TechBriefing

Java · React 일일 브리핑

2026.05.10 (Sun)

67
릴리즈
43
CVE
44
아티클

🎯 오늘의 헤드라인

Runtime tier S CVE · 05-04 · score 9.96
vm2 is an open source vm/sandbox for Node.js. In version 3.10.4, vm2 is vulnerable to full sandbox escape with arbitrary code execution. Attacker code inside VM.run() obtains host process object and runs host commands with zero host cooperation. This issue has been patched in version 3.10.5.
CVSS 9.8 · CRITICAL
Backend/Java tier S CVE · 04-28 · score 9.5
In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: be a servlet-based web application; have no Spring Security configuration of its own and rely on the default web security filter chain; depend on spri…
CVSS 9.1 · CRITICAL
Meta-Framework tier S CVE · 05-07 · score 9.41
Inngest is a platform for running event-driven and scheduled background functions with queueing, retries, and step orchestration. Versions 3.22.0 through 3.53.1 contain a vulnerability that allows unauthenticated remote attackers to exfiltrate environment variables from the host process via the serve() HTTP handler. T…
CVSS 8.6 · HIGH
React Core tier S CVE · 05-06 · score 9.25
A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to server crashes, out-of-memory exceptions or excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopa…
CVSS 7.5 · HIGH
Language/Eco tier S CVE · 05-08 · score 8.52
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.21, 20.3.19, 21.2.9, and 22.0.0-next.8, a Server-Side Request Forgery (SSRF) vulnerability exists in @angular/platform-server due to improper handling of URLs durin…

🚀 릴리즈 & 보안 21건

New Releases · 8
React Core · 05-06 · score 7.24
## React Server Components - Type hardening and performance improvements ([#36425](https://github.com/facebook/react/pull/36425) by @eps1lon and @unstubbable)
React Core · 05-06 · score 7.24
## React Server Components - Type hardening and performance improvements ([#36425](https://github.com/facebook/react/pull/36425) by @eps1lon and @unstubbable)
React Core · 05-06 · score 7.24
## React Server Components - Type hardening and performance improvements ([#36425](https://github.com/facebook/react/pull/36425) by @eps1lon and @unstubbable)
React State · 05-08 · score 7.02
Release 2026-05-08 14:26 ## Changes ### Features - lit query adapter (408289450) by @chughgaurav ### Chore - vue-query-devtools: set up vitest environment with production fallback test (#10629) (c8e1b…
React State · 05-08 · score 7.02
### Minor Changes - Add initial @tanstack/lit-query package ([#10652](https://github.com/TanStack/query/pull/10652))
Tooling · 05-07 · score 6.82
Please refer to [CHANGELOG.md](https://github.com/vitejs/vite/blob/v8.0.11/packages/vite/CHANGELOG.md) for details.
Tooling · 05-07 · score 6.82
Please refer to [CHANGELOG.md](https://github.com/vitejs/vite/blob/v7.3.3/packages/vite/CHANGELOG.md) for details.
React Core · 05-05 · score 6.59
See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7150
Breaking Changes · 5
Runtime · 05-07
### Notable Changes #### Experimental `node:ffi` module Node.js now includes an experimental `node:ffi` module for loading dynamic libraries and calling native symbols from JavaScript. The API is gate…
Runtime · 05-05
We're excited to announce the release of Node.js 26! Highlights include the Temporal API enabled by default, updates to the V8 JavaScript engine to 14.6, Undici to 8.0, and several important deprecati…
Tooling · 05-07
The Gradle team is excited to announce Gradle 8.14.5. Here are the highlights of this release: - Java 24 support - GraalVM Native Image toolchain selection - Enhancements to test reporting - Build Aut…
Backend/Java · 05-10
# Hibernate ORM 7.3.4.Final released Today, we published a new release of Hibernate ORM 7.3: 7.3.4.Final. You can find the full list of 7.3.4.Final changes [here](https://hibernate.atlassian.net/issue…
Backend/Java · 05-10
# Hibernate ORM 7.1.26.Final released Today, we published a new release of Hibernate ORM 7.1: 7.1.26.Final. You can find the full list of 7.1.26.Final changes [here](https://hibernate.atlassian.net/is…
CVE · 6
CVE-2026-26956CVSS 9.8 · CRITICAL
매칭 키워드: node.js · 05-04
vm2 is an open source vm/sandbox for Node.js. In version 3.10.4, vm2 is vulnerable to full sandbox escape with arbitrary code execution. Attacker code inside VM.run() obtains host process object and runs host commands with zero host coopera…
CVE-2026-26332CVSS 9.8 · CRITICAL
매칭 키워드: node.js · 05-04
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, SuppressedError allows attackers to escape the sandbox and run arbitrary code. This issue has been patched in version 3.11.0.
CVE-2026-24781CVSS 9.8 · CRITICAL
매칭 키워드: node.js · 05-04
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, VM2 suffers from a sandbox breakout vulnerability through the inspect function. This allows attackers to write code which can escape from the VM2 sandbox and execute arb…
CVE-2026-24120CVSS 9.8 · CRITICAL
매칭 키워드: node.js · 05-04
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.10.5, the fix for CVE-2023-37466 is insufficient and can be circumvented allowing attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands …
CVE-2026-24118CVSS 9.8 · CRITICAL
매칭 키워드: node.js · 05-04
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, VM2 suffers from a sandbox breakout vulnerability. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host s…
CVE-2026-41311CVSS 7.5 · HIGH
매칭 키워드: node.js · 05-09
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to version 10.25.7, a circular block reference in {% layout %} / {% block %} causes an infinite recursive loop, consuming all available memory (~4GB) …
Deprecations · 2
Runtime · 05-05
React Core · 04-17

📈 키워드 트렌드 상승 가중치 기준

https 동반: com, github, pull w 365.4
com 동반: https, github, pull w 330.8
github 동반: com, https, pull w 309.9
this 동반: react, vulnerability, been w 278.5
react 동반: this, vulnerability, file w 205.9
node 동반: prior, this, can w 201.2
데이터 소스: GitHub Releases · NVD CVE · 공식 블로그 RSS (Spring · React · Kotlin · TypeScript · Next.js · Vite).
중요도 score = tier + source weight + CVSS boost − age penalty (0~10).
생성 시각: 2026-05-10 21:30
구독을 원하지 않으시면 여기에서 해지할 수 있습니다.