Advisory Catalog

Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE

brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion

brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service

brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion

@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized

@grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages

@grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches

ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts

ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range

ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process

ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass

Axios: Prototype Pollution Gadget in axios toFormData Options

Axios: Prototype pollution gadget in fetch adapter can alter outbound requests

Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF

Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location

Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection

Axios: Header Injection via Inherited headers After Minimal Interceptor

Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)

Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method

Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization

Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders

Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls

@xhmikosr/decompress: Path traversal via symlink chain

code-ollama: `grep_search` Command Injection via Unescaped `$()` Shell Substitution (CWE-78)