{ "site": "https://pwn.watch", "generatedAt": "2026-10-22T16:23:59.585Z", "tag": { "id": "node", "label": "Node.js", "isStack": true, "url": "https://pwn.watch/t/node", "feed": "https://pwn.watch/t/node/feed.xml" }, "counts": { "incidents": 25, "live": 3, "notFullyPatched": 1, "patched": 22 }, "incidents": [ { "slug": "nodejs-october-2026-security-releases", "title": "Node.js October 2026 security releases (Brotli RCE + TLS/DNS highs)", "url": "https://pwn.watch/i/nodejs-october-2026-security-releases", "json": "https://pwn.watch/i/nodejs-october-2026-security-releases.json", "status": "live", "severity": "high", "patchStatus": "patched", "product": "Node.js", "tags": [ "node", "emudhra", "tls", "rce" ], "cveIds": [ "CVE-2026-111497", "CVE-2026-105482", "CVE-2026-105483", "CVE-2026-106069", "CVE-2026-105481", "CVE-2026-106072", "CVE-2026-106074", "CVE-2026-106070", "CVE-2026-106071", "CVE-2026-106073" ], "affectedVersions": [ "22.x, 24.x, 26.x (EOL lines not patched)" ], "fixedVersions": [ "22.23.4", "24.22.1", "26.12.1" ], "startedAt": "2026-10-21", "closedAt": null, "updatedAt": "2026-10-22T11:18:00+02:00", "summary": "On Oct 21 2026 Node.js shipped security updates for 22.x, 24.x and 26.x fixing ten vulnerabilities. The headline issue is CVE-2026-111497, a high-severity Brotli decoder out-of-bounds write that can enable remote code execution when attacker-controlled Brotli data is decoded. The same release also fixes TLS hostname/IP bypasses and DNS NUL truncation, and refreshes the bundled CA store for the eMudhra incident.", "xPost": null }, { "slug": "nextjs-october-2026-rce-security-release", "title": "Next.js out-of-band release fixes two unauthenticated RCEs (SVG image optimization CVE-2026-96889, use cache)", "url": "https://pwn.watch/i/nextjs-october-2026-rce-security-release", "json": "https://pwn.watch/i/nextjs-october-2026-rce-security-release.json", "status": "live", "severity": "critical", "patchStatus": "patched", "product": "Next.js (next on npm), sharp / librsvg", "tags": [ "node", "npm", "nextjs", "vercel", "sharp", "rce" ], "cveIds": [ "CVE-2026-96889" ], "affectedVersions": [ "next >= 10.0.0, <= 15.5.27 (Image Optimization SVG RCE, CVE-2026-96889)", "next >= 16.0.0, <= 16.4.0", "sharp < 0.35.5 (bundles vulnerable librsvg)" ], "fixedVersions": [ "next 15.5.28", "next 16.4.1", "sharp 0.35.5 (librsvg 2.63.2)" ], "startedAt": "2026-10-14", "closedAt": null, "updatedAt": "2026-10-22T18:00:43+02:00", "summary": "On Oct 14 2026 Vercel shipped Next.js 16.4.1 and 15.5.28 with two critical unauthenticated remote code execution fixes held back from the September release: CVE-2026-96889 / GHSA-2464-fhr4-w9xw, a use-after-free in librsvg (via sharp) reachable through the Image Optimization API when SVGs are processed on glibc-based Linux, and GHSA-673q-mjm6-r5xr, RCE in App Router apps with Cache Components when a `use cache` function returns multiple typed arrays. A high-severity Server Actions DoS (GHSA-p3m5-59mp-jv5r) is fixed too. GitHub added the SVG advisory to its global database on Oct 22. No known exploitation.", "xPost": null }, { "slug": "tensorlake-npm-shai-hulud-worm", "title": "tensorlake@0.5.144 npm Shai-Hulud worm with hostage GitHub token", "url": "https://pwn.watch/i/tensorlake-npm-shai-hulud-worm", "json": "https://pwn.watch/i/tensorlake-npm-shai-hulud-worm.json", "status": "live", "severity": "critical", "patchStatus": "partial", "product": "tensorlake (npm)", "tags": [ "node", "npm", "github", "shai-hulud", "supply-chain" ], "cveIds": [ "GHSA-8g63-53c9-65j2" ], "affectedVersions": [ "0.5.144" ], "fixedVersions": [ "0.5.143 (safe pin); remove 0.5.144" ], "startedAt": "2026-10-07", "closedAt": null, "updatedAt": "2026-10-22T18:15:27+02:00", "summary": "On Oct 8 2026, tensorlake@0.5.144 was published from the real GitHub repo (with npm provenance) carrying a preinstall hook that installs a Shai-Hulud-style credential-stealing worm. It harvests npm/GitHub/cloud/SSH/AI-tool secrets, spreads to other packages, and installs a “gh-token-monitor” that wipes the home directory if the stolen GitHub token is revoked. Pin 0.5.143; remove the monitor before rotating tokens.", "xPost": null }, { "slug": "subql-common-npm-backdoor", "title": "SubQuery @subql/common 5.8.3 published with credential stealer + backdoor", "url": "https://pwn.watch/i/subql-common-npm-backdoor", "json": "https://pwn.watch/i/subql-common-npm-backdoor.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "@subql/common (npm) and downstream @subql/* packages", "tags": [ "node", "npm", "github", "supply-chain", "infostealer" ], "cveIds": [ "GHSA-9333-3c4x-x3h5", "MAL-2026-17571" ], "affectedVersions": [ "@subql/common 5.8.3", "@subql/common 5.8.3-onf-rt1 (attacker canary, no payload found; 'redteam' dist-tag still points to it)", "Downstream ranges that resolve to 5.8.3, e.g. @subql/cli 6.6.3, @subql/node-core 19.3.1, @subql/query 2.25.0, @subql/node-ethereum 6.5.0" ], "fixedVersions": [ "@subql/common 5.8.2 (npm 'latest')" ], "startedAt": "2026-10-05T11:56:29Z", "closedAt": "2026-10-10", "updatedAt": "2026-10-22T12:04:00+02:00", "summary": "On Oct 5 2026 @subql/common 5.8.3 was published to npm through SubQuery's own GitHub Actions trusted publisher, after a short-lived branch changed the release step to swap the built package for a tarball downloaded from ci-artifacts.dev. The payload ran on install (postinstall) and on import, stole CI/cloud/GitHub/npm/Kubernetes/Vault/SSH and AI-tool credentials, offered a reverse shell, and with a workflow-scoped token tried to push a secret-dumping workflow. It was live about 50 minutes; 5.8.2 is the safe version. Many @subql packages accept 5.8.3 through their version ranges.", "xPost": null }, { "slug": "shai-hulud-chaindrop-npm-keyv-august", "title": "CHAINDROP / Mini Shai-Hulud npm worm (keyv + 400+ packages)", "url": "https://pwn.watch/i/shai-hulud-chaindrop-npm-keyv-august", "json": "https://pwn.watch/i/shai-hulud-chaindrop-npm-keyv-august.json", "status": "closed", "severity": "critical", "patchStatus": "partial", "product": "npm ecosystem (keyv, cacheable, flat-cache, cache-manager, and 400+ packages)", "tags": [ "node", "npm", "github", "shai-hulud", "supply-chain" ], "cveIds": [], "affectedVersions": [ "Compromised patch versions published ~Aug 4 2026 (see Wiz/JFrog package lists)" ], "fixedVersions": [ "Pin known-good versions; purge caches; npm CLI 12+ disables preinstall by default" ], "startedAt": "2026-08-04", "closedAt": "2026-08-15", "updatedAt": "2026-08-15", "summary": "In early August 2026 a Mini Shai-Hulud / CHAINDROP worm compromised keyv and related cache packages, then self-propagated via stolen npm tokens to 400+ packages (1B+ monthly downloads across the graph). Payload runs via preinstall (disabled by default on npm 12+), steals npm/GitHub/cloud/CI secrets, and republishes backdoored versions. Microsoft, Elastic, JFrog and Wiz published analyses.", "xPost": null }, { "slug": "nx-nx-console-cve-2026-48027", "title": "Nx Nx Console: Nx Console Embedded Malicious Code Vulnerability", "url": "https://pwn.watch/i/nx-nx-console-cve-2026-48027", "json": "https://pwn.watch/i/nx-nx-console-cve-2026-48027.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Nx Nx Console", "tags": [ "node", "devtools", "nx", "supply-chain", "ransomware", "cisa-kev" ], "cveIds": [ "CVE-2026-48027" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-05-27", "closedAt": "2026-05-27", "updatedAt": "2026-05-27", "summary": "Nx Console contains an embedded malicious code vulnerability that allowed a malicious version of Nx Console to be published. The compromised extension fetched an obfuscated payload that could harvested credentials from multiple sources on disk and in memory. Added to CISA KEV on 2026-05-27.", "xPost": null }, { "slug": "tanstack-tanstack-cve-2026-45321", "title": "TanStack TanStack: TanStack Unspecified Vulnerability", "url": "https://pwn.watch/i/tanstack-tanstack-cve-2026-45321", "json": "https://pwn.watch/i/tanstack-tanstack-cve-2026-45321.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "TanStack TanStack", "tags": [ "node", "npm", "tanstack", "ransomware", "cisa-kev" ], "cveIds": [ "CVE-2026-45321" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-05-27", "closedAt": "2026-05-27", "updatedAt": "2026-05-27", "summary": "TanStack contains an unspecified vulnerability that allowed malicious versions of the product to be published to the npm registry to publish credential-stealing malware under a trusted identity. Added to CISA KEV on 2026-05-27.", "xPost": null }, { "slug": "shai-hulud-antv-npm-may", "title": "Mini Shai-Hulud hits AntV / timeago.js npm ecosystem", "url": "https://pwn.watch/i/shai-hulud-antv-npm-may", "json": "https://pwn.watch/i/shai-hulud-antv-npm-may.json", "status": "closed", "severity": "critical", "patchStatus": "partial", "product": "npm @antv/*, timeago.js, related packages under atool", "tags": [ "node", "npm", "github", "shai-hulud", "supply-chain" ], "cveIds": [], "affectedVersions": [ "Malicious versions published during May 2026 campaign window" ], "fixedVersions": [ "Remove malicious versions; rotate CI/cloud secrets; pin clean releases" ], "startedAt": "2026-05-19", "closedAt": "2026-06-01", "updatedAt": "2026-06-01", "summary": "May 2026 wave of Mini Shai-Hulud compromised packages across Alibaba’s AntV visualization ecosystem and timeago.js (via npm account atool). Payload harvested CI secrets from GitHub Actions runner memory and dumped credentials to public GitHub repos. StepSecurity documented the ongoing spread.", "xPost": null }, { "slug": "nextjs-react-may-2026-security-release", "title": "Next.js / React Server Components May 2026 security release", "url": "https://pwn.watch/i/nextjs-react-may-2026-security-release", "json": "https://pwn.watch/i/nextjs-react-may-2026-security-release.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Next.js; react-server-dom-webpack/parcel/turbopack", "tags": [ "node", "nextjs", "react" ], "cveIds": [ "CVE-2026-23870" ], "affectedVersions": [ "Next.js 13.x–16.x App Router (see advisory tables); RSC packages 19.0.0–19.0.5, 19.1.0–19.1.6, 19.2.0–19.2.5" ], "fixedVersions": [ "Next.js 15.5.18", "Next.js 16.2.6", "react-server-dom-* 19.0.6 / 19.1.7 / 19.2.6" ], "startedAt": "2026-05-06", "closedAt": "2026-05-07", "updatedAt": "2026-05-08", "summary": "Coordinated May 6–7 2026 security release for React Server Components (CVE-2026-23870 DoS) and multiple Next.js advisories spanning middleware/proxy bypass, XSS, SSRF, cache poisoning and DoS. Upgrade Next.js to 15.5.18 or 16.2.6; react-server-dom-* to 19.0.6 / 19.1.7 / 19.2.6. Next.js 13.x/14.x had no planned patches.", "xPost": null }, { "slug": "openai-employee-devices-tanstack-shai-hulud", "title": "OpenAI employee devices hit via TanStack Mini Shai-Hulud wave", "url": "https://pwn.watch/i/openai-employee-devices-tanstack-shai-hulud", "json": "https://pwn.watch/i/openai-employee-devices-tanstack-shai-hulud.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "TanStack-related npm packages / OpenAI employee endpoints", "tags": [ "node", "npm", "openai", "tanstack", "shai-hulud", "supply-chain", "data-breach" ], "cveIds": [], "affectedVersions": [ "Compromised TanStack package versions in the May wave" ], "fixedVersions": [], "startedAt": "2026-05-01", "closedAt": "2026-05-31", "updatedAt": "2026-05-31", "summary": "In May 2026 OpenAI confirmed two employee devices were breached as part of the broader TanStack Mini Shai-Hulud npm supply-chain campaign. OpenAI said customer data, production systems, IP and deployed software were not impacted.", "xPost": null }, { "slug": "react-rsc-dos-cve-2026-23869-april", "title": "React Server Components DoS CVE-2026-23869 (April Next.js advisory)", "url": "https://pwn.watch/i/react-rsc-dos-cve-2026-23869-april", "json": "https://pwn.watch/i/react-rsc-dos-cve-2026-23869-april.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Next.js App Router / React Server Components", "tags": [ "node", "nextjs", "react" ], "cveIds": [ "CVE-2026-23869" ], "affectedVersions": [ "Next.js >=13.0.0 <15.5.15 and >=16.0 <16.2.3" ], "fixedVersions": [ "15.5.15", "16.2.3" ], "startedAt": "2026-04-08", "closedAt": "2026-04-08", "updatedAt": "2026-04-08", "summary": "April 8 2026 Next.js advisory GHSA-q4gf-8mx6-v5v3 tracks upstream CVE-2026-23869: crafted requests to App Router Server Function endpoints can cause excessive CPU / DoS. Patched in Next.js 15.5.15 and 16.2.3.", "xPost": null }, { "slug": "react-native-community-cli-cve-2025-11953", "title": "React Native Community CLI: React Native Community CLI OS Command Injection Vulnerability", "url": "https://pwn.watch/i/react-native-community-cli-cve-2025-11953", "json": "https://pwn.watch/i/react-native-community-cli-cve-2025-11953.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "React Native Community CLI", "tags": [ "node", "windows", "react-native", "cisa-kev", "rce" ], "cveIds": [ "CVE-2025-11953" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-02-05", "closedAt": "2026-02-05", "updatedAt": "2026-02-05", "summary": "React Native Community CLI contains an OS command injection vulnerability which could allow unauthenticated network attackers to send POST requests to the Metro Development Server and run arbitrary executables via a vulnerable endpoint exposed by the server. On Windows, attackers can also execute arbitrary shell commands with fully controlled arguments. Added to CISA KEV on 2026-02-05.", "xPost": null }, { "slug": "react2shell-react-server-components-cve-2025-55182", "title": "React2Shell: CVSS 10 unauthenticated RCE in React Server Components and Next.js", "url": "https://pwn.watch/i/react2shell-react-server-components-cve-2025-55182", "json": "https://pwn.watch/i/react2shell-react-server-components-cve-2025-55182.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "React Server Components (react-server-dom-*), Next.js", "tags": [ "node", "react2shell", "react", "nextjs", "vercel", "rce", "zero-day", "cisa-kev", "ransomware" ], "cveIds": [ "CVE-2025-55182" ], "affectedVersions": [ "React 19.0.0, 19.1.0-19.1.1, 19.2.0 (react-server-dom-webpack / -parcel / -turbopack)", "Next.js App Router releases using affected React (see advisory)" ], "fixedVersions": [ "React 19.0.1", "React 19.1.2", "React 19.2.1", "Next.js: patched release lines per the React/Next.js advisory" ], "startedAt": "2025-12-03", "closedAt": "2025-12-12", "updatedAt": "2025-12-12", "summary": "A flaw in how React Server Components deserialize Flight payloads let an unauthenticated request run code on the server. Next.js App Router apps were affected by default. China-nexus groups including Earth Lamia and Jackpot Panda exploited it within hours of disclosure. CVE-2025-66478 (the Next.js id) was rejected as a duplicate.", "xPost": null }, { "slug": "shai-hulud-2-npm-worm-november-2025", "title": "Shai-Hulud 2.0: worm backdoors ~800 npm packages incl. Zapier, PostHog, Postman, ENS", "url": "https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025", "json": "https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "npm packages (posthog-js, posthog-node, @postman/*, Zapier, ENS Domains, AsyncAPI and others)", "tags": [ "npm", "node", "shai-hulud", "posthog", "postman", "zapier", "github", "supply-chain", "infostealer", "worm" ], "cveIds": [], "affectedVersions": [ "e.g. posthog-node 4.18.1, 5.13.3, 5.11.3; posthog-js 1.297.3; posthog-react-native 4.11.1; @postman/tunnel-agent 0.6.5-0.6.7 (full lists in sources)" ], "fixedVersions": [ "Malicious versions unpublished; use versions published after 2025-11-24 per each vendor" ], "startedAt": "2025-11-24", "closedAt": "2025-11-26", "updatedAt": "2025-11-26", "summary": "A second wave of the Shai-Hulud worm ran in npm preinstall scripts (setup_bun.js), stole credentials with TruffleHog and pushed them to public GitHub repos, then republished packages with any npm tokens it found. Datadog counted 796 backdoored packages with 20M+ weekly downloads; Wiz saw 25,000+ attacker repos.", "xPost": null }, { "slug": "shai-hulud-npm-worm-september-2025", "title": "Shai-Hulud: first self-replicating npm worm hits 500+ packages incl. @ctrl/tinycolor and CrowdStrike", "url": "https://pwn.watch/i/shai-hulud-npm-worm-september-2025", "json": "https://pwn.watch/i/shai-hulud-npm-worm-september-2025.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "npm packages (@ctrl/tinycolor, @crowdstrike/*, 500+ others)", "tags": [ "npm", "node", "github-actions", "shai-hulud", "crowdstrike", "github", "supply-chain", "infostealer", "worm" ], "cveIds": [], "affectedVersions": [ "Specific malicious versions of 500+ npm packages (see Socket / CISA lists)" ], "fixedVersions": [ "Malicious versions removed from npm; upgrade to versions published after the incident" ], "startedAt": "2025-09-14", "closedAt": "2025-09-23", "updatedAt": "2025-09-23", "summary": "A worm spread through npm by stealing maintainers' npm and GitHub tokens with TruffleHog, then republishing their packages with a malicious bundle.js postinstall. It created shai-hulud GitHub workflows to exfiltrate secrets and made private repos public. CISA counted more than 500 affected packages, including @ctrl/tinycolor and several @crowdstrike packages.", "xPost": null }, { "slug": "chalk-debug-npm-hijack-september-2025", "title": "chalk, debug and 16 other npm packages (2B+ weekly downloads) hijacked via fake 2FA email", "url": "https://pwn.watch/i/chalk-debug-npm-hijack-september-2025", "json": "https://pwn.watch/i/chalk-debug-npm-hijack-september-2025.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "npm: chalk, debug, ansi-styles, strip-ansi, supports-color and 13 more", "tags": [ "npm", "node", "chalk", "phishing", "supply-chain", "crypto" ], "cveIds": [], "affectedVersions": [ "chalk 5.6.1", "debug 4.4.2", "ansi-styles 6.2.2", "strip-ansi 7.1.1", "supports-color 10.2.1", "ansi-regex 6.2.1", "wrap-ansi 9.0.1", "slice-ansi 7.1.1", "has-ansi 6.0.1", "chalk-template 1.1.1", "supports-hyperlinks 4.1.1", "others: see debug-js/debug#1005" ], "fixedVersions": [ "chalk 5.6.2", "ansi-styles 6.2.3", "strip-ansi 7.1.2", "supports-color 10.2.2", "ansi-regex 6.2.2", "wrap-ansi 9.0.2", "slice-ansi 7.1.2", "has-ansi 6.0.2", "chalk-template 1.1.2", "supports-hyperlinks 4.1.2", "debug and others: republished by the maintainer on 2025-09-13" ], "startedAt": "2025-09-08", "closedAt": "2025-09-13", "updatedAt": "2025-09-15", "summary": "Maintainer Josh Junon (qix) was phished by a fake npm 2FA-reset email from npmjs.help. The attacker published malicious versions of 18 packages, including chalk, debug, ansi-styles and strip-ansi, with code that hijacked crypto wallet transactions in browsers. They were live for about two hours.", "xPost": null }, { "slug": "nx-s1ngularity-npm-supply-chain-august-2025", "title": "s1ngularity: malicious Nx releases used AI CLIs to hunt secrets, 5,500+ private repos exposed", "url": "https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025", "json": "https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "nx and @nx/* npm packages", "tags": [ "npm", "node", "github-actions", "ai", "nx", "s1ngularity", "github", "supply-chain", "infostealer" ], "cveIds": [], "affectedVersions": [ "nx 20.9.0-20.12.0, 21.5.0-21.8.0", "@nx/devkit, @nx/js, @nx/workspace, @nx/node 20.9.0 / 21.5.0", "@nx/eslint 21.5.0", "@nx/key, @nx/enterprise-cloud 3.2.0" ], "fixedVersions": [ "Malicious versions removed from npm (see GHSA-cxm3-wv7p-598c)" ], "startedAt": "2025-08-26", "closedAt": "2025-08-29", "updatedAt": "2025-08-29", "summary": "Attackers abused a GitHub Actions injection bug in nrwl/nx to steal its npm token and published malicious nx and @nx/* versions for about four hours. The postinstall script used local AI CLIs (Claude, Gemini, Q) to find secrets and pushed them to public s1ngularity-repository repos. A second phase used stolen GitHub tokens to make 5,500+ private repos public.", "xPost": null }, { "slug": "eslint-config-prettier-npm-phishing-cve-2025-54313", "title": "eslint-config-prettier and friends hijacked via npnjs.com phishing (CVE-2025-54313)", "url": "https://pwn.watch/i/eslint-config-prettier-npm-phishing-cve-2025-54313", "json": "https://pwn.watch/i/eslint-config-prettier-npm-phishing-cve-2025-54313.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "npm: eslint-config-prettier, eslint-plugin-prettier, synckit, @pkgr/core, napi-postinstall, is", "tags": [ "npm", "node", "eslint", "phishing", "windows", "supply-chain", "infostealer" ], "cveIds": [ "CVE-2025-54313" ], "affectedVersions": [ "eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, 10.1.7", "is 3.3.1, 5.0.0" ], "fixedVersions": [ "Malicious versions removed; use other eslint-config-prettier versions (see CVE record)" ], "startedAt": "2025-07-18", "closedAt": "2025-07-22", "updatedAt": "2025-07-22", "summary": "A maintainer was phished through the typosquat domain npnjs.com. The attacker published malicious eslint-config-prettier versions whose install script ran node-gyp.dll on Windows, dropping the Scavenger infostealer. eslint-plugin-prettier, synckit, @pkgr/core, napi-postinstall and later the 'is' package were also hit.", "xPost": null }, { "slug": "nextjs-middleware-auth-bypass-cve-2025-29927", "title": "Next.js middleware authorization bypass via x-middleware-subrequest (CVE-2025-29927)", "url": "https://pwn.watch/i/nextjs-middleware-auth-bypass-cve-2025-29927", "json": "https://pwn.watch/i/nextjs-middleware-auth-bypass-cve-2025-29927.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Next.js (self-hosted)", "tags": [ "node", "nextjs", "vercel", "auth-bypass" ], "cveIds": [ "CVE-2025-29927" ], "affectedVersions": [ "11.1.4-12.3.4", "13.0.0-13.5.8", "14.0.0-14.2.24", "15.0.0-15.2.2" ], "fixedVersions": [ "12.3.5", "13.5.9", "14.2.25", "15.2.3" ], "startedAt": "2025-03-21", "closedAt": "2025-03-22", "updatedAt": "2025-03-22", "summary": "Sending a crafted x-middleware-subrequest header made self-hosted Next.js skip middleware entirely, bypassing auth checks done there. Apps hosted on Vercel were protected. Fixed in 12.3.5, 13.5.9, 14.2.25 and 15.2.3; otherwise strip the header at the edge.", "xPost": null }, { "slug": "jquery-cve-2020-11023", "title": "JQuery: Cross-Site Scripting (XSS) Vulnerability", "url": "https://pwn.watch/i/jquery-cve-2020-11023", "json": "https://pwn.watch/i/jquery-cve-2020-11023.json", "status": "closed", "severity": "medium", "patchStatus": "patched", "product": "JQuery", "tags": [ "node", "jquery", "cisa-kev" ], "cveIds": [ "CVE-2020-11023" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-01-23", "closedAt": "2025-01-23", "updatedAt": "2025-01-23", "summary": "JQuery contains a persistent cross-site scripting (XSS) vulnerability. When passing maliciously formed, untrusted input enclosed in HTML tags, JQuery's DOM manipulators can execute untrusted code in the context of the user's browser. Added to CISA KEV on 2025-01-23.", "xPost": null }, { "slug": "solana-web3-js-npm-compromise-cve-2024-54134", "title": "@solana/web3.js npm package backdoored to steal private keys", "url": "https://pwn.watch/i/solana-web3-js-npm-compromise-cve-2024-54134", "json": "https://pwn.watch/i/solana-web3-js-npm-compromise-cve-2024-54134.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "@solana/web3.js (npm)", "tags": [ "node", "npm", "solana", "crypto", "supply-chain" ], "cveIds": [ "CVE-2024-54134" ], "affectedVersions": [ "1.95.6", "1.95.7" ], "fixedVersions": [ "1.95.8" ], "startedAt": "2024-12-03", "closedAt": "2024-12-04", "updatedAt": "2024-12-04", "summary": "A publish-access account for @solana/web3.js was compromised. Malicious versions 1.95.6 and 1.95.7, live on npm from 15:20 to 20:25 UTC on 2024-12-03, exfiltrated private key material from apps and bots that handle keys directly. Non-custodial wallets were generally not affected. Fixed in 1.95.8.", "xPost": null }, { "slug": "lottiefiles-lottie-player-npm-compromise", "title": "@lottiefiles/lottie-player npm package hijacked with a crypto wallet drainer", "url": "https://pwn.watch/i/lottiefiles-lottie-player-npm-compromise", "json": "https://pwn.watch/i/lottiefiles-lottie-player-npm-compromise.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "@lottiefiles/lottie-player (npm)", "tags": [ "node", "npm", "lottiefiles", "crypto", "supply-chain" ], "cveIds": [], "affectedVersions": [ "2.0.5", "2.0.6", "2.0.7" ], "fixedVersions": [ "2.0.8" ], "startedAt": "2024-10-30", "closedAt": "2024-10-31", "updatedAt": "2024-10-31", "summary": "A LottieFiles developer's npm access was abused to publish @lottiefiles/lottie-player 2.0.5, 2.0.6 and 2.0.7 on 2024-10-30. Sites loading the 'latest' build from CDNs like unpkg and jsDelivr showed a wallet-connect popup that tried to drain visitors' crypto wallets. LottieFiles unpublished the versions and released 2.0.8, a copy of 2.0.4.", "xPost": null }, { "slug": "ledger-connect-kit-npm-supply-chain-2023", "title": "Ledger Connect Kit npm package hijacked to drain crypto wallets", "url": "https://pwn.watch/i/ledger-connect-kit-npm-supply-chain-2023", "json": "https://pwn.watch/i/ledger-connect-kit-npm-supply-chain-2023.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "@ledgerhq/connect-kit (npm)", "tags": [ "npm", "node", "ledger", "supply-chain", "crypto", "wallet-drainer", "phishing" ], "cveIds": [], "affectedVersions": [ "@ledgerhq/connect-kit 1.1.5, 1.1.6, 1.1.7" ], "fixedVersions": [ "1.1.8" ], "startedAt": "2023-12-14", "closedAt": "2023-12-14", "updatedAt": "2023-12-14", "summary": "Attackers phished a former Ledger employee's npm account and published malicious @ledgerhq/connect-kit versions 1.1.5 to 1.1.7. Because many dApps load it from a CDN without pinning a version, their users were shown wallet-drainer prompts. Ledger shipped a clean 1.1.8 within about 40 minutes of finding out.", "xPost": null }, { "slug": "libwebp-heap-overflow-cve-2023-4863", "title": "libwebp heap overflow exploited in the wild (CVE-2023-4863)", "url": "https://pwn.watch/i/libwebp-heap-overflow-cve-2023-4863", "json": "https://pwn.watch/i/libwebp-heap-overflow-cve-2023-4863.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "libwebp (Google Chrome and everything that bundles libwebp)", "tags": [ "node", "python", "libwebp", "google", "chrome", "electron", "zero-day", "cisa-kev" ], "cveIds": [ "CVE-2023-4863" ], "affectedVersions": [ "Google Chrome before 116.0.5845.187; libwebp before 1.3.2 (NVD)" ], "fixedVersions": [ "Chrome 116.0.5845.187", "libwebp 1.3.2", "Bundling apps/libraries: see each vendor's advisory" ], "startedAt": "2023-09-11", "closedAt": "2023-09-13", "updatedAt": "2023-09-13", "summary": "A heap overflow in libwebp's lossless decoder, found by Apple SEAR and Citizen Lab after the BLASTPASS iPhone exploit, was exploited in the wild. Because libwebp is everywhere, browsers, Electron apps and image libraries that bundle it all had to ship updates.", "xPost": null }, { "slug": "http2-rapid-reset-ddos-cve-2023-44487", "title": "HTTP/2 Rapid Reset: record-breaking DDoS attacks (CVE-2023-44487)", "url": "https://pwn.watch/i/http2-rapid-reset-ddos-cve-2023-44487", "json": "https://pwn.watch/i/http2-rapid-reset-ddos-cve-2023-44487.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "HTTP/2 protocol implementations (servers, proxies, CDNs)", "tags": [ "node", "go", "java", "dotnet", "http2", "ddos", "cloudflare", "google", "aws", "nginx", "cisa-kev" ], "cveIds": [ "CVE-2023-44487" ], "affectedVersions": [ "Most HTTP/2 implementations; see each vendor's advisory" ], "fixedVersions": [ "See vendor advisories (each HTTP/2 implementation shipped its own fix)" ], "startedAt": "2023-08-25", "closedAt": "2023-10-10", "updatedAt": "2023-10-10", "summary": "Attackers abused HTTP/2 stream cancellation (open a request, reset it right away, repeat) to make servers do work at enormous rates. Peaks hit 398M req/s at Google, 201M at Cloudflare and 155M at AWS. Almost every HTTP/2 server and proxy needed a fix, including Node.js, Go, Java servers, .NET/IIS and nginx.", "xPost": null } ], "posts": [ { "authorName": "Node.js", "handle": "nodejs", "avatarUrl": "https://pbs.twimg.com/profile_images/2087612853830258688/JUl27p1E_bigger.jpg", "text": "🔐 Node.js security updates are now available!\n\nNew releases for Node.js 22.x, 24.x & 26.x address multiple vulnerabilities, including high-severity issues.\n\nReview the details and update your systems to stay secure.\n\n🔗 https://t.co/W4kfzx5lxz\n\n#NodeJS #Security", "date": "2026-10-21T22:39:27.000Z", "url": "https://x.com/nodejs/status/2113037478286221570", "media": [], "incident": "nodejs-october-2026-security-releases" }, { "authorName": "Mark Gadala-Maria", "handle": "markgadala", "avatarUrl": "https://pbs.twimg.com/profile_images/1904279027013001216/STf4Q5To_bigger.jpg", "text": "🚨 BREAKING: Node.js just dropped its OWN security bombshell.\n\n4 HIGH-SEVERITY vulnerabilities patched TODAY, including one that could let hackers remotely execute malicious code on vulnerable servers.\n\n→ 10 SECURITY FLAWS were addressed in today's Node.js release, FOUR rated https://t.co/k3Vb8WK1eC", "date": "2026-10-21T17:11:48.000Z", "url": "https://x.com/markgadala/status/2112955022082207978", "media": [], "incident": "nodejs-october-2026-security-releases" }, { "authorName": "Daily CyberSecurity", "handle": "Daily_CyberSec", "avatarUrl": "https://pbs.twimg.com/profile_images/2067063139271905280/morJwm3H_bigger.jpg", "text": "The Node.js security release fixes 10 flaws, including a Brotli remote code execution bug, CVE-2026-111497. Update to 26.12.1, 24.22.1 or 22.23.4.\n\n#NodeJS #CVE2026111497 #CVE2026105483 #CVE2026106069 #RemoteCodeExecution #TLS #JavaScript #CyberSecurity\nhttps://t.co/2Rmy6FPWq0", "date": "2026-10-21T15:49:04.000Z", "url": "https://x.com/Daily_CyberSec/status/2112934202412826673", "media": [], "incident": "nodejs-october-2026-security-releases" }, { "authorName": "5h3ll", "handle": "social5h3ll", "avatarUrl": "https://pbs.twimg.com/profile_images/2098744719451037699/D5xMv_cH_bigger.jpg", "text": "Breaking 🚨 - Node.js October 2026 Security Releases – High severity fixes available now! \n\nSecurity updates are out for the supported Node.js lines: 26.x, 24.x, and 22.x.\n\nHighest severity is HIGH. Key issues include:\n• TLS non-canonical IP address handling (CVE-2026-106069 / https://t.co/npxfOdxGdg", "date": "2026-10-21T12:03:43.000Z", "url": "https://x.com/social5h3ll/status/2112877488456044609", "media": [ { "type": "image", "url": "https://pbs.twimg.com/media/HVJy39RW8AApYfx.jpg" } ], "incident": "nodejs-october-2026-security-releases" }, { "authorName": "The Hacker News", "handle": "TheHackersNews", "avatarUrl": "https://pbs.twimg.com/profile_images/1597647879811657728/FLgHrLHy_bigger.jpg", "text": "‼️ ALERT - Next.js just shipped an out-of-band security update for TWO critical unauthenticated RCE flaws (both CVSS 9.5) + a high-severity DoS.\n\nRCEs: RSC use cache (GHSA-673q-mjm6-r5xr) and librsvg via sharp (CVE-2026-96889).\n\n🔗 Read - https://t.co/ndnN46ysGv", "date": "2026-10-15T12:35:50.000Z", "url": "https://x.com/TheHackersNews/status/2110711243942330566", "media": [], "incident": "nextjs-october-2026-rce-security-release" }, { "authorName": "ThreatWire", "handle": "ThreatWire_", "avatarUrl": "https://pbs.twimg.com/profile_images/2074748840775688192/LvaBIlOK_bigger.jpg", "text": "🚨 CRITICAL: CVE-2026-96889 — Next.js Image Optimization RCE via SVG (librsvg/sharp)\n\nScore 9.5 (CVSS 4.0, Next.js advisory). Unauthenticated. Glibc Linux.\nAffects Next.js 10.0.0–15.5.27 and 16.0.0–16.4.0.\nFixed in 15.5.28 and 16.4.1. Check npm ls sharp → 0.35.5+.\nNot in CISA", "date": "2026-10-15T05:37:11.000Z", "url": "https://x.com/ThreatWire_/status/2110605887907713139", "media": [], "incident": "nextjs-october-2026-rce-security-release" }, { "authorName": "Bhavesh Verma", "handle": "xbhaveshverma", "avatarUrl": "https://pbs.twimg.com/profile_images/2102764953153474560/GdTC_kqB_bigger.jpg", "text": "Tensorlake npm Package Poisoned by the Shai-Hulud Worm, Credential-Stealing Payload Targeted AI Agent Infrastructure and Carried a “Hostage Token” That Triggers Destruction if Revoked\n \nOn October 8, 2026, a malicious release of the tensorlake npm package, version 0.5.144, was", "date": "2026-10-14T07:30:00.000Z", "url": "https://x.com/xbhaveshverma/status/2110271890346623049", "media": [], "incident": "tensorlake-npm-shai-hulud-worm" }, { "authorName": "sunil kumawat", "handle": "Sunil_kumawat17", "avatarUrl": "https://pbs.twimg.com/profile_images/2098057965584732161/FSLSFQ4M_bigger.jpg", "text": "1/ npm: tensorlake@0.5.144 (Oct 8) shipped a Shai-Hulud-style worm in a preinstall hook. It hunts npm, GitHub and cloud creds plus .claude/.cursor configs.\n\nTreat the host as compromised. Socket: remove gh-token-monitor before revoking tokens, or it can wipe your home dir.", "date": "2026-10-12T03:42:11.000Z", "url": "https://x.com/Sunil_kumawat17/status/2109489785181991309", "media": [], "incident": "tensorlake-npm-shai-hulud-worm" }, { "authorName": "Techzine", "handle": "techzine", "avatarUrl": "https://pbs.twimg.com/profile_images/1240303566201511936/gHRGR8Fs_bigger.png", "text": "The Shai-Hulud worm infected the npm SDK of the AI platform Tensorlake. The malware steals credentials and can wipe home directories when tokens are revoked. dlvr.​it/TVrLFR #Security #npm #ShaiHulud #Socket #Tensorlake - Follow for more https://t.co/mLg7PlLPhr", "date": "2026-10-09T07:37:16.000Z", "url": "https://x.com/techzine/status/2108461779328332283", "media": [ { "type": "image", "url": "https://pbs.twimg.com/media/HULCz6Ga8AE7wrg.jpg" } ], "incident": "tensorlake-npm-shai-hulud-worm" }, { "authorName": "GMO Flatt Security Inc.", "handle": "flatt_sec_en", "avatarUrl": "https://pbs.twimg.com/profile_images/1403333053322121218/K05KKmYR_bigger.jpg", "text": "We have published a new blog post covering a recent software supply chain attack on the @subql/common npm package.\n\nIt covers technical details of the compromised package, as well as guidance on response if affected, as well as recommendations for users to protect against supply", "date": "2026-10-06T12:09:04.000Z", "url": "https://x.com/flatt_sec_en/status/2107443017829519848", "media": [], "incident": "subql-common-npm-backdoor" } ], "changes": [ { "incident": "nextjs-october-2026-rce-security-release", "incidentTitle": "Next.js out-of-band release fixes two unauthenticated RCEs (SVG image optimization CVE-2026-96889, use cache)", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-22", "title": "GitHub publishes GHSA-2464-fhr4-w9xw to the global Advisory Database (critical), so Dependabot and npm audit start flagging affected next versions.", "body": null, "sourceUrl": "https://github.com/advisories/GHSA-2464-fhr4-w9xw", "url": "https://pwn.watch/i/nextjs-october-2026-rce-security-release" }, { "incident": "nodejs-october-2026-security-releases", "incidentTitle": "Node.js October 2026 security releases (Brotli RCE + TLS/DNS highs)", "severity": "high", "status": "live", "patchStatus": "patched", "date": "2026-10-21", "title": "Node.js published the Wednesday security releases and advisory.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/nodejs-october-2026-security-releases" }, { "incident": "nodejs-october-2026-security-releases", "incidentTitle": "Node.js October 2026 security releases (Brotli RCE + TLS/DNS highs)", "severity": "high", "status": "live", "patchStatus": "patched", "date": "2026-10-21", "title": "Vercel deployed WAF rules for the Brotli attack vector and began rolling patched runtimes.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/nodejs-october-2026-security-releases" }, { "incident": "nextjs-october-2026-rce-security-release", "incidentTitle": "Next.js out-of-band release fixes two unauthenticated RCEs (SVG image optimization CVE-2026-96889, use cache)", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-14", "title": "Vercel releases Next.js 16.4.1 and 15.5.28 as an out-of-band security update: two critical unauthenticated RCEs (SVG Image Optimization, `use cache` typed arrays) and a high-severity Server Actions DoS. No workaround for the `use cache` bug; upgrade even if you don't use those features.", "body": null, "sourceUrl": "https://nextjs.org/blog/nextjs-security-update-october-14-2026", "url": "https://pwn.watch/i/nextjs-october-2026-rce-security-release" }, { "incident": "nextjs-october-2026-rce-security-release", "incidentTitle": "Next.js out-of-band release fixes two unauthenticated RCEs (SVG image optimization CVE-2026-96889, use cache)", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-14", "title": "Netlify: the SVG flaw is also reachable through `next/og` ImageResponse; on Netlify the next/image path runs on its Image CDN, and impact there is a crashed function, not code execution.", "body": null, "sourceUrl": "https://www.netlify.com/changelog/2026-10-14-nextjs-react-security-vulnerabilities/", "url": "https://pwn.watch/i/nextjs-october-2026-rce-security-release" }, { "incident": "subql-common-npm-backdoor", "incidentTitle": "SubQuery @subql/common 5.8.3 published with credential stealer + backdoor", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2026-10-10", "title": "SubQuery maintainer: compromised token deleted, security review started.", "body": null, "sourceUrl": "https://github.com/subquery/subql/issues/3047", "url": "https://pwn.watch/i/subql-common-npm-backdoor" }, { "incident": "tensorlake-npm-shai-hulud-worm", "incidentTitle": "tensorlake@0.5.144 npm Shai-Hulud worm with hostage GitHub token", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-08", "title": "0.5.144 published via the project’s release workflow.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/tensorlake-npm-shai-hulud-worm" }, { "incident": "tensorlake-npm-shai-hulud-worm", "incidentTitle": "tensorlake@0.5.144 npm Shai-Hulud worm with hostage GitHub token", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-08+", "title": "StepSecurity / Socket detections and public write-ups; remediation guidance emphasizes removing gh-token-monitor before revoke.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/tensorlake-npm-shai-hulud-worm" }, { "incident": "tensorlake-npm-shai-hulud-worm", "incidentTitle": "tensorlake@0.5.144 npm Shai-Hulud worm with hostage GitHub token", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-07", "title": "Malicious commits land on tensorlakeai/tensorlake main.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/tensorlake-npm-shai-hulud-worm" }, { "incident": "subql-common-npm-backdoor", "incidentTitle": "SubQuery @subql/common 5.8.3 published with credential stealer + backdoor", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2026-10-06", "title": "GMO Flatt Security publishes payload analysis and response guidance.", "body": null, "sourceUrl": "https://flatt.tech/research/posts/subql-common-npm-supply-chain-attack/", "url": "https://pwn.watch/i/subql-common-npm-backdoor" }, { "incident": "subql-common-npm-backdoor", "incidentTitle": "SubQuery @subql/common 5.8.3 published with credential stealer + backdoor", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2026-10-05T11:56Z", "title": "Malicious @subql/common 5.8.3 published via the repo's GitHub Actions trusted publisher (canary 5.8.3-onf-rt1 published ~32 min earlier).", "body": null, "sourceUrl": "https://www.stepsecurity.io/blog/subql-ecosystem-compromised", "url": "https://pwn.watch/i/subql-common-npm-backdoor" }, { "incident": "subql-common-npm-backdoor", "incidentTitle": "SubQuery @subql/common 5.8.3 published with credential stealer + backdoor", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2026-10-05T12:14Z", "title": "StepSecurity opens security issue #3047 in subquery/subql.", "body": null, "sourceUrl": "https://github.com/subquery/subql/issues/3047", "url": "https://pwn.watch/i/subql-common-npm-backdoor" }, { "incident": "subql-common-npm-backdoor", "incidentTitle": "SubQuery @subql/common 5.8.3 published with credential stealer + backdoor", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2026-10-05T12:46Z", "title": "GitHub publishes malware advisory GHSA-9333-3c4x-x3h5; version removed from npm (~50 minutes live); 'latest' back to 5.8.2.", "body": null, "sourceUrl": "https://github.com/advisories/GHSA-9333-3c4x-x3h5", "url": "https://pwn.watch/i/subql-common-npm-backdoor" }, { "incident": "nextjs-october-2026-rce-security-release", "incidentTitle": "Next.js out-of-band release fixes two unauthenticated RCEs (SVG image optimization CVE-2026-96889, use cache)", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-09-27", "title": "sharp 0.35.5 ships with librsvg 2.63.2; sharp's advisory GHSA-wq5f-xc86-pv6w later covers CVE-2026-96889 (use-after-free in librsvg).", "body": null, "sourceUrl": "https://github.com/advisories/GHSA-wq5f-xc86-pv6w", "url": "https://pwn.watch/i/nextjs-october-2026-rce-security-release" }, { "incident": "shai-hulud-chaindrop-npm-keyv-august", "incidentTitle": "CHAINDROP / Mini Shai-Hulud npm worm (keyv + 400+ packages)", "severity": "critical", "status": "closed", "patchStatus": "partial", "date": "2026-08-04", "title": "keyv/cacheable malicious releases observed; worm begins propagating.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/shai-hulud-chaindrop-npm-keyv-august" }, { "incident": "shai-hulud-chaindrop-npm-keyv-august", "incidentTitle": "CHAINDROP / Mini Shai-Hulud npm worm (keyv + 400+ packages)", "severity": "critical", "status": "closed", "patchStatus": "partial", "date": "2026-08-04/06", "title": "Microsoft, Elastic, JFrog publish analyses; 400+ packages listed.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/shai-hulud-chaindrop-npm-keyv-august" }, { "incident": "nx-nx-console-cve-2026-48027", "incidentTitle": "Nx Nx Console: Nx Console Embedded Malicious Code Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-05-27", "title": "CISA added CVE-2026-48027 to the KEV catalog (due 2026-06-10).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/nx-nx-console-cve-2026-48027" }, { "incident": "tanstack-tanstack-cve-2026-45321", "incidentTitle": "TanStack TanStack: TanStack Unspecified Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-05-27", "title": "CISA added CVE-2026-45321 to the KEV catalog (due 2026-06-10).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/tanstack-tanstack-cve-2026-45321" }, { "incident": "react-native-community-cli-cve-2025-11953", "incidentTitle": "React Native Community CLI: React Native Community CLI OS Command Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-02-05", "title": "CISA added CVE-2025-11953 to the KEV catalog (due 2026-02-26).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/react-native-community-cli-cve-2025-11953" }, { "incident": "react2shell-react-server-components-cve-2025-55182", "incidentTitle": "React2Shell: CVSS 10 unauthenticated RCE in React Server Components and Next.js", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-12-12", "title": "Unit 42 updates its threat brief on ongoing exploitation", "body": null, "sourceUrl": "https://unit42.paloaltonetworks.com/cve-2025-55182-react-and-cve-2025-66478-next/", "url": "https://pwn.watch/i/react2shell-react-server-components-cve-2025-55182" }, { "incident": "react2shell-react-server-components-cve-2025-55182", "incidentTitle": "React2Shell: CVSS 10 unauthenticated RCE in React Server Components and Next.js", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-12-05", "title": "CISA adds CVE-2025-55182 to KEV", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/react2shell-react-server-components-cve-2025-55182" }, { "incident": "react2shell-react-server-components-cve-2025-55182", "incidentTitle": "React2Shell: CVSS 10 unauthenticated RCE in React Server Components and Next.js", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-12-03", "title": "React discloses a critical vulnerability in React Server Components and ships fixes", "body": null, "sourceUrl": "https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components", "url": "https://pwn.watch/i/react2shell-react-server-components-cve-2025-55182" }, { "incident": "react2shell-react-server-components-cve-2025-55182", "incidentTitle": "React2Shell: CVSS 10 unauthenticated RCE in React Server Components and Next.js", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-12-03", "title": "AWS sees China-nexus groups exploiting it within hours", "body": "Including Earth Lamia and Jackpot Panda.", "sourceUrl": "https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/", "url": "https://pwn.watch/i/react2shell-react-server-components-cve-2025-55182" }, { "incident": "shai-hulud-2-npm-worm-november-2025", "incidentTitle": "Shai-Hulud 2.0: worm backdoors ~800 npm packages incl. Zapier, PostHog, Postman, ENS", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-11-26", "title": "GitHub privatizes malicious repos; public count drops to ~300", "body": null, "sourceUrl": "https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack", "url": "https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025" }, { "incident": "shai-hulud-2-npm-worm-november-2025", "incidentTitle": "Shai-Hulud 2.0: worm backdoors ~800 npm packages incl. Zapier, PostHog, Postman, ENS", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-11-26", "title": "PostHog publishes its post-mortem", "body": null, "sourceUrl": "https://posthog.com/blog/nov-24-shai-hulud-attack-post-mortem", "url": "https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025" }, { "incident": "shai-hulud-2-npm-worm-november-2025", "incidentTitle": "Shai-Hulud 2.0: worm backdoors ~800 npm packages incl. Zapier, PostHog, Postman, ENS", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-11-24", "title": "First compromised package published (03:10 UTC)", "body": null, "sourceUrl": "https://panther.com/blog/a-data-driven-analysis-of-the-sha1-hulud-2-0-campaign", "url": "https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025" }, { "incident": "shai-hulud-2-npm-worm-november-2025", "incidentTitle": "Shai-Hulud 2.0: worm backdoors ~800 npm packages incl. Zapier, PostHog, Postman, ENS", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-11-24", "title": "PostHog SDKs compromised (04:11 UTC); removed and tokens revoked by 09:30 UTC", "body": null, "sourceUrl": "https://posthog.com/blog/nov-24-shai-hulud-attack-post-mortem", "url": "https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025" }, { "incident": "shai-hulud-2-npm-worm-november-2025", "incidentTitle": "Shai-Hulud 2.0: worm backdoors ~800 npm packages incl. Zapier, PostHog, Postman, ENS", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-11-24", "title": "Postman unpublishes 17 infected packages (51 versions)", "body": null, "sourceUrl": "https://blog.postman.com/engineering/shai-hulud-2-0-npm-supply-chain-attack/", "url": "https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025" }, { "incident": "shai-hulud-2-npm-worm-november-2025", "incidentTitle": "Shai-Hulud 2.0: worm backdoors ~800 npm packages incl. Zapier, PostHog, Postman, ENS", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-11-24", "title": "Last compromised package seen (~17:00-18:00 UTC)", "body": null, "sourceUrl": "https://securitylabs.datadoghq.com/articles/shai-hulud-2.0-npm-worm/", "url": "https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025" }, { "incident": "shai-hulud-npm-worm-september-2025", "incidentTitle": "Shai-Hulud: first self-replicating npm worm hits 500+ packages incl. @ctrl/tinycolor and CrowdStrike", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-09-23", "title": "CISA alert: widespread supply chain compromise impacting npm (500+ packages)", "body": null, "sourceUrl": "https://www.cisa.gov/news-events/alerts/2025/09/23/widespread-supply-chain-compromise-impacting-npm-ecosystem", "url": "https://pwn.watch/i/shai-hulud-npm-worm-september-2025" }, { "incident": "shai-hulud-npm-worm-september-2025", "incidentTitle": "Shai-Hulud: first self-replicating npm worm hits 500+ packages incl. @ctrl/tinycolor and CrowdStrike", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-09-16", "title": "Largest burst, nearly 100 packages, including @crowdstrike scope", "body": null, "sourceUrl": "https://socket.dev/blog/ongoing-supply-chain-attack-targets-crowdstrike-npm-packages", "url": "https://pwn.watch/i/shai-hulud-npm-worm-september-2025" }, { "incident": "shai-hulud-npm-worm-september-2025", "incidentTitle": "Shai-Hulud: first self-replicating npm worm hits 500+ packages incl. @ctrl/tinycolor and CrowdStrike", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-09-15", "title": "Worm discovered; @ctrl/tinycolor and ~40 packages found compromised", "body": null, "sourceUrl": "https://www.sysdig.com/blog/shai-hulud-the-novel-self-replicating-worm-infecting-hundreds-of-npm-packages", "url": "https://pwn.watch/i/shai-hulud-npm-worm-september-2025" }, { "incident": "chalk-debug-npm-hijack-september-2025", "incidentTitle": "chalk, debug and 16 other npm packages (2B+ weekly downloads) hijacked via fake 2FA email", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-09-15", "title": "Initial CVEs posted", "body": null, "sourceUrl": "https://github.com/debug-js/debug/issues/1005", "url": "https://pwn.watch/i/chalk-debug-npm-hijack-september-2025" }, { "incident": "shai-hulud-npm-worm-september-2025", "incidentTitle": "Shai-Hulud: first self-replicating npm worm hits 500+ packages incl. @ctrl/tinycolor and CrowdStrike", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-09-14", "title": "First compromised versions published (17:58 UTC)", "body": null, "sourceUrl": "https://socket.dev/blog/ongoing-supply-chain-attack-targets-crowdstrike-npm-packages", "url": "https://pwn.watch/i/shai-hulud-npm-worm-september-2025" }, { "incident": "chalk-debug-npm-hijack-september-2025", "incidentTitle": "chalk, debug and 16 other npm packages (2B+ weekly downloads) hijacked via fake 2FA email", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-09-13", "title": "All remaining affected packages republished by the maintainer", "body": null, "sourceUrl": "https://github.com/debug-js/debug/issues/1005", "url": "https://pwn.watch/i/chalk-debug-npm-hijack-september-2025" }, { "incident": "chalk-debug-npm-hijack-september-2025", "incidentTitle": "chalk, debug and 16 other npm packages (2B+ weekly downloads) hijacked via fake 2FA email", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-09-08", "title": "Malicious versions start appearing on npm (13:16 UTC)", "body": null, "sourceUrl": "https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised", "url": "https://pwn.watch/i/chalk-debug-npm-hijack-september-2025" }, { "incident": "chalk-debug-npm-hijack-september-2025", "incidentTitle": "chalk, debug and 16 other npm packages (2B+ weekly downloads) hijacked via fake 2FA email", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-09-08", "title": "Sindre Sorhus publishes clean chalk-family versions over the compromised ones", "body": null, "sourceUrl": "https://github.com/chalk/chalk/issues/656", "url": "https://pwn.watch/i/chalk-debug-npm-hijack-september-2025" }, { "incident": "chalk-debug-npm-hijack-september-2025", "incidentTitle": "chalk, debug and 16 other npm packages (2B+ weekly downloads) hijacked via fake 2FA email", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-09-08", "title": "npm takes down all impacted versions (21:59 CEST); maintainer account restored (23:48 CEST)", "body": null, "sourceUrl": "https://github.com/debug-js/debug/issues/1005", "url": "https://pwn.watch/i/chalk-debug-npm-hijack-september-2025" }, { "incident": "nx-s1ngularity-npm-supply-chain-august-2025", "incidentTitle": "s1ngularity: malicious Nx releases used AI CLIs to hunt secrets, 5,500+ private repos exposed", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-08-28/29", "title": "Second phase: 5,500+ private repos of 400+ users/orgs made public with stolen tokens", "body": null, "sourceUrl": "https://www.wiz.io/blog/s1ngularity-supply-chain-attack", "url": "https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025" }, { "incident": "nx-s1ngularity-npm-supply-chain-august-2025", "incidentTitle": "s1ngularity: malicious Nx releases used AI CLIs to hunt secrets, 5,500+ private repos exposed", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-08-27", "title": "GitHub disables attacker-created s1ngularity repositories (09:00 UTC)", "body": null, "sourceUrl": "https://www.wiz.io/blog/s1ngularity-supply-chain-attack", "url": "https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025" }, { "incident": "nx-s1ngularity-npm-supply-chain-august-2025", "incidentTitle": "s1ngularity: malicious Nx releases used AI CLIs to hunt secrets, 5,500+ private repos exposed", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-08-26", "title": "Malicious