wolfi/lerna

Vulnerabilities (65)

• CVE-2026-53655Jun 15, 2026
  affected < 9.0.7-r10fixed 9.0.7-r10

  ### Summary `tar` (node-tar) applies a PAX extended header's `size=` record (and other PAX overrides) to the **next header entry of any type**, including intermediary metadata headers such as a GNU long-name (`L`) or long-link (`K`) entry. Per POSIX pax, a PAX extended header (`

• CVE-2026-53550Jun 15, 2026
  affected < 9.0.7-r10fixed 9.0.7-r10

  ### Summary A crafted YAML document can trigger algorithmic CPU exhaustion in `js-yaml` merge-key processing (`<<`) by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event

• CVE-2026-12143HigJun 12, 2026
  affected < 9.0.7-r9fixed 9.0.7-r9

  form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Disposition` header without escaping carriage return (CR), line fee

• CVE-2026-49982HigJun 11, 2026
  affected < 9.0.7-r9fixed 9.0.7-r9

  tmp is a temporary file and directory creator for node.js. In version 0.2.6, the _assertPath guard added to tmp rejects only string values that contain the substring ... It is bypassed when prefix, postfix, or template is supplied as a non-string value (Array, Buffer, or any obje

• CVE-2026-44705HigJun 11, 2026
  affected < 9.0.7-r6fixed 9.0.7-r6

  tmp is a temporary file and directory creator for node.js. Prior to 0.2.6, the tmp npm package contains a path traversal vulnerability that allows escaping the intended temporary directory when untrusted data flows into the prefix, postfix, or dir options. By embedding traversal

• CVE-2026-44494HigJun 11, 2026
  affected < 9.0.7-r7fixed 9.0.7-r7

  Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.16.0, the Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution in the application's dependency tree to be escalated into a full Man-

• CVE-2026-44492HigJun 11, 2026
  affected < 9.0.7-r7fixed 9.0.7-r7

  Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios does not normalise IPv4-mapped IPv6 addresses. When NO_PROXY lists an IPv4 address such as 127.0.0.1 or 169.254.169.254, a request URL using the IPv4-mapped IPv6 form (::ffff:7f00:

• CVE-2026-44490MedJun 11, 2026
  affected < 9.0.7-r7fixed 9.0.7-r7

  Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, axios exposes two read-side prototype-pollution gadgets. When Object.prototype is polluted by an upstream dependency in the same process (e.g. lodash _.merge / CVE-2018-16487), axios sil

• CVE-2026-44489LowJun 11, 2026
  affected < 9.0.7-r7fixed 9.0.7-r7

  Axios is a promise based HTTP client for the browser and Node.js. From 1.15.2 to before 1.16.0, nested objects created by utils.merge() (e.g., config.proxy) are still constructed as plain {} with Object.prototype in their chain. The setProxy() function at lib/adapters/http.js:209

• CVE-2026-45149MedMay 29, 2026
  affected < 9.0.7-r5fixed 9.0.7-r5

  The brace-expansion library generates arbitrary strings containing a common prefix and suffix. From 5.0.0 to before 5.0.6, the max option was being applied too late. When expanding a single large numeric range like {1..10000000}, the sequence generation loop generates all 10 mill

• CVE-2026-42338MedMay 12, 2026
  affected < 9.0.7-r4fixed 9.0.7-r4

  ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage (emi

• CVE-2026-42264HigMay 8, 2026
  affected < 9.0.7-r4fixed 9.0.7-r4

  Axios is a promise based HTTP client for the browser and Node.js. From version 1.0.0 to before version 1.15.2, fFive config properties (auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser) in the HTTP adapter are read via direct property access without hasOwnPropert

• CVE-2026-42044MedApr 24, 2026
  affected < 9.0.7-r4fixed 9.0.7-r4

  Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.2, he Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution in the application's dependency tree to be escalated into surgical, in

• CVE-2026-42043HigApr 24, 2026
  affected < 9.0.7-r4fixed 9.0.7-r4

  Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, an attacker who can influence the target URL of an Axios request can use any address in the 127.0.0.0/8 range (other than 127.0.0.1) to completely bypass the NO_PROXY protection. This vu

• CVE-2026-42042MedApr 24, 2026
  affected < 9.0.7-r4fixed 9.0.7-r4

  Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library's XSRF token protection logic uses JavaScript truthy/falsy semantics instead of strict boolean comparison for the withXSRFToken config property. When this property is s

• CVE-2026-42041MedApr 24, 2026
  affected < 9.0.7-r4fixed 9.0.7-r4

  Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution to silently suppress all HTTP error responses (401, 403, 500, etc.), c

• CVE-2026-42040LowApr 24, 2026
  affected < 9.0.7-r4fixed 9.0.7-r4

  Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the encode() function in lib/helpers/AxiosURLSearchParams.js contains a character mapping (charMap) at line 21 that reverses the safe percent-encoding of null bytes. After encodeURICompo

• CVE-2026-42039HigApr 24, 2026
  affected < 9.0.7-r4fixed 9.0.7-r4

  Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects with no depth limit, so a deeply nested value passed as request data crashes the Node.js process with a RangeError. This vulnerability is fixe

• CVE-2026-42038MedApr 24, 2026
  affected < 9.0.7-r4fixed 9.0.7-r4

  Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, he fix for no_proxy hostname normalization bypass is incomplete. When no_proxy=localhost is set, requests to 127.0.0.1 and [::1] still route through the proxy instead of bypassing it. Th

• CVE-2026-42037MedApr 24, 2026
  affected < 9.0.7-r4fixed 9.0.7-r4

  Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.1, the FormDataPart constructor in lib/helpers/formDataToStream.js interpolates value.type directly into the Content-Type header of each multipart part without sanitizing CRLF (\r\n) seque