Vulnerabilities - @validate-sdk/v2@1.22.17 - npm | ReversingLabs Spectra Assure Community

List of known vulnerabilities affecting the software package and the components it embeds. Last refreshed on: 2026/05/19

All detected vulnerabilities are fixable

Run the update/upgrade command in your package manager to resolve the detected vulnerabilities

CVSS Score

CVE Identifier

Summary

Tags

high

8.8

CVE-2025-15467

OpenSSL is vulnerable to a stack buffer overflow when parsing CMS AuthEnvelopedData messages with maliciously crafted AEAD parameters.

Exploits Exist

Fix Available

high

8.1

CVE-2026-28387

DANE TLSA-based server authentication in uncommon client configurations may result in a use-after-free and/or double-free.

Fix Available

high

7.5

CVE-2025-69420

OpenSSL is vulnerable to a type confusion vulnerability in the TimeStamp Response verification code, potentially leading to a Denial of Service.

Fix Available

high

7.5

CVE-2025-69421

OpenSSL's PKCS12_item_decrypt_d2i_ex function can trigger a NULL pointer dereference when processing a malformed PKCS#12 file, leading to Denial of Service.

Fix Available

high

7.5

CVE-2026-2673

OpenSSL may fail to negotiate the expected preferred key exchange group in TLS 1.3 due to a configuration issue.

Fix Available

high

7.5

CVE-2026-28388

OpenSSL is vulnerable to a NULL pointer dereference in delta CRL processing, potentially leading to a Denial of Service.

Fix Available

high

7.5

CVE-2026-28389

OpenSSL CMS EnvelopedData processing is vulnerable to a NULL pointer dereference, potentially causing a Denial of Service.

Fix Available

high

7.5

CVE-2026-28390

OpenSSL CMS EnvelopedData processing is vulnerable to a NULL pointer dereference, potentially causing a Denial of Service.

Fix Available

high

7.5

CVE-2026-31790

OpenSSL's RSA/RSASVE key encapsulation can leak sensitive data from an uninitialized memory buffer to a malicious peer.

Fix Available

high

7.4

CVE-2025-69419

OpenSSL's PKCS12_get_friendlyname function is vulnerable to a one-byte write before the allocated buffer when parsing maliciously crafted PKCS#12 files.

Fix Available

@validate-sdk/v2

SAFE Assessment

Compliance

Security

Threats

INCIDENTS FOR THIS VERSION:

Did you know...

@validate-sdk/v2

SAFE Assessment

Compliance

Security

Threats

IMPORTANT: All versions of this package have been maliciousLatest version with malware incident detected: 2 months agoVersion: 1.22.31

INCIDENTS FOR THIS VERSION:

Did you know...