TruSpace

LinkifyIt#match scan loop has quadratic algorithmic complexity

minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions

flatted vulnerable to unbounded recursion DoS in parse() revive phase

Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes

Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injection

Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up

ajv has ReDoS when using `$data` option

Undici has an HTTP Request/Response Smuggling issue

axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse

Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n

bn.js affected by an infinite loop

path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters

markdown-it is has a Regular Expression Denial of Service (ReDoS)

axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

Next.js's Middleware / Proxy redirects can be cache-poisoned

Multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads

Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF

minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern

Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching

Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`

Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig

Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream

Next.js has a Middleware / Proxy bypass through dynamic route parameter injection

Undici has CRLF Injection in undici via `upgrade` option

next-intl has prototype pollution with `experimental.messages.precompile` via attacker-controlled translation catalog keys

Axios is vulnerable to DoS attack through lack of data size check

morgan vulnerable to Log Forging via unneutralized control characters in :remote-user

@babel/core: Arbitrary File Read via sourceMappingURL Comment

Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0

glob CLI: Command injection via -c/--cmd executes matches with shell:true

Axios: unbounded recursion in toFormData causes DoS via deeply nested request data

Axios: Header Injection via Prototype Pollution

qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion

markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations

Multer vulnerable to Denial of Service via deeply nested field names

jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch

Allocation of Resources Without Limits or Throttling in Axios

minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments

Elliptic Uses a Cryptographic Primitive with a Risky Implementation

auth0/node-jws Improperly Verifies HMAC Signature

axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions

Next.js Vulnerable to Denial of Service with Server Components

Picomatch has a ReDoS vulnerability via extglob quantifiers

Next.js vulnerable to server-side request forgery in applications using WebSocket upgrades

lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`

Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client

brace-expansion: Zero-step sequence causes process hang and memory exhaustion