nx 21.5.0 and others published; npm removes them and revokes tokens that evening", "body": null, "sourceUrl": "https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c", "url": "https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025" }, { "incident": "nx-s1ngularity-npm-supply-chain-august-2025", "incidentTitle": "s1ngularity: malicious Nx releases used AI CLIs to hunt secrets, 5,500+ private repos exposed", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-08-24", "title": "Attacker exploits the workflow and exfiltrates the npm token", "body": null, "sourceUrl": "https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c", "url": "https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025" }, { "incident": "nx-s1ngularity-npm-supply-chain-august-2025", "incidentTitle": "s1ngularity: malicious Nx releases used AI CLIs to hunt secrets, 5,500+ private repos exposed", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-08-21", "title": "A PR adds a GitHub Actions workflow with an injection bug to nrwl/nx", "body": null, "sourceUrl": "https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c", "url": "https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025" }, { "incident": "eslint-config-prettier-npm-phishing-cve-2025-54313", "incidentTitle": "eslint-config-prettier and friends hijacked via npnjs.com phishing (CVE-2025-54313)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-07-22", "title": "Malicious 'is' package versions found in the same campaign", "body": null, "sourceUrl": "https://socket.dev/blog/npm-is-package-hijacked-in-expanding-supply-chain-attack", "url": "https://pwn.watch/i/eslint-config-prettier-npm-phishing-cve-2025-54313" }, { "incident": "eslint-config-prettier-npm-phishing-cve-2025-54313", "incidentTitle": "eslint-config-prettier and friends hijacked via npnjs.com phishing (CVE-2025-54313)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-07-18", "title": "Malicious eslint-config-prettier versions published after maintainer phishing", "body": null, "sourceUrl": "https://www.cve.org/CVERecord?id=CVE-2025-54313", "url": "https://pwn.watch/i/eslint-config-prettier-npm-phishing-cve-2025-54313" }, { "incident": "nextjs-middleware-auth-bypass-cve-2025-29927", "incidentTitle": "Next.js middleware authorization bypass via x-middleware-subrequest (CVE-2025-29927)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-03-22", "title": "Vercel publishes a postmortem on the bypass and its disclosure handling", "body": null, "sourceUrl": "https://vercel.com/blog/postmortem-on-next-js-middleware-bypass", "url": "https://pwn.watch/i/nextjs-middleware-auth-bypass-cve-2025-29927" }, { "incident": "nextjs-middleware-auth-bypass-cve-2025-29927", "incidentTitle": "Next.js middleware authorization bypass via x-middleware-subrequest (CVE-2025-29927)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-03-21", "title": "Next.js publishes advisory GHSA-f82v-jwr5-mffw", "body": null, "sourceUrl": "https://github.com/vercel/next.js/security/advisories/GHSA-f82v-jwr5-mffw", "url": "https://pwn.watch/i/nextjs-middleware-auth-bypass-cve-2025-29927" }, { "incident": "jquery-cve-2020-11023", "incidentTitle": "JQuery: Cross-Site Scripting (XSS) Vulnerability", "severity": "medium", "status": "closed", "patchStatus": "patched", "date": "2025-01-23", "title": "CISA added CVE-2020-11023 to the KEV catalog (due 2025-02-13).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/jquery-cve-2020-11023" }, { "incident": "solana-web3-js-npm-compromise-cve-2024-54134", "incidentTitle": "@solana/web3.js npm package backdoored to steal private keys", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-12-04", "title": "GitHub advisory GHSA-jcxm-7wvp-g6p5 published; upgrade to 1.95.8", "body": null, "sourceUrl": "https://github.com/solana-labs/solana-web3.js/security/advisories/GHSA-jcxm-7wvp-g6p5", "url": "https://pwn.watch/i/solana-web3-js-npm-compromise-cve-2024-54134" }, { "incident": "solana-web3-js-npm-compromise-cve-2024-54134", "incidentTitle": "@solana/web3.js npm package backdoored to steal private keys", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-12-03", "title": "Malicious 1.95.6 and 1.95.7 published to npm (15:20-20:25 UTC), then unpublished", "body": null, "sourceUrl": "https://github.com/solana-labs/solana-web3.js/security/advisories/GHSA-jcxm-7wvp-g6p5", "url": "https://pwn.watch/i/solana-web3-js-npm-compromise-cve-2024-54134" }, { "incident": "lottiefiles-lottie-player-npm-compromise", "incidentTitle": "@lottiefiles/lottie-player npm package hijacked with a crypto wallet drainer", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-10-30", "title": "Malicious 2.0.5, 2.0.6 and 2.0.7 pushed to npm; users report a wallet popup", "body": null, "sourceUrl": "https://github.com/LottieFiles/lottie-player/issues/254", "url": "https://pwn.watch/i/lottiefiles-lottie-player-npm-compromise" }, { "incident": "lottiefiles-lottie-player-npm-compromise", "incidentTitle": "@lottiefiles/lottie-player npm package hijacked with a crypto wallet drainer", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-10-30", "title": "LottieFiles removes the compromised access, unpublishes the versions and publishes 2.0.8", "body": null, "sourceUrl": "https://github.com/LottieFiles/lottie-player/issues/254", "url": "https://pwn.watch/i/lottiefiles-lottie-player-npm-compromise" }, { "incident": "ledger-connect-kit-npm-supply-chain-2023", "incidentTitle": "Ledger Connect Kit npm package hijacked to drain crypto wallets", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-12-14", "title": "Malicious connect-kit versions published to npm via a phished ex-employee account; Ledger ships 1.1.8 and the npm versions are removed", "body": null, "sourceUrl": "https://www.ledger.com/blog/security-incident-report", "url": "https://pwn.watch/i/ledger-connect-kit-npm-supply-chain-2023" }, { "incident": "http2-rapid-reset-ddos-cve-2023-44487", "incidentTitle": "HTTP/2 Rapid Reset: record-breaking DDoS attacks (CVE-2023-44487)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-10-10", "title": "Coordinated disclosure by Google, Cloudflare and AWS; CISA adds CVE-2023-44487 to KEV", "body": null, "sourceUrl": "https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack", "url": "https://pwn.watch/i/http2-rapid-reset-ddos-cve-2023-44487" }, { "incident": "libwebp-heap-overflow-cve-2023-4863", "incidentTitle": "libwebp heap overflow exploited in the wild (CVE-2023-4863)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-09-13", "title": "CISA adds CVE-2023-4863 to the KEV catalog", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/libwebp-heap-overflow-cve-2023-4863" }, { "incident": "libwebp-heap-overflow-cve-2023-4863", "incidentTitle": "libwebp heap overflow exploited in the wild (CVE-2023-4863)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-09-11", "title": "Chrome stable update fixes CVE-2023-4863; Google says an exploit exists in the wild", "body": null, "sourceUrl": "https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html", "url": "https://pwn.watch/i/libwebp-heap-overflow-cve-2023-4863" }, { "incident": "http2-rapid-reset-ddos-cve-2023-44487", "incidentTitle": "HTTP/2 Rapid Reset: record-breaking DDoS attacks (CVE-2023-44487)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-08-25", "title": "Cloudflare starts seeing unusually large HTTP/2 attacks", "body": null, "sourceUrl": "https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/", "url": "https://pwn.watch/i/http2-rapid-reset-ddos-cve-2023-44487" } ] }