Skip to content
Threat Feed
Subscribe

Tag

Ssr

2 briefs RSS
high advisory

Stored XSS in @vue/server-renderer via Attribute Name Injection

An insufficient character blacklist in @vue/server-renderer allows attackers to inject arbitrary HTML attributes by including carriage return characters in dynamic binding keys.

@vue/server-renderer xss web-application vue ssr code-vulnerability
1t
high advisory

Information Disclosure via Improper Buffer Serialization in devalue

The devalue library improperly serializes Node.js Buffer objects, exposing up to 64 KB of process-wide memory to end users in SSR environments via CVE-2026-92708.

devalue information-disclosure supply-chain npm ssr
1c