High, CVSS 8.3
Axios: Prototype Pollution Gadget in axios toFormData Options
npm axios · Upgrade to 1.20.0 or 0.34.0 by release line · >= 0.28.0, < 0.34.0; >= 1.15.1, < 1.20.0 · CVE-2026-101909 · GHSA-x97p-jq2g-jp4f · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.0
Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls
npm axios · Upgrade to 1.20.0 or later · >= 1.13.0, < 1.20.0 · CVE-2026-101898 · GHSA-3pq3-5fj3-cg6v · amended
- High, CVSS 8.2
Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization
npm axios · Upgrade to 1.20.0 or later · >= 1.13.0, < 1.20.0 · CVE-2026-101901 · GHSA-542g-h47m-68v8 · amended
- Critical, CVSS 9.5
Next.js: Remote Code Execution in next/og ImageResponse
npm next · Upgrade to 16.3.6 or later · >= 16.2.0, < 16.3.6 · GHSA-vcvr-r3jv-pc5j · amended
- High, CVSS 8.9
urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory
PyPI urllib3 · Upgrade to 2.8.0 or later · >= 1.10.3, < 2.8.0 · CVE-2026-97689 · GHSA-vxq7-64xx-v4gw · amended
- High, CVSS 7.6
urllib3: HTTPS proxy TLS configuration may be ignored or overridden
PyPI urllib3 · Upgrade to 2.8.0 or later · >= 1.26.0, < 2.8.0 · CVE-2026-97687 · GHSA-8988-9cw3-xx77 · amended
- High, CVSS 7.4
@nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets
npm @nestjs/platform-fastify · Upgrade to 12.0.2 or 11.2.4 by release line · < 11.2.4; >= 12.0.0, < 12.0.2 · GHSA-9c5c-9qcx-q35q · amended
- High, CVSS 7.5
Nodemailer addressparser: O(n^2) on comment-joined addresses enables a remote DoS (reachable via mailparser)
npm nodemailer · Upgrade to 10.0.5 or later · >= 9.1.0, <= 10.0.4 · CVE-2026-90776 · GHSA-prgh-xp8r-p3m5 · amended
- High, CVSS 7.5
Nest: Remote process termination via a deeply nested microservice message pattern
npm @nestjs/microservices · Upgrade to 12.0.2 or 11.2.4 by release line · < 11.2.4; >= 12.0.0, < 12.0.2 · CVE-2026-102281 · GHSA-m8vh-jmq9-5rjg · amended
- High, CVSS 7.5
brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion
npm brace-expansion · Upgrade to 5.0.11, 3.0.8, 2.1.6 or 1.1.20 by release line · >= 4.0.0, < 5.0.11; >= 3.0.0, < 3.0.8; >= 2.0.0, < 2.1.6; < 1.1.20 · CVE-2026-102278 · GHSA-qhr7-859c-m2p7 · amended
- High, CVSS 7.5
brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion
npm brace-expansion · Upgrade to 5.0.10, 3.0.7, 2.1.5 or 1.1.19 by release line · >= 4.0.0, < 5.0.10; >= 3.0.0, < 3.0.7; >= 2.0.0, < 2.1.5; < 1.1.19 · CVE-2026-102276 · GHSA-6j4f-fj2g-mc7p · amended
- High, CVSS 7.5
Socket.IO: Engine.IO Protocol Revision Mismatch DoS
npm engine.io · Upgrade to 6.6.10 or later · >= 6.6.0, < 6.6.10 · CVE-2026-102599 · GHSA-2gc4-cqfq-p2gv · amended
- High, CVSS 7.5
Nodemailer: Quadratic backtracking in the addressparser free-text fallback allows remote denial of service
npm nodemailer · Upgrade to 10.0.6 or later · <= 10.0.5 · CVE-2026-100700 · GHSA-v53p-9fqp-m79j · amended
- High, CVSS 7.4
PyJWT: PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation
PyPI pyjwt · Upgrade to 2.14.0 or later · >= 2.13.0, < 2.14.0 · CVE-2026-102266 · GHSA-9j54-fg26-wv3r · amended
- Critical, CVSS 9.1
PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard
PyPI pyjwt · Upgrade to 2.14.0 or later · <= 2.13.0 · CVE-2026-102268 · GHSA-ffc3-869f-jxw9 · amended
- High, CVSS 7.4
PyJWT accepts public JWK containers as HMAC secrets
PyPI pyjwt · Upgrade to 2.14.0 or later · >= 2.13.0, <= 2.13.0 · CVE-2026-102273 · GHSA-w2cx-738m-mc7w · amended
- High, CVSS 7.4
PyJWT: PyJWKClient follows redirects when fetching JWKS
PyPI pyjwt · Upgrade to 2.14.0 or later · <= 2.13.0 · CVE-2026-102267 · GHSA-9v7f-9g4p-ffgj · amended
- High, CVSS 7.4
PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard
PyPI pyjwt · Upgrade to 2.14.0 or later · >= 2.4.0, < 2.14.0 · CVE-2026-102271 · GHSA-p4g4-x82p-q773 · amended
- High, CVSS 7.4
PyJWT BOM Bypass
PyPI pyjwt · Upgrade to 2.14.0 or later · >= 2.13.0, <= 2.13.0 · CVE-2026-102272 · GHSA-r6x4-923q-g947 · amended
- High, CVSS 7.5
adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process (DoS)
npm adm-zip · Upgrade to 0.6.1 or later · <= 0.6.0 · CVE-2026-114102 · GHSA-8238-w5pm-2374 · amended
- High, CVSS 7.5
adm-zip: Decompression-bomb protection (fix for CVE-2026-39244) can be bypassed by declaring uncompressed size as 0
npm adm-zip · Upgrade to 0.6.1 or later · <= 0.6.0 · CVE-2026-92000 · GHSA-rcw4-f5rp-g42v · amended
- High, CVSS 7.1
adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation
npm adm-zip · Upgrade to 0.6.1 or later · <= 0.6.0 · CVE-2026-102282 · GHSA-j5f4-cc29-5x44 · amended
- High, CVSS 7.5
undici vulnerable to Denial of Service via unrequested WebSocket subprotocol
npm undici · Upgrade to 8.10.2, 7.29.1 or 6.28.1 by release line · >= 6.7.0, < 6.28.1; >= 7.0.0, < 7.29.1; >= 8.0.0, < 8.10.2 · CVE-2026-19534 · GHSA-rfgv-xxqx-mfg5 · amended
- High, CVSS 7.4
undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool
npm undici · Upgrade to 8.10.2 or 7.29.1 by release line · >= 7.24.1, < 7.29.1; >= 8.0.0, < 8.10.2 · CVE-2026-84961 · GHSA-w293-vg96-wgc3 · amended
- High, CVSS 7.4
undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors
npm undici · Upgrade to 8.10.2 or later · >= 8.10.0, < 8.10.2 · CVE-2026-85152 · GHSA-vp8m-p9jh-q5pm · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.