Node.js Security

53M Downloads At Risk: Critical 9.8 CVSS Vitest Remote Code Execution Vulnerabilities Disclosed

• Vulnerability Report

53M Downloads At Risk: Critical 9.8 CVSS Vitest Remote Code Execution Vulnerabilities Disclosed

Do Son June 5, 2026 0

Newly uncovered flaws expose millions of development setups to a dangerous Vitest remote code execution hazard. This...

Read More Read more about 53M Downloads At Risk: Critical 9.8 CVSS Vitest Remote Code Execution Vulnerabilities Disclosed

Popular npm Package shell-quote Patches Critical Command Injection Bug

• Vulnerability Report

Popular npm Package shell-quote Patches Critical Command Injection Bug

Do Son May 28, 2026 0

Maintainers recently patched a critical flaw in a highly popular ecosystem component. Specifically, developers resolved a dangerous...

Read More Read more about Popular npm Package shell-quote Patches Critical Command Injection Bug

220 Million at Risk: Critical 9.4 CVSS Remote Code Execution Hits protobuf.js

• Vulnerability Report

220 Million at Risk: Critical 9.4 CVSS Remote Code Execution Hits protobuf.js

Do Son April 17, 2026 0

As a pure JavaScript implementation of Google’s Protocol Buffers, protobuf.js is a foundational component for Node.js and...

Read More Read more about 220 Million at Risk: Critical 9.4 CVSS Remote Code Execution Hits protobuf.js

25 Million Users at Risk: Fastify Publicly Discloses PoC Exploit for Single-Space Security Bypass

• Vulnerability Report

25 Million Users at Risk: Fastify Publicly Discloses PoC Exploit for Single-Space Security Bypass

Do Son April 15, 2026 0

In the world of web performance, Fastify is a heavyweight, boasting over 25 million monthly downloads and...

Read More Read more about 25 Million Users at Risk: Fastify Publicly Discloses PoC Exploit for Single-Space Security Bypass

Critical SSRF Flaw Discovered in Axios – CVE-2025-62718 (CVSS 9.3)

• Vulnerability Report

Critical SSRF Flaw Discovered in Axios – CVE-2025-62718 (CVSS 9.3)

Do Son April 14, 2026 0

In the complex architecture of modern web applications, the difference between a secure internal request and a...

Read More Read more about Critical SSRF Flaw Discovered in Axios – CVE-2025-62718 (CVSS 9.3)

The Weakest Link: Popular Node.js Config Library “Convict” Hit by Prototype Pollution

• Vulnerability Report

The Weakest Link: Popular Node.js Config Library “Convict” Hit by Prototype Pollution

Do Son March 30, 2026 0

A critical vulnerability has been uncovered in node-convict, the widely used configuration management library designed to make...

Read More Read more about The Weakest Link: Popular Node.js Config Library “Convict” Hit by Prototype Pollution

Malicious npm Package “pino-sdk-v2” Caught Harvesting Secrets

• Malware

Malicious npm Package “pino-sdk-v2” Caught Harvesting Secrets

Do Son March 11, 2026 0

In the modern development landscape, supply chain attacks remain one of the most effective ways for threat...

Read More Read more about Malicious npm Package “pino-sdk-v2” Caught Harvesting Secrets

Algorithm Confusion: Critical 9.1 Flaw in Parse Server Allows Instant Google Account Takeover

• Vulnerability Report

Algorithm Confusion: Critical 9.1 Flaw in Parse Server Allows Instant Google Account Takeover

Do Son February 26, 2026 0

Parse Server, a widely used open-source backend designed to be deployed on any infrastructure running Node.js and...

Read More Read more about Algorithm Confusion: Critical 9.1 Flaw in Parse Server Allows Instant Google Account Takeover

High-Severity DoS Flaw Hits 46 Million ‘fast-xml-parser’ Downloads

• Vulnerability Report

High-Severity DoS Flaw Hits 46 Million ‘fast-xml-parser’ Downloads

Do Son February 19, 2026 0

If your Node.js application parses XML, you might want to check your dependencies immediately. A critical Denial...

Read More Read more about High-Severity DoS Flaw Hits 46 Million ‘fast-xml-parser’ Downloads