Category - API Security Blog

Node.js: HashDoS in V8

The V8 release used in Node.js v24.0.0 changed how string hashes were computed using rapidhash. This implementation reintroduced the HashDoS vulnerability, where an attacker who could control the stri ...

July 17, 2025

Fastify: Remote Code Execution via unsafe usage of `reply.view({ raw })` in @fastify/view (EJS template engine)

The @fastify/view plugin, when used with the EJS engine and the reply.view({ raw: <user-controlled-string> }) pattern, allowed arbitrary EJS execution. This vulnerability arose from the ...

July 17, 2025

curl: curl_easy_header runs at O(N) or worse and can be abused to use minute(s) of CPU time

Vulnerability description not...Read More ...

July 17, 2025

curl: Speculative Execution Side-Channel in `curl`

Vulnerability description not...Read More ...

July 17, 2025

curl: CRLF Injection in `–proxy-header` allows extra HTTP headers (CWE-93)

Vulnerability description not...Read More ...