undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse

protobufjs: Code injection through bytes field defaults in generated toObject code

@backstage/plugin-techdocs-node vulnerable to arbitrary code execution via MkDocs hooks

Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

Axios: shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)

FTP Command Injection via CRLF in basic-ftp

shell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op`

systeminformation: Linux command injection in networkInterfaces() via unsanitized NetworkManager connection profile name

Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

fast-uri vulnerable to host confusion via failed IDN canonicalization

undici WebSocket client vulnerable to denial of service via fragment count bypass

ws: Memory exhaustion DoS from tiny fragments and data chunks

form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)

Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection

Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter

Axios: Allocation of Resources Without Limits or Throttling in axios

Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection

JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection

ws: Uninitialized memory disclosure

Quadratic string concatentation in consumeComment in net/mail

Crash when handling long CNAME response in net

Quadratic string concatenation in consumePhrase in net/mail

xmldom: XML node injection through unvalidated processing instruction serialization

xmldom: XML injection through unvalidated DocumentType serialization

xmldom: Denial of service via uncontrolled recursion in XML serialization

xmldom: XML node injection through unvalidated comment serialization

fast-uri vulnerable to host confusion via percent-encoded authority delimiters

fast-uri vulnerable to path traversal via percent-encoded dot segments

Axios: unbounded recursion in toFormData causes DoS via deeply nested request data

follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets

Forge has signature forgery in Ed25519 due to missing S > L check

Forge has signature forgery in RSA-PKCS due to ASN.1 extra field

Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input

path-to-regexp vulnerable to Denial of Service via sequential optional groups

undici is vulnerable to Unhandled Exception in undici WebSocket Client Due to Invalid server_max_window_bits Validation

undici is vulnerable to Malicious WebSocket 64-bit length overflows undici parser and crashes the client

undici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate Decompression

flatted: Unbounded recursion DoS in parse() revive phase

SVGO: DoS through entity expansion in DOCTYPE (Billion Laughs)

Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unhandled AssertionError during Markdown…

Multer vulnerable to Denial of Service via uncontrolled recursion

Multer vulnerable to Denial of Service via incomplete cleanup

Multer vulnerable to Denial of Service via resource exhaustion

fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)

Axios affected by Denial of Service via __proto__ Key in mergeConfig

undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent

Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking

Backstage has a Possible Symlink Path Traversal in Scaffolder Actions