Skip to content

/

ZeroHour

ZeroHour aggregates public sources — security and AI press, vendor advisories, NVD, CISA KEV, FIRST EPSS, leak-site trackers and Have I Been Pwned — and classifies them with AI. Summaries can be wrong: read the original. All times are UTC.

News CVEs Incidents Tags Daily brief Traffic Sources RSS & API Kiosk Health Sitemap

Home
News feed
Exploited now

Security

CVEs
Ransomware & breaches
Threat actors & entities
IOCs

AI

AI & models

Explore

Tags
Daily brief
Analytics
Traffic & readers
Ask the feed
Sources

You

Watchlist
Saved
RSS, API & alerts

Node.js (Organization): news timeline & CVEs · ZeroHour

00:18 UTC· 4m ago

today 8.8K visits · 6.5K views · 1 read·all time 1.2M views

Organization

Node.js

1 mentions in 7 days · 2 in 30 days · 2 total · first seen Oct 1, 2026 · last 3d ago

Search everything

Timeline2 articles

Related CVEsby mentions

CVE-2026-1019098.3—
Prototype pollution in Axios toFormData options
published 10d ago· Axios
CVE-2026-1019018.2—
Unhandled HTTP/2 session error DoS in Axios
published 10d ago· axios
CVE-2026-1019068.2—
ReDoS in Axios proxy bypass on crafted redirects
published 10d ago· Axios
CVE-2026-1019038.2—
ReDoS in Axios data-URL parsing before 1.20.0
published 10d ago· Axios
CVE-2026-1019057.6—
Axios Node HTTP adapter hijack via prototype pollution
published 10d ago· axios
CVE-2026-1019077.0—
Redirect-policy bypass in Axios fetch adapter
published 10d ago· axios
CVE-2026-1018987.0—
Axios HTTP/2 bypasses proxy and DNS lookup policy
published 10d ago· axios

Appears with

organization Omacom Foundation 1 vendor DigitalOcean 1 organization Axios 1 organization DigitalOcean 1 organization Pidgin 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.

DigitalOcean Ends Open Source Credits Program

DigitalOcean is quietly ending its Open Source Credits program and stopping new or renewed credits.

DigitalOcean is sunsetting its Open Source Credits program without a public blog post, telling projects including Node.js that new applications, renewals, and extensions will not be approved. Existing credits can still be used, after which projects must pay or move infrastructure. Node.js maintainers discussed dropping DigitalOcean branding, after which the company reportedly re-engaged about a more selective program version 2.0. DigitalOcean also dropped GitHub Student Pack credits earlier and recently donated $3 million to the Omacom Foundation behind Omarchy Linux.

Hacker News · security·Oct 5, 17:12 UTC · 3d agoOther HN 20↑ · 3 comments1

8

Axios Flaws Let Attackers Bypass Proxy Controls and Trigger SSRF Attacks

Axios disclosed seven high-severity flaws, including HTTP/2 SSRF proxy bypass; attackers could reach internal services and cloud metadata; patched in 1.20.0.

Axios maintainers disclosed multiple high-severity vulnerabilities, led by GHSA-3pq3-5fj3-cg6v (CVE-2026-101898), where the HTTP/2 adapter ignores custom DNS lookup handlers, agents, and proxy settings, bypassing SSRF defenses. A related advisory (GHSA-44g4-m2mj-wpvx) notes Axios ignores CIDR-form NO_PROXY entries used to exclude private subnets like 10.0.0.0/8. Additional high-severity issues include prototype pollution in toFormData, ReDoS in two components, a fetch adapter ignoring maxRedirects, and mishandling of 0.0.0.0 and loopback variants in NO_PROXY checks.

GBHackers·Oct 1, 11:46 UTC · 7d agoVulnerability CVE-2026-101901 CVE-2026-101898 CVE-2026-101909+4 CVEs1

60