undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse

protobufjs: Code injection through bytes field defaults in generated toObject code

Electron: Use-after-free in WebContents fullscreen, pointer-lock, and keyboard-lock permission callbacks

Electron: Renderer command-line switch injection via undocumented commandLineSwitches webPreference

shell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op`

Electron: Use-after-free in offscreen child window paint callback

fast-uri vulnerable to host confusion via failed IDN canonicalization

undici WebSocket client vulnerable to denial of service via fragment count bypass

ws: Memory exhaustion DoS from tiny fragments and data chunks

form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)

Svelte devalue: DoS via sparse array deserialization

ws: Uninitialized memory disclosure

xmldom: XML node injection through unvalidated processing instruction serialization

xmldom: XML injection through unvalidated DocumentType serialization

xmldom: Denial of service via uncontrolled recursion in XML serialization

xmldom: XML node injection through unvalidated comment serialization

fast-uri vulnerable to host confusion via percent-encoded authority delimiters

fast-uri vulnerable to path traversal via percent-encoded dot segments

follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets

Vite has a `server.fs.deny` bypass with queries

Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket

Forge has signature forgery in Ed25519 due to missing S > L check

Forge has signature forgery in RSA-PKCS due to ASN.1 extra field

Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input

path-to-regexp vulnerable to Denial of Service via sequential optional groups

undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent