KERN KI Chat-Bot Example

LinkifyIt#match scan loop has quadratic algorithmic complexity

minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions

flatted vulnerable to unbounded recursion DoS in parse() revive phase

nanoid: non-secure generators can loop indefinitely with negative size

ajv has ReDoS when using `$data` option

Undici has an HTTP Request/Response Smuggling issue

nanoid: custom generators can loop indefinitely when size is zero

axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse

path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters

markdown-it is has a Regular Expression Denial of Service (ReDoS)

shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)

axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups

Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF

minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern

Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching

Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`

Axios: Excessive recursion in formDataToJSON can cause denial of service

Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig

Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream

yaml is vulnerable to Stack Overflow via deeply nested YAML collections

Undici has CRLF Injection in undici via `upgrade` option

undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives

Axios is vulnerable to DoS attack through lack of data size check

js-yaml: YAML merge-key chains can force quadratic CPU consumption

Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0

glob CLI: Command injection via -c/--cmd executes matches with shell:true

JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported

Axios: unbounded recursion in toFormData causes DoS via deeply nested request data

Axios: Header Injection via Prototype Pollution

PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments

qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion

markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations

jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch

Allocation of Resources Without Limits or Throttling in Axios

@isaacs/brace-expansion has Uncontrolled Resource Consumption

Axios: Nested axios option objects can consume polluted prototype values

minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments

auth0/node-jws Improperly Verifies HMAC Signature

axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions

undici vulnerable to downstream response desynchronization via retry interceptor

Picomatch has a ReDoS vulnerability via extglob quantifiers

lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`

Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client

brace-expansion: Zero-step sequence causes process hang and memory exhaustion

Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain

PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset