漏洞公告

Microsoft Security Advisory CVE-2026-50524 – .NET Denial of Service Vulnerability

Microsoft Security Advisory CVE-2026-47304 – .NET Security Feature Bypass Vulnerability

Microsoft Security Advisory CVE-2026-47302 – .NET Denial of Service Vulnerability

Microsoft Security Advisory CVE-2026-57108 – .NET Denial of Service Vulnerability

Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning

Axios form serializer maxDepth bypass via {} metatoken

Axios: Nested axios option objects can consume polluted prototype values

Axios: HTTP/2 streamed uploads bypass `maxBodyLength`

Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`

Axios: Prototype pollution gadgets can alter axios request construction

Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios

File Browser: Colliding username normalization gives two users the same home directory

File Browser: Share API exposes the password hash and bypass token

File Browser: Archive builder turns backslash filenames into path traversal (zip-slip)

protobufjs: Text Format string map parsing can mutate returned map object prototype

protobufjs: Denial of Service via infinite loop in .proto option parsing

webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header

webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints

Guzzle: Cookie Disclosure and Injection via IP-Address Domains

Astro: Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch

Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files

Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure)

node-tar: Process crash via PAX numeric path type confusion