Snyk test report

CVE-2026-45447

---

NVD Description

Note: Versions mentioned in the description apply only to the upstream nodejs package and not the nodejs package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

Issue summary: A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free during PKCS#7 signature verification.

Impact summary: A use-after-free may result in process crashes, heap corruption, or potentially remote code execution.

When processing a PKCS#7 or S/MIME signed message, if the SignedData digestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may incorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent use of the BIO by the calling application results in a use-after-free condition.

In the common case this occurs when the application later calls BIO_free() on the BIO originally passed to PKCS7_verify(). Depending on allocator behavior and application-specific BIO usage patterns, this may result in a crash or other memory corruption. In some application contexts this may potentially be exploitable for remote code execution.

Applications that process PKCS#7 or S/MIME signed messages using OpenSSL PKCS#7 APIs may be affected. Applications using the CMS APIs for this processing are not affected.

The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

Remediation

There is no fixed version for Ubuntu:22.04 nodejs.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447
• https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c
• https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8
• https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54
• https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c
• https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e
• https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c
• https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8
• https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54
• https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c
• https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e
• https://openssl-library.org/news/secadv/20260609.txt
• https://access.redhat.com/errata/RHSA-2026:25237
• https://access.redhat.com/errata/RHSA-2026:25239
• https://access.redhat.com/errata/RHSA-2026:26275
• https://access.redhat.com/errata/RHSA-2026:26319
• https://access.redhat.com/errata/RHSA-2026:29197
• https://access.redhat.com/errata/RHSA-2026:34102
• https://access.redhat.com/errata/RHSA-2026:35869
• https://access.redhat.com/errata/RHSA-2026:36215
• https://access.redhat.com/errata/RHSA-2026:36217
• https://access.redhat.com/errata/RHSA-2026:39009
• https://access.redhat.com/errata/RHSA-2026:39012
• https://access.redhat.com/errata/RHSA-2026:39981
• https://access.redhat.com/security/cve/CVE-2026-45447
• https://bugzilla.redhat.com/show_bug.cgi?id=2481898
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json
• https://access.redhat.com/errata/RHSA-2026:44438
• https://access.redhat.com/errata/RHSA-2026:47735
• https://access.redhat.com/errata/RHSA-2026:47737
• https://access.redhat.com/errata/RHSA-2026:58563
• https://access.redhat.com/errata/RHSA-2026:58981

---

Infinite loop

---

Overview

Affected versions of this package are vulnerable to Infinite loop through the customAlphabet and nanoid functions in nanoid/non-secure. An attacker can hang the calling thread by supplying a negative size to either function, causing the loop counter to decrement from a negative value and never reach its termination condition. This affects applications that pass unvalidated attacker-controlled size values into the non-secure ID generator, where a single malicious request can spin the process indefinitely and stop the service from responding.

Notes

• The vulnerable code path is in the nanoid/non-secure entry point, so bundles or consumers that import the non-secure module directly are the ones exposed; the secure/default package path is a separate export.
• The denial-of-service only shows up when callers pass a negative size into these APIs, which the advisory’s regression tests treat as returning an empty string rather than looping.

Remediation

Upgrade nanoid to version 3.3.16, 5.1.16 or higher.

References

• GitHub Commit

---

Integer Overflow or Wraparound

---

Overview

Affected versions of this package are vulnerable to Integer Overflow or Wraparound through the fillPool logic in index.js and index.cjs. An attacker can make subsequent ID generation deterministic by supplying an oversized size value to nanoid(size), which is coerced into a negative 32-bit integer and corrupts the shared random pool state. After that call, all later IDs produced in the same process lose their randomness and uniqueness, breaking session tokens, CSRF tokens, and other identifiers until the process restarts.

Remediation

Upgrade nanoid to version 3.3.12, 5.1.11 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Commit
• Maintainer's Advisory

---

Inefficient Algorithmic Complexity

---

Overview

js-yaml is a human-friendly data serialization language.

Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the yaml.load process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large !!omap sequence.

Remediation

Upgrade js-yaml to version 3.15.1, 4.3.1 or higher.

References

• GitHub Advisory

---

Infinite loop

---

Overview

Affected versions of this package are vulnerable to Infinite loop in the extractPartialStreams() and corresponding extraction functions for HEIF, JP2, and JXL. An attacker supplying an image whose requested box declares a size of zero can hang the parser indefinitely.

Note: This is a bypass of the fix for the vulnerability described in CVE-2025-71319.

Remediation

There is no fixed version for image-size.

References

• GitHub PR
• Vulnerability Report
• Vulnerable Code

---

Infinite loop

---

Overview

Affected versions of this package are vulnerable to Infinite loop in icns.js. An ICNS file with an icon entry whose declared length is zero can hang the parser indefinitely.

Remediation

There is no fixed version for image-size.

References

• GitHub PR
• Vulnerability Report
• Vulnerable Code

---

Interpretation Conflict

---

Overview

fast-uri is a Dependency-free RFC 3986 URI toolbox

Affected versions of this package are vulnerable to Interpretation Conflict due to malformed authority introducer handling in parseWithStatus() and resolve() in index.js. An attacker can bypass host-based URL checks and steer requests to an unintended host by supplying a URI that uses \\, /\\, or \\/ in place of // after the scheme. The parser folds those sequences into the path instead of recognizing an authority, while Node’s WHATWG URL treats them as a real authority on special schemes such as http, https, ws, wss, ftp, and file. Applications that validate a URL with fast-uri and then pass the same input to fetch(), undici, or Node’s HTTP clients can be sent to an attacker-controlled destination, enabling SSRF, redirect bypass, or outbound routing abuse.

Remediation

Upgrade fast-uri to version 2.4.4, 3.1.5, 4.1.2 or higher.

References

• GitHub Commit
• Maintainer's Advisory

---

Interpretation Conflict

---

Overview

fast-uri is a Dependency-free RFC 3986 URI toolbox

Affected versions of this package are vulnerable to Interpretation Conflict in resolve() through the resolve() process in index.js. An attacker can make an application resolve a scheme-relative reference such as //host/ against a scheme-bearing base and receive a host string that does not match the host produced when the result is parsed again. This lets policy checks or routing decisions operate on one host while the resolved URI actually points at another, which can bypass host allowlists and send the user to an unexpected destination.

Workarounds

• Resolve scheme-relative references against a base URI that already includes a scheme before any host-policy or origin check, so the host is evaluated in its final scheme context and cannot be checked under one interpretation and used under another.

Remediation

Upgrade fast-uri to version 2.4.5, 3.1.6, 4.1.3 or higher.

References

• GitHub Commit v2.4.5
• GitHub Commit v3.1.6
• GitHub Commit v4.1.3
• Maintainer's Advisory

---

Improper Handling of URL Encoding (Hex Encoding)

---

Overview

fast-uri is a Dependency-free RFC 3986 URI toolbox

Affected versions of this package are vulnerable to Improper Handling of URL Encoding (Hex Encoding) through the parseWithStatus, normalizeStringWithStatus, normalizeComparableURI, and resolve paths in index.js. An attacker can steer a URL normalizer or resolver to an attacker-chosen host by supplying a URI whose scheme decodes into reserved delimiter characters, such as %2f%2fevil.example:/pwn, causing normalize() or resolve() to emit a string that reparses with a different authority. This lets untrusted input bypass host-based redirect checks, allowlists, or outbound request decisions when applications trust the normalized result. A scheme containing encoded CRLF can also be serialized back as raw line breaks, which can corrupt a URI placed into a response header.

Remediation

Upgrade fast-uri to version 2.4.5, 3.1.6, 4.1.3 or higher.

References

• GitHub Commit v2.4.5
• GitHub Commit v3.1.6
• GitHub Commit v4.1.3
• Maintainer's Advisory

---

Improper Validation of Syntactic Correctness of Input

---

Overview

fast-uri is a Dependency-free RFC 3986 URI toolbox

Affected versions of this package are vulnerable to Improper Validation of Syntactic Correctness of Input through the normalizeIPv6() and parseWithStatus() host-processing paths in lib/utils.js and index.js. An attacker can route an application to a local or private address by supplying a malformed bracketed IPv6 literal such as http://[::not-valid]/private before the URL is normalized or checked. The parser accepts the malformed host without an error and silently rewrites it into a different valid IPv6 address, so downstream redirect handling, outbound requests, or host allowlist checks operate on the wrong destination. This can send traffic to loopback, unique-local, or link-local targets and expose internal services to unintended requests.

Workarounds

• Reject untrusted URLs whose host is a bracketed IPv6 literal before passing them to fast-uri; this prevents malformed IPv6 text from being normalized into a different valid local or private address.
• Route outbound requests against an explicit allowlist of addresses instead of trusting the normalized host; this limits the impact if a malformed bracketed IPv6 literal is supplied.

Remediation

Upgrade fast-uri to version 2.4.5, 3.1.6, 4.1.3 or higher.

References

• GitHub Commit v2.4.5
• GitHub Commit v3.1.6
• GitHub Commit v4.1.3
• Maintainer's Advisory

---

Double Decoding of the Same Data

---

Overview

fast-uri is a Dependency-free RFC 3986 URI toolbox

Affected versions of this package are vulnerable to Double Decoding of the Same Data through hostname normalization in normalize() and resolve() and the authority recomposition logic in index.js and lib/utils.js. An attacker can redirect an application to an unintended host by supplying a URI whose hostname contains nested percent-encoded bytes, such as an encoded loopback or metadata address. The parser decodes the hostname once during normalization and then decodes it again when rebuilding the authority, so %25 sequences can turn into live host delimiters or dot characters during processing. Applications that normalize or resolve untrusted URIs before SSRF checks, redirect validation, or host allowlisting can be steered to internal destinations like localhost or a cloud metadata endpoint.

Workarounds

• Reject untrusted URIs whose host component contains an encoded percent sign (%25) before passing them to normalize() or resolve(). This prevents nested percent-encoded hostnames from being decoded into live internal destinations such as loopback or metadata addresses.

Remediation

Upgrade fast-uri to version 2.4.5, 3.1.6, 4.1.3 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Commit v3.1.6
• Maintainer's Advisory

---

Directory Traversal

---

Overview

extract-zip is an unzip a zip file into a directory using 100% javascript

Affected versions of this package are vulnerable to Directory Traversal via the extraction process. An attacker can access or modify arbitrary files by crafting a malicious zip archive containing symlinks that point outside the intended extraction directory.

Details

A Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.

Directory Traversal vulnerabilities can be generally divided into two types:

• Information Disclosure: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.

st is a module for serving static files on web pages, and contains a vulnerability of this type. In our example, we will serve files from the public route.

If an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.

curl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa
        

Note %2e is the URL encoded version of . (dot).

• Writing arbitrary files: Allows the attacker to create or replace existing files. This type of vulnerability is also known as Zip-Slip.

One way to achieve this is by using a malicious zip archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.

The following is an example of a zip archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in /root/.ssh/ overwriting the authorized_keys file:

2018-04-15 22:04:29 .....           19           19  good.txt
        2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys
        

Remediation

There is no fixed version for extract-zip.

References

• Advisory
• GitHub Advisory

---

Prototype Pollution

---

Overview

browserslist is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset

Affected versions of this package are vulnerable to Prototype Pollution via the normalizeStats() function in node.js. An attacker can crash the process or alter an object’s prototype by supplying a poisoned browserslist-stats.json file or untrusted stats data with inherited object-key names such as __proto__ or toString. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a TypeError on lookup or invoke the __proto__ setter during assignment, breaking any tool that calls browserslist() and causing a denial of service.

Details

Prototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as __proto__, constructor and prototype. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the Object.prototype are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.

There are two main ways in which the pollution of prototypes occurs:

• Unsafe Object recursive merge

• Property definition by path

Unsafe Object recursive merge

The logic of a vulnerable recursive merge function follows the following high-level model:

merge (target, source)
        
          foreach property of source
        
            if property exists and is an object on both the target and the source
        
              merge(target[property], source[property])
        
            else
        
              target[property] = source[property]
        

When the source object contains a property named __proto__ defined with Object.defineProperty() , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of Object and the source of Object as defined by the attacker. Properties are then copied on the Object prototype.

Clone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: merge({},source).

lodash and Hoek are examples of libraries susceptible to recursive merge attacks.

Property definition by path

There are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: theFunction(object, path, value)

If the attacker can control the value of “path”, they can set this value to __proto__.myValue. myValue is then assigned to the prototype of the class of the object.

Types of attacks

There are a few methods by which Prototype Pollution can be manipulated:

Type	Origin	Short description
Denial of service (DoS)	Client	This is the most likely attack. DoS occurs when Object holds generic functions that are implicitly called for various operations (for example, toString and valueOf). The attacker pollutes Object.prototype.someattr and alters its state to an unexpected value such as Int or Object. In this case, the code fails and is likely to cause a denial of service. For example: if an attacker pollutes Object.prototype.toString by defining it as an integer, if the codebase at any point was reliant on someobject.toString() it would fail.
Remote Code Execution	Client	Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation. For example: eval(someobject.someattr). In this case, if the attacker pollutes Object.prototype.someattr they are likely to be able to leverage this in order to execute code.
Property Injection	Client	The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens. For example: if a codebase checks privileges for someuser.isAdmin, then when the attacker pollutes Object.prototype.isAdmin and sets it to equal true, they can then achieve admin privileges.

Affected environments

The following environments are susceptible to a Prototype Pollution attack:

• Application server

• Web server

• Web browser

How to prevent

1. Freeze the prototype— use Object.freeze (Object.prototype).

2. Require schema validation of JSON input.

3. Avoid using unsafe recursive merge functions.

4. Consider using objects without prototypes (for example, Object.create(null)), breaking the prototype chain and preventing pollution.

5. As a best practice use Map instead of Object.

For more information on this vulnerability type:

Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018

Remediation

Upgrade browserslist to version 4.28.7 or higher.

References

• GitHub Commit
• Maintainer's Advisory

---

Allocation of Resources Without Limits or Throttling

---

Overview

browserslist is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory cache and parseCache in index.js. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique browserslist() result and parsed query AST to be retained indefinitely.

Remediation

Upgrade browserslist to version 4.28.7 or higher.

References

• GitHub Commit
• Maintainer's Advisory

---