Security Digest: January 21, 2026 - 10 Critical Vulnerabilities

Today's security threats highlight critical vulnerabilities across several npm and pip packages, with potential impacts ranging from arbitrary code execution to signature forgery.

· 6 min read

Urgent Security Alert: 10 Critical Vulnerabilities Discovered Today

Executive Summary

Today's security threats highlight critical vulnerabilities across several npm and pip packages, with potential impacts ranging from arbitrary code execution to signature forgery. Immediate patching and configuration updates are essential to mitigate these risks.

Critical Vulnerabilities

  • CVE-2026-23966: Private Key Recovery in sm-crypto
    • Impact: Attackers can fully recover private keys.
    • Affected Systems: npm sm-crypto
    • Immediate Action: Update to the latest patched version of sm-crypto.
    • Mitigation: Rotate any compromised keys and monitor for suspicious activities.
  • CVE-2026-23950: Race Condition in node-tar
    • Impact: Allows symlink poisoning through path collisions, leading to arbitrary file overwrites.
    • Affected Systems: npm tar on macOS APFS
    • Immediate Action: Apply the recommended patch to path-reservations.js.
    • Mitigation: Filter out SymbolicLink entries when using node-tar.
  • CVE-2026-22807: Arbitrary Code Execution in vLLM
    • Impact: Remote code execution during model load without API access.
    • Affected Systems: pip vLLM
    • Immediate Action: Apply the patch from vLLM GitHub repository.
    • Mitigation: Ensure `trust_remote_code` is correctly gated during model loading.
  • CVE-2026-23956: Memory Exhaustion in Seroval
    • Impact: Potential Denial of Service through ReDoS.
    • Affected Systems: npm seroval
    • Immediate Action: Configure `disabledFeatures` to disable RegExp serialization.
    • Mitigation: Upgrade to the latest version of seroval.
  • CVE-2026-23967: Signature Malleability in sm-crypto
    • Impact: Attacker can forge valid signatures for existing messages.
    • Affected Systems: npm sm-crypto
    • Immediate Action: Update sm-crypto to the latest version.
    • Mitigation: Validate all signatures with additional verification steps.
  • CVE-2026-23737: Arbitrary Code Execution in Seroval
    • Impact: Exploitable via JSON deserialization.
    • Affected Systems: npm seroval
    • Immediate Action: Upgrade to the patched version.
    • Mitigation: No known workarounds; patch immediately.
  • CVE-2026-23965: Signature Forgery in sm-crypto
    • Impact: Allows forging of signatures for arbitrary public keys.
    • Affected Systems: npm sm-crypto
    • Immediate Action: Apply updates from the vendor.
    • Mitigation: Use additional signature verification processes.
  • CVE-2026-23957: Deserialization Processing Overhead in Seroval
    • Impact: Increased processing time during deserialization.
    • Affected Systems: npm seroval
    • Immediate Action: Use updated seroval version that computes array length during deserialization.
    • Mitigation: Monitor systems for unusual resource consumption.
  • CVE-2026-23736: Prototype Pollution in Seroval
    • Impact: Potential for arbitrary code execution.
    • Affected Systems: npm seroval
    • Immediate Action: Update to the latest version.
    • Mitigation: No known workarounds; apply patch.
  • CVE-2026-24046: Path Traversal in Backstage
    • Impact: Read, delete, or write files outside the intended directory.
    • Affected Systems: npm @backstage/backend-defaults, npm @backstage/plugin-scaffolder-backend
    • Immediate Action: Upgrade to the latest patched versions of affected packages.
    • Mitigation: Limit access to Scaffolder template creation and execution.

Previously Alerted

What to Do Now

  1. Immediately apply patches for sm-crypto, node-tar, vLLM, seroval, and Backstage packages.
  2. Verify system configurations and runtime for unusual activity.
  3. Set up continuous monitoring for any unauthorized access attempts.

Related Resources

  • Visit vendor advisories for sm-crypto, node-tar, vLLM, seroval, and Backstage for detailed patch notes.
  • Check internal blog posts for insights on handling similar vulnerabilities (coming soon).

Keep reading