Medium, CVSS 5.9
Forge: TLS client crash on an unsupported ServerHello compression method
npm node-forge · Upgrade to 1.4.3 or later · < 1.4.3 · CVE-2026-125332 · GHSA-w4xr-hqv8-ch44 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
26–50 of 67 matching · newest first
- Medium, CVSS 5.9
Forge: ReDoS in forge.http response header and cookie trimming
npm node-forge · Upgrade to 1.4.3 or later · >= 0.1.2, < 1.4.3 · CVE-2026-125333 · GHSA-6cv4-p8m7-4r25 · amended
- Medium, CVSS 5.9
Forge: TLS client crash on a handshake record received without a session
npm node-forge · Upgrade to 1.4.3 or later · < 1.4.3 · CVE-2026-125334 · GHSA-j8rw-jp99-435v · amended
- Low, CVSS 3.7
fast-xml-parser: Quadratic CPU consumption scanning unterminated stop-node tags
npm fast-xml-parser · Upgrade to 5.12.0 or later · < 5.12.0 · CVE-2026-126066 · GHSA-474x-hrwr-fgx4 · amended
- Medium, CVSS 4.8
Mongoose: Discriminator key values matching inherited properties (e.g. __t: 'constructor') bypass schema casting and can poison collections
npm mongoose · Upgrade to 9.11.4, 8.24.7, 7.8.13 or 6.13.12 by release line · < 6.13.12; >= 7.0.0, < 7.8.13; >= 8.0.0, < 8.24.7; >= 9.0.0, < 9.11.4 · CVE-2026-125116 · GHSA-wr5m-5jph-8m96 · amended
- High, CVSS 8.2
Mongoose walks into inherited properties when hydrating, setting, and merging, allowing overwrites of built-in functions (denial of service) and shared schema state
npm mongoose · Upgrade to 9.11.4, 8.24.7, 7.8.13 or 6.13.12 by release line · < 6.13.12; >= 7.0.0, < 7.8.13; >= 8.0.0, < 8.24.7; >= 9.0.0, < 9.11.4 · CVE-2026-125117 · GHSA-8332-j7wj-wjw4 · amended
- Low, CVSS 3.7
JRuby: NONET is bypassed for external DTDs and entities when the systemId uses a short-form IPv4 host
RubyGems nokogiri · Upgrade to 1.19.5 or later · < 1.19.5 · CVE-2026-126062 · GHSA-v995-44v6-5fqm · amended
- Low, CVSS 2.0
Nokogiri: Use-After-Free in Nokogiri when replacing an attribute value
RubyGems nokogiri · Upgrade to 1.19.5 or later · < 1.19.5 · CVE-2026-126064 · GHSA-3w22-6jfg-527w · amended
- Low, CVSS 2.3
Nokogiri: Mutation XSS through
noscriptcontent in Nokogiri's HTML5 serializerRubyGems nokogiri · Upgrade to 1.19.5 or later · >= 1.12.0, < 1.19.5 · CVE-2026-126063 · GHSA-4p39-36wj-23h4 · amended
- Medium, CVSS 6.5
Mongoose: Prototype pollution via Schema.prototype.virtual()
npm mongoose · Upgrade to 9.11.4, 8.24.7, 7.8.13 or 6.13.12 by release line · < 6.13.12; >= 7.0.0, < 7.8.13; >= 8.0.0, < 8.24.7; >= 9.0.0, < 9.11.4 · CVE-2026-125118 · GHSA-6972-9mcm-vhwj · amended
- High, CVSS 7.5
Mongoose: Connection-level sanitizeFilter not applied
npm mongoose · Upgrade to 9.11.4, 8.24.7, 7.8.13 or 6.13.12 by release line · >= 6.0.0, < 6.13.12; >= 7.0.0, < 7.8.13; >= 8.0.0, < 8.24.7; >= 9.0.0, < 9.11.4 · CVE-2026-125119 · GHSA-gg4r-jv3p-qx3c · amended
- Critical, CVSS 9.8
Mongoose: sanitizeFilter not applied on countDocuments
npm mongoose · Upgrade to 9.9.2, 8.24.3, 7.8.12 or 6.13.11 by release line · < 6.13.11; >= 7.0.0, < 7.8.12; >= 8.0.0, < 8.24.3; >= 9.0.0, < 9.9.2 · CVE-2026-125120 · GHSA-pcrw-h46h-c93h · amended
- High, CVSS 8.7
Rack: Multipart parsing allows DoS via unbounded scan buffer growth
RubyGems rack · Upgrade to 3.2.8, 3.1.23 or 2.2.25 by release line · < 2.2.25; >= 3.0.0, < 3.1.23; >= 3.2.0, < 3.2.8 · CVE-2026-125111 · GHSA-5v64-555j-wjxm · amended
- Low, CVSS 3.7
Rack: Multipart boundary ambiguity guard in Rack::Multipart::Parser can be bypassed with a quoted boundary value, allowing WAF bypass
RubyGems rack · Upgrade to 3.2.8, 3.1.23 or 2.2.25 by release line · < 2.2.25; >= 3.0.0, < 3.1.23; >= 3.2.0, < 3.2.8 · CVE-2026-125108 · GHSA-p8x9-v4hv-2w4g · amended
- Medium, CVSS 4.3
NocoBase: @nocobase/plugin-action-custom-request allows server-side request forgery through runtime URL overrides
npm @nocobase/plugin-action-custom-request · Upgrade to 2.2.0-alpha.4 (pre-release) or 2.1.15 by release line · >= 2.1.0-alpha.8, < 2.1.15; >= 2.2.0-alpha.1, < 2.2.0-alpha.4 · CVE-2026-79914 · GHSA-wrr5-j383-f7h2 · amended
- Medium, CVSS 4.8
Rack: Rack::Request#host_with_port (and #base_url / #url) return the raw invalid Host header — incomplete fix of CVE-2026-34835
RubyGems rack · Upgrade to 3.2.8 or 3.1.23 by release line · >= 3.0.0, < 3.1.23; >= 3.2.0, < 3.2.8 · CVE-2026-125109 · GHSA-2j8w-xcrc-x985 · amended
- Medium, CVSS 5.3
Rack: Rack::Static header_rules bypass via dot-segment normalization mismatch
RubyGems rack · Upgrade to 3.2.8, 3.1.23 or 2.2.25 by release line · < 2.2.25; >= 3.0.0, < 3.1.23; >= 3.2.0, < 3.2.8 · CVE-2026-125110 · GHSA-wvg4-6p58-3gh3 · amended
- Medium, CVSS 5.3
compose-lint: Text in a pull request can still issue CI workflow commands through compose-lint 0.31.0's output
PyPI compose-lint · Upgrade to 0.32.0 or later · >= 0.31.0, < 0.32.0 · CVE-2026-125121 · GHSA-r7j4-crjv-h467 · amended
- High, CVSS 8.8
OHIF Viewers: DOM-Based Cross Site Scripting (XSS) through MIME type of document
npm @ohif/extension-dicom-pdf · Upgrade to 3.14.0-beta.36 (pre-release), 3.13.10 or 3.12.18 by release line · >= 3.5.0-beta.0, < 3.12.18; >= 3.13.0-beta.0, < 3.13.10; >= 3.14.0-beta.0, < 3.14.0-beta.36 · CVE-2026-118670 · GHSA-xwgp-w3pj-q5h3 · amended
- Low, CVSS 3.7
Forge: Certificate signature verified with the issuer's RSA signature scheme
npm node-forge · Upgrade to 1.4.1 or later · < 1.4.1 · CVE-2026-118774 · GHSA-9wg5-mj3p-v49q · amended
- Low, CVSS 3.7
Forge: Incomplete PKCS#7 padding validation in AES/DES CBC and ECB decryption
npm node-forge · Upgrade to 1.4.1 or later · < 1.4.1 · CVE-2026-118776 · GHSA-2vgq-wchc-25w7 · amended
- Medium, CVSS 5.9
Forge: X.509 pathLenConstraint not enforced by verifyCertificateChain() for CA certificates without keyUsage
npm node-forge · Upgrade to 1.4.1 or later · < 1.4.1 · CVE-2026-119189 · GHSA-h46v-rmh6-fq4f · amended
- High, CVSS 7.5
Forge: ASN.1 resource exhaustion via BIT STRING decoding in asn1.fromDer
npm node-forge · Upgrade to 1.4.1 or later · < 1.4.1 · CVE-2026-119191 · GHSA-rhr8-3pm8-cq29 · amended
- High, CVSS 7.5
Forge: RSA PKCS#1 v1.5 signature forgery via non-canonical DigestInfo encoding
npm node-forge · Upgrade to 1.4.1 or later · < 1.4.1 · CVE-2026-119192 · GHSA-6qrw-m8cv-hcxf · amended
- Medium, CVSS 6.3
Effect: Cookie attribute injection via domain, path, and name fields in @effect/platform makeCookie()
npm effect · Upgrade to 4.0.0-beta.103 (pre-release) or later · >= 4.0.0-beta.0, < 4.0.0-beta.103 · +1 more package · CVE-2026-115779 · GHSA-chp3-j5qr-2vfr · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.