pwn.watch: Node.js incident updates https://pwn.watch/t/node Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Thu, 22 Oct 2026 16:23:59 GMT [critical] Next.js out-of-band release fixes two unauthenticated RCEs (SVG image optimization CVE-2026-96889, use cache): GitHub publishes GHSA-2464-fhr4-w9xw to the global Advisory Database (critical), so Dependabot and npm audit start flagging affected next versions. https://pwn.watch/i/nextjs-october-2026-rce-security-release nextjs-october-2026-rce-security-release:2026-10-22:GitHub publishes GHSA-2464-fhr4-w9xw to the global Advisory Database (critical), so Dependabot and npm audit start flagging affected next versions. Thu, 22 Oct 2026 00:00:00 GMT critical Source: https://github.com/advisories/GHSA-2464-fhr4-w9xw Status: live, patched [high] Node.js October 2026 security releases (Brotli RCE + TLS/DNS highs): Node.js published the Wednesday security releases and advisory. https://pwn.watch/i/nodejs-october-2026-security-releases nodejs-october-2026-security-releases:2026-10-21:Node.js published the Wednesday security releases and advisory. Wed, 21 Oct 2026 00:00:00 GMT high Status: live, patched [high] Node.js October 2026 security releases (Brotli RCE + TLS/DNS highs): Vercel deployed WAF rules for the Brotli attack vector and began rolling patched runtimes. https://pwn.watch/i/nodejs-october-2026-security-releases nodejs-october-2026-security-releases:2026-10-21:Vercel deployed WAF rules for the Brotli attack vector and began rolling patched runtimes. Wed, 21 Oct 2026 00:00:00 GMT high Status: live, patched [critical] Next.js out-of-band release fixes two unauthenticated RCEs (SVG image optimization CVE-2026-96889, use cache): Vercel releases Next.js 16.4.1 and 15.5.28 as an out-of-band security update: two critical unauthenticated RCEs (SVG Image Optimization, `use cache` typed arrays) and a high-severity Server Actions DoS. No workaround for the `use cache` bug; upgrade even if you don't use those features. https://pwn.watch/i/nextjs-october-2026-rce-security-release nextjs-october-2026-rce-security-release:2026-10-14:Vercel releases Next.js 16.4.1 and 15.5.28 as an out-of-band security update: two critical unauthenticated RCEs (SVG Image Optimization, `use cache` typed arrays) and a high-severity Server Actions DoS. No workaround for the `use cache` bug; upgrade even if you don't use those features. Wed, 14 Oct 2026 00:00:00 GMT critical Source: https://nextjs.org/blog/nextjs-security-update-october-14-2026 Status: live, patched [critical] Next.js out-of-band release fixes two unauthenticated RCEs (SVG image optimization CVE-2026-96889, use cache): Netlify: the SVG flaw is also reachable through `next/og` ImageResponse; on Netlify the next/image path runs on its Image CDN, and impact there is a crashed function, not code execution. https://pwn.watch/i/nextjs-october-2026-rce-security-release nextjs-october-2026-rce-security-release:2026-10-14:Netlify: the SVG flaw is also reachable through `next/og` ImageResponse; on Netlify the next/image path runs on its Image CDN, and impact there is a crashed function, not code execution. Wed, 14 Oct 2026 00:00:00 GMT critical Source: https://www.netlify.com/changelog/2026-10-14-nextjs-react-security-vulnerabilities/ Status: live, patched [critical] SubQuery @subql/common 5.8.3 published with credential stealer + backdoor: SubQuery maintainer: compromised token deleted, security review started. https://pwn.watch/i/subql-common-npm-backdoor subql-common-npm-backdoor:2026-10-10:SubQuery maintainer: compromised token deleted, security review started. Sat, 10 Oct 2026 00:00:00 GMT critical Source: https://github.com/subquery/subql/issues/3047 Status: closed, patched [critical] tensorlake@0.5.144 npm Shai-Hulud worm with hostage GitHub token: 0.5.144 published via the project’s release workflow. https://pwn.watch/i/tensorlake-npm-shai-hulud-worm tensorlake-npm-shai-hulud-worm:2026-10-08:0.5.144 published via the project’s release workflow. Thu, 08 Oct 2026 00:00:00 GMT critical Status: live, partial [critical] tensorlake@0.5.144 npm Shai-Hulud worm with hostage GitHub token: StepSecurity / Socket detections and public write-ups; remediation guidance emphasizes removing gh-token-monitor before revoke. https://pwn.watch/i/tensorlake-npm-shai-hulud-worm tensorlake-npm-shai-hulud-worm:2026-10-08+:StepSecurity / Socket detections and public write-ups; remediation guidance emphasizes removing gh-token-monitor before revoke. Thu, 08 Oct 2026 00:00:00 GMT critical Status: live, partial [critical] tensorlake@0.5.144 npm Shai-Hulud worm with hostage GitHub token: Malicious commits land on tensorlakeai/tensorlake main. https://pwn.watch/i/tensorlake-npm-shai-hulud-worm tensorlake-npm-shai-hulud-worm:2026-10-07:Malicious commits land on tensorlakeai/tensorlake main. Wed, 07 Oct 2026 00:00:00 GMT critical Status: live, partial [critical] SubQuery @subql/common 5.8.3 published with credential stealer + backdoor: GMO Flatt Security publishes payload analysis and response guidance. https://pwn.watch/i/subql-common-npm-backdoor subql-common-npm-backdoor:2026-10-06:GMO Flatt Security publishes payload analysis and response guidance. Tue, 06 Oct 2026 00:00:00 GMT critical Source: https://flatt.tech/research/posts/subql-common-npm-supply-chain-attack/ Status: closed, patched [critical] SubQuery @subql/common 5.8.3 published with credential stealer + backdoor: Malicious @subql/common 5.8.3 published via the repo's GitHub Actions trusted publisher (canary 5.8.3-onf-rt1 published ~32 min earlier). https://pwn.watch/i/subql-common-npm-backdoor subql-common-npm-backdoor:2026-10-05T11:56Z:Malicious @subql/common 5.8.3 published via the repo's GitHub Actions trusted publisher (canary 5.8.3-onf-rt1 published ~32 min earlier). Mon, 05 Oct 2026 00:00:00 GMT critical Source: https://www.stepsecurity.io/blog/subql-ecosystem-compromised Status: closed, patched [critical] SubQuery @subql/common 5.8.3 published with credential stealer + backdoor: StepSecurity opens security issue #3047 in subquery/subql. https://pwn.watch/i/subql-common-npm-backdoor subql-common-npm-backdoor:2026-10-05T12:14Z:StepSecurity opens security issue #3047 in subquery/subql. Mon, 05 Oct 2026 00:00:00 GMT critical Source: https://github.com/subquery/subql/issues/3047 Status: closed, patched [critical] SubQuery @subql/common 5.8.3 published with credential stealer + backdoor: GitHub publishes malware advisory GHSA-9333-3c4x-x3h5; version removed from npm (~50 minutes live); 'latest' back to 5.8.2. https://pwn.watch/i/subql-common-npm-backdoor subql-common-npm-backdoor:2026-10-05T12:46Z:GitHub publishes malware advisory GHSA-9333-3c4x-x3h5; version removed from npm (~50 minutes live); 'latest' back to 5.8.2. Mon, 05 Oct 2026 00:00:00 GMT critical Source: https://github.com/advisories/GHSA-9333-3c4x-x3h5 Status: closed, patched [critical] Next.js out-of-band release fixes two unauthenticated RCEs (SVG image optimization CVE-2026-96889, use cache): sharp 0.35.5 ships with librsvg 2.63.2; sharp's advisory GHSA-wq5f-xc86-pv6w later covers CVE-2026-96889 (use-after-free in librsvg). https://pwn.watch/i/nextjs-october-2026-rce-security-release nextjs-october-2026-rce-security-release:2026-09-27:sharp 0.35.5 ships with librsvg 2.63.2; sharp's advisory GHSA-wq5f-xc86-pv6w later covers CVE-2026-96889 (use-after-free in librsvg). Sun, 27 Sep 2026 00:00:00 GMT critical Source: https://github.com/advisories/GHSA-wq5f-xc86-pv6w Status: live, patched [critical] CHAINDROP / Mini Shai-Hulud npm worm (keyv + 400+ packages): keyv/cacheable malicious releases observed; worm begins propagating. https://pwn.watch/i/shai-hulud-chaindrop-npm-keyv-august shai-hulud-chaindrop-npm-keyv-august:2026-08-04:keyv/cacheable malicious releases observed; worm begins propagating. Tue, 04 Aug 2026 00:00:00 GMT critical Status: closed, partial [critical] CHAINDROP / Mini Shai-Hulud npm worm (keyv + 400+ packages): Microsoft, Elastic, JFrog publish analyses; 400+ packages listed. https://pwn.watch/i/shai-hulud-chaindrop-npm-keyv-august shai-hulud-chaindrop-npm-keyv-august:2026-08-04/06:Microsoft, Elastic, JFrog publish analyses; 400+ packages listed. Tue, 04 Aug 2026 00:00:00 GMT critical Status: closed, partial [high] Nx Nx Console: Nx Console Embedded Malicious Code Vulnerability: CISA added CVE-2026-48027 to the KEV catalog (due 2026-06-10). https://pwn.watch/i/nx-nx-console-cve-2026-48027 nx-nx-console-cve-2026-48027:2026-05-27:CISA added CVE-2026-48027 to the KEV catalog (due 2026-06-10). Wed, 27 May 2026 00:00:00 GMT high Status: closed, patched [high] TanStack TanStack: TanStack Unspecified Vulnerability: CISA added CVE-2026-45321 to the KEV catalog (due 2026-06-10). https://pwn.watch/i/tanstack-tanstack-cve-2026-45321 tanstack-tanstack-cve-2026-45321:2026-05-27:CISA added CVE-2026-45321 to the KEV catalog (due 2026-06-10). Wed, 27 May 2026 00:00:00 GMT high Status: closed, patched [high] React Native Community CLI: React Native Community CLI OS Command Injection Vulnerability: CISA added CVE-2025-11953 to the KEV catalog (due 2026-02-26). https://pwn.watch/i/react-native-community-cli-cve-2025-11953 react-native-community-cli-cve-2025-11953:2026-02-05:CISA added CVE-2025-11953 to the KEV catalog (due 2026-02-26). Thu, 05 Feb 2026 00:00:00 GMT high Status: closed, patched [critical] React2Shell: CVSS 10 unauthenticated RCE in React Server Components and Next.js: Unit 42 updates its threat brief on ongoing exploitation https://pwn.watch/i/react2shell-react-server-components-cve-2025-55182 react2shell-react-server-components-cve-2025-55182:2025-12-12:Unit 42 updates its threat brief on ongoing exploitation Fri, 12 Dec 2025 00:00:00 GMT critical Source: https://unit42.paloaltonetworks.com/cve-2025-55182-react-and-cve-2025-66478-next/ Status: closed, patched [critical] React2Shell: CVSS 10 unauthenticated RCE in React Server Components and Next.js: CISA adds CVE-2025-55182 to KEV https://pwn.watch/i/react2shell-react-server-components-cve-2025-55182 react2shell-react-server-components-cve-2025-55182:2025-12-05:CISA adds CVE-2025-55182 to KEV Fri, 05 Dec 2025 00:00:00 GMT critical Status: closed, patched [critical] React2Shell: CVSS 10 unauthenticated RCE in React Server Components and Next.js: React discloses a critical vulnerability in React Server Components and ships fixes https://pwn.watch/i/react2shell-react-server-components-cve-2025-55182 react2shell-react-server-components-cve-2025-55182:2025-12-03:React discloses a critical vulnerability in React Server Components and ships fixes Wed, 03 Dec 2025 00:00:00 GMT critical Source: https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components Status: closed, patched [critical] React2Shell: CVSS 10 unauthenticated RCE in React Server Components and Next.js: AWS sees China-nexus groups exploiting it within hours https://pwn.watch/i/react2shell-react-server-components-cve-2025-55182 react2shell-react-server-components-cve-2025-55182:2025-12-03:AWS sees China-nexus groups exploiting it within hours Wed, 03 Dec 2025 00:00:00 GMT critical Including Earth Lamia and Jackpot Panda. Source: https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/ Status: closed, patched [critical] Shai-Hulud 2.0: worm backdoors ~800 npm packages incl. Zapier, PostHog, Postman, ENS: GitHub privatizes malicious repos; public count drops to ~300 https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025 shai-hulud-2-npm-worm-november-2025:2025-11-26:GitHub privatizes malicious repos; public count drops to ~300 Wed, 26 Nov 2025 00:00:00 GMT critical Source: https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack Status: closed, patched [critical] Shai-Hulud 2.0: worm backdoors ~800 npm packages incl. Zapier, PostHog, Postman, ENS: PostHog publishes its post-mortem https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025 shai-hulud-2-npm-worm-november-2025:2025-11-26:PostHog publishes its post-mortem Wed, 26 Nov 2025 00:00:00 GMT critical Source: https://posthog.com/blog/nov-24-shai-hulud-attack-post-mortem Status: closed, patched [critical] Shai-Hulud 2.0: worm backdoors ~800 npm packages incl. Zapier, PostHog, Postman, ENS: First compromised package published (03:10 UTC) https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025 shai-hulud-2-npm-worm-november-2025:2025-11-24:First compromised package published (03:10 UTC) Mon, 24 Nov 2025 00:00:00 GMT critical Source: https://panther.com/blog/a-data-driven-analysis-of-the-sha1-hulud-2-0-campaign Status: closed, patched [critical] Shai-Hulud 2.0: worm backdoors ~800 npm packages incl. Zapier, PostHog, Postman, ENS: PostHog SDKs compromised (04:11 UTC); removed and tokens revoked by 09:30 UTC https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025 shai-hulud-2-npm-worm-november-2025:2025-11-24:PostHog SDKs compromised (04:11 UTC); removed and tokens revoked by 09:30 UTC Mon, 24 Nov 2025 00:00:00 GMT critical Source: https://posthog.com/blog/nov-24-shai-hulud-attack-post-mortem Status: closed, patched [critical] Shai-Hulud 2.0: worm backdoors ~800 npm packages incl. Zapier, PostHog, Postman, ENS: Postman unpublishes 17 infected packages (51 versions) https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025 shai-hulud-2-npm-worm-november-2025:2025-11-24:Postman unpublishes 17 infected packages (51 versions) Mon, 24 Nov 2025 00:00:00 GMT critical Source: https://blog.postman.com/engineering/shai-hulud-2-0-npm-supply-chain-attack/ Status: closed, patched [critical] Shai-Hulud 2.0: worm backdoors ~800 npm packages incl. Zapier, PostHog, Postman, ENS: Last compromised package seen (~17:00-18:00 UTC) https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025 shai-hulud-2-npm-worm-november-2025:2025-11-24:Last compromised package seen (~17:00-18:00 UTC) Mon, 24 Nov 2025 00:00:00 GMT critical Source: https://securitylabs.datadoghq.com/articles/shai-hulud-2.0-npm-worm/ Status: closed, patched [critical] Shai-Hulud: first self-replicating npm worm hits 500+ packages incl. @ctrl/tinycolor and CrowdStrike: CISA alert: widespread supply chain compromise impacting npm (500+ packages) https://pwn.watch/i/shai-hulud-npm-worm-september-2025 shai-hulud-npm-worm-september-2025:2025-09-23:CISA alert: widespread supply chain compromise impacting npm (500+ packages) Tue, 23 Sep 2025 00:00:00 GMT critical Source: https://www.cisa.gov/news-events/alerts/2025/09/23/widespread-supply-chain-compromise-impacting-npm-ecosystem Status: closed, patched [critical] Shai-Hulud: first self-replicating npm worm hits 500+ packages incl. @ctrl/tinycolor and CrowdStrike: Largest burst, nearly 100 packages, including @crowdstrike scope https://pwn.watch/i/shai-hulud-npm-worm-september-2025 shai-hulud-npm-worm-september-2025:2025-09-16:Largest burst, nearly 100 packages, including @crowdstrike scope Tue, 16 Sep 2025 00:00:00 GMT critical Source: https://socket.dev/blog/ongoing-supply-chain-attack-targets-crowdstrike-npm-packages Status: closed, patched [critical] Shai-Hulud: first self-replicating npm worm hits 500+ packages incl. @ctrl/tinycolor and CrowdStrike: Worm discovered; @ctrl/tinycolor and ~40 packages found compromised https://pwn.watch/i/shai-hulud-npm-worm-september-2025 shai-hulud-npm-worm-september-2025:2025-09-15:Worm discovered; @ctrl/tinycolor and ~40 packages found compromised Mon, 15 Sep 2025 00:00:00 GMT critical Source: https://www.sysdig.com/blog/shai-hulud-the-novel-self-replicating-worm-infecting-hundreds-of-npm-packages Status: closed, patched [critical] chalk, debug and 16 other npm packages (2B+ weekly downloads) hijacked via fake 2FA email: Initial CVEs posted https://pwn.watch/i/chalk-debug-npm-hijack-september-2025 chalk-debug-npm-hijack-september-2025:2025-09-15:Initial CVEs posted Mon, 15 Sep 2025 00:00:00 GMT critical Source: https://github.com/debug-js/debug/issues/1005 Status: closed, patched [critical] Shai-Hulud: first self-replicating npm worm hits 500+ packages incl. @ctrl/tinycolor and CrowdStrike: First compromised versions published (17:58 UTC) https://pwn.watch/i/shai-hulud-npm-worm-september-2025 shai-hulud-npm-worm-september-2025:2025-09-14:First compromised versions published (17:58 UTC) Sun, 14 Sep 2025 00:00:00 GMT critical Source: https://socket.dev/blog/ongoing-supply-chain-attack-targets-crowdstrike-npm-packages Status: closed, patched [critical] chalk, debug and 16 other npm packages (2B+ weekly downloads) hijacked via fake 2FA email: All remaining affected packages republished by the maintainer https://pwn.watch/i/chalk-debug-npm-hijack-september-2025 chalk-debug-npm-hijack-september-2025:2025-09-13:All remaining affected packages republished by the maintainer Sat, 13 Sep 2025 00:00:00 GMT critical Source: https://github.com/debug-js/debug/issues/1005 Status: closed, patched [critical] chalk, debug and 16 other npm packages (2B+ weekly downloads) hijacked via fake 2FA email: Malicious versions start appearing on npm (13:16 UTC) https://pwn.watch/i/chalk-debug-npm-hijack-september-2025 chalk-debug-npm-hijack-september-2025:2025-09-08:Malicious versions start appearing on npm (13:16 UTC) Mon, 08 Sep 2025 00:00:00 GMT critical Source: https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised Status: closed, patched [critical] chalk, debug and 16 other npm packages (2B+ weekly downloads) hijacked via fake 2FA email: Sindre Sorhus publishes clean chalk-family versions over the compromised ones https://pwn.watch/i/chalk-debug-npm-hijack-september-2025 chalk-debug-npm-hijack-september-2025:2025-09-08:Sindre Sorhus publishes clean chalk-family versions over the compromised ones Mon, 08 Sep 2025 00:00:00 GMT critical Source: https://github.com/chalk/chalk/issues/656 Status: closed, patched [critical] chalk, debug and 16 other npm packages (2B+ weekly downloads) hijacked via fake 2FA email: npm takes down all impacted versions (21:59 CEST); maintainer account restored (23:48 CEST) https://pwn.watch/i/chalk-debug-npm-hijack-september-2025 chalk-debug-npm-hijack-september-2025:2025-09-08:npm takes down all impacted versions (21:59 CEST); maintainer account restored (23:48 CEST) Mon, 08 Sep 2025 00:00:00 GMT critical Source: https://github.com/debug-js/debug/issues/1005 Status: closed, patched [critical] s1ngularity: malicious Nx releases used AI CLIs to hunt secrets, 5,500+ private repos exposed: Second phase: 5,500+ private repos of 400+ users/orgs made public with stolen tokens https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025 nx-s1ngularity-npm-supply-chain-august-2025:2025-08-28/29:Second phase: 5,500+ private repos of 400+ users/orgs made public with stolen tokens Thu, 28 Aug 2025 00:00:00 GMT critical Source: https://www.wiz.io/blog/s1ngularity-supply-chain-attack Status: closed, patched [critical] s1ngularity: malicious Nx releases used AI CLIs to hunt secrets, 5,500+ private repos exposed: GitHub disables attacker-created s1ngularity repositories (09:00 UTC) https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025 nx-s1ngularity-npm-supply-chain-august-2025:2025-08-27:GitHub disables attacker-created s1ngularity repositories (09:00 UTC) Wed, 27 Aug 2025 00:00:00 GMT critical Source: https://www.wiz.io/blog/s1ngularity-supply-chain-attack Status: closed, patched [critical] s1ngularity: malicious Nx releases used AI CLIs to hunt secrets, 5,500+ private repos exposed: Malicious nx 21.5.0 and others published; npm removes them and revokes tokens that evening https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025 nx-s1ngularity-npm-supply-chain-august-2025:2025-08-26:Malicious nx 21.5.0 and others published; npm removes them and revokes tokens that evening Tue, 26 Aug 2025 00:00:00 GMT critical Source: https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c Status: closed, patched [critical] s1ngularity: malicious Nx releases used AI CLIs to hunt secrets, 5,500+ private repos exposed: Attacker exploits the workflow and exfiltrates the npm token https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025 nx-s1ngularity-npm-supply-chain-august-2025:2025-08-24:Attacker exploits the workflow and exfiltrates the npm token Sun, 24 Aug 2025 00:00:00 GMT critical Source: https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c Status: closed, patched [critical] s1ngularity: malicious Nx releases used AI CLIs to hunt secrets, 5,500+ private repos exposed: A PR adds a GitHub Actions workflow with an injection bug to nrwl/nx https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025 nx-s1ngularity-npm-supply-chain-august-2025:2025-08-21:A PR adds a GitHub Actions workflow with an injection bug to nrwl/nx Thu, 21 Aug 2025 00:00:00 GMT critical Source: https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c Status: closed, patched [high] eslint-config-prettier and friends hijacked via npnjs.com phishing (CVE-2025-54313): Malicious 'is' package versions found in the same campaign https://pwn.watch/i/eslint-config-prettier-npm-phishing-cve-2025-54313 eslint-config-prettier-npm-phishing-cve-2025-54313:2025-07-22:Malicious 'is' package versions found in the same campaign Tue, 22 Jul 2025 00:00:00 GMT high Source: https://socket.dev/blog/npm-is-package-hijacked-in-expanding-supply-chain-attack Status: closed, patched [high] eslint-config-prettier and friends hijacked via npnjs.com phishing (CVE-2025-54313): Malicious eslint-config-prettier versions published after maintainer phishing https://pwn.watch/i/eslint-config-prettier-npm-phishing-cve-2025-54313 eslint-config-prettier-npm-phishing-cve-2025-54313:2025-07-18:Malicious eslint-config-prettier versions published after maintainer phishing Fri, 18 Jul 2025 00:00:00 GMT high Source: https://www.cve.org/CVERecord?id=CVE-2025-54313 Status: closed, patched [critical] Next.js middleware authorization bypass via x-middleware-subrequest (CVE-2025-29927): Vercel publishes a postmortem on the bypass and its disclosure handling https://pwn.watch/i/nextjs-middleware-auth-bypass-cve-2025-29927 nextjs-middleware-auth-bypass-cve-2025-29927:2025-03-22:Vercel publishes a postmortem on the bypass and its disclosure handling Sat, 22 Mar 2025 00:00:00 GMT critical Source: https://vercel.com/blog/postmortem-on-next-js-middleware-bypass Status: closed, patched [critical] Next.js middleware authorization bypass via x-middleware-subrequest (CVE-2025-29927): Next.js publishes advisory GHSA-f82v-jwr5-mffw https://pwn.watch/i/nextjs-middleware-auth-bypass-cve-2025-29927 nextjs-middleware-auth-bypass-cve-2025-29927:2025-03-21:Next.js publishes advisory GHSA-f82v-jwr5-mffw Fri, 21 Mar 2025 00:00:00 GMT critical Source: https://github.com/vercel/next.js/security/advisories/GHSA-f82v-jwr5-mffw Status: closed, patched [medium] JQuery: Cross-Site Scripting (XSS) Vulnerability: CISA added CVE-2020-11023 to the KEV catalog (due 2025-02-13). https://pwn.watch/i/jquery-cve-2020-11023 jquery-cve-2020-11023:2025-01-23:CISA added CVE-2020-11023 to the KEV catalog (due 2025-02-13). Thu, 23 Jan 2025 00:00:00 GMT medium Status: closed, patched [high] @solana/web3.js npm package backdoored to steal private keys: GitHub advisory GHSA-jcxm-7wvp-g6p5 published; upgrade to 1.95.8 https://pwn.watch/i/solana-web3-js-npm-compromise-cve-2024-54134 solana-web3-js-npm-compromise-cve-2024-54134:2024-12-04:GitHub advisory GHSA-jcxm-7wvp-g6p5 published; upgrade to 1.95.8 Wed, 