High, CVSS 7.5
Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address list
npm nodemailer · Upgrade to 9.1.0 or later · < 9.1.0 · CVE-2026-92596 · GHSA-2x7j-588g-ccc2 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.5
multer vulnerable to Denial of Service via crafted multipart field names
npm multer · Upgrade to 2.3.0 or later · < 2.3.0 · CVE-2026-77078 · GHSA-wc9g-mqfw-jrwm · amended
- High, CVSS 7.5
multer vulnerable to Denial of Service via file descriptor leak on aborted uploads
npm multer · Upgrade to 2.3.0 or later · >= 2.2.0, <= 2.2.0 · CVE-2026-77037 · GHSA-qfvm-cv95-jqjf · amended
- High, CVSS 7.5
multer vulnerable to Denial of Service via oversized array index in field names
npm multer · Upgrade to 2.3.0 or later · < 2.3.0 · CVE-2026-82333 · GHSA-535w-7cp7-47q4 · amended
- High, CVSS 8.6
Windows ML CLI: CORS misconfig enables localhost RCE
PyPI winml-cli · Upgrade to 0.4.0 or later · < 0.4.0 · CVE-2026-84452 · GHSA-96p9-rh4f-92cf · amended
- High, CVSS 8.6
mongodb: Reject "." and NUL bytes in database and collection names
Packagist mongodb/mongodb · Upgrade to 2.4.1 or 1.21.4 by release line · < 1.21.4; >= 2.0.0, < 2.4.1 · CVE-2026-81525 · GHSA-65fr-j4p9-vc33 · amended
- Critical, CVSS 9.8
Astro: Remote code execution through AVIF image optimization
npm astro · Upgrade to 7.2.8 or later · < 7.2.8 · GHSA-26w7-cxv4-gfx2 · amended
- High, CVSS 7.7
Composer arbitrary command execution via a malicious package's Perforce source URL
Packagist composer/composer · Upgrade to 2.10.3 or 2.2.30 by release line · >= 2.3.0, < 2.10.3; >= 1.0, < 2.2.30 · CVE-2026-84361 · GHSA-rvx4-ffvw-m9q3 · amended
- High, CVSS 8.9
sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545
npm sharp · Upgrade to 0.35.4 or later · < 0.35.4 · CVE-2026-114112 · GHSA-rgj7-g3m4-5g8c · amended
- High, CVSS 7.5
js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources
npm js-yaml · Upgrade to 4.3.2 or 3.15.2 by release line · >= 4.0.0, < 4.3.2; >= 3.0.0, < 3.15.2 · CVE-2026-84375 · GHSA-2883-xcg3-v3hh · amended
- High, CVSS 8.7
Tiptap: Quadratic ReDoS in block and inline Markdown attribute parsing
npm @tiptap/core · Upgrade to 3.30.5 or later · >= 3.7.0, < 3.30.5 · GHSA-j95f-988m-3j2f · amended
- High, CVSS 8.7
gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing
:authorityandHostheadersGo google.golang.org/grpc · Upgrade to 1.85.0-dev.0.20260825072537-93e31b48545e (pre-release), 1.84.0-dev.0.20260825144003-d5a41119e0e3 (pre-release), 1.83.2 or 1.82.2 by release line · < 1.82.2; >= 1.83.0, < 1.83.2; >= 1.84.0-dev, < 1.84.0-dev.0.20260825144003-d5a41119e0e3; >= 1.85.0-dev, < 1.85.0-dev.0.20260825072537-93e31b48545e · CVE-2026-84445 · GHSA-2v4p-qf9q-27wj · amended
- Critical, CVSS 9.5
Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used
npm next · Upgrade to 16.3.3 or 15.5.24 by release line · >= 10.0.0, < 15.5.24; >= 16.0.0, < 16.3.3 · GHSA-2xp9-vwfh-vxw4 · amended
- High, CVSS 8.2
SVGO: removeScripts allows executable links through namespace and control-character bypasses
npm svgo · Upgrade to 4.1.0, 3.3.5 or 2.8.4 by release line · >= 1.0.0, < 2.8.4; >= 3.0.0, < 3.3.5; >= 4.0.0, < 4.1.0 · CVE-2026-84370 · GHSA-w27v-7q3p-w38r · amended
- High, CVSS 8.7
xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator
npm @xmldom/xmldom · Upgrade to 0.9.12 or later · >= 0.9.11, <= 0.9.11 · CVE-2026-83617 · GHSA-jxjr-3g7g-3944 · amended
- High, CVSS 8.7
xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path
npm @xmldom/xmldom · Upgrade to 0.9.12 or later · >= 0.9.0, <= 0.9.11 · CVE-2026-83609 · GHSA-3px3-54cx-rmw9 · amended
- High, CVSS 8.7
xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator
npm @xmldom/xmldom · Upgrade to 0.9.12 or later · >= 0.9.10, <= 0.9.11 · CVE-2026-83618 · GHSA-vr34-hp96-76pp · amended
- High, CVSS 8.7
xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser
npm @xmldom/xmldom · Upgrade to 0.8.15 or later · >= 0.7.0, <= 0.8.14 · CVE-2026-83619 · GHSA-x4fp-j954-r2f4 · amended
- High, CVSS 8.7
xmldom: HTML raw-text closing-tag case mismatch causes output amplification
npm @xmldom/xmldom · Upgrade to 0.9.12 or later · >= 0.9.0-beta.1, <= 0.9.11 · CVE-2026-83612 · GHSA-6mj3-qw4j-hgrw · amended
- Critical, CVSS 9.8
Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections
Packagist predis/predis · Upgrade to 3.3.0 or later · >= 3.0.0-RC1, < 3.3.0 · CVE-2026-84372 · GHSA-w6f5-v2h6-g786 · amended
- Critical, CVSS 9.2
CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver
Packagist cakephp/cakephp +1 · Upgrade all 2 to 5.3.7, 5.2.15 or 5.1.10 by release line · >= 5.3.0, < 5.3.7; >= 5.2.0, < 5.2.15; >= 5.1.0, < 5.1.10 · CVE-2026-77635 · GHSA-fxf7-vhh8-7vpq · amended
- High, CVSS 8.2
CakePHP: SmtpTransport vulnerable to CRLF header injection
Packagist cakephp/cakephp · Upgrade to 5.3.7, 5.2.14, 5.1.9 or 2 more by release line · >= 4.5.0, < 4.5.12; >= 4.6.0, < 4.6.5; >= 5.0.0, < 5.1.9; >= 5.2.0, < 5.2.14; >= 5.3.0, < 5.3.7 · CVE-2026-77634 · GHSA-2qh5-382h-3jpc · amended
- Critical, CVSS 9.0
Next.js: Unauthenticated Remote Code Execution on windows-hosted servers
npm next · Upgrade to 16.3.3 or 15.5.24 by release line · >= 13.4.0, < 15.5.24; >= 16.0.0, < 16.3.3 · CVE-2026-75604 · GHSA-p293-qw3h-jr36 · amended
- Critical, CVSS 10.0
MapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize() via Live NamedNodeMap Removal Skip
npm maplibre-gl · Upgrade to 6.4.1 or later · <= 6.4.0 · CVE-2026-85061 · GHSA-jrc7-96c5-q579 · amended
- High, CVSS 7.5
HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)
PyPI httpx2 · Upgrade to 2.12.0 or later · < 2.12.0 · CVE-2026-84382 · GHSA-8xx6-hgc6-gc2m · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.