115 KI-Chatbot Agent Flow Backend

body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body

nanoid: non-secure generators can loop indefinitely with negative size

nanoid: custom generators can loop indefinitely when size is zero

path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters

Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching

qs: Denial of Service via Attacker Controlled isBuffer

Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling

launch-editor: `fs.existsSync()` existence check can be bypassed on Windows

Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution

When Vitest UI server is listening, arbitrary file can be read and executed

esbuild enables any website to send any requests to the development server and read the response

source-map-js allows event-loop denial of service through indexed source-map section offsets

launch-editor: escapeCmdArgs() omits % escaping on Windows

PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments

qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)

qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion

Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock

Tinypool: Prototype Pollution Gadget to RCE in run() options

auth0/node-jws Improperly Verifies HMAC Signature

vite allows server.fs.deny bypass via backslash on Windows

Vite: Cross origin script execution through Vite custom middleware

Picomatch has a ReDoS vulnerability via extglob quantifiers

vite: `server.fs.deny` bypass on Windows alternate paths

PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset

Vite middleware may serve files starting with the same name with the public directory

proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

Vite's `server.fs` settings were not applied to HTML files

Zod can exhaust memory while validating oversized constrained collections

Rollup 4 has Arbitrary File Write via Path Traversal

Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket

qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set

PostCSS has XSS via Unescaped </style> in its CSS Stringify Output

Vitest: Code injection via unauthenticated manual mock registration

PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure

launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors

Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine

body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement

launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows

qs's arrayLimit bypass in comma parsing allows denial of service

MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint

nanoid: Integer Overflow or Wraparound