Node-oauth Node-oauth2-server vulnerabilities

• node-oauth node-oauth2-server, node-oauth\/oauth2-server +1 more @node-oauth/oauth2-server: PKCE code_verifier ABNF not enforced in token exchange allows brute-force redemption of intercepted authorization codes CVE-2026-41213 Fix available 5.9 MediumApril 16, 2026