Understand vulnerabilities. Protect your applications.

Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive

Nuxt server islands render `useHeadSafe` input without sanitisation

Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routes

Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering

next.js cache leak across root param values in nested 'use cache' functions

ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process

Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signing

stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service

ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API

ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)

ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorization

AdonisJS HTTP Server: Uncontrolled Resource Consumption and Inefficient Regular Expression Complexity

Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix

A path traversal vulnerability on Windows allows clients communicating with an exposed Vite server to bypass redirect allowlist checks using backslashes. This can permit unauthorized reading of files outside the Vite root directory that the server process has access to.

ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization

ApostropheCMS contains a stored cross-site scripting vulnerability where editor-controlled style field values in widgets are serialized into HTML wrapper attributes without escaping, allowing arbitrary script execution.

ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefix

A stored cross-site scripting vulnerability in ApostropheCMS allows authenticated users with edit permissions to inject arbitrary HTML and JavaScript via trailing content in color fields. Upgrading to version 4.34.0 or later mitigates this issue.

ApostropheCMS: Import API bypasses publication roles for protected content

A vulnerability in ApostropheCMS allows the import API to bypass publication roles, enabling users with edit-only permissions to create, replace, or delete published content without required publishing authority.

ApostropheCMS: Import archives can exhaust server storage and deny service

A vulnerability in ApostropheCMS allows authenticated users to exhaust server storage during archive extraction due to missing decompression quotas and failure cleanup, potentially causing a denial of service.

ApostropheCMS: Archive duplicate continuation lets contributors overwrite published content

In @apostrophecms/import-export, the overrideDuplicates continuation accepts client-supplied replacement choices, allowing contributors to overwrite published content without publication authority.