Npm
7 posts tagged with “Npm”
CVE-2026-75899: fast-uri SSRF via Repeated Hostname Decoding
How to fix CVE-2026-75899: upgrade fast-uri to 2.4.5, 3.1.6, or 4.1.3. Nested percent-encoding in a hostname becomes localhost after normalize() or resolve(). Not RCE. Same patch train as three sibling High SSRF and host-confusion GHSAs.
CVE-2026-77068: n8n Member RCE via MCP Node-Schema Path Traversal
How to fix CVE-2026-77068: upgrade n8n to 2.35.5 (floor 2.33.4 / 2.34.1). Member-level MCP schema path traversal RCE in the MAIN process. Not unauthenticated.
BREAKING: CVE-2026-18549 - @fastify/multipart Aborted Upload DoS
CVE-2026-18549 lets unauthenticated clients leak temp files and hang request handlers in @fastify/multipart <10.1.1, causing disk and event-loop exhaustion. Upgrade to 10.1.1.
BREAKING: CVE-2026-18165 - @fastify/oauth2 Login CSRF via Plantable State Cookies
@fastify/oauth2 7.2.0 through 8.2.0 accepts plantable OAuth state cookies from related hosts, enabling login CSRF. Upgrade to 8.3.0 and enable hostPrefixedCookies.
BREAKING: CVE-2026-18500 - @fastify/jwt Key Override Authorization Bypass
CVE-2026-18500 lets @fastify/jwt before 10.2.2 override a route-specific verification key with the global secret, breaking JWT authorization-domain separation. NVD scores it 8.1 HIGH.
Keyv Supply Chain Attack: 2 Billion Monthly Downloads Compromised in npm Worm
Attackers compromised the GitHub account of keyv maintainer jaredwray, injecting a credential-stealing worm into 434+ npm packages with 2B+ monthly downloads.
Slopsquatting: When AI Hallucinations Become Supply Chain Attacks
AI coding assistants hallucinate package names 19.7% of the time. Attackers register those names on npm and PyPI before real packages can claim them. Tens of thousands of developers have already installed malicious packages their AI suggested. Here is how the attack works, what the research shows, and how to stop your team from becoming the next victim.