Traefik: Forwarded alias spoofing top pre-auth decision bypass

Traefik: ForwardAuth trustForwardHeader=false allows spoofed X-Forwarded-Prefix to bypass auth

Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0

Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization

Netty: HttpClientCodec response desynchronization

Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder)

Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`

Improper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf

Improper restriction of the scope of accessible objects in Thymeleaf expressions

Lego: Arbitrary File Write via Path Traversal in Webroot HTTP-01 Provider

Traefik: StripPrefixRegex auth bypass via Path/RawPath desync

Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509

Model Context Protocol Go SDK: DNS Rebinding Protection Disabled by Default for Servers Running on Localhost

Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS

Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation

fast-uri vulnerable to path traversal via percent-encoded dot segments

Values produced by ${random.value} are not suitable for use as secrets

Axios: unbounded recursion in toFormData causes DoS via deeply nested request data

follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets

PKIX draft CompositeVerifier accepts empty signature sequence as valid.

GOSTCTR implementation unable to process more than 255 blocks correctly

undici is vulnerable to Unhandled Exception in undici WebSocket Client Due to Invalid server_max_window_bits Validation

undici is vulnerable to Malicious WebSocket 64-bit length overflows undici parser and crashes the client

undici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate Decompression

flatted: Unbounded recursion DoS in parse() revive phase

SVGO: DoS through entity expansion in DOCTYPE (Billion Laughs)

In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with Content-Encoding: gzip, is processed…

Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking

Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy

LDAP Injection Vulnerability in LDAPStoreHelper.java

Traefik mTLS bypass via fragmented ClientHello SNI extraction failure