UH
Vendor
uhop
8
CVEs
0
On KEV
3
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-114129 | ST stream-json uhop | 6.2 | Oct 21 | stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service |
| CVE-2026-104183 | ST stream-json uhop | 5.1 | Oct 1 | stream-json: Prototype pollution: Assembler writes this.current[this.key] on plain objects |
| CVE-2026-104182 | ST stream-json uhop | 6.2 | Oct 1 | stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk |
| CVE-2026-71429 | ST stream-json uhop | 6.2 | Sep 3 | stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS) |
| CVE-2026-71498 | NO node-re2 uhop | 5.1 | Aug 6 | node-re2: Out-of-bounds heap read in `replace`/`split` via a `Buffer` ending in a truncated multi-byte UTF-8 character → adjacent heap memory disclosed to JavaScript |
| CVE-2026-71430 | NO node-re2 uhop | 6.2 | Aug 6 | node-re2: String.prototype.replace(re2, template) aborts the Node process (uncatchable ToLocalChecked on empty MaybeLocal) when the result exceeds V8's max string length |
| CVE-2026-68499 | NO node-re2 uhop | 6.2 | Jul 30 | re2: Global `String.prototype.match` with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth (DoS) |
| CVE-2026-67550 | NO node-re2 uhop | 5.7 | Jul 30 | re2: Out-of-bounds heap read in `exec`/`test`/`match` via attacker-influenced `lastIndex` on a non-ASCII subject → uncatchable process crash (DoS) |