04 Dec 2024 00:00:00 GMT high Source: https://github.com/solana-labs/solana-web3.js/security/advisories/GHSA-jcxm-7wvp-g6p5 Status: closed, patched [high] @solana/web3.js npm package backdoored to steal private keys: Malicious 1.95.6 and 1.95.7 published to npm (15:20-20:25 UTC), then unpublished https://pwn.watch/i/solana-web3-js-npm-compromise-cve-2024-54134 solana-web3-js-npm-compromise-cve-2024-54134:2024-12-03:Malicious 1.95.6 and 1.95.7 published to npm (15:20-20:25 UTC), then unpublished Tue, 03 Dec 2024 00:00:00 GMT high Source: https://github.com/solana-labs/solana-web3.js/security/advisories/GHSA-jcxm-7wvp-g6p5 Status: closed, patched [high] @lottiefiles/lottie-player npm package hijacked with a crypto wallet drainer: Malicious 2.0.5, 2.0.6 and 2.0.7 pushed to npm; users report a wallet popup https://pwn.watch/i/lottiefiles-lottie-player-npm-compromise lottiefiles-lottie-player-npm-compromise:2024-10-30:Malicious 2.0.5, 2.0.6 and 2.0.7 pushed to npm; users report a wallet popup Wed, 30 Oct 2024 00:00:00 GMT high Source: https://github.com/LottieFiles/lottie-player/issues/254 Status: closed, patched [high] @lottiefiles/lottie-player npm package hijacked with a crypto wallet drainer: LottieFiles removes the compromised access, unpublishes the versions and publishes 2.0.8 https://pwn.watch/i/lottiefiles-lottie-player-npm-compromise lottiefiles-lottie-player-npm-compromise:2024-10-30:LottieFiles removes the compromised access, unpublishes the versions and publishes 2.0.8 Wed, 30 Oct 2024 00:00:00 GMT high Source: https://github.com/LottieFiles/lottie-player/issues/254 Status: closed, patched [critical] Ledger Connect Kit npm package hijacked to drain crypto wallets: Malicious connect-kit versions published to npm via a phished ex-employee account; Ledger ships 1.1.8 and the npm versions are removed https://pwn.watch/i/ledger-connect-kit-npm-supply-chain-2023 ledger-connect-kit-npm-supply-chain-2023:2023-12-14:Malicious connect-kit versions published to npm via a phished ex-employee account; Ledger ships 1.1.8 and the npm versions are removed Thu, 14 Dec 2023 00:00:00 GMT critical Source: https://www.ledger.com/blog/security-incident-report Status: closed, patched [high] HTTP/2 Rapid Reset: record-breaking DDoS attacks (CVE-2023-44487): Coordinated disclosure by Google, Cloudflare and AWS; CISA adds CVE-2023-44487 to KEV https://pwn.watch/i/http2-rapid-reset-ddos-cve-2023-44487 http2-rapid-reset-ddos-cve-2023-44487:2023-10-10:Coordinated disclosure by Google, Cloudflare and AWS; CISA adds CVE-2023-44487 to KEV Tue, 10 Oct 2023 00:00:00 GMT high Source: https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack Status: closed, patched [high] libwebp heap overflow exploited in the wild (CVE-2023-4863): CISA adds CVE-2023-4863 to the KEV catalog https://pwn.watch/i/libwebp-heap-overflow-cve-2023-4863 libwebp-heap-overflow-cve-2023-4863:2023-09-13:CISA adds CVE-2023-4863 to the KEV catalog Wed, 13 Sep 2023 00:00:00 GMT high Status: closed, patched [high] libwebp heap overflow exploited in the wild (CVE-2023-4863): Chrome stable update fixes CVE-2023-4863; Google says an exploit exists in the wild https://pwn.watch/i/libwebp-heap-overflow-cve-2023-4863 libwebp-heap-overflow-cve-2023-4863:2023-09-11:Chrome stable update fixes CVE-2023-4863; Google says an exploit exists in the wild Mon, 11 Sep 2023 00:00:00 GMT high Source: https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html Status: closed, patched [high] HTTP/2 Rapid Reset: record-breaking DDoS attacks (CVE-2023-44487): Cloudflare starts seeing unusually large HTTP/2 attacks https://pwn.watch/i/http2-rapid-reset-ddos-cve-2023-44487 http2-rapid-reset-ddos-cve-2023-44487:2023-08-25:Cloudflare starts seeing unusually large HTTP/2 attacks Fri, 25 Aug 2023 00:00:00 GMT high Source: https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/ Status: closed, patched