Uuhop

Products

Exploited and recent CVEs

• CVE-2026-114129 Medium 6.2 stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service 0.3%
• CVE-2026-104183 Medium 5.1 stream-json: Prototype pollution: Assembler writes this.current[this.key] on plain objects 0.2%
• CVE-2026-104182 Medium 6.2 stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk 0.2%
• CVE-2026-71429 Medium 6.2 stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS) 0.2%
• CVE-2026-71498 Medium 5.1 node-re2: Out-of-bounds heap read in `replace`/`split` via a `Buffer` ending in a truncated multi-byte UTF-8 character → adjacent heap memory disclosed to JavaScript 0.2%
• CVE-2026-71430 Medium 6.2 node-re2: String.prototype.replace(re2, template) aborts the Node process (uncatchable ToLocalChecked on empty MaybeLocal) when the result exceeds V8's max string length 0.2%
• CVE-2026-68499 Medium 6.2 re2: Global `String.prototype.match` with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth (DoS) 0.2%
• CVE-2026-67550 Medium 5.7 re2: Out-of-bounds heap read in `exec`/`test`/`match` via attacker-influenced `lastIndex` on a non-ASCII subject → uncatchable process crash (DoS) 0.2%