A concurrency issue in @better-auth/drizzle-adapter and @better-auth/kysely-adapter when using PostgreSQL for rate-limit record storage can allow bursts of concurrent requests to exceed configured rate limits. This affects versions 1.6.17 up to but not including 1.7.7 for drizzle-adapter and up to but not including 1.7.0 for kysely-adapter. The flaw weakens rate limiting on sensitive endpoints like password sign-in and two-factor verification but does not bypass authentication or directly compromise accounts.
A vulnerability in better-auth versions from 1.5.0-beta.12 up to but not including 1.7.7 with the OAuth Proxy plugin allows an attacker to sign in as another user if certain conditions are met. The issue arises when the OAuth Proxy plugin shares the same secret as the global Better Auth secret, sign-in state is stored in a cookie, and implicit account linking is enabled. An attacker who knows a user's verified email can impersonate that user without needing provider sign-in or victim interaction. The flaw is fixed in version 1.7.7.
A critical vulnerability in better-auth versions from 1.4.0-beta.18 up to but not including 1.7.7 allows an unauthenticated attacker to use the OAuth state value as a Magic Link token to sign in as any user by knowing only their email address. This bypasses email verification and OAuth provider authentication, granting full session access. The flaw affects configurations using Magic Link with default or hashed token storage combined with social or Generic OAuth sign-in and database-backed OAuth state storage. The issue is fixed in version 1.7.7.
Nodemailer versions from 3.0.0 up to but not including 10.0.13 contain a vulnerability in the SMTP client where certain regular expressions used to detect SMTP AUTH mechanisms cause quadratic backtracking. This leads to a denial of service by blocking the Node.js event loop during the EHLO response parsing if the server returns a crafted response with long whitespace runs and no matching mechanism. The vulnerability can be triggered pre-authentication by an attacker controlling or influencing the SMTP server or man-in-the-middling the connection before STARTTLS. A fix is available in Nodemailer version 10.0.13.
Nodemailer has a vulnerability in its address parser where RFC 5322 comments inside angle-bracket email addresses are not stripped. This causes the comment text and parentheses to be included verbatim in the parsed address, leading to malformed SMTP commands that are rejected by mail servers. The issue affects versions from 3.0.0 up to but not including 10.0.13 and is distinct from previously patched comment handling bugs. A fix is available in version 10.0.13.
Nodemailer SMTP client versions from 3.0.0 up to but not including 10.0.10 contain a vulnerability in the SMTP response parser that allows a malicious or compromised SMTP server to cause a denial of service by sending a large number of continuation lines without a completion line. This triggers quadratic CPU usage in the Node.js event loop, freezing the entire process before authentication occurs. The vulnerability is fixed in version 10.0.10.
A vulnerability in the better-auth deviceAuthorization() plugin versions from 1.3.8-beta.3 up to, but not including, 1.7.0-rc.3 allows an attacker to trick a signed-in user into approving a device login request without showing the requesting client or requested permissions. This can lead to the attacker obtaining a live session token for the user. The issue is fixed starting with version 1.7.0-rc.3.
Satori versions from 0.0.27 up to but not including 0.33.5 improperly escape certain values in generated SVG output, allowing crafted input to be interpreted as SVG markup. This vulnerability can lead to unintended SVG rendering depending on how the SVG is consumed. A fix is available in version 0.33.5. No complete workaround exists other than upgrading; applications that cannot upgrade immediately should avoid rendering attacker-controlled content with Satori.
CVE-2026-103288 is an authorization bypass vulnerability in the Ghost blogging platform's comment like feature. It allows authenticated members to delete comment likes or dislikes they are not authorized to remove. This issue affects Ghost versions from 5.9.0 up to but not including 6.44.1. The vulnerability is fixed in version 6.44.1.
dcmjs, a JavaScript library for DICOM manipulation used in web-based medical imaging viewers, contains an input validation bypass in its handling of DS (Decimal String) and IS (Integer String) value representations. The vulnerability allows malformed input strings to bypass sanitization and produce JavaScript Infinity or NaN values, or accept scientific notation in integer fields, violating DICOM standards. This can corrupt spatial geometry, image display, radiation dose calculations, and other clinical data in downstream applications. The issue is fixed in dcmjs version 0.52.0.
