Skip to content
Uhop vulnerabilities
Newest
-
uhop stream-json
stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service
CVE-2026-114129
Fix available
6.2 Medium
-
uhop stream-json
stream-json: Prototype pollution: Assembler writes this.current[this.key] on plain objects
CVE-2026-104183
Fix available
5.1 Medium
-
uhop stream-json
stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk
CVE-2026-104182
Fix available
6.2 Medium
-
uhop stream-json
stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS)
CVE-2026-71429
Fix available
6.2 Medium
-
uhop node-re2
node-re2: Out-of-bounds heap read in `replace`/`split` via a `Buffer` ending in a truncated multi-byte UTF-8 character → adjacent heap memory disclosed to JavaScript
CVE-2026-71498
Fix available
5.1 Medium
-
uhop node-re2
node-re2: String.prototype.replace(re2, template) aborts the Node process (uncatchable ToLocalChecked on empty MaybeLocal) when the result exceeds V8's max string length
CVE-2026-71430
Fix available
6.2 Medium
-
uhop node-re2
re2: Global `String.prototype.match` with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth (DoS)
CVE-2026-68499
Fix available
6.2 Medium
-
uhop node-re2
re2: Out-of-bounds heap read in `exec`/`test`/`match` via attacker-influenced `lastIndex` on a non-ASCII subject → uncatchable process crash (DoS)
CVE-2026-67550
Fix available
5.7 Medium