Vulnerabilities
adm-zip Uncaught Exception Crashes Node.js on Malformed ZIP
A missing error handler in adm-zip before 0.6.1 allows unauthenticated attackers to crash Node.js processes via corrupted DEFLATE data, rated High severity.
Read moreNode.js
Everything BlueTeam Insider has reported about Node.js: 6 stories, newest first. Part of our Vulnerabilities coverage.
Vulnerabilities
adm-zip CVE-2026-114104: Inconsistent Entry Resolution Bypasses Validation
A high-severity flaw in adm-zip allows attackers to write unvalidated data to disk by exploiting duplicate entries in ZIP archives.
Read more
Vulnerabilities
Nodemailer ReDoS in SMTP EHLO Handler Blocks Node Event Loop
A high-severity flaw in Nodemailer allows malicious SMTP servers to freeze applications through regex backtracking, requiring an upgrade to version 10.0.13.
Read more
Vulnerabilities
Nodemailer SMTP Parser Vulnerability Enables Denial of Service
A quadratic complexity flaw in Nodemailer allows attackers to exhaust memory and block event loops during SMTP authentication.
Read more
Vulnerabilities
Stills Media Processor Vulnerable to Critical OS Command Injection via File Paths
Attackers can execute arbitrary shell commands in Stills versions before 25.24.2 by naming media files with special characters that trigger command execution.
Read more
Vulnerabilities
fast-jwt CVE-2026-107723 Bypasses Claim Checks via Array Payloads
A high-severity flaw in the popular Node.js library allows attackers to skip expiry, issuer, and audience validation by submitting tokens with array payloads.
Read more