TruSpace

LinkifyIt#match scan loop has quadratic algorithmic complexity

minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions

node-tar: Decompression/parse DoS via unlimited input

flatted vulnerable to unbounded recursion DoS in parse() revive phase

Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes

Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injection

Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up

ajv has ReDoS when using `$data` option

Undici has an HTTP Request/Response Smuggling issue

axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse

Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n

bn.js affected by an infinite loop

path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters

markdown-it is has a Regular Expression Denial of Service (ReDoS)

shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)

axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

Next.js's Middleware / Proxy redirects can be cache-poisoned

brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups

Multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads

Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF

minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern

Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching

Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`

Axios: Excessive recursion in formDataToJSON can cause denial of service

Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig

Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream

Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences

Next.js has a Middleware / Proxy bypass through dynamic route parameter injection

Undici has CRLF Injection in undici via `upgrade` option

next-intl has prototype pollution with `experimental.messages.precompile` via attacker-controlled translation catalog keys

Next.js: Unbounded Server Action payload in Edge runtime

fast-uri vulnerable to host confusion via failed IDN canonicalization

Axios is vulnerable to DoS attack through lack of data size check

morgan vulnerable to Log Forging via unneutralized control characters in :remote-user

@babel/core: Arbitrary File Read via sourceMappingURL Comment

js-yaml: YAML merge-key chains can force quadratic CPU consumption

Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0

glob CLI: Command injection via -c/--cmd executes matches with shell:true

Axios: unbounded recursion in toFormData causes DoS via deeply nested request data

Next.js: Cache confusion of response bodies for requests with bodies

Axios: Header Injection via Prototype Pollution

PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments

qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion

markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations

Multer vulnerable to Denial of Service via deeply nested field names

jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch

Allocation of Resources Without Limits or Throttling in Axios