Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0

Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF

Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization

Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable

Netty: HttpClientCodec response desynchronization

Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder)

Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking

Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`

Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)

Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642

Quarkus authorization bypass via semicolon path normalization inconsistency

Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS

Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation

Axios: unbounded recursion in toFormData causes DoS via deeply nested request data

follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets

Forge has signature forgery in Ed25519 due to missing S > L check

Forge has signature forgery in RSA-PKCS due to ASN.1 extra field

Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input

Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass

Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

flatted: Unbounded recursion DoS in parse() revive phase

SVGO: DoS through entity expansion in DOCTYPE (Billion Laughs)

Undertow: outofmemory when parsing form data encoding with application/x-www-form-urlencoded

Smallrye-fault-tolerance: smallrye fault tolerance

Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking

Io.quarkus.http/quarkus-http-core: quarkus http cookie smuggling

Keycloak: org.keycloak.protocol.oidc: unvalidated cross-origin messages in checkloginiframe leads to ddos

Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy

Keycloak: xss via assertion consumer service url in saml post-binding flow

Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript

Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain