Learn from real security vulnerabilities and how Orbis AppSec fixed them
A high-severity infinite loop vulnerability (CVE-2026-67213) was discovered in the nanoid package's `customAlphabet` function, affecting versions before 5.1.6. The concord-frontend application depended on nanoid 6.0.1, which contained this flaw. The fix downgrades to nanoid 3.3.17, a patched version that eliminates the infinite loop condition triggered by crafted input to custom alphabet ID generation.
A critical authentication bypass in the `/api/posts` endpoint allowed any unauthenticated user to create, update, or delete posts without verification. The POST endpoint had zero authentication checks, while PUT and DELETE endpoints used a trivially bypassable username comparison that attackers could forge by simply including the target username in their request body. The fix validates user identity by looking up the userId in the database before any post operations.
A critical Server-Side Request Forgery (SSRF) vulnerability was discovered in `libraries/microworlds/video.js` where the `VideoCanvasWrapper.loadVideo()` function passed user-controlled URLs directly to `fetch()` without any validation. An attacker could exploit this by supplying URLs pointing to internal services, localhost endpoints, or malicious external servers. The fix introduces strict URL parsing and protocol validation before any network request is made.
CVE-2026-69192 revealed a critical inconsistency in the `ip-address` npm package where the `Address4` class decoded leading-zero octets as decimal while standard DNS resolvers interpreted them as octal, creating a trust-boundary bypass and SSRF attack vector. The fix upgrades `ip-address` from version 10.2.0 to 10.3.1 in the CanvaLight plugin, correcting the parsing behavior to match resolver expectations.
A high-severity command injection vulnerability was discovered in `bin/init.mjs` where the `shallowClone` function passed a user-controllable `ref` parameter directly to `execSync` shell commands. This could allow attackers to execute arbitrary system commands by crafting malicious git reference names. The fix implements strict input validation and replaces `execSync` with `execFileSync` to eliminate shell interpretation entirely.
A critical denial-of-service vulnerability (CVE-2026-39244) in adm-zip 0.5.10 allowed attackers to craft malicious ZIP files that triggered excessive memory allocation, potentially crashing the Node.js process. The fix upgrades adm-zip to version 0.6.0, which includes proper memory allocation limits when parsing ZIP entries. This vulnerability was discovered in the `solarIncidenceService.js` service, where uploaded ZIP files are processed without sandboxing.
A high-severity vulnerability (GHSA-4w2j-m93h-cj5j) in quinn-proto 0.11.14 allowed attackers to exhaust server memory through unbounded out-of-order QUIC stream reassembly. The fix upgrades to quinn-proto 0.11.15, which implements proper bounds checking to prevent malicious clients from forcing servers to buffer unlimited out-of-order stream data.
A high-severity denial-of-service vulnerability (GHSA-5p4m-2wfm-xmqj) in js-yaml versions 4.3.0 and 3.x caused quadratic CPU consumption when resolving `!!omap` (ordered map) types in YAML documents. Attackers who could supply crafted YAML input could cause CPU exhaustion proportional to the square of the input size, potentially grinding Node.js services to a halt. The fix upgrades js-yaml to 4.3.1 and pins the version via a `package.json` overrides block to ensure no transitive dependency can r
A high-severity denial of service vulnerability (CVE-2025-58754) was discovered in axios versions prior to 1.12.0, where the library failed to enforce data size limits on HTTP responses. This flaw could allow attackers to crash Node.js applications by sending massive payloads that exhaust memory. The fix involved upgrading axios from version 1.11.0 to 1.12.0 in the ComfyUIGen plugin's dependencies.
CVE-2025-58754 is a high-severity Denial of Service vulnerability in axios versions prior to 1.12.0, caused by a lack of data size validation on incoming responses. An attacker could send or trigger excessively large HTTP responses that exhaust the application's memory, crashing the Node.js process. The fix upgrades axios from 1.9.0 to 1.12.0, which introduces proper data size checks.
A high-severity shell injection vulnerability was discovered in `.forgejo/workflows/docker.yml` where `${{github.ref}}` and `${{github.ref_name}}` were directly interpolated into a bash `run:` step. An attacker could craft malicious git reference names to inject arbitrary commands into the CI runner, potentially stealing secrets and source code. The fix moves these values into intermediate environment variables, preventing command injection.
The quinn-proto library, a critical component for QUIC protocol implementations, contained a denial of service vulnerability (CVE-2026-31812) that could be triggered by specially crafted QUIC Initial packets. A security update from version 0.11.13 to 0.11.14 tightens the handling of untrusted network input, preventing attackers from exhausting server resources through malformed packets.