Advisory Catalog

shell-quote: `quote()` command injection via a line terminator in a token after a `{ comment }` token

pbkdf2 rehashes long passwords on every iteration, enabling denial of service

Nest: Remote process termination via a deeply nested microservice message pattern

Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE

Laravel: XSS in Debug Page Information

brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion

brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service

brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion

PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion

PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set

PyJWT accepts public JWK containers as HMAC secrets

PyJWT BOM Bypass

PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard

PyJWT: ReDoS vulnerability when calling the `is_pem_format` function.

PyJWT: Non-canonical signature segments enable raw-token revocation bypass

PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard

PyJWT: PyJWKClient follows redirects when fetching JWKS

PyJWT: PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation

PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header

PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)

PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)

@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized

Authlib: empty signatures validation in JWS JSON deserialization

Apple Multiple Products Out-of-Bounds Write Vulnerability

@grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages

@grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches

ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts

ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range

ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process

ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass

Axios: Prototype Pollution Gadget in axios toFormData Options