最新のセキュリティ情報
2 ページ目
10月21日(水)昨日
ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorization
影響: npm:apostrophe < 4.33.0 → 4.33.0 Summary ApostropheCMS enforces per-type authorization on pages: a page type may declare editRole / publishRole (the core @apostrophecms/archive-page does), so a project can define restricted subtrees that only higher-privileged roles may create or edit within. The move() operation in the @apostrophecms/page module is supposed to enforce that a page may only be moved into a parent the actor has create rights over, the same boundary the page-insert route enforces. The destination-parent authoriza…
ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service
影響: npm:@apostrophecms/db-connect < 1.1.0 → 1.1.0, npm:apostrophe < 4.33.0 → 4.33.0 Summary @apostrophecms/db-connect ships an in-memory MongoDB emulation used by its SQLite, PostgreSQL, and multipostgres adapters. Its unsetNestedField helper walks an attacker-controlled dotted field path with no segment validation and calls delete on the resolved property. A low-privileged authenticated user (any role holding view-draft, which every editor and contributor has; reduced to any logged-in user when guestApiAccess is enabled) can send a piece-type REST GET request whose project qu…
ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render
影響: npm:sanitize-html < 2.18.0 → 2.18.0 Summary sanitize-html discards the content of every element in nonTextTags. It delimits that region using htmlparser2's close events, and ignores the isImplied flag htmlparser2 passes it. Closing a still-open ancestor from inside a makes htmlparser2 unwind its stack past the noscript; the synthetic implied close it emits on the way ends the discard region early, and everything after it is treated as ordinary body content. A browser with scripting enabled parses content as raw text, so the same…
follow-redirects array-form headers bypass cross-origin credential stripping
影響: npm:follow-redirects >= 1.16.0, < 1.16.1 → 1.16.1 Summary follow-redirects removes sensitive credential headers (Authorization, Proxy-Authorization, Cookie, and any caller-declared sensitiveHeaders) before following a redirect that crosses to a different host or downgrades to a less secure protocol. The removal routine iterates the caller's headers container with for...in and matches header names against a filter. This assumes the headers container is a plain object keyed by header names. Node's underlying http.request, which follow-redirects…
follow-redirects sensitiveHeaders regex escaping can expose credential headers
影響: npm:follow-redirects >= 1.16.0, < 1.16.1 → 1.16.1 Summary follow-redirects 1.16.0 introduced the sensitiveHeaders option (the fix for CVE-2026-40895 / GHSA-r4q5-vmmm-2653), which lets an application declare extra header names that must be removed when a redirect crosses to a different host or downgrades protocol. The filter is a single case-insensitive regular expression built by concatenating the declared header names into an alternation after passing each through escapeRegex. escapeRegex escapes only a partial set of metacharacters and leave…
@angular/router: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR)
影響: npm:@angular/router >= 22.0.0, < 22.2.1 → 22.2.1, npm:@angular/router >= 21.2.0, < 21.2.25 → 21.2.25 A denial of service (DoS) vulnerability was identified in @angular/router when Server-Side Rendering (SSR) is enabled on Node.js (V8) and RouterLink directives are rendered with queryParamsHandling: 'merge' or 'preserve', configured either per link or globally via defaultQueryParamsHandling. Starting in v21.2.0 ([angular/angular#66181](https://github.com/angular/angular/pull/66181)), RouterLink internals were refactored to use signals, introducing a computed signal (_urlTree) that cached the re…
10月20日(火)
@angular/router: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)
影響: npm:@angular/router >= 22.0.0, < 22.2.1 → 22.2.1, npm:@angular/router >= 21.0.0, < 21.2.25 → 21.2.25, npm:@angular/router >= 20.0.0, < 20.3.33 → 20.3.33, npm:@angular/router <= 19.2.25 A denial of service (DoS) vulnerability was identified in @angular/router when Server-Side Rendering (SSR) is enabled on Node.js (V8). During route recognition, @angular/router fails to validate whether an auxiliary outlet segment in the URL matches a route configured for that specific outlet name. Because unconfigured empty-path outlet groups (such as a:/(), x:/(...), or ///(...)) are not rejected during matching, the router repeatedly re-evaluates the route configuration against each arbitrar…
Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths
影響: npm:hono >= 4.12.4, < 4.13.11 → 4.13.11 Summary serveStatic decodes the request path a second time after Hono has already decoded it for routing. A crafted request can be routed as one path and served as another, so middleware mounted on a static prefix does not run for a file under that prefix. Details Hono decodes the request path once before routing. serveStatic decoded it again before resolving the file. With a malformed percent-encoded sequence, the first decode leaves part of the path encoded, the router matches the encoded for…
@angular/platform-server: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR)
影響: npm:@angular/platform-server >= 22.0.0, < 22.2.1 → 22.2.1, npm:@angular/platform-server >= 21.0.0, < 21.2.25 → 21.2.25, npm:@angular/platform-server >= 20.0.0, < 20.3.33 → 20.3.33, npm:@angular/platform-server <= 19.2.25 An open redirect vulnerability was identified in @angular/platform-server when Server-Side Rendering (SSR) is enabled. When Angular SSR renders an incoming request, URL resolution and platform navigation are managed by ServerPlatformLocation using resolveUrl (or parseUrl in v20). While resolveUrl rejected protocol-relative URLs whose raw string directly started with //, this check ran prior to WHATWG URL normalization. When a request URL includes a popping dot-segment followed by multiple slash…
markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes
影響: npm:markdown-it >= 15.0.0, < 15.0.2 → 15.0.2, npm:markdown-it < 14.3.2 → 14.3.2 Impact When typographer: true is enabled, specially crafted Markdown can cause quadratic processing time in the smartquotes rule, potentially leading to denial of service in applications processing untrusted input. Many opening double quotes followed by unmatched closing single quotes cause repeated scans of the entire opener stack. The same issue occurs with the quote types reversed. The default configuration (typographer: false) is not affected, but this option is enabled with high probabilit…
10月19日(月)
Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent Traffic
A fake Web3 accelerator has been observed pushing information stealers and backdoors to Windows and macOS systems using malicious npm packages under the pretext of offering free artificial intelligence (AI) credits for Anthropic Claude and Google Gemini, coding tools, and security audits. "The tools delivered information-stealing malware and backdoors for macOS and Windows machines," Elastic
運営指定の遠隔操作ソフト導入を参加条件とされたセキュリティイベントについてまとめてみた
2026年10月12日、Elastic Security Labsは、暗号資産やWeb3の創業者を狙う偽のアクセラレーター「Apex Accelerator」が悪性のnpmパッケージで端末を狙っていたと公表しました。同じ名称の運営がTOKEN2049期間中の催しで参加の条件としてセキュリティ製品の導入を迫ったとする申告も出ています。ここでは関連する情報をまとめます。 偽アクセラレーターApex Accelerator Apex Acceleratorは、暗号資産やWeb3の創業者を狙う偽のアクセラレーター。Elastic Security Labsは追跡名REF8801として調査しており、「A…
10月17日(土)
MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon
Cybersecurity researchers have discovered a malicious npm package that's part of a recently disclosed software supply chain attack campaign dubbed MALFEX. The package, named "imgdecode," was uploaded to the package registry on September 30, 2026, by a user named "malfexteste8." It has been downloaded 979 times as of writing and is still available on npm as of writing. The latest version of
ckan-mcp-server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out)
影響: npm:@aborruso/ckan-mcp-server < 0.4.112 → 0.4.112 Summary The MCP Apps UI resource (an interactive DataStore table rendered in the host's webview/iframe) communicates with its parent via postMessage. Its inbound message listener performs no event.origin validation, and its outbound messages are sent with target origin ''. Any window/frame able to reach the document can inject data into the table and interfere with the MCP UI handshake, and the UI's own JSON-RPC messages are broadcast without an origin restriction. Affected code src/resources/d…
Improving navigation experience in v0 with Next.js 16.4
How we used Partial Prefetching and a coding agent to improve navigation across v0 with Next.js 16.4.
10月16日(金)
TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses
影響: npm:@tanstack/start-server-core >= 1.143.12, < 1.169.39 → 1.169.39, npm:@tanstack/react-start >= 1.143.12, < 1.168.60 → 1.168.60, npm:@tanstack/solid-start >= 1.143.12, < 1.168.57 → 1.168.57, npm:@tanstack/vue-start >= 1.143.12, < 1.168.56 → 1.168.56 Impact An unauthenticated attacker can craft a URL to a server function in an affected TanStack Start app. If someone opens the link, the app can return attacker-controlled HTML from its own origin and run the attacker's JavaScript there. The script can access same-origin data available to that visitor and make requests with their authority. Cause The server-function transport can pass request payload fields into internal middleware state instead of limiting them to public input fields. A malfo…
Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning
影響: npm:@anthropic-ai/claude-code < 2.1.179 → 2.1.179 The plugin install flow in Claude Code and Claude Desktop checked out a marketplace's pinned commit SHA using git checkout without verifying that the resulting HEAD matched the pinned SHA. An attacker controlling a plugin's upstream repository could create a branch named identically to the pinned 40-character SHA, causing the checkout to silently resolve to the attacker's branch tip instead of the reviewed commit, resulting in attacker-controlled code being installed bypassing the pinned hash.…
Qwik: Crashing any Qwik Server via Resource thenable
影響: npm:@builder.io/qwik < 1.20.0 → 1.20.0, npm:@qwik.dev/core < 2.0.0-beta37 → 2.0.0-beta37 Summary A Qwik server in the default configuration can be crashed with one unauthenticated HTTP request. During qwik-json body parsing, ResourceSerializer.$fill$ does Promise.resolve(resource._resolved). If _resolved is a plain object whose .then is a QRL for an unregistered symbol, the async QRL rejects, the rejection is orphaned, and Node terminates the process via its default unhandled-rejection policy. Impact One unauthenticated request crashes the server. Looping keeps every replica dead a…
Backstage: Improper access control in backend action invocation
影響: npm:@backstage/backend-defaults < 0.17.8 → 0.17.8 Impact An authenticated user could invoke actions that an operator had excluded through action configuration. Existing action permissions and downstream authorization remain enforced. Patches Patched in @backstage/backend-defaults version 0.17.8 Workarounds Limit access to action invocation endpoints to trusted service callers until upgrading.
10月15日(木)
Next.js Security Update for Upstream Vulnerabilities
The October 14, 2026 out-of-band security update for Next.js is now available
10月10日(土)
Deno is joining Cloudflare
Putting ourselves in the best place to build the future of the web
10月9日(金)
Upcoming Next.js Security Update for Upstream Vulnerabilities
Next.js plans to publish an out-of-band security update next Wednesday, October 14, 2026, addressing two Critical and one High severity vulnerabilities in upstream dependencies.
10月8日(木)
10月7日(水)
Next.js 16.4
Next.js 16.4 introduces lazy compilation, smaller Turbopack output, React 19.3 features, Cache Components improvements, and new developer tooling.
10月1日(木)
September 2026 Security Release
The September 2026 security release for Next.js is now available
9月24日(木)
Upcoming Next.js September Security Release
Next.js is preparing a scheduled September security release for September 30, 2026.
9月23日(水)
Next.js Security Update for a Critical Upstream Issue
The September 22, 2026 out-of-band security update for Next.js is now available
Upcoming Next.js Security Update for a Critical Upstream Issue
Next.js 16.3.6 and 15.5.26 are planned for a critical out-of-band security update on September 22, 2026.
9月22日(火)
9月17日(木)
9月10日(木)
9月9日(水)
React 19.3
React 19.3 adds new features like View Transitions, Fragment Refs, browser(), Trusted Types, and more.
9月4日(金)
How we closed 1,500 GitHub issues in one month
How the Next.js team used an agent to research old reports and work through the issue backlog.
How Turbopack chunks your JavaScript
Turbopack’s chunking speeds up page loads and enables sharing code across pages. We shipped new experimental features to improve chunking in Next.js 16.3.
8月27日(木)
8月26日(水)
August 2026 Security Release
The August 2026 security release for Next.js is now available
Update: August Next.js Security Release
Next.js is moving the August security release forward to August 25, 2026.
8月21日(金)
Upcoming Next.js August Security Release
Next.js is preparing a scheduled August security release for August 26, 2026.
8月19日(水)
Building App-like Experiences with Next.js 16.3
Build app-like experiences with Instant Navigations, server-rendered data, optimistic updates, and live client state in Next.js 16.3.
8月6日(木)
Making Navigations Instant in v0
The case study behind Instant Navigations in Next.js 16.3, and how we made v0's navigations instant using tests and a coding agent.
8月4日(火)
Next.js 16.3
Next.js 16.3 introduces Instant Navigations, a suite of tools for single-page-app responsiveness, plus a faster dev server, faster builds, and improved tooling for AI agents.