Page 23
A high-severity vulnerability (CVE-2026-13697) was discovered in undici, the popular Node.js HTTP client, where malformed Cache-Control directives could lead to information disclosure and denial of service. The cache interceptor failed to properly validate the `private` directive in Cache-Control headers, potentially exposing sensitive cached data. This fix upgrades undici to versions 7.29.0 and 8.9.0 to address the parsing flaw.
A high-severity denial of service vulnerability (CVE-2026-32287) was discovered in the `github.com/antchfx/xpath` Go library, where crafted boolean XPath expressions could trigger an infinite loop, consuming CPU resources indefinitely. The fix upgrades the dependency from v1.3.3 to v1.3.6 in the `go.mod` file of the affected project. This vulnerability is particularly dangerous for any Go application that parses or evaluates XPath expressions from untrusted input.
A critical command injection vulnerability (CVE-2026-9277) was discovered in shell-quote 1.8.3, where unescaped line terminators could allow arbitrary code execution. The vulnerability was fixed by upgrading to shell-quote 1.9.0, which properly escapes line terminators in the react-devtools-core dependency chain, preventing attackers from breaking out of quoted strings to inject malicious commands.
A critical security issue was discovered in the S3 Express deployment configuration file where an AWS Secret Access Key was hardcoded as a placeholder example. This vulnerability could allow attackers to gain unauthorized access to AWS resources if the example file was accidentally deployed to production or committed to version control without proper sanitization.
A critical command injection vulnerability (CVE-2026-9277) was discovered in shell-quote 1.8.3, where unescaped line terminators could allow attackers to inject arbitrary shell commands into parsed strings. The fix upgrades shell-quote to 1.9.0 via a package override in the docs-site's package.json, closing the attack surface without affecting valid inputs. This vulnerability was flagged by Trivy in the Docusaurus-based documentation site's dependency tree.
A GitHub Actions workflow in `templates/devto/devto-readme.yml` referenced `actions/checkout@v4` and `actions/setup-node@v4` using mutable version tags instead of pinned commit SHAs. This pattern enables supply-chain attacks where a compromised action owner silently repoints a tag to malicious code. The fix pins both actions to their full 40-character commit SHAs while preserving version comments for maintainability.
A critical vulnerability (CVE-2026-54466) was discovered in websocket-driver version 0.7.4, a widely-used WebSocket protocol handler in the Node.js ecosystem. This fix upgrades the dependency to version 0.7.5 using npm overrides in the docs-site package, eliminating the vulnerability from the dependency tree without requiring changes to direct dependencies.
A hardcoded AWS Secret Access Key pattern was detected in the `settings.example` configuration file of an nginx AWS credentials module. While the value itself was a placeholder string, its format matched a real AWS secret key pattern, making it a dangerous template that could mislead developers into committing real credentials. The fix replaces the lookalike secret value with an unambiguous placeholder that cannot be mistaken for or used as a real credential.
A high-severity vulnerability (CVE-2026-44486) in Axios versions prior to 1.16.0 caused Proxy-Authorization headers to leak to redirect targets when the HTTP client re-evaluated proxy settings and switched to a direct connection. This information disclosure bug exposed sensitive proxy credentials to unintended destinations, and was fixed by upgrading from Axios 1.15.2 to 1.18.0 in the client application.
A critical Server-Side Request Forgery (SSRF) vulnerability in `src/fetch.js` allowed the `fetchPage()` function to access internal network addresses, private IP ranges, and cloud metadata endpoints without any validation. This fix hardens input validation to block requests to RFC 1918 private addresses, localhost, and cloud metadata endpoints, preventing attackers from exploiting the function to probe internal infrastructure.
A critical security vulnerability was discovered in the Apple Store API implementation where three authentication endpoints (`/auth/login`, `/auth/refresh`, `/auth/reset`) lacked rate limiting protection. This allowed unlimited authentication attempts from a single IP address, enabling credential stuffing and brute force attacks. The fix implements an in-memory rate limiter that restricts each IP to 5 requests per 15-minute window.
A high-severity vulnerability (CVE-2026-13676) in the fast-uri npm package allowed attackers to bypass security policies through improper Unicode hostname canonicalization. The fix upgrades fast-uri from version 3.1.2 to 4.1.2 using npm overrides to ensure the patched version is used throughout the dependency tree of the cc-viewer project.