Security Research

Security Blog

Page 7

critical6 min

How Denial of Service via Malformed JSON Input happens in Go and how to fix it

A Denial of Service vulnerability (CVE-2026-32285) was discovered in the `github.com/buger/jsonparser` dependency used by this Go application, where crafted malformed JSON input could cause the parser to crash or hang, potentially taking down any service that processes untrusted JSON. The fix upgrades the dependency from v1.1.1 to v1.1.2 in `go.mod` and `go.sum`, closing the attack vector without changing any valid-input behavior. This is a practical reminder that transitive dependencies carry r

#security#golang#denial-of-service+2 more
A
anupamme
Aug 26, 2026
high7 min

How Dependency Chain Forgery happens in Go modules and how to fix it

A high-severity vulnerability in `golang.org/x/mod` (CVE-2026-56864) allowed a malicious GOSUMDB to serve arbitrary module content by exploiting weaknesses in checksum database verification. Upgrading from v0.37.0 to v0.40.0 closes the attack surface by tightening how the module system validates responses from untrusted sources. Any Go project that resolves dependencies through a compromised or attacker-controlled proxy is affected until this upgrade is applied.

#security#golang#supply-chain+2 more
A
anupamme
Aug 26, 2026
high8 min

How Prototype Pollution happens in Node.js async libraries and how to fix it

A high-severity prototype pollution vulnerability (CVE-2021-43138) was discovered in the `async` npm package versions prior to 3.2.2, affecting the `node-red-contrib-opcua` project. By exploiting crafted input passed through async's utility functions, an attacker could corrupt JavaScript's `Object.prototype`, potentially enabling privilege escalation or remote code execution. Upgrading `async` from `3.2.1` to `^3.2.2` in both `package.json` and `package-lock.json` eliminates the attack surface e

#injection#prototype-pollution#nodejs+3 more
A
anupamme
Aug 26, 2026
high8 min

How SQL Injection happens in Python BigQuery connectors and how to fix it

A high-severity SQL injection vulnerability was discovered in a BigQuery connector's query-building logic, where Python f-strings interpolated user-controlled identifiers—project_id, dataset_id, table_id, and timestamp_column—directly into SQL without validation. An attacker with control over connector configuration could inject arbitrary BigQuery SQL, including destructive statements. The fix introduces strict allowlist-based identifier validation using compiled regular expressions before any S

#sql-injection#python#bigquery+2 more
A
anupamme
Aug 26, 2026
high7 min

How Quadratic CPU Consumption Happens in JavaScript YAML Parsing and How to Fix It

A high-severity denial-of-service vulnerability in js-yaml (GHSA-5p4m-2wfm-xmqj) allowed attackers to trigger quadratic CPU consumption by supplying crafted YAML input containing `!!omap` (ordered map) types. The vulnerability affected both the 3.x and 4.x branches of js-yaml, and the fix for CVE-2026-59870 had not been backported to all affected versions. Upgrading from `js-yaml@4.3.0` to `4.3.1` (and `3.15.0` to `3.15.1`) resolves the issue by correcting the inefficient duplicate-key detection

#security#javascript#nodejs+3 more
A
anupamme
Aug 26, 2026
high8 min

How Unicode Hostname Canonicalization Bypass happens in Node.js and how to fix it

CVE-2026-13676 is a high-severity vulnerability in the `fast-uri` npm package where improper Unicode hostname canonicalization allowed attackers to bypass security policies by crafting hostnames that appeared safe but resolved differently after normalization. The fix upgrades `fast-uri` from version 3.1.2 to 4.1.2 and pins the version using an npm `overrides` directive in `package.json` to ensure no transitive dependency pulls in the vulnerable version.

#security#nodejs#unicode+4 more
A
anupamme
Aug 26, 2026
high6 min

How Security Policy Bypass via Improper Unicode Hostname Canonicalization Happens in Node.js and How to Fix It

A high-severity vulnerability (CVE-2026-13676) in the `fast-uri` npm package allowed attackers to bypass security policies through improper Unicode hostname canonicalization. The fix upgrades `fast-uri` from version 3.1.0 to 4.1.2 using npm overrides to ensure the patched version is used throughout the entire dependency tree of the `ide-agent-kit` project.

#security#javascript#nodejs+4 more
A
anupamme
Aug 26, 2026
critical6 min

How Unsafe Random Number Generation in form-data Compromises Multipart Form Security and How to Fix It

CVE-2025-7783 exposes a critical vulnerability in the form-data library where unsafe random number generation was used for generating multipart form boundaries, potentially allowing attackers to predict boundary values and manipulate form data. The fix upgrades form-data to versions 4.0.6, 3.0.4, and 2.5.4, which implement proper cryptographic randomness and update security-critical dependencies like hasown and mime-types.

#cryptography#javascript#node-js+2 more
A
anupamme
Aug 25, 2026
critical8 min

How Cross-Site Scripting happens in XML parsing libraries and how to fix it

CVE-2026-25896 is a critical Cross-Site Scripting vulnerability in the `fast-xml-parser` npm package caused by improper handling of DOCTYPE entity declarations. The flaw was discovered in the `mail-worker` service's dependency tree and patched by upgrading to version 5.3.5/4.5.4 and enforcing the fix via a pnpm override to `5.7.0`. Left unpatched, this vulnerability could allow attackers to inject malicious scripts through crafted XML payloads processed by the mail pipeline.

#xss#javascript#xml-parsing+4 more
A
anupamme
Aug 25, 2026
critical5 min

How Arbitrary Code Execution via Protobuf Definition Injection Happens in Node.js and How to Fix It

A critical vulnerability in protobufjs (CVE-2026-41242) allowed attackers to execute arbitrary code by injecting malicious type fields into protobuf definitions. This fix upgrades the protobufjs dependency from version 7.3.0 to 7.6.5, eliminating the attack vector in a private Node.js application's dependency tree.

#injection#javascript#nodejs+4 more
A
anupamme
Aug 25, 2026
high7 min

How ReDoS happens in Node.js path-to-regexp and how to fix it

CVE-2024-52798 is a Regular Expression Denial of Service (ReDoS) vulnerability in the `path-to-regexp` package's 0.1.x branch, which remains unpatched in that legacy line. Because `path-to-regexp` is a transitive dependency pulled in by `websocket-driver` and many other popular Node.js packages, any application that processes attacker-controlled URL paths through an affected version is at risk of catastrophic backtracking that can freeze the event loop. Upgrading `websocket-driver` to 0.7.5 — an

#security#redos#nodejs+2 more
A
anupamme
Aug 25, 2026
high7 min

How Denial of Service via Crafted Long-Path Tar Archives Happens in Node.js and How to Fix It

CVE-2026-73566 is a Denial of Service vulnerability in node-tar that allows attackers to craft specially malformed tar archives with excessively long file paths to exhaust system resources and crash applications. The fix upgrades tar from version 7.5.19 to 7.5.21, which implements proper path length validation to prevent this attack vector.

#security#denial-of-service#node-js+3 more
A
anupamme
Aug 25, 2026