@backstage/plugin-techdocs-node vulnerable to arbitrary code execution via MkDocs hooks

FTP Command Injection via CRLF in basic-ftp

xmldom: XML injection through unvalidated DocumentType serialization

fast-uri vulnerable to path traversal via percent-encoded dot segments

Axios: unbounded recursion in toFormData causes DoS via deeply nested request data

follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets

Forge has signature forgery in Ed25519 due to missing S > L check

Forge has signature forgery in RSA-PKCS due to ASN.1 extra field

Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input

path-to-regexp vulnerable to Denial of Service via sequential optional groups

undici is vulnerable to Unhandled Exception in undici WebSocket Client Due to Invalid server_max_window_bits Validation

undici is vulnerable to Malicious WebSocket 64-bit length overflows undici parser and crashes the client

undici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate Decompression

flatted: Unbounded recursion DoS in parse() revive phase

SVGO: DoS through entity expansion in DOCTYPE (Billion Laughs)

Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unhandled AssertionError during Markdown…

Multer vulnerable to Denial of Service via uncontrolled recursion

Multer vulnerable to Denial of Service via incomplete cleanup

Multer vulnerable to Denial of Service via resource exhaustion

fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)

Axios affected by Denial of Service via __proto__ Key in mergeConfig

Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking

Backstage has a Possible Symlink Path Traversal in Scaffolder Actions