affected, and the fix upgrades the package to 4.0.6 (consolidating previously split nested versions) while eliminating the predictable boundary generation. Attackers who could predict or influence multipart boundaries could craft malicious payloads that escape intended field boundaries.

#cryptography#nodejs#npm+3 more
A
anupamme
Aug 26, 2026
high9 min

How Denial of Service via Adjacent Inline Attribute Blocks Happens in PHP and how to fix it

A high-severity denial-of-service vulnerability (GHSA-g2gp-3wwq-f4ph) was discovered in `league/commonmark`, a popular PHP Markdown parsing library. The flaw allows an attacker to craft Markdown input containing adjacent inline attribute blocks that trigger catastrophic processing, potentially exhausting server resources. Upgrading from version 2.7.1 to 2.9.0 resolves the issue by hardening how the parser handles these malformed constructs.

#security#php#denial-of-service+2 more
A
anupamme
Aug 26, 2026