Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
108
GitHub Actions
54
Go
4,508
Maven
5,000+
npm
5,000+
NuGet
1,091
pip
5,000+
Pub
13
RubyGems
1,145
Rust
1,511
Swift
62
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
1
Go
18
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,510
Rust
10

29 advisories

Loading
Mermaid XY Charts are vulnerable to an infinite loop DoS Moderate
CVE-2026-71436 was published for mermaid (npm) Aug 6, 2026
aloisklink Credited to aloisklink
re2: Global `String.prototype.match` with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth (DoS) Moderate
CVE-2026-68499 was published for re2 (npm) Jul 31, 2026
ataberk-xyz Credited to ataberk-xyz
nanoid: custom generators can loop indefinitely when size is zero High
CVE-2026-67213 was published for nanoid (npm) Jul 29, 2026
ai Credited to ai
nanoid: non-secure generators can loop indefinitely with negative size High
CVE-2026-67214 was published for nanoid (npm) Jul 29, 2026
Immutable.js `List` 32-bit trie overflow → unrecoverable DoS High
CVE-2026-59879 was published for immutable (npm) Jul 21, 2026
mateuszismyname Credited to mateuszismyname
protobufjs: Denial of Service via infinite loop in .proto option parsing Moderate
CVE-2026-59877 was published for protobufjs (npm) Jul 20, 2026
bilerden Credited to bilerden
node-tar: Negative tar entry size causes infinite loop in archive replace High
CVE-2026-59874 was published for tar (npm) Jul 20, 2026
Jvr2022 Credited to Jvr2022
image-size: ICNS parser allows denial of service through an infinite loop High
CVE-2025-71330 was published for image-size (npm) Jun 10, 2026
image-size: JXL and HEIF parsers allow denial of service through infinite loops High
CVE-2025-71329 was published for image-size (npm) Jun 10, 2026
Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS Moderate
CVE-2026-41150 was published for mermaid (npm) May 11, 2026
aloisklink Credited to aloisklink and Twavesx Twavesx Twavesx
Marked Vulnerable to OOM Denial of Service via Infinite Recursion in marked Tokenizer High
CVE-2026-41680 was published for marked (npm) Apr 29, 2026
MaanVader Credited to MaanVader
Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input High
CVE-2026-33891 was published for node-forge (npm) Mar 26, 2026
Kr0emer Credited to Kr0emer
jsrsasign is vulnerable to DoS through Infinite Loop when processing zero or negative inputs High
CVE-2026-4598 was published for jsrsasign (npm) Mar 23, 2026
music-metadata has an infinite loop vulnerability in ASF parser High
CVE-2026-32256 was published for music-metadata (npm) Mar 17, 2026
ByamB4 Credited to ByamB4
file-type affected by infinite loop in ASF parser on malformed input with zero-size sub-header Moderate
CVE-2026-31808 was published for file-type (npm) Mar 10, 2026
bn.js affected by an infinite loop Moderate
CVE-2026-2739 was published for bn.js (npm) Feb 20, 2026
richardsimko Credited to richardsimko and jochenschmich-aeberle jochenschmich-aeberle jochenschmich-aeberle
Sandbox escape via infinite recursion and error objects Moderate
CVE-2026-25533 was published for @enclave-vm/core (npm) Feb 5, 2026
cristianstaicu Credited to cristianstaicu and frontegg-david frontegg-david frontegg-david
jsPDF Denial of Service (DoS) High
CVE-2025-57810 was published for jspdf (npm) Aug 26, 2025
AlexRomberg Credited to AlexRomberg
ts-asn1-der has Incorrect DER Encoding of Numbers Leading to Denial of Service and Incorrect Value Representation Moderate
CVE-2025-32029 was published for @apeleghq/asn1-der (npm) Apr 7, 2025
image-size Denial of Service via Infinite Loop during Image Processing High
CVE-2025-71319 was published for image-size (npm) Apr 2, 2025
dellalibera Credited to dellalibera and TheFrankemon TheFrankemon TheFrankemon
In Azle, calling `setTimer` causes infinite loop of timers High
CVE-2025-29776 was published for azle (npm) Mar 14, 2025
Infinite loop and Blind SSRF found inside the Webfinger mechanism in @fedify/fedify Moderate
CVE-2025-23221 was published for @fedify/fedify (npm) Jan 21, 2025
nnfrog Credited to nnfrog
Predictable results in nanoid generation when given non-integer values Moderate
CVE-2024-55565 was published for nanoid (npm) Dec 9, 2024
krassowski Credited to krassowski, katzj, and CrzyHAX91 katzj katzj
CrzyHAX91 CrzyHAX91
Improper calculations in ECC implementation can trigger a Denial-of-Service (DoS) High
CVE-2023-25653 was published for node-jose (npm) Feb 16, 2023
justaugustus Credited to justaugustus and bifurcation bifurcation bifurcation
file-type vulnerable to Infinite Loop via malformed MKV file High
CVE-2022-36313 was published for file-type (npm) Jul 22, 2022
kiskoza Credited to kiskoza and ItalyPaleAle ItalyPaleAle ItalyPaleAle
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database