Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF

lodash vulnerable to Code Injection via `_.template` imports key names

Handlebars.js has JavaScript Injection via AST Type Confusion

Rollup 4 has Arbitrary File Write via Path Traversal

HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

Traefik Vulnerable to BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerField

@fastify/reply-from vulnerable to connection header abuse enabling stripping of proxy-added headers

Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options

node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal

Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial

Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block

Traefik has Knative Ingress Rule Injection that Allows Host Restriction Bypass

Go JOSE affect by a panic in JWE decryption

Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation

Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass

Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

path-to-regexp vulnerable to Denial of Service via sequential optional groups

Incorrect enforcement of email constraints in crypto/x509

Traefik: lowercase `Connection` tokens can delete traefik-managed forwarded identity headers (for example, `X-Real-Ip`)

Traefik: tcp router clears read deadlines before tls forwarding, enabling stalled handshakes (slowloris doS)

Traefik: TCP readTimeout bypass via STARTTLS on Postgres

Axios affected by Denial of Service via __proto__ Key in mergeConfig

Fastify's Content-Type header tab character allows body validation bypass

node-tar Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization

node-tar has Race Condition in Path Reservations via Unicode Ligature Collisions on macOS APFS

wheel Allows Arbitrary File Permission Modification via Path Traversal

Traefik mTLS bypass via fragmented ClientHello SNI extraction failure

Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions

Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain

ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled