A denial of service vulnerability exists in the joi library's string email validation when using the multiple option. The email validation splits input strings using a regular expression that performs in quadratic time on long runs of whitespace, causing the Node.js event loop to block for several seconds with large whitespace inputs. This affects joi versions from 16.0.0 through 17.13.8 and 18.0.0 through 18.3.0. The issue is fixed in joi versions 17.13.9 and 18.3.1.
A denial of service vulnerability exists in @hapi/content versions prior to 6.0.3 due to quadratic-time parsing of Content-Disposition parameters. An unauthenticated attacker can send a multipart/form-data request with a long token lacking an '=' character, causing the Node.js event loop to block for several seconds to minutes. This affects hapi servers with multipart payload routes and applications using Content.disposition() on untrusted headers. The issue is fixed in version 6.0.3.
minimatch versions prior to 11.0.1 contain a denial of service vulnerability caused by an attacker-controlled pattern amplification during glob pattern preprocessing. This leads to exponential growth in internal data structures and quadratic processing time, resulting in excessive CPU and memory consumption. The issue is fixed in version 11.0.1.
A vulnerability in glob versions 9.0.0 through 14.0.1 allows asynchronous directory traversal operations to continue consuming CPU and filesystem I/O after an abort signal or timeout has been triggered. This occurs because abort branches in the code call callbacks without returning, causing continued recursive directory reads even after cancellation. The issue impacts availability by allowing excessive resource consumption, potentially degrading service performance. The flaw is fixed in glob version 14.0.2.
Authlib's implementation examples for the RFC 7592 dynamic client registration management protocol omit a critical security check that binds the registration_access_token to the specific client being accessed. This omission allows an attacker possessing any valid registration_access_token and a target client_id to bypass authorization controls and read, update, or delete other clients' registrations. The vulnerability affects Authlib versions from 0.15 up to but not including 1.9.1 and is fixed in version 1.9.1.
A vulnerability in pypdf versions prior to 6.21.3 can cause long runtimes when retrieving page labels from a crafted PDF file. This issue has been fixed in version 6.21.3. Users unable to upgrade immediately can apply the changes from the referenced pull request as a workaround.
A vulnerability in pypdf prior to version 6.21.3 allows an attacker to craft a malicious PDF that triggers large memory usage when loading an invalid dictionary in strict mode. This can lead to denial of service due to resource exhaustion. The issue has been fixed in pypdf version 6.21.3.
CVE-2026-119208 is a vulnerability in pypdf versions prior to 6.21.3 where an attacker can craft an encrypted PDF file with a manipulated /Count value. Accessing the page count of such a PDF can cause excessive runtimes and large memory usage. This issue has been fixed in pypdf version 6.21.3.
A vulnerability in pypdf prior to version 6.21.3 allows an attacker to craft a PDF file with cross-reference streams that causes large memory usage when parsed. This issue has been fixed in pypdf version 6.21.3. Users unable to upgrade immediately can apply the changes from the referenced pull request as a workaround.
pyasn1 versions up to 0.6.4 have a vulnerability in decoding constructed BIT STRING values where CPU consumption grows quadratically with input size. This occurs because the decoder repeatedly shifts and copies accumulated data for each fragment, leading to potential CPU exhaustion and denial of service when processing attacker-controlled ASN.1 data. The issue affects BER and CER decoders and certain schema-driven DER decoding paths. The vulnerability is fixed in version 0.6.5.
pyasn1 versions 0.6.4 and earlier contain a denial of service vulnerability due to quadratic time complexity in decoding binary-encoded ASN.1 REAL values with large mantissas. This issue affects BER, CER, and DER decoders that use the vulnerable RealPayloadDecoder. An attacker supplying crafted ASN.1 data with large REAL mantissas can cause excessive CPU consumption during decoding. The vulnerability is fixed in pyasn1 version 0.6.5.
