OP
Vendor
Openjsf
29
CVEs
0
On KEV
0
New 30D
Products
FA7.5
Fast-uri
Openjsf
11 CVEs0 on KEV0 new
EX7.5
Express
Openjsf
5 CVEs0 on KEV0 new
BO7.5
Body-parser
Openjsf
2 CVEs0 on KEV0 new
DI5.4
Dijit
Openjsf
1 CVEs0 on KEV0 new
EL7.5
Electroncord
Openjsf
1 CVEs0 on KEV0 new
ES5.5
Eslint
Openjsf
1 CVEs0 on KEV0 new
MA6.4
Marko
Openjsf
1 CVEs0 on KEV0 new
MA6.4
Marko/runtime-tags
Openjsf
1 CVEs0 on KEV0 new
ME7.5
Messageformat
Openjsf
1 CVEs0 on KEV0 new
NV7.5
Node Version Manager
Openjsf
1 CVEs0 on KEV0 new
PA7.5
Packager
Openjsf
1 CVEs0 on KEV0 new
SE6.1
Serve-index
Openjsf
1 CVEs0 on KEV0 new
SE4.7
Serve-static
Openjsf
1 CVEs0 on KEV0 new
WE9.8
Webdriverio
Openjsf
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-84394 | FA Fast-uri Openjsf | 7.5 | Sep 2 | fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority |
| CVE-2026-84292 | FA Fast-uri Openjsf | 7.5 | Sep 2 | fast-uri vulnerable to authority injection via an unvalidated port in serialize |
| CVE-2026-76172 | FA Fast-uri Openjsf | 7.5 | Aug 24 | fast-uri vulnerable to host confusion via percent-encoded scheme normalization |
| CVE-2026-75975 | FA Fast-uri Openjsf | 7.5 | Aug 24 | fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization |
| CVE-2026-75899 | FA Fast-uri Openjsf | 7.5 | Aug 24 | fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding |
| CVE-2026-75931 | FA Fast-uri Openjsf | 7.5 | Aug 24 | fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references |
| CVE-2026-18446 | FA Fast-uri Openjsf | 7.5 | Jul 31 | fast-uri vulnerable to host confusion via backslash authority introducer |
| CVE-2026-16221 | FA Fast-uri Openjsf | 7.5 | Jul 19 | fast-uri vulnerable to host confusion via literal backslash authority delimiter |
| CVE-2026-12590 | BO Body-parser Openjsf | 5.9 | Jul 9 | body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement |
| CVE-2026-13676 | FA Fast-uri Openjsf | 7.5 | Jun 29 | fast-uri vulnerable to host confusion via failed IDN canonicalization |
| CVE-2026-10796 | NV Node Version Manager Openjsf | 7.5 | Jun 4 | nvm executes commands from a malicious Node.js mirror's version strings |
| CVE-2026-25244 | WE Webdriverio Openjsf | 9.8 | May 18 | WebdriverIO has Command Injection in the BrowserStack Service |
| CVE-2026-41591 | MA Marko Openjsf | 6.4 | May 8 | Marko: XSS via case-insensitive script/style closing tag bypass in runtime HTML escaping |
| CVE-2026-6322 | FA Fast-uri Openjsf | 7.5 | May 5 | fast-uri vulnerable to host confusion via percent-encoded authority delimiters |
| CVE-2026-6321 | FA Fast-uri Openjsf | 7.5 | May 4 | fast-uri vulnerable to path traversal via percent-encoded dot segments |
| CVE-2025-50537 | ES Eslint Openjsf | 5.5 | Jan 26 | Stack overflow vulnerability in eslint before 9.26.0 when serializing objects with circular references in eslint/lib/shared/serialization.js |
| CVE-2025-57349 | ME Messageformat Openjsf | 7.5 | Sep 24 | The messageformat package, an implementation of the Unicode MessageFormat 2 specification for JavaScript, is vulnerable to prototype pollution due to improper handling of message… |
| CVE-2024-10491 | EX Express Openjsf | 5.3 | Oct 29 | Preload arbitrary resources by injecting additional `Link` headers |
| CVE-2024-45590 | BO Body-parser Openjsf | 7.5 | Sep 10 | body-parser vulnerable to denial of service when url encoding is enabled |
| CVE-2024-43800 | SE Serve-static Openjsf | 4.7 | Sep 10 | serve-static affected by template injection that can lead to XSS |
| CVE-2024-43796 | EX Express Openjsf | 4.7 | Sep 10 | express vulnerable to XSS via response.redirect() |
| CVE-2024-29900 | PA Packager Openjsf | 7.5 | Mar 29 | Electron Packager bundles Electron-based application source code with a renamed Electron executable and supporting files into folders ready for distribution |
| CVE-2024-29041 | EX Express Openjsf | 6.1 | Mar 25 | Express.js minimalist web framework for node |
| CVE-2024-26136 | EL Electroncord Openjsf | 7.5 | Feb 20 | kedi ElectronCord is a bot management tool for Discord |
| CVE-2022-24999 | EX Express Openjsf | 7.5 | Nov 26 | qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be… |
| CVE-2020-4051 | DI Dijit Openjsf | 5.4 | Jun 15 | In Dijit before versions 1.11.11, and greater than or equal to 1.12.0 and less than 1.12.9, and greater than or equal to 1.13.0 and less than 1.13.8, and greater than or equal to… |
| CVE-2014-6393 | EX Express Openjsf | 6.1 | Aug 9 | The Express web framework before 3.11 and 4.x before 4.5 for Node.js does not provide a charset field in HTTP Content-Type headers in 400 level responses, which might allow remote… |
| CVE-2015-8856 | SE Serve-index Openjsf | 6.1 | Jan 23 | Cross-site scripting (XSS) vulnerability in the serve-index package before 1.6.3 for Node.js allows remote attackers to inject arbitrary web script or HTML via a crafted file or… |