tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server calls JSON.parse outside a request-local error boundary in the POST /mcp handler in integrations/mcp-server/src/index.ts. A single unauthenticated malformed JSON body raises a SyntaxError that terminates the Node.js process, leaving the MCP service unavailable until an external supervisor restarts it. This issue is fixed in version 4.3.1.
fastify is a web framework for Node.js. In versions 5.8.0 through 5.12.7, when the server is configured with a nonzero handlerTimeout and a route returns a streaming response, a request whose stream has already sent its headers but stays open past the timeout crashes the server. When the timeout fires, Fastify tries to send a new error response on a response that has already started, raising an uncaught ERR_HTTP_HEADERS_SENT that terminates the Node.js process and interrupts any other in-flight requests. An unauthenticated remote client can trigger this with a single request to an affected streaming endpoint, so the impact is availability only, and exploitation requires the non-default handlerTimeout to be set. The default handlerTimeout of 0 is not affected. The issue is fixed in fastify 5.12.8, and users should upgrade to 5.12.8 or later. As a workaround, set handlerTimeout to 0, which disables the affected timeout path.
@fastify/cors is the CORS plugin for the Fastify web framework. In versions 8.2.0 through 11.3.x, an application that registers the plugin with the non-default onSend hook option crashes on a CORS preflight. On an OPTIONS request that carries the Origin and Access-Control-Request-Method headers, the plugin calls reply.send from inside the onSend hook and re-enters the send pipeline, so a second write of the response headers throws an uncaught ERR_HTTP_HEADERS_SENT that can terminate the Node.js process when no process-level handler is installed. An unauthenticated remote client can trigger this with a single preflight request, so the impact is availability only, and exploitation requires the non-default onSend configuration. The issue is fixed in @fastify/cors 11.4.0, where onSend is no longer an accepted hook value and registration fails with a clear error instead of crashing at request time, and users should upgrade to 11.4.0 or later. As a workaround, use any other hook such as the default onRequest, or set preflight to false.
Aedes is an MQTT broker that can run on any stream server. Prior to 1.1.1, the MQTT broker does not bound topic depth or structural complexity before passing topics through `mqemitter` into `qlobber`. A `PUBLISH`, `SUBSCRIBE`, or registered `Will` message containing an excessively deep topic can reach `qlobber._split_words` in `lib/qlobber.js` and trigger an uncaught `too many words` exception. Calls from `handlers/subscribe.js` and the publishing logic are not protected against that exception, so it escapes to the `Node.js event loop` and terminates the entire broker. The `Will` path is independently reachable when a client disconnects ungracefully: it calls `broker.publish` directly and bypasses the `PUBLISH` handler. An attacker must be able to establish an `MQTT session`, authenticated or unauthenticated according to broker configuration. A successful attack disconnects all legitimate clients and prevents reconnection until the broker process restarts. This issue is fixed in version 1.1.1.
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection(), fragmented handshake message, interleaved record to process the relevant input or security decision. node-forge continued processing after a TLS record of another content type interrupted a fragmented handshake message. A remote peer could trigger an uncaught TypeError in process(), causing the connection or hosting process to fail. This issue is fixed in version 1.4.1.
A NULL pointer dereference vulnerability in WatchGuard Fireware OS’s management interface allows a remote, unauthenticated attacker with network access to the management interface to crash the management service by sending a specially crafted login request. Repeated exploitation terminates all active administrator sessions and in-progress management operations and can prevent management of the device. Traffic processing is not affected.
A vulnerability in DataDog's dd-trace-py Python APM client versions 3.13.0 through 4.15.4 allows an unhandled exception to occur during IAST string-processing instrumentation when old-style % string formatting processes attacker-controlled input. This can cause the Python process to terminate unexpectedly. Exploitation requires IAST to be enabled, which is not the default setting, and the application to apply the vulnerable formatting to attacker-controlled data. The issue is fixed in version 4.15.5.
CVE-2026-89090 is a denial of service vulnerability in the event stream header decoder of AWS SDK for Go v2 versions prior to 2026-03-23. An unauthenticated remote actor can send a crafted event stream response frame with an invalid header value type, causing the application process to panic and terminate. The issue is fixed in version 2026-03-23 and later.
CVE-2026-115892 is a type confusion vulnerability in the Wasmtime runtime for WebAssembly. It affects versions from 46.0.0 up to but not including 48.0.7, and from 49.0.0 up to but not including 49.0.4. The flaw occurs when lowering a host-created component-model stream or future into a guest, omitting a required payload-type check after the value passes through guest code. A malicious guest controlling exported function types or returned values can cause the host to pass a type-erased value to a guest expecting a different payload type, resulting in a panic in the Wasmtime host. The issue is fixed in versions 48.0.7 and 49.0.4.
CVE-2026-89318 is a vulnerability in Eclipse KeyPont - GOSE where the decryption function passes a JSON Web Encryption (JWE) initialization vector (IV) to the cipher without validating its length. The Go standard library panics if the GCM nonce length is incorrect, causing the decrypting goroutine to crash. This affects versions from 0.8.0 up to 0.13.0-rc1 and from 0 up to 1.0.0-rc4. The issue is fixed in version 1.0.0-rc4.
CVE-2026-89316 is a vulnerability in Eclipse Foundation's Eclipse KeyPont - GOSE where the function LoadPublicKey performs an unchecked type assertion on an EC key's curve. This can cause a panic when a JSON Web Key (JWK) declares a key type of EC but uses a non-EC algorithm, which is allowed by RFC 7517 §4.4. The issue affects versions from 0.7.3 up to 1.0.0-rc4. A fix is available starting with version 1.0.0-rc4.
CVE-2026-89315 is a vulnerability in Eclipse Foundation's Eclipse KeyPont - GOSE where the JwtClaims.MarshalJSON function dynamically creates Go structs using reflect.StructOf. This function panics if a field name is not a valid Go identifier or if there are duplicate field names, conditions that can occur with typical JWT claim names. The issue affects versions from 0 up to 1.0.0-rc4, with a fix available starting from version 1.0.0-rc4. The vulnerability has a CVSS score of 6.9, indicating a medium severity level.
CVE-2026-89312 is a vulnerability in Eclipse Foundation's Eclipse KeyPont - GOSE where the function AesGcmCryptor.Open does not validate the length of a caller-supplied nonce before passing it to cipher.AEAD.Open. The Go standard library panics if the GCM nonce length is incorrect, causing the decrypting goroutine to crash when processing a JWE with a wrong-sized IV. This affects certain versions prior to 1.0.0-rc4.
A vulnerability in body-parser middleware for Node.js and Express allows a specially crafted request with compressed content to cause an uncaught exception, crashing the application process. This affects versions before 1.20.9 and from 2.0.0 up to but not including 2.4.0. The issue arises because trailing bytes after a valid compressed frame cause an error in the decompression stream that is not caught, leading to process termination. The vulnerability is fixed in versions 1.20.9 and 2.4.0. Users should upgrade or disable request-body inflation as a workaround.
A vulnerability in multer versions 2.0.0 through before 2.5.0 allows a Node.js process to crash when using an asynchronous fileFilter. If a request is aborted while the asynchronous fileFilter is pending, an unhandled error event occurs due to a resumed parsing stream without an error listener, causing the process to exit. This issue is fixed in multer 2.5.0.
Apache bRPC versions prior to 1.18.0, when built with the WITH_THRIFT option enabled, contain a vulnerability where a malformed T_EXCEPTION reply from a server can cause the client to throw uncaught exceptions. These exceptions cause the client process to terminate abruptly, affecting all ongoing RPC calls. This issue is fixed in version 1.18.0.
A vulnerability in Gitea versions up to 28.1.0 causes an uncaught exception when requesting the repositories page for an individual user instead of an organization. This triggers a nil pointer dereference leading to a server panic and HTTP 500 error. The issue requires no authentication and can be triggered by any user. The fix changes the response to return a 404 error for individual users, preventing the panic.
CVE-2026-42270 is a vulnerability in countly-server, the server-side component of the Countly analytics platform. Prior to versions 24.05.50 and 25.03.44, certain public image and screenshot routes use local filesystem storage and call getStream to pipe filesystem streams to HTTP responses without an error listener. An unauthenticated request with a URL-encoded dot can cause createReadStream to open a directory, triggering an asynchronous EISDIR error that is unhandled, leading to termination of the Node.js process. This results in denial of service by making the analytics API unavailable. The issue affects routes such as star-rating/images/, dashboards/images/screenshots/, /appimages/*, /memberimages/*, and */screenshots/*. The vulnerability is fixed in versions 24.05.50 and 25.03.44.
CVE-2026-103936 is a high-severity vulnerability in the JavaScript libp2p networking stack prior to version 6.0.28. The issue arises in the @libp2p/webrtc webRTCDirect() Node.js listener, which processes unauthenticated STUN Binding Requests before completing peer authentication and connection setup. A crafted short ICE password derived from the STUN request causes an uncaught native invalid_argument exception in node-datachannel or libdatachannel, leading to process termination (SIGABRT). This denial of service vulnerability does not affect confidentiality, integrity, or allow code execution. The issue is fixed in libp2p version 6.0.28.