undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse

launch-editor vulnerable to command injection via the crafted request on Windows

Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options

shell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op`

Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial

Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block

fast-uri vulnerable to host confusion via failed IDN canonicalization

undici WebSocket client vulnerable to denial of service via fragment count bypass

ws: Memory exhaustion DoS from tiny fragments and data chunks

form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)

Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh

Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

fast-uri vulnerable to host confusion via percent-encoded authority delimiters

fast-uri vulnerable to path traversal via percent-encoded dot segments

follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets

OpenTelemetry-Go multi-value `baggage` header extraction causes excessive allocations (remote dos amplification)

Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation

Forge has signature forgery in Ed25519 due to missing S > L check

Forge has signature forgery in RSA-PKCS due to ASN.1 extra field

Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input

Denial of service in github.com/buger/jsonparser

undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent