Bjohansebas

compression is a Node.js and Express compression middleware. In versions before 1.8.2, when a client aborts the connection while a compressed response is still being sent, the zlib stream created to compress that response is never destroyed, so each aborted compressed response leaks its native zlib memory. A remote unauthenticated attacker can repeatedly open requests and disconnect early, exhausting the available memory and crashing the server. All applications using compression are affected. The issue is fixed in compression 1.8.2, and users should upgrade to 1.8.2 or later.

hbs is an Express view engine wrapper for Handlebars. Version 4.3.0 can crash the Node.js process during output escaping when an async helper, registered with registerAsyncHelper, resolves to an object whose toHTML property is truthy but not callable. Handlebars escapeExpression calls the toHTML method on any value that has a truthy toHTML, so such a value throws a TypeError, and because the async substitution runs on a later tick outside the render function's try/catch, the throw is an uncaught exception that terminates the process without sending a response. Only version 4.3.0 is affected, since the throwing escape was introduced by the fix for CVE-2026-16231 and earlier versions do not escape async helper values. It can be triggered remotely when an async helper resolves to an externally influenced object such as parsed JSON. The issue is fixed in hbs 4.3.1, and users should upgrade to hbs 4.3.1 or later.

**Name of the Vulnerable Software and Affected Versions** morgan versions prior to 1.12.0 **Description** An issue exists in the internal helper used to escape log token values. The software fails to neutralize Unicode line separator characters U+0085 (Next Line), U+2028 (Line Separator), and U+2029 (Paragraph Separator). An unauthenticated remote client can inject these characters into an attacker-controlled log token, such as a Basic auth username processed via the `remote-user` token. This allows for log forging, where Unicode-aware downstream log processing systems split a single request log into multiple logical records. **Recommendations** Upgrade to version 1.12.0.

**Name of the Vulnerable Software and Affected Versions** multer versions prior to 2.3.0 **Description** A race condition exists in the file stream handling when an application utilizes an asynchronous `fileFilter` in conjunction with the `fileSize` limit. This allows files that exceed the configured size limit to bypass the limit rejection. The impact is limited as the underlying multipart parser still truncates the stream at the size limit, meaning the issue is a bypass of the rejection mechanism rather than uncontrolled resource consumption. **Recommendations** Update to version 2.3.0.

**Name of the Vulnerable Software and Affected Versions** multer versions prior to 2.3.0 **Description** When using the disk storage engine for handling multipart/form-data, the software fails to close the underlying write file descriptor if an upload is aborted or truncated before the write stream finishes. Although the visible file is removed, the open descriptor remains, causing a leak of file descriptors and disk blocks. A remote attacker can exploit this by sending repeated aborted or malformed multipart uploads to an upload route, potentially exhausting system resources and leading to a denial of service. **Recommendations** Upgrade to version 2.3.0.

**Name of the Vulnerable Software and Affected Versions** hbs versions 2.1.0 through 4.2.1 **Description** The `registerAsyncHelper` API in the hbs Express view engine bypasses the automatic HTML escaping of Handlebars. During the first render pass, an async helper returns an opaque placeholder that is escaped; however, hbs subsequently replaces this placeholder with the raw callback return value without escaping it. This occurs across cached, uncached, and layout render paths. If an application passes attacker-influenced data, such as user-supplied content from a database, into an async helper callback, it can lead to stored or reflected cross-site scripting (XSS), where arbitrary HTML and JavaScript are injected into the server-rendered page. **Recommendations** Upgrade to version 4.3.0.

**Name of the Vulnerable Software and Affected Versions** body-parser versions prior to 1.20.6 body-parser versions prior to 2.3.0 **Description** When the parser is configured with an invalid `limit` option value, such as an unparseable string or NaN (Not-a-Number), the request body size check is silently skipped. This occurs because the internal parsing mechanism returns null, causing applications that rely on the `limit` parameter as their primary safeguard to accept arbitrarily large payloads. This can lead to excessive memory and CPU consumption, resulting in a denial of service. **Recommendations** Update body-parser to version 1.20.6 or later. Update body-parser to version 2.3.0 or later. Validate the `limit` value before passing it to the parser by ensuring the value is not null or a non-finite number at startup.

**Name of the Vulnerable Software and Affected Versions** webpack-dev-server versions prior to 5.2.6 **Description** An unauthenticated peer can cause the Node.js process to terminate, resulting in a denial of service. This occurs when the server receives a normal HTTP request with a malformed Host header or a WebSocket upgrade request to the `/ws` endpoint with a malformed Origin header. The malformed values trigger an uncaught exception in the host-validation path, crashing the development server. The impact is limited to the availability of the server, with no risk of code execution or data disclosure. **Recommendations** Upgrade to webpack-dev-server version 5.2.6. Keep the development server bound to localhost and avoid exposing it to untrusted networks.

**Name of the Vulnerable Software and Affected Versions** webpack-dev-server versions prior to 5.2.6 **Description** Internal developer endpoints '/webpack-dev-server/open-editor' and '/webpack-dev-server/invalidate' perform state-changing actions on GET requests without verifying the request origin. This allows any website visited by a developer to trigger these endpoints cross-origin. An attacker can open arbitrary local files in the developer's editor, including those outside the project root. Additionally, repeated requests can spawn multiple editor processes and force recompilations, leading to system performance degradation. **Recommendations** Upgrade to webpack-dev-server 5.2.6.

**Name of the Vulnerable Software and Affected Versions** multer versions 2.0.0-alpha.1 through 2.1.1 multer version 3.0.0-alpha.1 **Description** A Denial of Service issue exists when using diskStorage. Aborted or malformed multipart uploads leave orphaned partial files on disk because the `Readable.pipe()` call does not propagate the stream destroy signal to the underlying `fs.WriteStream`. This allows an attacker to exhaust disk space by triggering numerous aborted uploads. **Recommendations** Upgrade to version 2.2.0 for versions 2.0.0-alpha.1 through 2.1.1. Upgrade to version 3.0.0-alpha.2 for version 3.0.0-alpha.1.

**Name of the Vulnerable Software and Affected Versions** webpack-dev-server versions prior to 5.2.5 **Description** A permissive user-configured proxy with a broad context (e.g., '/') and `ws: true` intercepts the development server's own Hot Module Replacement (HMR) WebSocket and forwards it to the proxy target. This results in the leakage of the browser's cookies and Origin header to the backend and bypasses the development server's Host/Origin validation. Additionally, this causes corruption of the HMR socket as both the HMR and the proxy attempt to write to the same socket. **Recommendations** Update to version 5.2.5. Scope user-defined proxy context to specific paths instead of '/'. Omit `ws: true` from the proxy entry when WebSocket forwarding is not required.