Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0

Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF

protobufjs has an arbitrary code execution issue

lodash vulnerable to Code Injection via `_.template` imports key names

flatted: Prototype Pollution via parse()

@backstage/plugin-techdocs-node: TechDocs Mkdocs Configuration Key Enables Arbitrary Code Execution

Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable

Rollup 4 has Arbitrary File Write via Path Traversal

The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution

fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names

Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`

Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)

gRPC-Go has an authorization bypass via missing leading slash in :path

@backstage/plugin-techdocs-node vulnerable to arbitrary code execution via MkDocs hooks

FTP Command Injection via CRLF in basic-ftp

xmldom: XML injection through unvalidated DocumentType serialization

fast-uri vulnerable to path traversal via percent-encoded dot segments

Axios: unbounded recursion in toFormData causes DoS via deeply nested request data

follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets

Forge has signature forgery in Ed25519 due to missing S > L check

Forge has signature forgery in RSA-PKCS due to ASN.1 extra field

Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input

path-to-regexp vulnerable to Denial of Service via sequential optional groups

undici is vulnerable to Unhandled Exception in undici WebSocket Client Due to Invalid server_max_window_bits Validation

undici is vulnerable to Malicious WebSocket 64-bit length overflows undici parser and crashes the client

undici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate Decompression

flatted: Unbounded recursion DoS in parse() revive phase

SVGO: DoS through entity expansion in DOCTYPE (Billion Laughs)

Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unhandled AssertionError during Markdown…

Multer vulnerable to Denial of Service via uncontrolled recursion

Multer vulnerable to Denial of Service via incomplete cleanup

Multer vulnerable to Denial of Service via resource exhaustion

fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)

Axios affected by Denial of Service via __proto__ Key in mergeConfig

Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking

Backstage has a Possible Symlink Path Traversal in Scaffolder Actions

Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy

Rhdh: graphql injection leading to platform-wide denial of service (dos) in rh developer hub orchestrator plugin

wheel Allows Arbitrary File Permission Modification via Path Traversal

Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions

Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain

ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled