Understand vulnerabilities. Protect your applications.

next.js cache leak across root param values in nested 'use cache' functions

ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process

Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signing

stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service

ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API

ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)

ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorization

AdonisJS HTTP Server: Uncontrolled Resource Consumption and Inefficient Regular Expression Complexity

Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix

A path traversal vulnerability on Windows allows clients communicating with an exposed Vite server to bypass redirect allowlist checks using backslashes. This can permit unauthorized reading of files outside the Vite root directory that the server process has access to.

ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization

ApostropheCMS contains a stored cross-site scripting vulnerability where editor-controlled style field values in widgets are serialized into HTML wrapper attributes without escaping, allowing arbitrary script execution.

ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefix

A stored cross-site scripting vulnerability in ApostropheCMS allows authenticated users with edit permissions to inject arbitrary HTML and JavaScript via trailing content in color fields. Upgrading to version 4.34.0 or later mitigates this issue.

ApostropheCMS: Import API bypasses publication roles for protected content

A vulnerability in ApostropheCMS allows the import API to bypass publication roles, enabling users with edit-only permissions to create, replace, or delete published content without required publishing authority.

ApostropheCMS: Import archives can exhaust server storage and deny service

A vulnerability in ApostropheCMS allows authenticated users to exhaust server storage during archive extraction due to missing decompression quotas and failure cleanup, potentially causing a denial of service.

ApostropheCMS: Archive duplicate continuation lets contributors overwrite published content

In @apostrophecms/import-export, the overrideDuplicates continuation accepts client-supplied replacement choices, allowing contributors to overwrite published content without publication authority.

Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`

In Vite dev servers running on Node.js or Deno, specially crafted requests can disclose the initial bytes of arbitrary files outside the configured access boundaries through WebAssembly parser error messages.

Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine

In Vite on non-Windows systems, an issue allows files outside the configured root to be served if a project imports a path matching an absolute system path and the development server is exposed to the network. Updating to a patched version resolves the issue.

@angular/common: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035)

A URL parsing discrepancy in the Angular HTTP client can cause cross-site request forgery tokens to leak to external domains during mutating requests. Attackers can leverage these leaked tokens to execute unauthorized actions against an authenticated user session.