Vendor
Openjsf
28 known vulnerabilities in products by Openjsf, 0 of them actively exploited (CISA KEV).
Key figures
28
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
1
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-25244 | WebdriverIO has Command Injection in the BrowserStack Service | 9.8 | |
| High | CVE-2026-10796 | nvm executes commands from a malicious Node.js mirror's version strings | 7.5 | |
| High | CVE-2022-24999 | Openjsf Express: security vulnerability | 7.5 | |
| High | CVE-2026-6321 | fast-uri vulnerable to path traversal via percent-encoded dot segments | 7.5 | |
| Medium | CVE-2015-8856 | Openjsf Serve-index: Cross-Site Scripting (XSS) | 6.1 | |
| High | CVE-2026-13676 | fast-uri vulnerable to host confusion via failed IDN canonicalization | 7.5 | |
| High | CVE-2026-84394 | fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority | 7.5 | |
| High | CVE-2026-75931 | fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references | 7.5 | |
| High | CVE-2024-45590 | body-parser vulnerable to denial of service when url encoding is enabled | 7.5 | |
| High | CVE-2026-16221 | fast-uri vulnerable to host confusion via literal backslash authority delimiter | 7.5 | |
| High | CVE-2026-6322 | fast-uri vulnerable to host confusion via percent-encoded authority delimiters | 7.5 | |
| High | CVE-2026-18446 | fast-uri vulnerable to host confusion via backslash authority introducer | 7.5 | |
| Medium | CVE-2014-6393 | Openjsf Express: Cross-Site Scripting (XSS) | 6.1 | |
| High | CVE-2026-84292 | fast-uri vulnerable to authority injection via an unvalidated port in serialize | 7.5 | |
| High | CVE-2026-76172 | fast-uri vulnerable to host confusion via percent-encoded scheme normalization | 7.5 | |
| High | CVE-2026-75975 | fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization | 7.5 | |
| High | CVE-2026-75899 | fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding | 7.5 | |
| High | CVE-2024-29900 | @electron/packager's build process memory potentially leaked into final executable | 7.5 | |
| Medium | CVE-2024-29041 | Express.js Open Redirect in malformed URLs | 6.1 | |
| High | CVE-2024-26136 | kedi ElectronCord's Discord Token is public | 7.5 | |
| High | CVE-2025-57349 | Openjsf Messageformat: Denial of Service | 7.5 | |
| Medium | CVE-2020-4051 | XSS in Dijit Editor's LinkDialog plugin | 3.7 | |
| Medium | CVE-2024-43800 | serve-static affected by template injection that can lead to XSS | 5.0 | |
| Medium | CVE-2026-41591 | Marko: XSS via case-insensitive script/style closing tag bypass in runtime HTML escaping | 6.4 | |
| Medium | CVE-2026-12590 | Body-parser: Allocation of Resources Without Limits or Throttling | 3.7 |
Products
| OpenJS Foundation fast-uri | 11 | 0 |
| Express | 5 | 0 |