Snyk test report

Uncaught Exception

---

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Uncaught Exception in the TLS module when a SNICallback throws synchronously on unexpected input the exception bypasses TLS error handlers and propagates as an uncaught exception. A remote attacker can crash or exhaust resources of a TLS server by sending input that causes the callback to throw an error.

Note:

This is caused by an incomplete fix for CVE-2026-21637.

Remediation

Upgrade node to version 20.20.2, 22.22.2, 24.14.1, 25.8.2 or higher.

References

• GitHub Commit
• Node.js Security Releases

---

Uncaught Exception

---

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Uncaught Exception in Node.js HTTP request handling. The flaw triggers when an incoming request includes a header named __proto__ and the server application accesses req.headersDistinct. This causes dest["__proto__"] to incorrectly resolve to Object.prototype, resulting in an uncaught TypeError when .push() is called on a non-array. Because this exception is thrown synchronously inside a property getter, standard error listeners cannot intercept it. This causes the Node.js process to crash unless every access is explicitly wrapped in a try/catch block.

Remediation

Upgrade node to version 20.20.2, 22.22.2, 24.14.1, 25.8.2 or higher.

References

• GitHub Commit
• Node.js Security Releases

---

Integer Overflow or Wraparound

---

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Integer Overflow or Wraparound in the WebCrypto cipher output length calculation in src/crypto/crypto_aes.cc, where data_len + blockSize + tag_len is computed as a signed int before being passed to OpenSSL. An attacker can abort the process and cause a denial of service by passing an input around a multiple of 2 GiB to subtle.encrypt(), which overflows that length computation and crashes the runtime.

Remediation

Upgrade node to version 22.23.0, 24.17.0, 26.3.1 or higher.

References

• GitHub Commit
• Node.js Advisory

---

Improper Certificate Validation

---

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Improper Certificate Validation due to the HTTPS Agent skipping hostname verification across identity policies. An attacker can intercept or manipulate encrypted communications by exploiting TLS session reuse without proper hostname validation.

Remediation

Upgrade node to version 22.23.2, 24.18.1, 26.5.1 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Commit
• Node.js

---

Directory Traversal

---

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Directory Traversal due to improper enforcement of the permission model in the process.report. An attacker can access or overwrite files outside of the intended --allow-fs-write paths by leveraging this flaw to bypass security boundaries.

Details

A Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.

Directory Traversal vulnerabilities can be generally divided into two types:

• Information Disclosure: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.

st is a module for serving static files on web pages, and contains a vulnerability of this type. In our example, we will serve files from the public route.

If an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.

curl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa
        

Note %2e is the URL encoded version of . (dot).

• Writing arbitrary files: Allows the attacker to create or replace existing files. This type of vulnerability is also known as Zip-Slip.

One way to achieve this is by using a malicious zip archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.

The following is an example of a zip archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in /root/.ssh/ overwriting the authorized_keys file:

2018-04-15 22:04:29 .....           19           19  good.txt
        2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys
        

Remediation

Upgrade node to version 22.23.2, 24.18.1, 26.5.1 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Commit
• Node.js

---

Allocation of Resources Without Limits or Throttling

---

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the HTTP/2 header block handling. An attacker can cause excessive memory consumption by sending specially crafted HTTP/2 requests that bypass memory limits.

Remediation

Upgrade node to version 22.23.2, 24.18.1 or higher.

References

• GitHub Commit
• GitHub Commit
• Node.js

---

Use After Free

---

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Use After Free in the HTTP/2 handling process when nghttp2_session_mem_send() is called re-entrantly during the execution of nghttp2_session_mem_recv(). An attacker can cause a heap-use-after-free condition by triggering concurrent or re-entrant calls, potentially leading to denial of service or other unpredictable behavior.

Remediation

Upgrade node to version 22.23.2, 24.18.1, 26.5.1 or higher.

