Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF

CVE-2026-33816 in github.com/jackc/pgx

CVE-2026-33815 in github.com/jackc/pgx

Rails Active Storage has possible Path Traversal in DiskService

flatted: Prototype Pollution via parse()

Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable

Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking

Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`

Libxml: heap use after free (uaf) leads to denial of service (dos)

Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

Faraday: Uncontrolled recursion in NestedParamsEncoder allows stack exhaustion DoS via deeply nested query parameters

form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)

JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection

follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets

Rack: Algorithmic-Complexity DoS in Rack::Multipart::Parser

Rack: Denial of Service via Unbounded Multipart File Upload Without Content-Length

flatted: Unbounded recursion DoS in parse() revive phase

Incorrect enforcement of email constraints in crypto/x509

SVGO: DoS through entity expansion in DOCTYPE (Billion Laughs)

Rack has a Directory Traversal via Rack:Directory

Axios affected by Denial of Service via __proto__ Key in mergeConfig

Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking

Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy

Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript

net-imap: Command Injection via unvalidated Symbol inputs

ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled