javascript Archives • Daily CyberSecurity

Body-Parser Flaw CVE-2026-111181 Lets One Request Crash Express Servers, PoC Public

Body-parser vulnerability CVE-2026-111181 enables Express denial of service with a single request

Body-Parser Flaw CVE-2026-111181 Lets One Request Crash Express Servers, PoC Public

Do Son October 28, 2026

Body-parser vulnerability CVE-2026-111181 (CVSS 7.5) enables Express denial of service with one request. Upgrade to body-parser 2.4.0 or 1.20.9.

Storybook Fixes CVSS 9.4 Dev Server Flaw That Lets Malicious Sites Inject Code Storybook dev server vulnerability CVE-2026-114125 allows code injection from malicious websites

Storybook dev server vulnerability CVE-2026-114125 allows code injection from malicious websites

Storybook Fixes CVSS 9.4 Dev Server Flaw That Lets Malicious Sites Inject Code

Do Son October 26, 2026

Storybook dev server vulnerability CVE-2026-114125 (CVSS 9.4) enables code injection from malicious websites. Upgrade to 10.6.2, 9.1.21 or 8.6.19.

Handlebars.js RCE Flaws Disclosed With Public PoC, Threatening 172 Million Monthly Downloads Handlebars.js vulnerability CVE-2026-106445 and CVE-2026-106446 remote code execution flaws with public PoC fixed in version 4.7.10

Handlebars.js vulnerability CVE-2026-106445 and CVE-2026-106446 remote code execution flaws with public PoC fixed in version 4.7.10

Handlebars.js RCE Flaws Disclosed With Public PoC, Threatening 172 Million Monthly Downloads

Do Son October 7, 2026

Two Handlebars.js vulnerability disclosures (CVE-2026-106445, CVE-2026-106446) enable RCE. Details and PoC are public. Update to 4.7.10 now.

Electron Fixes Five High-Severity Sandbox and Isolation Vulnerabilities Electron vulnerabilities CVE-2026-102676, CVE-2026-102673 and CVE-2026-102674 weakening sandbox and isolation in desktop apps

Electron vulnerabilities CVE-2026-102676, CVE-2026-102673 and CVE-2026-102674 weakening sandbox and isolation in desktop apps

Electron Fixes Five High-Severity Sandbox and Isolation Vulnerabilities

Do Son September 30, 2026

Five high-severity Electron vulnerabilities, including CVE-2026-102676, CVE-2026-102673 and CVE-2026-102674, weaken sandbox isolation. Update Electron now.

Vitest Flaw Rated CVSS 9.4 Hits an npm Package With 65 Million Weekly Downloads Vitest vulnerability in Browser Mode bypassing the file-access permission gate (CVSS 9.4)

Vitest vulnerability in Browser Mode bypassing the file-access permission gate (CVSS 9.4)

Vitest Flaw Rated CVSS 9.4 Hits an npm Package With 65 Million Weekly Downloads

Do Son July 22, 2026

A Vitest vulnerability rated CVSS 9.4 lets Browser Mode commands bypass the file-access gate. The npm package sees 65M weekly downloads.

Is Your React App Vulnerable to the CVE-2026-23870 DoS Attack? React Server Components Vulnerability CVE-2026-23870 React Server Components Server-Side DoS React DoS Vulnerability CVE-2026-23864 React Server Components DoS, Source Code Disclosure React RCE, Server Components Deserialization CVE-2025-55182

React Server Components Vulnerability CVE-2026-23870 React Server Components Server-Side DoS React DoS Vulnerability CVE-2026-23864 React Server Components DoS, Source Code Disclosure React RCE, Server Components Deserialization CVE-2025-55182

Is Your React App Vulnerable to the CVE-2026-23870 DoS Attack?

Do Son May 8, 2026

Protect your app from CVE-2026-23870. Learn how this high-severity React Server Components DoS flaw crashes servers and how to patch your React 19 build today.

High-Severity SSRF Flaw Uncovered in Angular’s Server-Side Rendering Angular hostname hijacking vulnerability Angular SSRF Origin Hijacking Angular XSS Vulnerability CVE-2026-32635 Angular i18n XSS CVE-2026-27970 Angular SSR SSRF CVE-2026-27739 Angular Vulnerability CVE-2026-22610 CVE-2025-59052 Angular security Angular XSS Bypass, SVG Injection

Angular hostname hijacking vulnerability Angular SSRF Origin Hijacking Angular XSS Vulnerability CVE-2026-32635 Angular i18n XSS CVE-2026-27970 Angular SSR SSRF CVE-2026-27739 Angular Vulnerability CVE-2026-22610 CVE-2025-59052 Angular security Angular XSS Bypass, SVG Injection

High-Severity SSRF Flaw Uncovered in Angular’s Server-Side Rendering

Do Son April 17, 2026

Angular patches a critical 8.7 SSRF flaw in @angular/platform-server. Attackers can hijack SSR origins via URL normalization. Patch v19, v20, or v21 now!

CVE-2026-40175 (CVSS 10): Critical Axios Vulnerability and Exploit Code Disclosed Publicly Axios proxy vulnerabilities prototype pollution gadget Axios Vulnerability Cloud Hijacking Axios npm supply chain attack Axios Vulnerability Node.js DoS CVE-2025-58754 CVE-2025-27152 Axios Vulnerability, Form-Data Flaw

Axios proxy vulnerabilities prototype pollution gadget Axios Vulnerability Cloud Hijacking Axios npm supply chain attack Axios Vulnerability Node.js DoS CVE-2025-58754 CVE-2025-27152 Axios Vulnerability, Form-Data Flaw

CVE-2026-40175 (CVSS 10): Critical Axios Vulnerability and Exploit Code Disclosed Publicly

Do Son April 12, 2026

A critical CVSS 10 flaw in Axios (CVE-2026-40175) allows attackers to bypass AWS IMDSv2 and achieve RCE via header injection. Upgrade to v1.15.0 now!

Frontend Secrets Exposed: Vite Patches Critical Security Bypass in Dev Server Vite Vulnerability Arbitrary File Read

Frontend Secrets Exposed: Vite Patches Critical Security Bypass in Dev Server

Do Son April 9, 2026

Vite patches critical flaws (CVE-2026-39364 & CVE-2026-39363) allowing arbitrary file reads and .env leaks via WebSockets and query params. Upgrade to 8.0.5!

Fileless Remcos RAT Hijacks Trusted Windows Tools Remcos RAT Fileless Malware

Fileless Remcos RAT Hijacks Trusted Windows Tools

Do Son April 7, 2026

Researchers unmask a fileless Remcos RAT campaign using obfuscated JS and LOLBins to hijack systems in-memory. See the technical breakdown from Lat61.

Lodash Patches High-Severity Code Injection Vulnerability Lodash Code Injection CVE-2026-4800

Lodash Patches High-Severity Code Injection Vulnerability

Do Son April 2, 2026

Lodash (CVE-2026-4800) faces an 8.1 CVSS code injection flaw in the _.template function. Attackers can bypass validation via imports. Update to 4.18.0 now!

The xmldom CDATA Flaw That Puts 23 Million Weekly Users at Risk xmldom Vulnerability XML Injection

The xmldom CDATA Flaw That Puts 23 Million Weekly Users at Risk

Do Son April 2, 2026

Fix CVE-2026-34601 in @xmldom/xmldom (CVSS 7.5). A CDATA injection flaw allows attackers to bypass "safe zones" and manipulate business logic. Update now!

Axios Under Siege: Critical npm Supply Chain Attack Hijacks Lead Maintainer to Drop Multi-Platform RAT TanStack Typosquatting npm Supply Chain Attack Axios Supply Chain Attack npm Poisoning eScan Supply Chain Attack Antivirus Compromise APT-36, NCERT WhatsApp Advisory FBI alert, Salesforce Salt Typhoon, APT group ConnectWise ScreenConnect hack Nation-state cyberattack FortiGate Leak - zkLend vulnerability - TRIPLESTRENGTH Threat Actor Group Dark Storm

TanStack Typosquatting npm Supply Chain Attack Axios Supply Chain Attack npm Poisoning eScan Supply Chain Attack Antivirus Compromise APT-36, NCERT WhatsApp Advisory FBI alert, Salesforce Salt Typhoon, APT group ConnectWise ScreenConnect hack Nation-state cyberattack FortiGate Leak - zkLend vulnerability - TRIPLESTRENGTH Threat Actor Group Dark Storm

Axios Under Siege: Critical npm Supply Chain Attack Hijacks Lead Maintainer to Drop Multi-Platform RAT

Do Son March 31, 2026

Axios versions 1.14.1 & 0.30.4 have been poisoned. A hijacked maintainer account is dropping a RAT via postinstall scripts. Revert to safe versions now!

The Weakest Link: Popular Node.js Config Library “Convict” Hit by Prototype Pollution Prototype Pollution node-convict Vulnerability

The Weakest Link: Popular Node.js Config Library “Convict” Hit by Prototype Pollution

Do Son March 30, 2026

Node-convict (CVE-2026-33864) faces a 9.4 CVSS Prototype Pollution flaw. Bypass filters and hijack Node.js apps. Update to version 6.2.5 now to stay secure.

Dream Job or Nightmare? Lazarus Group Hunts Crypto Devs with “Graphalgo” Malware TanStack Typosquatting npm Supply Chain Attack Axios Supply Chain Attack npm Poisoning eScan Supply Chain Attack Antivirus Compromise APT-36, NCERT WhatsApp Advisory FBI alert, Salesforce Salt Typhoon, APT group ConnectWise ScreenConnect hack Nation-state cyberattack FortiGate Leak - zkLend vulnerability - TRIPLESTRENGTH Threat Actor Group Dark Storm

Dream Job or Nightmare? Lazarus Group Hunts Crypto Devs with “Graphalgo” Malware

Do Son February 13, 2026

Lazarus Group targets crypto developers with fake job offers in new "Graphalgo" campaign. Malicious npm packages deliver multi-stage malware. Stay alert.

Node.js Patches Memory Leak and Permission Bypasses CVE-2024-27980 Node.js Vulnerability CVE-2025-55131

Node.js Patches Memory Leak and Permission Bypasses

Do Son January 14, 2026

Urgent: Node.js patches CVE-2025-55131 (High Severity). "Dirty" memory flaw exposes secrets. Update to v20.20.0/v22.22.0 now to stop data leaks.

Angular Security Alert: High-Severity SVG Flaw CVE-2026-22610 Exposes Apps to XSS Angular hostname hijacking vulnerability Angular SSRF Origin Hijacking Angular XSS Vulnerability CVE-2026-32635 Angular i18n XSS CVE-2026-27970 Angular SSR SSRF CVE-2026-27739 Angular Vulnerability CVE-2026-22610 CVE-2025-59052 Angular security Angular XSS Bypass, SVG Injection

Angular Security Alert: High-Severity SVG Flaw CVE-2026-22610 Exposes Apps to XSS

Do Son January 13, 2026

Angular CVE-2026-22610 (CVSS 8.5) allows XSS via SVG script attributes. Update to v21.0.7 or v20.3.16 immediately to secure your apps.

“Better Auth” Framework Alert: The Double-Slash Trick That Bypasses Security Controls Better Auth Bypass, rou3 Path Normalization Better Auth Bypass, CVE-2025-61928 Better Auth vulnerability

Better Auth Bypass, rou3 Path Normalization Better Auth Bypass, CVE-2025-61928 Better Auth vulnerability

“Better Auth” Framework Alert: The Double-Slash Trick That Bypasses Security Controls

Do Son December 18, 2025

A normalization flaw in Better Auth's router allows attackers to bypass access controls and rate limits using simple double-slash URLs.

Google Chrome Emergency Update: High-Severity Memory Corruption Flaws Fixed in WebGPU and V8

Chrome 148 lazy loading Chrome for Linux ARM64 Chrome 145 Update Chrome Security Fixes Chrome Security Update CVE-2026-1220 Chrome 144 Security Update CVE-2026-0899 Chrome Memory Safety, WebGPU UAF Chrome V8 Type Confusion, Google Updater Flaw Chrome V8 Flaw, CVE-2025-13042 Chrome V8, Type Confusion, Chrome 142 Update Chrome V8 Flaw, CVE-2025-12036 Chrome 141, WebGPU Overflow Google Chrome preloading Chrome, V8 vulnerability CVE-2025-9132 Chrome Security Update, Use-After-Free Chrome V8, Type Confusion Chrome Telemetry, Windows 10 EOL Microsoft Family Safety, Chrome Blocking Chrome Security Update, High-Severity Google Chrome, Antitrust CVE-2024-10487 and CVE-2024-10488 Google Chrome Root Program Chrome Update, CVE-2025-3619 Chrome Acquisition, Perplexity.ai

Google Chrome Emergency Update: High-Severity Memory Corruption Flaws Fixed in WebGPU and V8

Do Son December 17, 2025

Google released an urgent Chrome update to patch High-severity flaws in WebGPU and V8. Fixes include a Use-After-Free and Memory Corruption. Update to v143.0.7499.146+ now.

Angular Alert: Protocol-Relative URLs Leak XSRF Tokens (CVE-2025-66035) Angular, CVE-2025-66035

Angular Alert: Protocol-Relative URLs Leak XSRF Tokens (CVE-2025-66035)

Do Son November 27, 2025

CVE-2025-66035: Angular protocol-relative URLs leak XSRF tokens, bypassing CSRF protection. Update to v19.2.16, v20.3.14, or v21.0.1 now.

New Malware Found in npm Package “fezbox” Uses QR Codes to Steal Credentials GuLoader Malware CloudEye Obfuscation npm, malware Ethereum, npm supply chain OAST techniques StilachiRAT macOS Malware PasivRobber

GuLoader Malware CloudEye Obfuscation npm, malware Ethereum, npm supply chain OAST techniques StilachiRAT macOS Malware PasivRobber

New Malware Found in npm Package “fezbox” Uses QR Codes to Steal Credentials

Do Son September 23, 2025

A new malicious npm package, "fezbox," hides a credential-stealing payload within a QR code, which it uses to exfiltrate web cookies and credentials.

Massive npm Supply Chain Attack: Qix’s Account Compromised, Billions of Weekly Downloads at Risk npm-l

Massive npm Supply Chain Attack: Qix’s Account Compromised, Billions of Weekly Downloads at Risk

Do Son September 9, 2025

A key npm maintainer's account was compromised, leading to a supply chain attack. Malicious code in popular packages is stealing crypto during transactions.