serve

Information Exposure on Case Insensitive File Systems in serve

Directory Traversal in serve

Directory Traversal in serve

vercel/serve allows access to restricted files if filename is URL encoded.

PenPot MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCE

Parse Server's MFA recovery codes not consumed after use

@libp2p/kad-dht: Unvalidated PUT_VALUE records allow unbounded disk exhaustion on DHT server nodes

HAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apis

OpenClaw's andbox browser noVNC observer lacked VNC authentication

Parse Server's GraphQL "Did you mean ...?" validation suggestions disclose schema to unauthenticated callers

Malicious code in @seezo/sdr-mcp-server (npm)

parse-server's session object properties can be updated by foreign user if object ID is known

Cross-Site Scripting in serve-index

browserstack-runner has an unauthenticated arbitrary file read via path traversal in HTTP server

Parse Server vulnerable to Prototype Pollution via Cloud Code Webhooks or Cloud Code Triggers

NodeVM network builtin exclusions bypass via internal _http_client and _http_server

Directory Traversal in serverliujiayi1

Directory Traversal in zjjserver

@node-oauth/oauth2-server: PKCE code_verifier ABNF not enforced in token exchange allows brute-force redemption of intercepted authorization codes

Miniflare vulnerable to Server-Side Request Forgery (SSRF)

Cross-Site Scripting in http_server

@grackle-ai/server: Unescaped Error String in renderPairingPage() HTML Template

Server crashes on invalid Cloud Function or Cloud Job name

Malicious code in @protos-team/frontend-server (npm)

Markdownify MCP Server allows Server-Side Request Forgery (SSRF) via the Markdownify.get() function

Directory traversal in rollup-plugin-server

webpack-dev-server users' source code may be stolen when they access a malicious web site

Server-Side Request Forgery in Directus

Information disclosure in parse-server

TinaCMS CLI Dev Server Vulnerable to Cross-Origin File Exfiltration via CORS Misconfiguration + Path Traversal in TinaCMS

Parse Server exposes the data schema via GraphQL API

Path traversal in rollup-plugin-serve

matrix-js-sdk can be tricked into disclosing E2EE room keys to a participating homeserver

Astro's server source code is exposed to the public if sourcemaps are enabled

Actual Sync Server has an Authenticated Path Traversal

Parse Server has a protected fields bypass via logical query operators

Malicious code in scilla-server (npm)

Parse Server has a bypass of class-level permissions in LiveQuery

eBay API MCP Server Affected by Environment Variable Injection

Signal K Server Vulnerable to Denial of Service via Unrestricted Access Request Flooding

Server-Side Request Forgery in parse-url

Backstage Scaffolder plugin vulnerable to Server-Side Request Forgery

Paperclip: Approval decision attribution spoofing via client-controlled `decidedByUserId` in paperclip server

Directory traversal in rollup-plugin-server

statics-server Cross-site Scripting vulnerability

OpenCode's Unauthenticated HTTP Server Allows Arbitrary Command Execution

Astro development server error page is vulnerable to reflected Cross-site Scripting

Server-Side Request Forgery (SSRF) in vriteio/vrite

Invalid file request can crash server

Parse Server crash via deeply nested query condition operators

MCP Server Kubernetes has an Argument Injection in port_forward tool via space-splitting

Server-Side Request Forgery in axios

Websites were able to send any requests to the development server and read the response in vite

parse-server's endpoint `/loginAs` allows `readOnlyMasterKey` to gain full read and write access as any user

Next.js has a Denial of Service with Server Components

easy-static-server vulnerable to Directory Traversal

Astro: Memory exhaustion DoS due to missing request body size limit in Server Islands

Server-side request forgery in Ghost CMS

Unexpected server crash in Next.js

Directory Traversal in enserver

Malicious code in upchieve-server (npm)

OpenClaw has a Matrix allowlist bypass via displayName and cross-homeserver localpart matching

Server-Side Request Forgery in private-ip

Malicious code in @tanstack/vue-start-server (npm)

Parse Server's custom object ID allows to acquire role privileges

Malicious code in mcp-server-todo (npm)

Parse Server vulnerable to user enumeration via email verification endpoint

h3 has a Path Traversal via Percent-Encoded Dot Segments in serveStatic Allows Arbitrary File Read

Inefficient Regular Expression Complexity in code-server

yii2-mcp-server has a Command Injection Issue

Parse Server: GraphQL `__type` introspection bypass via inline fragments when public introspection is disabled

Directory Traversal in serve46

Path Traversal in web-node-server

Dark Reader gives users the ability to request style sheets from local web servers

Malicious code in agoric-servers (npm)

Signal K Server Vulnerable to Unauthenticated Information Disclosure via Exposed Endpoints

MCP Server Kubernetes vulnerable to command injection in several tools

Prototype Pollution in litespeed.js and appwrite/server-ce

HackMD MCP Server has Server-Side Request Forgery (SSRF) vulnerability

Hono has an Arbitrary Key Read in Serve static Middleware (Cloudflare Workers Adapter)

Cross-site Scripting (XSS) - Stored in crud-file-server

Directory Traversal in qinserve

Cross site scripting in code-server

Parse Server LiveQuery subscription with invalid regular expression crashes server

Server-Side Request Forgery and Inclusion of Functionality from Untrusted Control Sphere in jsreport

Directory Traversal in startserver

Malicious code in wise_lena_bot_server (npm)

@lumieducation/h5p-server Fails to Sanitize Plain Text Strings

Malicious code in fxa-admin-server (npm)

Nu Html Checker (vnu) contains a Server-Side Request Forgery (SSRF) vulnerability

React Server Components are Vulnerable to RCE

Parse Server session creation endpoint allows overwriting server-generated session fields

Directory Traversal in serverwzl

Directory Traversal in dcserver

Cross-Site Scripting in http-file-server

Cross-site Scripting in lightning-server

simplehttpserver allows directory traversal and file listing

MCPHub's ServerController is vulnerable to Command Injection

OpenClaw's runtime /debug override path accepted prototype-reserved keys

Parse Server has role escalation and CLP bypass via direct `_Join` table write

CSRF vulnerability in save-server

@grackle-ai/server has a Missing Secure Flag on Session Cookie

Directory Traversal in node-server-forfront

hubl-server downloads resources over HTTP

Nuxt OG Image vulnerable to Server-Side Request Forgery via user-controlled parameters

Parse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolution

Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE)

Parse Server's GraphQL WebSocket endpoint bypasses security middleware

Malicious code in dexter-server (npm)

Parse Server: File metadata endpoint bypasses `beforeFind` / `afterFind` trigger authorization

Parse Server vulnerable to SQL injection via `Increment` operation on nested object field in PostgreSQL

Vite XSS vulnerability in `server.transformIndexHtml` via URL payload

Directus vulnerable to Server-Side Request Forgery On File Import

Malicious code in usaa-mock-server (npm)

Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url

Parse Server OAuth2 adapter app ID validation sends wrong token to introspection endpoint

Microsoft Playwright MCP Server vulnerable to DNS Rebinding Attack; Allows Attackers Access to All Server Tools

Directory Traversal in fancy-server

evershop allows unauthenticated attackers to exhaust application server's resources via "GET /images" API

cors-anywhere vulnerable to server-side request forgery

Malicious code in @hongfangze/simple-resource-server (npm)

h3: Double Decoding in `serveStatic` Bypasses `resolveDotSegments` Path Traversal Protection via `%252e%252e`

Parse Server vulnerable to schema poisoning via prototype pollution in deep copy

Server-Side Request Forgery in Request

@hono/node-server cannot handle "double dots" in URL

Malicious code in falcor-server (npm)

ZDI-CAN-19105: Parse Server literalizeRegexPart SQL Injection

Parse Server has a NoSQL injection via token type in password reset and email verification endpoints

Utils.readChallengeTx does not verify the server account signature

@actual-app/sync-server: Missing authorization in sync endpoints allows cross-user budget file access in multi-user mode

LangSmith Client SDK Affected by Server-Side Request Forgery via Tracing Header Injection

Parse Server LiveQuery subscription query depth bypass

@adonisjs/http-server has an Open Redirect vulnerability

Parse Server vulnerable to session token exfiltration via `redirectClassNameForKey` query parameter

mcp-remote exposed to OS command injection via untrusted MCP server connections

PostHog Plugin Server SQL Injection Vulnerability

Directory Traversal in calmquist.static-server

Malicious code in datadog-serverless-macro (npm)

SignalK Server has Path Traversal leading to information disclosure

Directory Traversal in jn_jj_server

Malicious code in pay-by-bank-dashboard-server (npm)

Malicious code in @cloudplatform-single-spa/svp-bare-metal-servers (npm)

Malicious code in mitui-base-server (npm)

Directory Traversal in serverxxx

Malicious code in ttspc-server-sample (npm)

RedwoodSDK has a CSRF vulnerability in server function dispatch via GET requests

Parse Server vulnerable to LDAP injection via unsanitized user input in DN and group filter construction

Path Traversal in serve-here.js

Malicious code in brave-search-mcp-server (npm)

Parse Server: MFA recovery code single-use bypass via concurrent requests

Markdownify MCP Server allows attackers to read arbitrary files

Strapi plugins vulnerable to Server-Side Template Injection and Remote Code Execution in the Users-Permissions Plugin

Malicious code in pgserve (npm)

xcode-mcp-server vulnerable to Command Injection

m-server Vulnerable to Directory Traversal

Parse Server has an OAuth login vulnerability

Parse Server before v3.4.1 vulnerable to Denial of Service

Downloads Resources over HTTP in ntfserver

Malicious code in breakout-chat-server (npm)

Vite has an `server.fs.deny` bypass with an invalid `request-target`

Parse Server has an auth provider validation bypass on login via partial authData

vite allows server.fs.deny bypass via backslash on Windows

Malicious code in pingserver-test.01 (npm)

Malicious code in 47cliens_server (npm)

Malicious code in fxa-profile-server (npm)

Signal K Server Vulnerable to Remote Code Execution via Malicious npm Package

Parse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entries

Sync-in Server has Username Enumeration via Timing Attack

Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution

Malicious code in @jaggle/resizeobserves (npm)

Parse Server missing audience validation in Keycloak authentication adapter

Axios vulnerable to Server-Side Request Forgery

Parse Server stores password in plain text

Directory Traversal in static-html-server

Malicious code in fas_elbridge_server (npm)

Malicious code in showcase-server (npm)

Malicious code in @xvideos/server (npm)

Vite's `server.fs.deny` is bypassed when using `?import&raw`

Directory Traversal in serverwg

Sync-in Server has a stored cross-site scripting (XSS) vulnerability

ZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass Vulnerability

h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream Fields

Node.js Sandbox MCP Server vulnerability can lead to Sandbox Escape via Command Injection

Parse Server is vulnerable to Server-Side Request Forgery (SSRF) via Instagram OAuth Adapter

Signal K Server vulnerable to JWT Token Theft via WebSocket Enumeration and Unauthenticated Polling

@grackle-ai/server has Missing Content-Security-Policy and X-Frame-Options Headers

Directory Traversal in quickserver

sqlserver is malware

Directory Traversal in cypserver

Budibase Unrestricted Server-Side Request Forgery (SSRF) via REST Datasource Query Preview

Malicious code in @asyncapi/server-api (npm)

express-rate-limit: IPv4-mapped IPv6 addresses bypass per-client rate limiting on servers with dual-stack network

Path Traversal in statics-server

Directory Traversal in tinyserver2

Storybook Dev Server is Vulnerable to WebSocket Hijacking

React Router has CSRF issue in Action/Server Action Request Processing

Cline Kanban Server has a Cross-Origin WebSocket Hijacking Vulnerability

Invalid push request payload crashes Parse Server

Command injection in Parse Server through prototype pollution

Portkey.ai Gateway: Server-Side Request Forgery (SSRF) in Custom Host

Parse Server Vulnerable to Server-Side Request Forgery (SSRF) in File Upload via URI Format

Parse Server may crash when uploading file without extension

static-dev-server vulnerable to path traversal

Denial of Service Vulnerability in React Server Components

Next.js Allows a Denial of Service (DoS) with Server Actions

Malicious code in nfs-server-alpine (npm)

Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events

Vite's server.fs.deny bypassed with /. for files under project root

@yoda.digital/gitlab-mcp-server's SSE transport has no authentication and wildcard CORS, exposing all 86 GitLab tools

@hono/node-server: Middleware bypass via repeated slashes in serveStatic

Server-Side Request Forgery in @peertube/embed-api

Server-Side Request Forgery in @uppy/companion

parse-server auth adapter app ID validation can be circumvented

Parse Server OAuth2 authentication adapter account takeover via identity spoofing

Directory Traversal in serverhuwenhui

Open Redirect in serve-static

Parse Server has a SQL injection via query field name when using PostgreSQL

Signal K Server has an Unauthenticated Regular Expression Denial of Service (ReDoS) via WebSocket Subscription Paths

@vitejs/plugin-rsc has a Denial of Service with React Server Components

Directory Traversal in infraserver

evershop allows unauthenticated attackers to force server to initiate HTTP request via "GET /images" API

Parse Server: Classes `_GraphQLConfig` and `_Audience` master key bypass via generic class routes

Next.js Server-Side Request Forgery in Server Actions

Denial of Service vulnerability in lite-web-server

code-server vulnerable to Missing Origin Validation in WebSockets

mcp-server-kubernetes has potential security issue in exec_in_pod tool

Parse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL API

Path Traversal in http-server-node

Parse Server: `PagesRouter` path traversal allows reading files outside configured pages directory

Vite allows server.fs.deny to be bypassed with .svg or relative paths

Parse Server vulnerable to stored cross-site scripting (XSS) via SVG file upload

Server-Side Request Forgery in node-pdf-generator

Malicious code in @relyt/mcp-server-relytone (npm)

Parse Server's Endpoint `/sessions/me` bypasses `_Session` `protectedFields`

Hidden Directories Always Served in inert

Sensitive Data Exposure in parse-server

Cross-Site Scripting in m-server

Parse Server is vulnerable to Prototype Pollution via Cloud Code Webhooks

Malicious code in bfx-lib-server-js (npm)

Directory Traversal in hcbserver

parse-server: Malformed `$regex` query leaks database error details in API response

Malicious code in okfe-serverless-conf (npm)

Parse Server has SQL Injection through aggregate and distinct field names in PostgreSQL adapter

Gatsby develop server has Local File Inclusion vulnerability

Vite Plugin React has a Source Code Exposure Vulnerability in React Server Components

Vite Plugin React has a Denial of Service Vulnerability in React Server Components

Malicious code in @f5rest/odata-v4-server (npm)

Signal K Server: OAuth Authorization Code Theft via Unvalidated Host Header in OIDC Flow

Ghost vulnerable to Server Side Request Forgery (SSRF) via oEmbed Bookmark

Parse Server has a Cross-Site Scripting (XSS) vulnerability via Unescaped Mustache Template Variables

Malicious code in server-bare-log (npm)

@grackle-ai/server JSON.parse lacks try-catch logic in its gRPC Service AdapterConfig Handling

Malicious code in preview-server-auth (npm)

Malicious code in jobserver (npm)

Malicious code in @jd-org/clear-server (npm)

Server-Side Request Forgery in ftp-srv

Malicious code in gson-server (npm)

Payload: Server-Side Request Forgery (SSRF) in External File URL Uploads

Parse Server vulnerable to SQL Injection via dot-notation sub-key name in `Increment` operation on PostgreSQL

angular-server-side-configuration information disclosure vulnerability in monorepo with node.js backend

Malicious code in flipper-server-companion (npm)

Vite middleware may serve files starting with the same name with the public directory

Server-Side Request Forgery in link-preview-js

parse-server: MFA SMS one-time password accepted twice under concurrent login

parse-server has GraphQL complexity validator exponential fragment traversal DoS

Parse Server has a login timing side-channel reveals user existence

Parse Server has a protected fields bypass via LiveQuery subscription WHERE clause

Server-Side Request Forgery in phantomjs-seo

Parse Server's Session Update endpoint allows overwriting server-generated session fields

Malicious code in nayan-apis-server (npm)

Parse Server has denylist `requestKeywordDenylist` keyword scan bypass through nested object placement

Parse Server has a protected field change detection oracle via LiveQuery watch parameter

@profullstack/mcp-server vulnerable to OS Command Injection in domain_lookup Module

Server-Side Request Forgery in kityminder

Parse Server: SQL injection via dot-notation field name in PostgreSQL

Directory Traversal in serveryztyzt

Malicious code in ui5-cap-event-app-server (npm)

Malicious code in ee-server-auth-nodejs (npm)

Server side request forgery in SwaggerUI

Malicious code in truth-loop-server (npm)

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

Vite's `server.fs.deny` did not deny requests for patterns with directories.

Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation

Malicious code in @cloudplatform-single-spa/serverless-containers (npm)

Path Traversal in crud-file-server

Parse Server has a password reset token single-use bypass via concurrent requests

TanStack Start - Server Core: Inbound server-function request deserialization could invoke a sibling client-referenced server function

Malicious code in @wxi-dev/serverless-tsc-config (npm)

Malicious code in react-server-dom-unbundled (npm)

Parse Server's LiveQuery bypasses CLP pointer permission enforcement

Directory Traversal in sgqserve

Parse Server vulnerable to stored XSS via file upload of HTML-renderable file types

Directory Traversal in liuyaserver

Malicious code in foxy.io-serverless-functions-on-netlify-demo (npm)

@hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware

lite-server vulnerable to Denial of Service

@budibase/server: Command Injection in PostgreSQL Dump Command

Directory Traversal in zwserver

Malicious code in picl-server (npm)

Directory Traversal in fsk-server

TerriaJS-Server has a domain validation bypass vulnerability in its proxy allowlist

Parse Server exposes auth data via /users/me endpoint

Malicious code in lite-serper-mcp-server (npm)

Astro Development Server has Arbitrary Local File Read

Parse Server: Account takeover via JWT algorithm confusion in Google auth adapter

Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters

Directory Traversal in uekw1511server

Parse Server leaks protected fields via LiveQuery afterEvent trigger

serverless MCP Server vulnerable to Command Injection in list-projects tool

Path traversal in servey

Path Traversal in statichttpserver

Astro vulnerable to reflected XSS via the server islands feature

Malicious code in node-server-sdk (npm)

Signal K Server: Arbitrary Prototype Read via `from` Field Bypass

Parse Server's Cloud function dispatch crashes server via prototype chain traversal

Malicious code in xnil-server (npm)

uppy's companion module is vulnerable to Server-Side Request Forgery (SSRF)

Malicious code in @postman/postman-mcp-server (npm)

Malicious code in @confluence-classic/confluence-frontend-server (npm)

Cross-site scripting in TileServer GL

@utcp/http: SSRF via attacker-controlled OpenAPI servers[0].url in HTTP communication protocol

Directory Traversal in myserver.alexcthomas18

Agions taskflow-ai vulnerable to os command injection in src/mcp/server/handlers.ts

Malicious code in vue-dev-serverr (npm)

Inngest TypeScript SDK exposes environment variables via serve() handler on unhandled HTTP methods

Malicious code in @vapi-ai/server-sdk (npm)

Directory Traversal in peiserver

Malicious code in paypal-sdk-server-side-integration (npm)

Uptime Kuma Server-side Template Injection (SSTI) in Notification Templates Allows Arbitrary File Read

Directory Traversal in mockserve

Malicious code in whatsapp-otp-sample-server (npm)

Malicious code in nodes-tree-visualizer-server (npm)

Duplicate Advisory: OpenClaw: MCP loopback owner context is derived from server-issued bearer tokens

Fetch MCP Server has a Server-Side Request Forgery (SSRF) vulnerability

esbuild enables any website to send any requests to the development server and read the response

Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query

Directory Traversal in serveryaozeyan

pdfmake is vulnerable to server-side request forgery (SSRF)

Directory Traversal in wffserve

Parse Server email verification resend page leaks user existence

Apollo Server: Browser bug allows for bypass of XS-Search (read-only Cross-Site Request Forgery) prevention

Duplicate Advisory: ssrfcheck has Incomplete IP Address Deny List that leads to Server-Side Request Forgery Vulnerability

Malicious code in ids-enterprise-mcp-server (npm)

Strapi Server-Side Request Forgery (SSRF)

Server-Side Request Forgery in @uppy/companion

Malicious code in dapp-inter-agservers (npm)

Parse Server: Account takeover via operator injection in authentication data identifier

ssrfcheck Vulnerable to Server-Side Request Forgery (SSRF) and Incomplete List of Disallowed Inputs

Malicious code in dedicated-servers (npm)

Malicious code in mz-server (npm)

Astro has memory exhaustion DoS due to missing request body size limit in Server Actions

Next.js Vulnerable to Denial of Service with Server Components

Malicious code in @reserach_org_jfhalsdhfkslsfds/openai-server-skfghdg (npm)

Malicious code in replit-desktop-release-server (npm)

Next.js: null origin can bypass Server Actions CSRF checks

code-server's session cookie can be extracted by having user visit specially crafted proxy URL

ssrfcheck: SSRF Bypass Caused by Failure to Classify Reserved IP Address Space as Invalid

Qwik vulnerable to Unauthenticated RCE via server$ Deserialization

Directory Traversal in iter-server

Next.js vulnerable to server-side request forgery in applications using WebSocket upgrades

Path Traversal in simplehttpserver

Malicious code in ui-extensions-server-kit (npm)

lobe-chat `/api/proxy` endpoint Server-Side Request Forgery vulnerability

Malicious code in engage-digital-source-server-template-js (npm)

Malicious code in cors-typescript-server (npm)

Cross-Site Scripting in min-http-server

OpenClaw: MCP stdio server env could load dangerous startup variables from workspace config

Flowise Cors Misconfiguration in packages/server/src/index.ts

@dapperduckling/keycloak-connector-server has Reflected XSS Vulnerability in Authentication Flow URL Handling

Malicious code in homeappserver (npm)

Signal K Server's WebSocket Login Endpoint Lacks Rate Limiting (Credential Brute-Force)

LiveQuery publishes user session tokens in parse-server

Directory Traversal in serverzyy

Hono: Middleware bypass via repeated slashes in serveStatic

awwaiid mcp-server-taskwarrior vulnerable to command injection

Malicious code in grenache-fib-server (npm)

Duplicate Advisory: OpenClaw's andbox browser noVNC observer lacked VNC authentication

@grackle-ai/server has Missing WebSocket Origin Header Validation

lite-dev-server vulnerable to Directory Traversal

Flowise affected by Server-Side Request Forgery (SSRF) in HTTP Node Leading to Internal Network Access

next-mdx-remote affected by arbitrary code execution in React server-side rendering of untrusted MDX content

Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components

Stored Cross-Site Scripting in simplehttpserver

RedwoodSDK has Same-site CSRF through lack of origin validation in its server actions

Directory Traversal in tencent-server

Malicious code in @gameforge/http-server (npm)

Path Traversal in angular-http-server

Malicious code in @xvideos/server-inherited (npm)

Malicious code in ace_authorization_server (npm)

Directory Traversal in serverabc

Actual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated Servers

parse-server's file creation and deletion bypasses `readOnlyMasterKey` write restriction

Hono vulnerable to arbitrary file access via serveStatic vulnerability

Path traversal in oak allows transfer of hidden files within the served root directory

Malicious code in mcp-server-fixthis (npm)

Malicious code in gxm-reference-web-auth-server (npm)

Malicious code in chain-reserve-wallet-adapter (npm)

Malicious code in nayan-apis-servers (npm)

Malicious code in driver-app-server (npm)

Malicious code in raise-http-server (npm)

Next.js vulnerable to cache poisoning in React Server Component responses

Opening a malicious website while running a Nuxt dev server could allow read-only access to code

Code Injection in oauth2-server

Path Traversal in simplehttpserver

Path Traversal in general-file-server

Angular: SSRF via protocol-relative and backslash URLs in Angular Platform-Server

Malicious code in apple-app-store-server-library-poc (npm)

Signal K Server: Privilege Escalation by Admin Role Injection via /enableSecurity

Missing Origin Validation in webpack-dev-server

Directory Traversal in shit-server

Malicious code in matlab-language-server (npm)

Parse Server has a query condition depth bypass via pre-validation transform pipeline

React Server Components are Vulnerable to RCE

Nuxt's route middleware is not enforced when rendering `.server.vue` pages via `/__nuxt_island/page_*`

Malicious code in serverless-provisioned-memory-report (npm)

Malicious code in vro-language-server (npm)

Next Server Actions Source Code Exposure

Malicious code in @rezserver/fetlife-assets (npm)

Vite bypasses server.fs.deny when using ?raw??

Malicious code in vscode-azure-mcp-server (npm)

Malicious code in @lanyer640/mcp-runcommand-server (npm)

Actual Sync-server Gocardless service is logging sensitive data including bearer tokens and account numbers

Malicious code in mongodb-stitch-server-testutils (npm)

Malicious code in addons-server (npm)

Malicious code in exodus-update-server (npm)

Malicious code in mattermost-metrics-server (npm)

Malicious code in react-server-dom-turbopack-experimental (npm)

Malicious code in node-config-server-utils (npm)

Malicious code in ing-kit-dev-server (npm)

Malicious code in @adminproxy/module-utils-server (npm)

Malicious code in notebooklanguageserver (npm)

Malicious code in inno-basic-server (npm)

Malicious code in apple-app-store-server-library-v3 (npm)

Malicious code in explorhub-mcp-server (npm)

Malicious code in grenache-nodejs-example-fib-server (npm)

Malicious code in grenache-nodejs-fib-server (npm)

Malicious code in serverless-action (npm)

Malicious code in jscs-server (npm)

Malicious code in @citely/mcp-server (npm)

Malicious code in @tanstack/react-start-server (npm)

Malicious code in near-api-server (npm)

Malicious code in serverlog-dispatch (npm)

Malicious code in @tanstack/solid-start-server (npm)

Directory Traversal in serverlyr

Malicious code in mcp-server-fetch (npm)

Malicious code in mcp-server-figma (npm)

Malicious code in mcp-server-git (npm)

Malicious code in mcp-server-github (npm)

Malicious code in mcp-server-notion (npm)

Malicious code in mcp-server-sentry (npm)

Malicious code in mcp-server-sequential-thinking (npm)

Malicious code in mcp-server-supabase (npm)

Malicious code in bitrix24-tasks-mcp-server (npm)

Malicious code in operation-server-sdk (npm)

Malicious code in mcp-server-everything (npm)

protobufjs: Memory amplification from preserved unknown fields in binary decode

Malicious code in cosmosdb-server (npm)

vite: `server.fs.deny` bypass on Windows alternate paths

@angular/platform-server: Missing `<noscript>` Raw-Text Serialization Escaping leads to Cross-Site Scripting (XSS) in Angular SSR

Malicious code in pagespeed-server (npm)

@angular/platform-server: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Malicious code in mcp-server-iehub-proxy (npm)

Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter

Malicious code in paypay-sample-ecommerce-server (npm)

DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM

Nuxt: Dev server discloses project absolute path and persistent workspace UUID via `/.well-known/appspecific/com.chrome.devtools.json`

@angular/platform-server: URL Parser Differential leading to SSRF Allowlist Bypass

Malicious code in webpack-dev-server.legacy (npm)

Malicious code in adroit-websdk-server (npm)

Malicious code in webhooks-resources-nodejs-server (npm)

parse-server new anonymous user session acts as if it's created with password

Malicious code in cua-primitives-server (npm)

Malicious code in prompt-eng-server (npm)

Malicious code in react-server-dom-vite (npm)

Malicious code in sp-api-dev-assistant-mcp-server (npm)

OneUptime has WebAuthn 2FA bypass: server accepts client-supplied challenge instead of server-stored value, allowing credential replay

Directory Traversal in mfrserver

RCE in SiteServer CMS

Parse Server affected by empty authData bypassing credential requirement on signup

Malicious code in discord-bot-server (npm)

Server-Side Request Forgery in ssrf-agent

Malicious code in @posthog/web-dev-server (npm)

Malicious code in nayan-api-server (npm)

Malicious code in @browserbasehq/mcp-server-browserbase (npm)

Malicious code in samples-cors-typescript-server (npm)

Unexpected server crash in Next.js.

Parse Server vulnerable to brute force guessing of user sensitive data via search patterns

Malicious code in paypal-scripts-server-utils (npm)

Seafile Server has multiple stored XSS vulnerabilities

Malicious code in seal_online_node_server (npm)

Server-Side Request Forgery in FUXA

Malicious code in server_qa_automation (npm)

Malicious code in serverbeat (npm)

Malicious code in serverjsdefine (npm)

Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist

Malicious code in serverless-yandex-cloud-template (npm)

Source Code Exposure Vulnerability in React Server Components

fast-xml-parser has stack overflow in XMLBuilder with preserveOrder

Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem

Directory Traversal in f2e-server

OpenClaw: MCP loopback owner context is derived from server-issued bearer tokens

Parse Server option `masterKeyIps` vulnerability to IP spoofing

Next Vulnerable to Denial of Service with Server Components

Electerm Security Vulnerability: RCE via malicious SSH server filename in openFileWithEditor

Sync-in Server: SSRF protection bypass via IPv4-mapped IPv6 addresses in regExpPrivateIP

Svelte vulnerable to XSS when using objects during server-side rendering

NocoDB: Server-Side Request Forgery via Database Connection Host

Server side request forgery in @isomorphic-git/cors-proxy

Malicious code in @ensdomains/server-analytics (npm)

Malicious code in sifchain-changes-server (npm)

Malicious code in nayan-server (npm)

Malicious code in myfirstdependencywithserver (npm)

Path Traversal in http-file-server

Malicious code in media-server-embed (npm)

engram: HTTP server CORS wildcard + auth-off-by-default enables CSRF graph exfiltration and persistent indirect prompt injection

Malicious code in @tanstack/start-static-server-functions (npm)

Malicious code in @xvideos/facade-server (npm)

Malicious code in @aiscene/aiserver (npm)

jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions

Malicious code in paypal-server-sdk (npm)

Parse Server has a rate limit bypass via batch request endpoint

Malicious code in serve-static-corell (npm)

Malicious code in onboarding-server (npm)

Arbitrary remote file read in Wrangler dev server

Malicious code in www-server (npm)

CouchAuth has a Server-Side Template Injection vulnerability in its email functionality

Malicious code in gatsby-mars-pet-parent-journey--server (npm)

Path Traversal in angular-http-server

serve-static vulnerable to template injection that can lead to XSS

GitHub Kanban MCP Server vulnerable to Command Injection

Incorrect Authorization in serverless-offline

Directory Traversal in badjs-sourcemap-server

Vitest browser mode serves unsanitized otelCarrier query parameter as inline script

SSRF in @aborruso/ckan-mcp-server via base_url allows access to internal networks

oauth2-server through 3.1.1 vulnerable to Open Redirect

Azure MCP Server has Server-Side Request Forgery issue that allows authorized attacker to elevate privileges over a network

Signal K Server Vulnerable to Access Request Spoofing

When Vitest UI server is listening, arbitrary file can be read and executed

Nuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99)

Parse Server: Denial of Service via unindexed database query for unconfigured auth providers

Apify Model Context Protocol (MCP) server: Domain Allowlist Bypass in fetch-apify-docs via String Prefix Matching

Parse Server crashes with query parameter

Malicious code in http-long-poll-server (npm)

Hono vulnerable to Restricted Directory Traversal in serveStatic with deno

Nuxt dev server vite-node IPC socket is world-connectable on Linux

Malicious code in @mlspace/env-jupyter-server (npm)

vm2 Host Promise Resolution Preserves Object Identity Across Sandbox Boundary

Malicious code in https-servers (npm)

@executeautomation/database-server does not properly restrict access, bypassing a "read-only" mode

mcp-server-semgrep has a Command Injection issue

Parse Server has Regular Expression Denial of Service (ReDoS) via `$regex` query in LiveQuery

Malicious code in webpack-dev-serve-middleware (npm)

Malicious code in console-webapp-static-server (npm)

Malicious code in unms-server (npm)

BigSweetPotatoStudio HyperChat has a Server-Side Request Forgery issue

Vite's `server.fs` settings were not applied to HTML files

Malicious code in t-invest-mcp-server (npm)

Malicious code in mcp-server-postgres (npm)

Parse Server has a session field immutability bypass via falsy-value guard

Malicious code in mcp-server-redis (npm)

Astro: Server island encrypted parameters vulnerable to cross-component replay

Malicious code in @tanstack/start-server-core (npm)

Malicious code in @antv/mcp-server-antv (npm)

@vitejs/plugin-rsc has a Denial of Service Vulnerability in React Server Components

MCP NMAP Server has an Injection vulnerability

Malicious code in klook-tetris-server (npm)

Malicious code in telebot-server (npm)

Parse Server's OAuth2 adapter shares mutable state across providers via singleton instance

Denial of Service Vulnerability in React Server Components

@angular/platform-server: SSRF via Hostname Hijacking

Parse Server's Cloud Hooks and Cloud Jobs bypass `readOnlyMasterKey` write restriction

webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins

Malicious code in react-server-dom-webpack-experimental (npm)

hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)

@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g)

ActualBudget server is Missing Authentication for SimpleFIN and Pluggy AI bank sync endpoints

Malicious code in resize-observe (npm)

Malicious code in webhooks-server (npm)

Duplicate Advisory: OpenClaw: MCP stdio server env could load dangerous startup variables from workspace config

Malicious code in @actbase/node-server (npm)

Malicious code in server-fpti (npm)

Parse Server has an MFA single-use token bypass via concurrent authData login requests

Malicious code in @voiceflow/serverless-plugin-typescript (npm)

@cyanheads/git-mcp-server vulnerable to command injection in several tools

Malicious code in snapshot-server (npm)

Malicious code in @mastra/mcp-docs-server (npm)

Malicious code in server-log-engine (npm)

Malicious code in server-tiny-log (npm)

Malicious code in @mastra/server (npm)

Malicious code in @antv/g-dom-mutation-observer-api (npm)

Malicious code in @antv/mcp-server-chart (npm)

basic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response buffering

Parse Server: File upload Content-Type override via extension mismatch

Malicious code in apple-appstore-server-library (npm)

Malicious code in kyxserver-everything (npm)

Malicious code in react-server-dom-fb (npm)

Malicious code in inspector-server (npm)

Malicious code in npe-toolkit-server-deps (npm)

Malicious code in demo-mercadopago-mcp-server (npm)

md-fileserver: Stored/Reflected XSS when viewing Markdown (raw HTML allowed)

MCP Server Kubernetes: Tool Access Control Bypass via Presentation-Layer Filtering Without Execution-Layer Enforcement

React Server Components have multiple Denial of Service Vulnerabilities

Parse Server has a protected fields bypass via dot-notation in query and sort

FUXA's Unauthenticated Project Data Disclosure Exposes Server-Side Scripts and Device Configurations

Vite: `server.fs.deny` bypassed with queries

Malicious code in @tiledesk/tiledesk-server (npm)

Facebook React has a Denial of Service Vulnerability in React Server Components

React Server Components have a Denial of Service Vulnerability

@grpc/grpc-js: A malformed request can cause a server crash

Element Call reports full URLs of visited pages to analytics server

@grpc/grpc-js: An incoming malformed compressed message can cause a client or server crash

webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browser

Signal K Server: Unauthenticated Source Priorities Manipulation

@vitejs/plugin-rsc Remote Code Execution through unsafe dynamic imports in RSC server function APIs on development server

Next.js vulnerable to cache poisoning via collisions in React Server Component cache-busting

Malicious code in proof-of-reserves-adapter (npm)

MCP Server Kubernetes: kubectl-generic flag injection enables Kubernetes bearer token exfiltration

Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket

Malicious code in @cloudplatform-single-spa/bare-metal-servers (npm)

Malicious code in serverless-api-partners (npm)

Malicious code in serverless-infrastructure (npm)

Malicious code in serverless-push-hasura (npm)

NocoDB: Server-Side Request Forgery via Spreadsheet Fetch URL

Parse Server: Pre-authentication denial of service via client version header regex backtracking

NocoDB: Server-Side Request Forgery via Base Migration URL

NocoDB: Server-Side Request Forgery via Spreadsheet Import Endpoint

Malicious code in @cloudplatform-single-spa/ml-ai-agents-mcp-server (npm)

Malicious code in skywriter_server (npm)

Parse Server has a LiveQuery protected-field guard bypass via array-like logical operator value

webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies

Malicious code in @xvideos/auth-server (npm)

Malicious code in @xvideos/server-base (npm)

Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up

esbuild allows arbitrary file read when running the development server on Windows

Parser Server's streaming file download bypasses afterFind file trigger authorization

Open Source Kubectl MCP Server vulnerable to arbitrary code execution via user interaction with crafted HTML page

npm PraisonAI MCPServer exposes unauthenticated HTTP tools/call

a11y-mcp: Server-Side Request Forgery (SSRF) vulnerability in A11yServer function

Signal K Server: Server-Side Request Forgery via Remote Connection Endpoints

Malicious code in @posthog/plugin-server (npm)

Malicious code in strapi-plugin-server (npm)

parse-server: Endpoints `/login` and `/verifyPassword` disclose MFA secrets and protected fields when `_User` get is denied

parse-server: Stored XSS via trailing-dot filename bypassing file upload extension blocklist

parse-server: LiveQuery discloses object data to a subscriber across an ACL read-access change

parse-server: Denial of service via exponential-time processing of deeply nested query operators

parse-server crashes when receiving file download request with invalid byte range

SearXNG MCP Server: DNS-resolved Private Hostname SSRF in `web_url_read`

Network-AI: ApprovalInbox HTTP server has no authentication — anyone can approve pending agent actions

parse-server: Server option routeAllowList is bypassable through batch sub-requests

Kozou: Unauthenticated MCP HTTP server and bundled dev-stack hardening (DNS-rebinding, request-body limits, read-only reads, default network exposure)

parse-server: Stored XSS via non-standard file extension bypassing file upload extension blocklist

Agentic-Flow: OS Command Injection in agentic-flow MCP server tools via unsanitized tool-parameter interpolation into execSync

parse-server has cloud function validator bypass via prototype chain traversal

parse-server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACL

Parse Server exposes auth data via verify password endpoint

SearXNG MCP Server: Unbounded Response Body Read Bypasses URL Size Limit in `web_url_read`

Malicious code in defillama-apy-server (npm)