A vulnerability in @sveltejs/adapter-node causes the server to crash when proxying certain requests via fetch due to attempts to add headers to immutable requests. This results in a denial of service for other requests handled by the server. The issue affects versions >=5.5.7 <5.5.8 and >=6.0.0-next.0 <6.0.1 and has been fixed in versions 5.5.8 and 6.0.1.
CVE-2026-128130 is a vulnerability in aiohttp, an asynchronous HTTP client/server framework for Python. Versions prior to 3.14.4 that run without the standard C-extension wheel or use AIOHTTP_NO_EXTENSIONS are affected. The issue arises when the pipelined request queue is full, causing the pure-Python parser to store unparsed data and return it to the caller. This leads to repeated processing of already-handled requests and excessive memory consumption. The vulnerability is fixed in version 3.14.4.
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, aiohttp buffers all additional connection data received while a request marked for upgrade, such as a WebSocket handshake, is being handled, without a size limit or flow control. A remote attacker can stream data behind an upgrade request to a handler that does not immediately accept or reject the upgrade and cause unbounded memory consumption. This issue is fixed in version 3.14.4.
CVE-2026-128128 is a vulnerability in aiohttp versions prior to 3.14.4 where the C WebSocket reader uses signed 64-bit arithmetic to add a declared frame length to an already buffered partial message size. This can cause an integer overflow near 2^63, bypassing the max_msg_size check and allowing a remote attacker to cause unbounded memory consumption by sending a small non-final fragment followed by an oversized message. The Python WebSocket reader is not affected. The issue is fixed in version 3.14.4.
Tornado versions prior to 6.6.1 contain an open redirect vulnerability due to inconsistent URL parsing between browsers and Python's urllib. This discrepancy allows URLs starting with three or more slashes to bypass the redirect protections fixed in version 6.6.0. The issue is addressed in Tornado 6.6.1, which improves detection and fixes a regression from the previous fix.
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (210090ccc9100e6c597aad39d11e410acef8a071607f39e03f2390a241d72993)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (96eae7b1c28054524f2c4203894a47a04560e1a0ed000f06c24fe462cd23b5fa)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (2ccd8066def4bcb091eb9569a4da819bf85fcdb79b84f13c1929631fdf3f8023)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (21b5a62ef01982e9a14c53b8bbb9546ebc6ef818d142da7e30e97274ac83550a)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (108fc9272e868dae6abff63ffb7cc2373390c562c4c5df9069003a25a2254b5b)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (282cbb4cab1a7f68eed71dd584afc39ce791fd2aef341bfd79d7bb92f0a2cd90)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (872e778044849ea3872b104b58aa9c33a9ec5019bf9f769772d4697ba65f1724)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
CVE-2026-128127 is a high-severity vulnerability in aiohttp prior to version 3.14.4. The issue occurs in BodyPartReader.read_chunk() when processing multipart parts with Content-Transfer-Encoding set to base64. The function reads until the chunk length is a multiple of four without enforcing a byte limit, which can lead to uncontrolled resource consumption. This allows a remote attacker to send specially crafted multipart requests that bypass client_max_size limits, potentially causing excessive memory use or event loop spinning. The vulnerability is fixed in aiohttp version 3.14.4.
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (3a4ee39eff835f7cc1076b7bffce75879bcba742f48d8e6f941e3cfcae252233)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (bc24e55ce3f7c51fa65863c9d85d3c0b63361177e80250ac895d2355c490890a)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (fcf1c7f28acc3f67c97b82c6013eedb1f467915be41ce7a223dc22779fd01da0)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (09e403ff2121bd2b46b023a1a65d27b32241caa372c0d6dc7f0313e356f154fb)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (98fd35974611aaad11696c4c491aba6b860b92dc9d6a5a9b52f0a79077fc369d)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (22064b1999e6db826fe8d7f648961bb976cba63aef7a5a5a72203e481f04bb7a)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (b40dab9570ad2ffb35e3912732070ae5753e23756d48100db9d013180a47a186)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.