protobufjs has an arbitrary code execution issue

Gvisor-tap-vsock: gvisor-tap-vsock: unathenticated arbitrary file deletion on the host via /expose

undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse

protobufjs: Code injection through bytes field defaults in generated toObject code

shell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op`

fast-uri vulnerable to host confusion via failed IDN canonicalization

undici WebSocket client vulnerable to denial of service via fragment count bypass

ws: Memory exhaustion DoS from tiny fragments and data chunks

form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)

Svelte devalue: DoS via sparse array deserialization

ws: Uninitialized memory disclosure

xmldom: XML node injection through unvalidated processing instruction serialization

xmldom: XML injection through unvalidated DocumentType serialization

xmldom: Denial of service via uncontrolled recursion in XML serialization

xmldom: XML node injection through unvalidated comment serialization

fast-uri vulnerable to host confusion via percent-encoded authority delimiters

fast-uri vulnerable to path traversal via percent-encoded dot segments

follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets

undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent

ip-address: XSS in Address6 HTML-emitting methods

Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers