Skip to content
Openjsf vulnerabilities
Newest
-
fast-uri
fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority
CVE-2026-84394
Fix available
7.5 High
-
fast-uri
fast-uri vulnerable to authority injection via an unvalidated port in serialize
CVE-2026-84292
Fix available
7.5 High
-
fast-uri
fast-uri vulnerable to host confusion via percent-encoded scheme normalization
CVE-2026-76172
Fix available
7.5 High
-
fast-uri
fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization
CVE-2026-75975
Fix available
7.5 High
-
fast-uri
fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references
CVE-2026-75931
Fix available
7.5 High
-
fast-uri
fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding
CVE-2026-75899
Fix available
7.5 High
-
fast-uri
fast-uri vulnerable to host confusion via backslash authority introducer
CVE-2026-18446
Fix available
7.5 High
-
fast-uri
fast-uri vulnerable to host confusion via literal backslash authority delimiter
CVE-2026-16221
Fix available
7.5 High
-
body-parser
body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement
CVE-2026-12590
Fix available
3.7 Low
-
fast-uri, red hat cluster observability operator 1.5.0, confidential compute attestation +49 more +51 more
fast-uri vulnerable to host confusion via failed IDN canonicalization
CVE-2026-13676
Fix available
7.5 High
-
nvm-sh nvm, openjsf node version manager +1 more
nvm executes commands from a malicious Node.js mirror's version strings
CVE-2026-10796
7.5 High
-
openjsf webdriverio, red hat hardened images +1 more
WebdriverIO has Command Injection in the BrowserStack Service
CVE-2026-25244
Fix available
9.8 Critical
-
marko-js marko, openjsf marko\/runtime-tags +1 more
Marko: XSS via case-insensitive script/style closing tag bypass in runtime HTML escaping
CVE-2026-41591
Fix available
6.4 Medium
-
openjsf eslint
Withdrawn Advisory: eslint has a Stack Overflow when serializing objects with circular references
CVE-2025-50537
Fix available
5.5 Medium
-
openjsf messageformat
messageformat has a prototype pollution vulnerability
CVE-2025-57349
Fix available
7.5 High
-
@clerk express
Preload arbitrary resources by injecting additional `Link` headers
CVE-2024-10491
Fix available
4.0 Medium
-
body-parser
body-parser vulnerable to denial of service when url encoding is enabled
CVE-2024-45590
Public exploitFix available
7.5 High
-
expressjs serve-static
serve-static affected by template injection that can lead to XSS
CVE-2024-43800
Fix available
5.0 Medium
-
@clerk express
express vulnerable to XSS via response.redirect()
CVE-2024-43796
Fix available
5.0 Medium
-
electron packager, electron-packager project electron-packager +1 more
@electron/packager's build process memory potentially leaked into final executable
CVE-2024-29900
Fix available
7.5 High
-
@clerk express
Express.js Open Redirect in malformed URLs
CVE-2024-29041
Fix available
6.1 Medium
-
electronjs electroncord
kedi ElectronCord's Discord Token is public
CVE-2024-26136
7.5 High
-
openjsf express, qs project qs, debian linux +2 more
qs vulnerable to Prototype Pollution
CVE-2022-24999
Public exploitFix available
EPSS 15.7%
7.5 High
-
dojo dijit, debian linux, netapp active iq unified manager +3 more +5 more
XSS in Dijit Editor's LinkDialog plugin
CVE-2020-4051
Fix available
3.7 Low
-
fast-uri, red hat cluster observability operator 1.5.0, confidential compute attestation +53 more +55 more
fast-uri vulnerable to host confusion via percent-encoded authority delimiters
CVE-2026-6322
Fix available
7.5 High
-
fast-uri, red hat cluster observability operator 1.5.0, confidential compute attestation +32 more +34 more
fast-uri vulnerable to path traversal via percent-encoded dot segments
CVE-2026-6321
Fix available
7.5 High
-
openjsf express
No Charset in Content-Type Header in express
CVE-2014-6393
Fix available
6.1 Medium
-
openjsf serve-index
Cross-Site Scripting in serve-index
CVE-2015-8856
Fix available
6.1 Medium