Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF

CVE-2026-33816 in github.com/jackc/pgx

CVE-2026-33815 in github.com/jackc/pgx

lodash vulnerable to Code Injection via `_.template` imports key names

Rollup 4 has Arbitrary File Write via Path Traversal

Tekton Pipelines git resolver has path traversal that allows reading arbitrary files from the resolver pod

Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh

Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent

Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`

Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

Axios: shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)

Next.js: Server-side request forgery in applications using WebSocket upgrades

Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509

node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal

Next.js: Middleware / Proxy bypass through dynamic route parameter injection

Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection

Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter

Axios: Allocation of Resources Without Limits or Throttling in axios

Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection

Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh

Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes

Next.js: Denial of Service via connection exhaustion in applications using Cache Components

Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes

Next.js: Middleware / Proxy bypass in Pages Router applications using i18n

urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API

Prometheus: remote read endpoint allows denial of service via crafted snappy payload

Prometheus Azure AD remote write OAuth client secret exposed via config API

Go-getter may allow to arbitrary filesystem reads through git operations

path-to-regexp vulnerable to Denial of Service via sequential optional groups

Incorrect enforcement of email constraints in crypto/x509

PKCS7_verify Signature Validation Bypass in AWS-LC

PKCS7_verify Certificate Chain Validation Bypass in AWS-LC

Axios affected by Denial of Service via __proto__ Key in mergeConfig

pyasn1 has a DoS vulnerability in decoder

devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse

devalue vulnerable to denial of service due to memory exhaustion in devalue.parse

Denial of Service in Keras via Excessive Memory Allocation in HDF5 Metadata

urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)

PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed

Golang-fips: golang fips zeroed buffer

Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh

node-tar Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization

React Router vulnerable to XSS via Open Redirects

Next.js: Denial of Service in the Image Optimization API

node-tar has Race Condition in Path Reservations via Unicode Ligature Collisions on macOS APFS

wheel Allows Arbitrary File Permission Modification via Path Traversal

Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh

Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing

Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain