Skip to content
OpenAdvisories

Package · Wolfi

langfuse-3-worker

249 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

93 results · Clear filters · Feed

  • High 8.6
    CVE-2025-61732

    Potential code smuggling via doc comments in cmd/cgo

    A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.

    Go toolchain cmd/cgo langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi Go
  • High 7.1
    CVE-2026-25536

    @modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

    MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.10.0 to 1.25.3, cross-client response data leak when a single McpServer/Server and transport instance is reused across multiple client connections…

    Model Context Protocol typescript-sdk langfuse-3-worker langfuse-3 Wolfi npm
  • High 7.5
    CVE-2026-25128

    fast-xml-parser has RangeError DoS Numeric Entities Bug

    fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 5.0.9 through 5.3.3, a RangeError vulnerability exists in the numeric entity processing of fast-xml-pa…

    NaturalIntelligence fast-xml-parser langfuse-3-worker renovate Ubuntu Wolfi npm
  • High 7.8
    CVE-2025-61731

    Arbitrary file write using cgo pkg-config directive in cmd/go

    Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The "#cgo pkg-config:" directive in a Go source file provides command-line arguments to provide to the Go pkg-config com…

    Go toolchain cmd/go langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi Go
  • High 7.0
    CVE-2025-68119

    Unexpected code execution when invoking toolchain in cmd/go

    Downloading and building modules with malicious version strings can cause local code execution. On systems with Mercurial (hg) installed, downloading modules from non-standard sources (e.g., custom domains) can cause unexpected code execution due to how exter…

    Go toolchain cmd/go langfuse-3-worker golang Debian Ubuntu Azure Linux Alpine Wolfi Go
  • High 8.2
    CVE-2026-22817

    JWT Algorithm Confusion via Unsafe Default (HS256) in Hono JWT Middleware Allows Token Forgery and Auth Bypass

    Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.11.4, there is a flaw in Hono’s JWK/JWKS JWT verification middleware allowed the JWT header’s alg value to influence signature verification when the selected JWK …

    honojs hono langfuse-3-worker hono Wolfi npm
  • High 8.2
    CVE-2026-22818

    JWT algorithm confusion in Hono JWK Auth Middleware when JWK lacks "alg" (untrusted header.alg fallback)

    Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.11.4, there is a flaw in Hono’s JWK/JWKS JWT verification middleware allowed the algorithm specified in the JWT header to influence signature verification when th…

    honojs hono langfuse-3-worker hono Wolfi npm
  • High 7.2
    CVE-2026-22028

    Preact has JSON VNode Injection issue

    Preact, a lightweight web development framework, JSON serialization protection to prevent Virtual DOM elements from being constructed from arbitrary JSON. A regression introduced in Preact 10.26.5 caused this protection to be softened. In applications where v…

    preactjs preact langfuse-3-worker langfuse-3 Ubuntu Wolfi npm
  • High 8.7
    CVE-2026-0621

    MCP TypeScript SDK UriTemplate Exploded Array Pattern ReDoS

    Anthropic's MCP TypeScript SDK versions up to and including 1.25.1 contain a regular expression denial of service (ReDoS) vulnerability in the UriTemplate class when processing RFC 6570 exploded array patterns. The dynamically generated regular expression use…

    Anthropic MCP TypeScript SDK langfuse-3-worker langfuse-3 Wolfi npm
  • High 7.5
    CVE-2025-14874

    Nodemailer: nodemailer: denial of service via crafted email address header

    A flaw was found in Nodemailer. This vulnerability allows a denial of service (DoS) via a crafted email address header that triggers infinite recursion in the address parser.

    Red Hat nodemailer Red Hat Advanced Cluster Management for Kubernetes 2 nodemailer Debian Ubuntu Wolfi npm Maven
  • High 8.5
    CVE-2025-68130

    tRPC has possible prototype pollution in `experimental_nextAppDirCaller`

    tRPC allows users to build and consume fully typesafe APIs without schemas or code generation. Starting in version 10.27.0 and prior to versions 10.45.3 and 11.8.0, a A prototype pollution vulnerability exists in `@trpc/server`'s `formDataToObject` function, …

    trpc trpc langfuse-3-worker langfuse-3 Wolfi npm
  • High 7.5
    CVE-2025-65945 Public exploit

    auth0/node-jws improper HMAC signature verification vulnerability

    auth0/node-jws is a JSON Web Signature implementation for Node.js. In versions 3.2.2 and earlier and version 4.0.0, auth0/node-jws has an improper signature verification vulnerability when using the HS256 algorithm under specific conditions. Applications are …

    auth0 node-jws langfuse-3-worker renovate Wolfi npm
  • High 7.6
    CVE-2025-66414

    DNS Rebinding Protection Disabled by Default in Model Context Protocol TypeScript SDK for Servers Running on Localhost

    MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Prior to 1.24.0, The Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based M…

    Model Context Protocol typescript-sdk langfuse-3-worker langfuse-3 Wolfi npm