Labs

Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.

• highCVE-2026-84375

  CVE-2026-84375: js-yaml ReDoS via Empty Merge-Key Sources

  A flaw in js-yaml's merge-key guard lets attackers freeze a Node.js process with a small YAML file by repeatedly merging an aliased sequence of empty mappings, bypassing the maxTotalMergeKeys CPU…

• highCVE-2026-81525

  CVE-2026-81525: mongodb/mongodb PHP Library NoSQL Namespace Injection via Dot and NUL Bytes

  Untrusted input containing a dot or a NUL byte in a MongoDB database or collection name can silently redirect queries to a completely different database or collection, bypassing access controls in…

• highCVE-2026-84452

  CVE-2026-84452: winml-cli CORS Wildcard Enables Localhost RCE via trust_remote_code

  Any website a user visits can silently call the winml-cli local HTTP API, pass a malicious AI model path with remote-code execution enabled, and run arbitrary code on the user's machine.

• highCVE-2026-82333

  CVE-2026-82333: multer Denial of Service via Oversized Array Index in Field Names

  Sending a multipart form with a near-max numeric array index in a field name forces multer to allocate and iterate a maximum-length sparse array, blocking Node.js's event loop and making the server…

• highCVE-2026-77037

  CVE-2026-77037: multer Denial of Service via File Descriptor Leak on Aborted Uploads

  Aborting a file upload to a Node.js app using multer 2.2.0 leaks an open file descriptor every time, so an attacker can exhaust the server's file descriptors and take it down without any…

• highCVE-2026-77078

  CVE-2026-77078: multer Denial of Service via Crafted Multipart Field Names

  A two-field multipart request with oversized numeric array indexes in field names crashes any Node.js server running multer, making it instantly and remotely killable by an unauthenticated attacker.

• high

  @typespec/openapi3 Path Traversal via Versioned Enum Value in Output Filename

  A crafted version string in a TypeSpec versioned enum can smuggle path traversal sequences into the emitted output filename, letting the compiler write or overwrite YAML and JSON files anywhere on…

• high

  nodemailer Quadratic ReDoS in addressparser (O(n²) address-list parsing)

  Nodemailer's address parser builds its result array with Array.concat() inside a loop, causing CPU time to grow as the square of the number of addresses, letting any caller freeze a Node.js server…

• high

  CVE-2026-84383: sharp Heap Buffer Overflow via Crafted AVIF/HEIC File (libheif RCE)

  Passing a crafted AVIF or HEIC image to any version of sharp before 0.35.4 can trigger a heap buffer overflow inside libheif and lead to remote code execution on Linux.

• highCVE-2026-84361

  CVE-2026-84361: Composer OS Command Injection via Malicious Perforce Source URL

  A malicious package hosted on a custom Composer repository can embed a crafted Perforce source URL that tricks the p4 client into running an arbitrary local command when a developer or CI system runs…

• highCVE-2026-83615

  CVE-2026-83615: @xmldom/xmldom Quadratic Memory DoS via Namespace Nesting

  Sending a small XML document with deeply nested namespace declarations causes xmldom's parser to consume memory quadratically, crashing the Node.js process before any application logic runs.

• highCVE-2026-83619

  CVE-2026-83619: @xmldom/xmldom End-Tag Whitespace ReDoS

  Parsing an XML end tag with a long run of whitespace followed by a non-whitespace character causes the @xmldom/xmldom 0.8.x parser to stall the Node.js event loop for seconds, letting an…