Issues

[MEDIUM] stream-json has a prototype pollution issue: Assembler writes this.current[this.key] on plain objects

cdk8s-team/cdk8s-examples#994 · opened

on Oct 9, 2026

[MEDIUM] stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk

cdk8s-team/cdk8s-examples#993 · opened

on Oct 9, 2026

[MEDIUM] Nx: Path traversal in nx migrate package-migrations extraction

cdk8s-team/cdk8s-examples#991 · opened

on Oct 9, 2026

[MEDIUM] PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion

cdk8s-team/cdk8s-examples#992 · opened

on Oct 9, 2026

[HIGH] Nx: OS command injection via git revisions and remote refs

cdk8s-team/cdk8s-examples#989 · opened

on Oct 9, 2026

[HIGH] Nx daemon and plugin worker sockets are accessible to other local users

cdk8s-team/cdk8s-examples#990 · opened

on Oct 9, 2026

[MEDIUM] sprintf-js vulnerable to denial of service through unbounded precision specifiers

cdk8s-team/cdk8s-examples#988 · opened

on Oct 9, 2026

[HIGH] fast-uri vulnerable to authority injection via an unvalidated port in serialize

cdk8s-team/cdk8s-examples#981 · opened

on Oct 5, 2026

[MEDIUM] fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets

cdk8s-team/cdk8s-examples#980 · opened

on Oct 5, 2026

[MEDIUM] Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method

cdk8s-team/cdk8s-examples#979 · opened

on Oct 5, 2026

[HIGH] xmldom: Quadratic-memory consumption

cdk8s-team/cdk8s-examples#962 · opened

on Sep 13, 2026

[HIGH] js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

cdk8s-team/cdk8s-examples#963 · opened

on Sep 13, 2026

[MEDIUM] xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content

cdk8s-team/cdk8s-examples#960 · opened

on Sep 13, 2026

[HIGH] xmldom: Quadratic-time attribute deduplication

cdk8s-team/cdk8s-examples#959 · opened

on Sep 13, 2026

[HIGH] xmldom: DocType `name` Injection Bypasses requireWellFormed

cdk8s-team/cdk8s-examples#961 · opened

on Sep 13, 2026

[HIGH] xmldom: Element name injection via createElement() bypasses requireWellFormed

cdk8s-team/cdk8s-examples#956 · opened

on Sep 13, 2026

[HIGH] xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed

cdk8s-team/cdk8s-examples#957 · opened

on Sep 13, 2026

[HIGH] xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser

cdk8s-team/cdk8s-examples#958 · opened

on Sep 13, 2026

[HIGH] xmldom: Processing Instruction Target Injection Bypasses requireWellFormed

cdk8s-team/cdk8s-examples#954 · opened

on Sep 13, 2026

[HIGH] xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge

cdk8s-team/cdk8s-examples#955 · opened

on Sep 13, 2026

[HIGH] fast-uri vulnerable to host confusion via percent-encoded scheme normalization

cdk8s-team/cdk8s-examples#951 · opened

on Sep 6, 2026

[MEDIUM] xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization

cdk8s-team/cdk8s-examples#952 · opened

on Sep 6, 2026

[HIGH] fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization

cdk8s-team/cdk8s-examples#950 · opened

on Sep 6, 2026

[MEDIUM] stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS)

cdk8s-team/cdk8s-examples#949 · opened

on Sep 6, 2026

[HIGH] fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding

cdk8s-team/cdk8s-examples#948 · opened

on Sep 5, 2026

Navigation Menu

Repository navigation

Issues

[MEDIUM] stream-json has a prototype pollution issue: Assembler writes this.current[this.key] on plain objects

[MEDIUM] stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk

[MEDIUM] Nx: Path traversal in nx migrate package-migrations extraction

[MEDIUM] PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion

[HIGH] Nx: OS command injection via git revisions and remote refs

[HIGH] Nx daemon and plugin worker sockets are accessible to other local users

[MEDIUM] sprintf-js vulnerable to denial of service through unbounded precision specifiers

[HIGH] fast-uri vulnerable to authority injection via an unvalidated port in serialize

[MEDIUM] fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets

[MEDIUM] Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method

[HIGH] xmldom: Quadratic-memory consumption

[HIGH] js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

[MEDIUM] xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content

[HIGH] xmldom: Quadratic-time attribute deduplication

[HIGH] xmldom: DocType `name` Injection Bypasses requireWellFormed

[HIGH] xmldom: Element name injection via createElement() bypasses requireWellFormed

[HIGH] xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed

[HIGH] xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser

[HIGH] xmldom: Processing Instruction Target Injection Bypasses requireWellFormed

[HIGH] xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge

[HIGH] fast-uri vulnerable to host confusion via percent-encoded scheme normalization

[MEDIUM] xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization

[HIGH] fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization

[MEDIUM] stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS)

[HIGH] fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding