KERN Chatbot

minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions

flatted vulnerable to unbounded recursion DoS in parse() revive phase

js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

nanoid: non-secure generators can loop indefinitely with negative size

ajv has ReDoS when using `$data` option

nanoid: custom generators can loop indefinitely when size is zero

brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups

minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern

Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching

yaml is vulnerable to Stack Overflow via deeply nested YAML collections

Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling

js-yaml: YAML merge-key chains can force quadratic CPU consumption

DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS

JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported

When Vitest UI server is listening, arbitrary file can be read and executed

esbuild enables any website to send any requests to the development server and read the response

PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments

Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)

minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments

Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock

vite allows server.fs.deny bypass via backslash on Windows

Picomatch has a ReDoS vulnerability via extglob quantifiers

DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.

Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM

brace-expansion: Zero-step sequence causes process hang and memory exhaustion

vite: `server.fs.deny` bypass on Windows alternate paths

PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset

Vite middleware may serve files starting with the same name with the public directory

JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases

form-data: CRLF injection in form-data via unescaped multipart field names and filenames

Vite's `server.fs` settings were not applied to HTML files

js-yaml has prototype pollution in merge (<<)

brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash

Rollup 4 has Arbitrary File Write via Path Traversal

Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket

PostCSS has XSS via Unescaped </style> in its CSS Stringify Output

PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure

Prototype Pollution via parse() in NodeJS flatted

brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows

uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided

baseline-browser-mapping process termination on invalid input causes denial of service

nanoid: Integer Overflow or Wraparound