pyasn1 versions 0.6.4 and earlier contain a denial of service vulnerability due to quadratic-time processing when decoding constructed OCTET STRINGs, constructed character strings, and indefinite-length ANY types. This occurs because the decoder repeatedly concatenates fragments in a way that causes CPU time to grow quadratically with the number of fragments. An attacker supplying crafted ASN.1 input to an affected decoder can cause CPU exhaustion. The issue affects BER and CER decoding paths and certain non-DER constructed strings accepted by the DER decoder with specific schema. No confidentiality or integrity impact is reported.
pyasn1 versions from 0.3.3 up to but not including 0.6.5 have a vulnerability causing quadratic CPU usage when decoding attacker-controlled BER, CER, or DER data without an ASN.1 schema. This occurs due to inefficient handling of tag sets during schemaless decoding, allowing crafted inputs with many distinct long tag IDs to exhaust CPU resources and degrade service availability. No confidentiality or integrity impacts are reported. The issue is fixed in version 0.6.5.
The node-forge library's function asn1.oidToDer() improperly encoded Object Identifier (OID) strings with out-of-range first arcs, causing them to be encoded as different, trusted OIDs. This flaw was an incomplete fix of a previous vulnerability and affected versions prior to 1.4.1. The issue was fixed in version 1.4.1 by rejecting out-of-range first arcs and correctly encoding the first subidentifier. The vulnerability allows an attacker to cause applications that accept untrusted OID strings and encode them with node-forge to emit a different OID than intended, potentially bypassing string-based OID checks. There is no impact on confidentiality or availability, and DER parsing is unaffected.
A prototype pollution vulnerability exists in the forge.http client of node-forge before version 1.4.1. The client improperly stores cookies from Set-Cookie headers in a plain object keyed by cookie name and path, allowing a malicious server to use cookie names like '__proto__' or 'constructor' to modify Object.prototype or Object. This can lead to adding or deleting properties on Object.prototype, potentially altering application logic or breaking functionality. The issue is fixed in node-forge 1.4.1 by ignoring such dangerous cookie names and paths.
A vulnerability in the node-forge TLS client causes a crash when the server sends no certificate during the TLS handshake. The client incorrectly checks for the server certificate, leading to a TypeError exception that terminates the Node.js process using the client. This issue is fixed in node-forge version 1.4.1.
A Regular Expression Denial of Service (ReDoS) vulnerability exists in node-forge's pem.decode() function prior to version 1.4.1. The vulnerability arises from inefficient regular expressions used to parse PEM-encoded data, causing the Node.js event loop to block for seconds to minutes when processing crafted inputs. This affects any application that parses untrusted PEM text using node-forge, such as services handling uploaded certificates or keys. The issue is fixed in node-forge version 1.4.1.
node-forge versions prior to 1.4.1 contain a denial of service vulnerability in the BigInteger.modInverse() function due to an infinite loop triggered by negative input values. This occurs when a negative value or modulus is passed, causing the function to spin indefinitely at 100% CPU and block the Node.js event loop. The issue is an incomplete fix of a previous vulnerability and affects RSA key generation when using negative public exponents. The vulnerability does not affect key parsing or standard usage with typical exponents like 65537. It was fixed in node-forge 1.4.1 by returning zero for zero or negative inputs.
A vulnerability in node-forge versions prior to 1.4.1 causes the CA store to lose trusted CA certificates with duplicate subject names during certificate chain verification. When verifying a chain, the function removes certificates from the CA store's internal list, leading to persistent denial of service for subsequent verifications involving those certificates. This affects applications that reuse a CA store containing multiple certificates sharing the same subject name. The issue is fixed in node-forge 1.4.1.
A vulnerability in node-forge's AES-GCM implementation allows authentication bypass when the tagLength option passed to the cipher start() method is zero or converts to zero. This causes the authentication tag to be empty, making decipher.finish() return true for any ciphertext and additional data if the supplied tag is empty or missing. The issue is fixed in node-forge version 1.4.1 by validating the tagLength against allowed NIST values.