nodejs

A crafted tar archive can now turn a routine Node.js extraction into a pathway for reading and writing arbitrary files outside the intended extraction directory — a high‑severity flaw in the widely used node‑tar package tracked as CVE‑2026‑26960 that was fixed in node‑tar 7.5.8. Background...

The llhttp parser bug tracked as CVE-2023-30589 remains an important cautionary case for WindowsForum readers: Microsoft’s Security Response Center (MSRC) has publicly mapped the vulnerable open‑source component to Azure Linux, but that mapping is an inventory attestation — not a categorical...

The semver package—ubiquitous in the npm ecosystem—contained a Regular Expression Denial of Service (ReDoS) flaw that lets attackers hang or crash Node.js processes when untrusted input is parsed as a version range, and the vulnerability is tracked as CVE-2022-25883 with fixes released in semver...

The open-source Node.js middleware body-parser has a high‑severity denial‑of‑service issue when parsing URL‑encoded request bodies; projects using versions earlier than 1.20.3 should treat this as urgent: upgrade immediately or apply strong mitigations to avoid resource‑exhaustion attacks...

A newly disclosed vulnerability in Node.js — tracked as CVE-2024-22025 — allows an attacker who controls a URL passed into the built-in fetch() implementation to cause a Denial of Service (DoS) by driving the process into resource exhaustion through Brotli decompression. In practical terms...