Security Research

Security Blog

Page 17

high9 min

How Denial of Service via Infinite Loop happens in JavaScript and how to fix it

CVE-2026-67213 is a high-severity Denial of Service vulnerability in the nanoid library (versions before 3.3.18 and 5.1.6) where a crafted input to the custom alphabet ID generation function triggers an infinite loop, freezing the Node.js process. The vulnerability was present in the `remotion-composer` package's dependency tree via `package-lock.json`, and was resolved by upgrading nanoid to 3.3.18 and adding a `package.json` override to enforce the patched version across the entire dependency

#security#javascript#nodejs+2 more
A
anupamme
Aug 26, 2026
high8 min

How Denial of Service via Infinite Loop happens in JavaScript and how to fix it

CVE-2026-67213 is a high-severity Denial of Service vulnerability in the popular nanoid library where a crafted call to the custom alphabet ID generation function can trigger an infinite loop, hanging the Node.js process indefinitely. The fix upgrades nanoid from 3.3.17 to 3.3.18 (and from pre-5.1.6 to 5.1.6) in `src-frontend/package-lock.json`, eliminating the infinite loop condition. Any application using nanoid's custom alphabet feature with user-influenced input was potentially exposed to a

#security#denial-of-service#javascript+4 more
A
anupamme
Aug 26, 2026
high7 min

How Cross-Site Scripting happens in jsPDF and how to fix it

CVE-2026-31938 is a critical cross-site scripting vulnerability in jsPDF versions prior to 4.2.1, where unsanitized output options could allow attackers to inject malicious scripts into PDF generation workflows. The fix upgrades jsPDF from 3.0.4 to 4.2.1 in both `package.json` and `pnpm-lock.yaml`, closing the attack surface in Handsontable's export-to-PDF feature. Developers using jsPDF in any web application should upgrade immediately, as this vulnerability is assessed as likely exploitable.

#xss#javascript#jspdf+3 more
A
anupamme
Aug 26, 2026
high8 min

How Information Disclosure happens in Go dependency management and how to fix it

CVE-2026-42151 is a high-severity information disclosure vulnerability in the Prometheus monitoring library (github.com/prometheus/prometheus) that exposed Azure OAuth client secrets through the Prometheus configuration API endpoint. Applications depending on versions prior to v0.311.3 were at risk of leaking sensitive Azure credentials to anyone with access to the config API. The fix involves upgrading the dependency in go.mod from v0.310.0 to v0.311.3.

#hardcoded-secrets#go#prometheus+3 more
A
anupamme
Aug 26, 2026
high8 min

How Denial of Service via Infinite Loop happens in JavaScript dependency nanoid and how to fix it

CVE-2026-67213 is a high-severity Denial of Service vulnerability in the popular nanoid package, where a flaw in the custom alphabet random ID generation path can trigger an infinite loop, hanging the process indefinitely. The fix upgrades nanoid from 3.3.12 to 3.3.18 (and 5.x to 5.1.6), patching the loop condition without changing any public API behavior. Any web application that exposes nanoid's ID generation to user-influenced input should treat this as a priority update.

#security#javascript#nodejs+2 more
A
anupamme
Aug 26, 2026
high8 min

How EL Injection happens in Java JSF applications and how to fix it

A high-severity Expression Language (EL) injection vulnerability was discovered and fixed in `PrimeFacesResourceProcessor.java`, a JSF phase listener responsible for resolving the PrimeFaces theme configuration. The flaw allowed a dynamically sourced theme parameter value to be passed directly into an EL expression factory without first verifying whether the value was actually an EL expression or plain text. The fix introduces explicit input branching that separates EL expressions from literal s

#injection#java#jsf+3 more
A
anupamme
Aug 26, 2026
high9 min

How Denial of Service via Memory Exhaustion happens in Node.js Socket.IO and how to fix it

CVE-2026-69185 is a high-severity Denial of Service vulnerability in `socket.io-parser` where crafted malicious packets can exhaust server memory, crashing real-time Node.js applications. The fix upgrades `socket.io-parser` from version 4.2.6 to 4.2.7 and pins the dependency via an `overrides` field in `package.json` to ensure the patched version is used throughout the dependency tree. Any application using Socket.IO for bidirectional real-time communication is potentially at risk until this upg

#security#denial-of-service#nodejs+2 more
A
anupamme
Aug 26, 2026
medium7 min

How XML External Entity (XXE) Injection happens in Python and how to fix it

A medium-severity XML External Entity (XXE) vulnerability was discovered in `listKeyboardLayouts.py`, where Python's native `xml.etree.ElementTree` library was used to parse XML data. This library is susceptible to XXE attacks, which can allow attackers to read local files, perform server-side request forgery, or cause denial of service. The fix replaces the unsafe import with `defusedxml.ElementTree`, a drop-in hardened alternative recommended by the Python documentation itself.

#injection#xxe#python+3 more
A
anupamme
Aug 26, 2026
critical6 min

How Denial of Service via Malformed JSON Input happens in Go and how to fix it

A Denial of Service vulnerability (CVE-2026-32285) was discovered in the `github.com/buger/jsonparser` dependency used by this Go application, where crafted malformed JSON input could cause the parser to crash or hang, potentially taking down any service that processes untrusted JSON. The fix upgrades the dependency from v1.1.1 to v1.1.2 in `go.mod` and `go.sum`, closing the attack vector without changing any valid-input behavior. This is a practical reminder that transitive dependencies carry r

#security#golang#denial-of-service+2 more
A
anupamme
Aug 26, 2026
high7 min

How Dependency Chain Forgery happens in Go modules and how to fix it

A high-severity vulnerability in `golang.org/x/mod` (CVE-2026-56864) allowed a malicious GOSUMDB to serve arbitrary module content by exploiting weaknesses in checksum database verification. Upgrading from v0.37.0 to v0.40.0 closes the attack surface by tightening how the module system validates responses from untrusted sources. Any Go project that resolves dependencies through a compromised or attacker-controlled proxy is affected until this upgrade is applied.

#security#golang#supply-chain+2 more
A
anupamme
Aug 26, 2026
high8 min

How Prototype Pollution happens in Node.js async libraries and how to fix it

A high-severity prototype pollution vulnerability (CVE-2021-43138) was discovered in the `async` npm package versions prior to 3.2.2, affecting the `node-red-contrib-opcua` project. By exploiting crafted input passed through async's utility functions, an attacker could corrupt JavaScript's `Object.prototype`, potentially enabling privilege escalation or remote code execution. Upgrading `async` from `3.2.1` to `^3.2.2` in both `package.json` and `package-lock.json` eliminates the attack surface e

#injection#prototype-pollution#nodejs+3 more
A
anupamme
Aug 26, 2026
high8 min

How SQL Injection happens in Python BigQuery connectors and how to fix it

A high-severity SQL injection vulnerability was discovered in a BigQuery connector's query-building logic, where Python f-strings interpolated user-controlled identifiers—project_id, dataset_id, table_id, and timestamp_column—directly into SQL without validation. An attacker with control over connector configuration could inject arbitrary BigQuery SQL, including destructive statements. The fix introduces strict allowlist-based identifier validation using compiled regular expressions before any S

#sql-injection#python#bigquery+2 more
A
anupamme
Aug 26, 2026