Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

Axios: shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)

Next.js: Server-side request forgery in applications using WebSocket upgrades

Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509

node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal

Next.js: Middleware / Proxy bypass through dynamic route parameter injection

Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection

Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter

Axios: Allocation of Resources Without Limits or Throttling in axios

Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection

Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh

Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes

Next.js: Denial of Service via connection exhaustion in applications using Cache Components

Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes

Next.js: Middleware / Proxy bypass in Pages Router applications using i18n

urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API

Prometheus: remote read endpoint allows denial of service via crafted snappy payload

Prometheus Azure AD remote write OAuth client secret exposed via config API

Go-getter may allow to arbitrary filesystem reads through git operations

path-to-regexp vulnerable to Denial of Service via sequential optional groups

Incorrect enforcement of email constraints in crypto/x509

PKCS7_verify Signature Validation Bypass in AWS-LC

PKCS7_verify Certificate Chain Validation Bypass in AWS-LC

Axios affected by Denial of Service via __proto__ Key in mergeConfig

pyasn1 has a DoS vulnerability in decoder

devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse

devalue vulnerable to denial of service due to memory exhaustion in devalue.parse

Denial of Service in Keras via Excessive Memory Allocation in HDF5 Metadata

urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)

PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed