Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0

Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF

lodash vulnerable to Code Injection via `_.template` imports key names

Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable

gRPC-Go has an authorization bypass via missing leading slash in :path

Axios: unbounded recursion in toFormData causes DoS via deeply nested request data

follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets

Unexpected work during chain building in crypto/x509

Incorrect parsing of IPv6 host literals in net/url

Axios affected by Denial of Service via __proto__ Key in mergeConfig

Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking

Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy

Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions

Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain

ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled