High, CVSS 8.2
Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location
npm axios · Upgrade to 1.20.0 or later · >= 1.15.0, < 1.20.0 · CVE-2026-101906 · GHSA-mghh-pgcx-3jjj · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
1551–1575 of 30,910 matching · newest first
- High, CVSS 8.3
Axios: Prototype Pollution Gadget in axios toFormData Options
npm axios · Upgrade to 1.20.0 or 0.34.0 by release line · >= 0.28.0, < 0.34.0; >= 1.15.1, < 1.20.0 · CVE-2026-101909 · GHSA-x97p-jq2g-jp4f · amended
- High, CVSS 7.0
Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls
npm axios · Upgrade to 1.20.0 or later · >= 1.13.0, < 1.20.0 · CVE-2026-101898 · GHSA-3pq3-5fj3-cg6v · amended
- High, CVSS 8.2
Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization
npm axios · Upgrade to 1.20.0 or later · >= 1.13.0, < 1.20.0 · CVE-2026-101901 · GHSA-542g-h47m-68v8 · amended
- Medium, CVSS 6.9
urllib3: Chunked Deflate streaming can enter an infinite loop
PyPI urllib3 · Upgrade to 2.8.0 or later · >= 2.6.2, < 2.8.0 · CVE-2026-97688 · GHSA-gh4c-6fx4-qh6g · amended
- Critical, CVSS 9.5
Next.js: Remote Code Execution in next/og ImageResponse
npm next · Upgrade to 16.3.6 or later · >= 16.2.0, < 16.3.6 · GHSA-vcvr-r3jv-pc5j · amended
- High, CVSS 8.9
urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory
PyPI urllib3 · Upgrade to 2.8.0 or later · >= 1.10.3, < 2.8.0 · CVE-2026-97689 · GHSA-vxq7-64xx-v4gw · amended
- High, CVSS 7.6
urllib3: HTTPS proxy TLS configuration may be ignored or overridden
PyPI urllib3 · Upgrade to 2.8.0 or later · >= 1.26.0, < 2.8.0 · CVE-2026-97687 · GHSA-8988-9cw3-xx77 · amended
- Medium, CVSS 6.5
Nest: Unbounded memory growth in the NestJS TCP microservice transport
npm @nestjs/microservices · Upgrade to 12.0.3 or 11.2.5 by release line · < 11.2.5; >= 12.0.0, < 12.0.3 · GHSA-96h4-vgxj-gvm2 · amended
- High, CVSS 7.4
@nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets
npm @nestjs/platform-fastify · Upgrade to 12.0.2 or 11.2.4 by release line · < 11.2.4; >= 12.0.0, < 12.0.2 · GHSA-9c5c-9qcx-q35q · amended
- High, CVSS 7.5
Nodemailer addressparser: O(n^2) on comment-joined addresses enables a remote DoS (reachable via mailparser)
npm nodemailer · Upgrade to 10.0.5 or later · >= 9.1.0, <= 10.0.4 · CVE-2026-90776 · GHSA-prgh-xp8r-p3m5 · amended
- Medium, CVSS 4.4
PyJWT: ReDoS vulnerability when calling the
is_pem_formatfunction.PyPI pyjwt · Upgrade to 2.14.0 or later · <= 2.13.0 · CVE-2026-102270 · GHSA-jwrc-g2q2-pq5p · amended
- High, CVSS 7.5
Nest: Remote process termination via a deeply nested microservice message pattern
npm @nestjs/microservices · Upgrade to 12.0.2 or 11.2.4 by release line · < 11.2.4; >= 12.0.0, < 12.0.2 · CVE-2026-102281 · GHSA-m8vh-jmq9-5rjg · amended
- Medium, CVSS 4.8
fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets
npm fast-uri · Upgrade to 4.1.5, 3.1.8 or 2.4.7 by release line · < 2.4.7; >= 3.0.0, < 3.1.8; >= 4.0.0, < 4.1.5 · CVE-2026-86472 · GHSA-hrr3-gc8f-f4qj · amended
- Medium, CVSS 4.8
fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization
npm fast-uri · Upgrade to 4.1.5 or later · >= 4.1.3, < 4.1.5 · CVE-2026-86818 · GHSA-jvvf-x445-j334 · amended
- Medium, CVSS 6.3
ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range
npm ip-address · Upgrade to 10.7.1 or later · <= 10.7.0 · CVE-2026-101912 · GHSA-j6r3-76f7-8jcv · amended
- Medium, CVSS 6.3
ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process
npm ip-address · Upgrade to 10.7.1 or later · <= 10.7.0 · CVE-2026-101911 · GHSA-h3mg-xc3c-68pw · amended
- Medium, CVSS 5.9
moment vulnerable to Path Traversal via crafted non-string locale name
npm moment · Upgrade to 2.31.0 or later · >= 2.29.2, < 2.31.0 · CVE-2026-17495 · GHSA-4p3w-j4w9-5jqw · amended
- Medium, CVSS 5.3
brace-expansion: Quadratic-time expansion of the
{a},b}rewrite causes CPU denial of servicenpm brace-expansion · Upgrade to 5.0.12, 3.0.9, 2.1.7 or 1.1.21 by release line · >= 4.0.0, < 5.0.12; >= 3.0.0, < 3.0.9; >= 2.0.0, < 2.1.7; < 1.1.21 · CVE-2026-102277 · GHSA-q2hr-2g5m-vwhr · amended
- High, CVSS 7.5
brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion
npm brace-expansion · Upgrade to 5.0.11, 3.0.8, 2.1.6 or 1.1.20 by release line · >= 4.0.0, < 5.0.11; >= 3.0.0, < 3.0.8; >= 2.0.0, < 2.1.6; < 1.1.20 · CVE-2026-102278 · GHSA-qhr7-859c-m2p7 · amended
- High, CVSS 7.5
brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion
npm brace-expansion · Upgrade to 5.0.10, 3.0.7, 2.1.5 or 1.1.19 by release line · >= 4.0.0, < 5.0.10; >= 3.0.0, < 3.0.7; >= 2.0.0, < 2.1.5; < 1.1.19 · CVE-2026-102276 · GHSA-6j4f-fj2g-mc7p · amended
- High, CVSS 7.5
Socket.IO: Engine.IO Protocol Revision Mismatch DoS
npm engine.io · Upgrade to 6.6.10 or later · >= 6.6.0, < 6.6.10 · CVE-2026-102599 · GHSA-2gc4-cqfq-p2gv · amended
- Medium, CVSS 5.3
Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing
npm nodemailer · Upgrade to 10.0.9 or later · >= 9.1.0, < 10.0.9 · CVE-2026-100699 · GHSA-g57g-f23g-4646 · amended
- High, CVSS 7.5
Nodemailer: Quadratic backtracking in the addressparser free-text fallback allows remote denial of service
npm nodemailer · Upgrade to 10.0.6 or later · <= 10.0.5 · CVE-2026-100700 · GHSA-v53p-9fqp-m79j · amended
- High, CVSS 7.4
PyJWT: PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation
PyPI pyjwt · Upgrade to 2.14.0 or later · >= 2.13.0, < 2.14.0 · CVE-2026-102266 · GHSA-9j54-fg26-wv3r · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.