The npm package '@azure-growth/signup-ux-components' version 1.2.2 has been identified as malicious by the OpenSSF Package Analysis project. The package is flagged because it communicates with a domain linked to malicious activity. There is no CVSS score or detailed technical impact provided. No known exploits in the wild have been reported.
The npm package @camera.ui/camera-ui-nvr-windows-amd64 version 1.6.1 contains malicious code that can fully compromise any computer on which it is installed or running. This compromise includes potential unauthorized access to all secrets and keys stored on the affected system. Removal of the package does not guarantee elimination of all malicious software introduced by it.
The npm package ctf-agent version 0.1.0 is identified as malicious. Although detailed static analysis found no direct evidence of credential theft, remote code execution, or backdoors, the package is considered fully compromising any system on which it is installed. Systems with this package should be treated as fully compromised, and all stored secrets and keys must be rotated from a clean environment. Removal of the package alone does not guarantee eradication of all malicious components.
The npm package csvflow-schema version 1.0.0 was found to contain malicious code in its postinstall script. This script collects local system information, writes it to a temporary file, launches the Windows calculator application, and sends an HTTPS request to a hardcoded external domain with a unique install identifier. The package was removed from npm shortly after publication.
The npm package @iobandamwer/native-helper is a malicious package that acts as a temporary placeholder stub but includes an active install-time dropper. It installs a native addon that decodes and executes an opaque payload outside the npm install process. The payload execution is gated to avoid CI environments, containers, and analysis sandboxes. Installing this package on a developer machine results in attacker-controlled code running detached from the installation process, potentially compromising the entire system.
The npm package 'path-stream-utils-testmetest' is a malicious package that includes a native addon executing an opaque payload during installation and runtime. It drops and executes a hidden file in /tmp, evades sandbox and CI environments by detecting various environment indicators, and runs encrypted code not inspectable from the package contents. Installation or use of this package compromises the host system, potentially granting full control to an attacker.
The npm package '@iobandamwer/cache-helper' is a malicious package masquerading as a cache utility. It contains no source code but includes prebuilt native binaries that execute a hidden payload during installation. This payload writes an opaque file to a temporary location, makes it executable, and runs it detached from the install process. The package includes extensive evasion techniques to detect CI environments, sandboxes, debuggers, and containerized environments, indicating it is designed to avoid analysis. Any system with this package installed should be considered fully compromised, and all secrets on that system should be rotated immediately.
The postcss-semantic-themes npm package contains malicious code that executes obfuscated JavaScript modules and includes native binaries performing extensive environment fingerprinting to evade analysis. It masquerades as a CSS theming kit but instead acts as a staged supply-chain malware payload, including brandjacking of the legitimate tailwindcss package name. Installation of this package compromises the host system, potentially exposing all stored secrets and keys.
The npm package harlow-css-mixer version 0.0.0-stage is identified as malicious software. Installation or execution of this package may lead to a full compromise of the affected computer. It does not contain installer secrets or network fetches, but its presence indicates potential unauthorized control. Immediate removal and secret/key rotation are advised to mitigate risks.
The @worca/app npm package versions 1.14.0-rc.2 and 1.14.0-rc.4 contain malicious code that can fully compromise any computer on which it is installed or running. The package includes components resembling an egress-control proxy, telemetry channels, and local bridge/UI, with suspicious token co-occurrences detected in multiple core files. Removal of the package alone does not guarantee elimination of all malicious software, and all secrets and keys on the affected machine should be rotated immediately from a separate, trusted device.