undici is vulnerable to Malicious WebSocket 64-bit length overflows undici parser and crashes the client

undici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate Decompression

flatted: Unbounded recursion DoS in parse() revive phase

SVGO: DoS through entity expansion in DOCTYPE (Billion Laughs)

Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unhandled AssertionError during Markdown…

Multer vulnerable to Denial of Service via uncontrolled recursion

Multer vulnerable to Denial of Service via incomplete cleanup

Multer vulnerable to Denial of Service via resource exhaustion

fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)

Axios affected by Denial of Service via __proto__ Key in mergeConfig

Nodemailer: nodemailer: email to an unintended domain can occur due to interpretation conflict

undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent

Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking

Backstage has a Possible Symlink Path Traversal in Scaffolder Actions

Inefficient candidate hostname parsing in crypto/x509

Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy

Rhdh: graphql injection leading to platform-wide denial of service (dos) in rh developer hub orchestrator plugin

ip-address: XSS in Address6 HTML-emitting methods

Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain

ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled