node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal

Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

Faraday: Uncontrolled recursion in NestedParamsEncoder allows stack exhaustion DoS via deeply nested query parameters

form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)

JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection

follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets

Rack: Algorithmic-Complexity DoS in Rack::Multipart::Parser

Rack: Denial of Service via Unbounded Multipart File Upload Without Content-Length

flatted: Unbounded recursion DoS in parse() revive phase

Incorrect enforcement of email constraints in crypto/x509

SVGO: DoS through entity expansion in DOCTYPE (Billion Laughs)

Rack has a Directory Traversal via Rack:Directory

Axios affected by Denial of Service via __proto__ Key in mergeConfig

Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking