https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 16 Oct 2026 07:27:48 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-20736 EUVD-2026-20736 https://cve.radiocsirt.org/vuln/euvd-2026-20736 https://cve.radiocsirt.org/vuln/fkie_cve-2021-3189 <p>The slashify package 1.0.0 for Node.js allows open-redirect attacks, as demonstrated by a localhost:3000///example.com/ substring.</p> <p>The slashify package 1.0.0 for Node.js allows open-redirect attacks, as demonstrated by a localhost:3000///example.com/ substring.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-3189 https://cve.radiocsirt.org/vuln/ghsa-f4hq-453j-p95f <p><strong>Affected:</strong> npm: slashify</p> <p>The package is an Express middleware that normalises routes by stripping any final slash, redirecting, for example, `bookings/latest/` to `bookings/latest`. However, it does not validate the path it redirects to in any way. In particular, if the path starts with two slashes (or two backslashes, or a slash and a backslash, etc.) it may redirect to a different domain.</p> <p>Consider the [example from the docs](https://www.npmjs.com/package/slashify#usage). Assume we have run it and started a server on `localhost:3000`, then visiting `localhost:3000///github.com/` redirects you to https://github.com.</p> <p>## Recommendation</p> <p>This vulnerability is currently un-patched in the `slashify` package so there is no known safe version of this package. Discontinuing use of `slashify` is recommended.</p> <p><strong>Affected:</strong> npm: slashify</p> <p>The package is an Express middleware that normalises routes by stripping any final slash, redirecting, for example, `bookings/latest/` to `bookings/latest`. However, it does not validate the path it redirects to in any way. In particular, if the path starts with two slashes (or two backslashes, or a slash and a backslash, etc.) it may redirect to a different domain.</p> <p>Consider the [example from the docs](https://www.npmjs.com/package/slashify#usage). Assume we have run it and started a server on `localhost:3000`, then visiting `localhost:3000///github.com/` redirects you to https://github.com.</p> <p>## Recommendation</p> <p>This vulnerability is currently un-patched in the `slashify` package so there is no known safe version of this package. Discontinuing use of `slashify` is recommended.</p> https://cve.radiocsirt.org/vuln/ghsa-f4hq-453j-p95f https://cve.radiocsirt.org/vuln/gsd-2021-3189 gsd-2021-3189 https://cve.radiocsirt.org/vuln/gsd-2021-3189