lodash vulnerable to Code Injection via `_.template` imports key names

Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable

fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names

undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse

NGINX ngx_http_rewrite_module vulnerability

fast-uri vulnerable to host confusion via failed IDN canonicalization

undici WebSocket client vulnerable to denial of service via fragment count bypass

ws: Memory exhaustion DoS from tiny fragments and data chunks

form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)

ws: Uninitialized memory disclosure

fast-uri vulnerable to host confusion via percent-encoded authority delimiters

fast-uri vulnerable to path traversal via percent-encoded dot segments

Go JOSE affect by a panic in JWE decryption

undici is vulnerable to Unhandled Exception in undici WebSocket Client Due to Invalid server_max_window_bits Validation

undici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate Decompression

fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)

undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent

SpdyStream: DOS on CRI

React Router vulnerable to XSS via Open Redirects

Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions

ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled