Node.js & npm

A flaw in msgpack5's streaming decoder causes repeated reparsing of completed elements when a MessagePack container is split across chunks, allowing a remote peer to induce quadratic CPU usage and block the Node.js event loop. Fixed in 6.1.0. (CVE-2026-107297)

Piscina, a Node.js worker pool library, stores its ThreadPool options as a plain object inheriting from Object.prototype. Combined with a separate prototype-pollution bug elsewhere in an application, this can let an attacker influence security-sensitive worker settings such as execArgv, loadBalancer, or env, potentially leading to code execution in worker threads. Fixed in 4.9.4, 5.3.2, and 6.0.0-rc.5.

DBHub, a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB and SQLite, had two flaws in its HTTP transport mode: a DNS-rebinding bypass of its origin check (CVE-2026-61742) and a read-only enforcement bug that still allows writes and, in privileged setups, remote code execution (CVE-2026-61788). Both are fixed in updated DBHub releases.

A sanitizer bypass in SunEditor versions up to 2.47.10 allows event-handler attributes to survive sanitization on namespaced or custom HTML elements, enabling stored cross-site scripting. The issue is fixed in version 2.47.11.

A flaw in http-cache-semantics (through version 4.2.0) allows unauthenticated attackers to retrieve other users' cached responses, including session cookies, by sending crafted max-stale requests. No fix is currently available.

A vulnerability in the braces npm package (versions up to and including 3.0.3) allows attackers to crash Node.js processes by supplying deeply nested brace patterns that exhaust the call stack. No fix is currently available.

vm2 3.11.7 fixes eight separate sandbox-escape and isolation-bypass vulnerabilities, several allowing arbitrary code execution in the host Node.js process. All affected versions up to and including 3.11.6 should be upgraded immediately.

The npm package @zereight/mcp-gitlab, a Model Context Protocol server for GitLab, has four separate advisories covering unauthenticated remote file read, SSRF, DNS rebinding, and multiple safety-control bypasses. Several issues allow unauthenticated attackers to steal GitLab access tokens. Fixes are available in versions 2.1.27 and 2.1.30.

A code injection flaw in OmniRoute's ACP custom-agent endpoint lets attackers execute arbitrary code on the server. No fixed version is currently available.