References

• GitHub Commit
• Node.js

---

Allocation of Resources Without Limits or Throttling

---

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the dns.resolveAny function when processing a DNS response containing more than 256 A records. An attacker can cause the process to abort repeatedly by sending specially crafted DNS responses.

Remediation

Upgrade node to version 22.23.2, 24.18.1, 26.5.1 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Commit
• Node.js

---

Allocation of Resources Without Limits or Throttling

---

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the node:zlib synchronous APIs when a spoofed TypedArray byteLength triggers a reachable assertion. An attacker can cause the process to crash repeatedly by exploiting this condition.

Remediation

Upgrade node to version 22.23.2, 24.18.1, 26.5.1 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Commit
• Node.js

---

Use After Free

---

NVD Description

Note: Versions mentioned in the description apply only to the upstream lua5.1 package and not the lua5.1 package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.

Remediation

Upgrade Ubuntu:22.04 lua5.1 to version 5.1.5-8.1ubuntu0.22.04.1~esm1 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2025-49844
• https://github.com/redis/redis/commit/d5728cb5795c966c5b5b1e0f0ac576a7e69af539
• https://github.com/redis/redis/releases/tag/8.2.2
• https://github.com/redis/redis/security/advisories/GHSA-4789-qfc9-5f9q
• http://www.openwall.com/lists/oss-security/2025/10/07/2
• https://github.com/lastvocher/redis-CVE-2025-49844
• https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2025/CVE-2025-49844.yaml

---

Stack-based Buffer Overflow

---

NVD Description

Note: Versions mentioned in the description apply only to the upstream lua-bitop package and not the lua-bitop package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to trigger a stack buffer overflow in the bit library, which may potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This problem has been fixed in Redis versions 6.2.16, 7.2.6, and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Remediation

Upgrade Ubuntu:22.04 lua-bitop to version 1.0.2-5ubuntu0.22.04.1~esm2 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2024-31449
• https://github.com/redis/redis/commit/1f7c148be2cbacf7d50aa461c58b871e87cc5ed9
• https://github.com/redis/redis/security/advisories/GHSA-whxg-wx83-85p5

---

Inefficient Algorithmic Complexity

---

Overview

js-yaml is a human-friendly data serialization language.

Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in merge key (<<) handling during YAML parsing, where each mapping in a chain re-enumerates the keys inherited from the previous mapping. An attacker can exhaust CPU and cause denial of service by supplying a document with N chained merge mappings, which forces roughly O(N^2) work for O(N) input. Exploitation requires the application to parse untrusted YAML with the default or YAML11 schema, under which merge keys are resolved.

Remediation

Upgrade js-yaml to version 3.15.0, 4.3.0 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Commit
• GitHub Commit

---

Inefficient Algorithmic Complexity

---

Overview

js-yaml is a human-friendly data serialization language.

Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the yaml.load process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large !!omap sequence.

Remediation

Upgrade js-yaml to version 3.15.1, 4.3.1 or higher.

References

• GitHub Advisory

---

Interpretation Conflict

---

Overview

fast-uri is a Dependency-free RFC 3986 URI toolbox

Affected versions of this package are vulnerable to Interpretation Conflict due to malformed authority introducer handling in parseWithStatus() and resolve() in index.js. An attacker can bypass host-based URL checks and steer requests to an unintended host by supplying a URI that uses \\, /\\, or \\/ in place of // after the scheme. The parser folds those sequences into the path instead of recognizing an authority, while Node’s WHATWG URL treats them as a real authority on special schemes such as http, https, ws, wss, ftp, and file. Applications that validate a URL with fast-uri and then pass the same input to fetch(), undici, or Node’s HTTP clients can be sent to an attacker-controlled destination, enabling SSRF, redirect bypass, or outbound routing abuse.

Remediation

Upgrade fast-uri to version 2.4.4, 3.1.5, 4.1.2 or higher.

References

• GitHub Commit
• Maintainer's Advisory

---

Interpretation Conflict

---

Overview

fast-uri is a Dependency-free RFC 3986 URI toolbox

Affected versions of this package are vulnerable to Interpretation Conflict in resolve() through the resolve() process in index.js. An attacker can make an application resolve a scheme-relative reference such as //host/ against a scheme-bearing base and receive a host string that does not match the host produced when the result is parsed again. This lets policy checks or routing decisions operate on one host while the resolved URI actually points at another, which can bypass host allowlists and send the user to an unexpected destination.

Workarounds

• Resolve scheme-relative references against a base URI that already includes a scheme before any host-policy or origin check, so the host is evaluated in its final scheme context and cannot be checked under one interpretation and used under another.

Remediation

Upgrade fast-uri to version 2.4.5, 3.1.6, 4.1.3 or higher.

References

• GitHub Commit v2.4.5
• GitHub Commit v3.1.6
• GitHub Commit v4.1.3
• Maintainer's Advisory

---

Improper Handling of URL Encoding (Hex Encoding)

---

Overview

fast-uri is a Dependency-free RFC 3986 URI toolbox

Affected versions of this package are vulnerable to Improper Handling of URL Encoding (Hex Encoding) through the parseWithStatus, normalizeStringWithStatus, normalizeComparableURI, and resolve paths in index.js. An attacker can steer a URL normalizer or resolver to an attacker-chosen host by supplying a URI whose scheme decodes into reserved delimiter characters, such as %2f%2fevil.example:/pwn, causing normalize() or resolve() to emit a string that reparses with a different authority. This lets untrusted input bypass host-based redirect checks, allowlists, or outbound request decisions when applications trust the normalized result. A scheme containing encoded CRLF can also be serialized back as raw line breaks, which can corrupt a URI placed into a response header.

Remediation

Upgrade fast-uri to version 2.4.5, 3.1.6, 4.1.3 or higher.

References

• GitHub Commit v2.4.5
• GitHub Commit v3.1.6
• GitHub Commit v4.1.3
• Maintainer's Advisory

---

Improper Validation of Syntactic Correctness of Input

---

Overview

fast-uri is a Dependency-free RFC 3986 URI toolbox

Affected versions of this package are vulnerable to Improper Validation of Syntactic Correctness of Input through the normalizeIPv6() and parseWithStatus() host-processing paths in lib/utils.js and index.js. An attacker can route an application to a local or private address by supplying a malformed bracketed IPv6 literal such as http://[::not-valid]/private before the URL is normalized or checked. The parser accepts the malformed host without an error and silently rewrites it into a different valid IPv6 address, so downstream redirect handling, outbound requests, or host allowlist checks operate on the wrong destination. This can send traffic to loopback, unique-local, or link-local targets and expose internal services to unintended requests.

Workarounds

• Reject untrusted URLs whose host is a bracketed IPv6 literal before passing them to fast-uri; this prevents malformed IPv6 text from being normalized into a different valid local or private address.
• Route outbound requests against an explicit allowlist of addresses instead of trusting the normalized host; this limits the impact if a malformed bracketed IPv6 literal is supplied.

Remediation

Upgrade fast-uri to version 2.4.5, 3.1.6, 4.1.3 or higher.

References

• GitHub Commit v2.4.5
• GitHub Commit v3.1.6
• GitHub Commit v4.1.3
• Maintainer's Advisory

---

Double Decoding of the Same Data

---

Overview

fast-uri is a Dependency-free RFC 3986 URI toolbox

Affected versions of this package are vulnerable to Double Decoding of the Same Data through hostname normalization in normalize() and resolve() and the authority recomposition logic in index.js and lib/utils.js. An attacker can redirect an application to an unintended host by supplying a URI whose hostname contains nested percent-encoded bytes, such as an encoded loopback or metadata address. The parser decodes the hostname once during normalization and then decodes it again when rebuilding the authority, so %25 sequences can turn into live host delimiters or dot characters during processing. Applications that normalize or resolve untrusted URIs before SSRF checks, redirect validation, or host allowlisting can be steered to internal destinations like localhost or a cloud metadata endpoint.

Workarounds

• Reject untrusted URIs whose host component contains an encoded percent sign (%25) before passing them to normalize() or resolve(). This prevents nested percent-encoded hostnames from being decoded into live internal destinations such as loopback or metadata addresses.

Remediation

Upgrade fast-uri to version 2.4.5, 3.1.6, 4.1.3 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Commit v3.1.6
• Maintainer's Advisory

---

Prototype Pollution

---

Overview

browserslist is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset

Affected versions of this package are vulnerable to Prototype Pollution via the normalizeStats() function in node.js. An attacker can crash the process or alter an object’s prototype by supplying a poisoned browserslist-stats.json file or untrusted stats data with inherited object-key names such as __proto__ or toString. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a TypeError on lookup or invoke the __proto__ setter during assignment, breaking any tool that calls browserslist() and causing a denial of service.

Details

Prototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as __proto__, constructor and prototype. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the Object.prototype are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.

There are two main ways in which the pollution of prototypes occurs:

• Unsafe Object recursive merge

• Property definition by path

Unsafe Object recursive merge

The logic of a vulnerable recursive merge function follows the following high-level model:

merge (target, source)
        
          foreach property of source
        
            if property exists and is an object on both the target and the source
        
              merge(target[property], source[property])
        
            else
        
              target[property] = source[property]
        

When the source object contains a property named __proto__ defined with Object.defineProperty() , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of Object and the source of Object as defined by the attacker. Properties are then copied on the Object prototype.

Clone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: merge({},source).

lodash and Hoek are examples of libraries susceptible to recursive merge attacks.

Property definition by path

There are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: theFunction(object, path, value)

If the attacker can control the value of “path”, they can set this value to __proto__.myValue. myValue is then assigned to the prototype of the class of the object.

Types of attacks

There are a few methods by which Prototype Pollution can be manipulated:

Type	Origin	Short description
Denial of service (DoS)	Client	This is the most likely attack. DoS occurs when Object holds generic functions that are implicitly called for various operations (for example, toString and valueOf). The attacker pollutes Object.prototype.someattr and alters its state to an unexpected value such as Int or Object. In this case, the code fails and is likely to cause a denial of service. For example: if an attacker pollutes Object.prototype.toString by defining it as an integer, if the codebase at any point was reliant on someobject.toString() it would fail.
Remote Code Execution	Client	Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation. For example: eval(someobject.someattr). In this case, if the attacker pollutes Object.prototype.someattr they are likely to be able to leverage this in order to execute code.
Property Injection	Client	The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens. For example: if a codebase checks privileges for someuser.isAdmin, then when the attacker pollutes Object.prototype.isAdmin and sets it to equal true, they can then achieve admin privileges.

Affected environments

The following environments are susceptible to a Prototype Pollution attack:

• Application server

• Web server

• Web browser

How to prevent

1. Freeze the prototype— use Object.freeze (Object.prototype).

2. Require schema validation of JSON input.

3. Avoid using unsafe recursive merge functions.

4. Consider using objects without prototypes (for example, Object.create(null)), breaking the prototype chain and preventing pollution.

5. As a best practice use Map instead of Object.

For more information on this vulnerability type:

Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018

Remediation

Upgrade browserslist to version 4.28.7 or higher.

References

• GitHub Commit
• Maintainer's Advisory

---

Allocation of Resources Without Limits or Throttling

---

Overview

browserslist is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory cache and parseCache in index.js. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique browserslist() result and parsed query AST to be retained indefinitely.

Remediation

Upgrade browserslist to version 4.28.7 or higher.

References

• GitHub Commit
• Maintainer's Advisory

---