auto-generated · daily
Security posture across every ecosystem.
64 critical/high severity findings across the monorepo — triage before merge.
Last generated 2026-09-15T06:02:40Z.
3Critical
61High
51Medium
7Low
19Info
Coverage
Ecosystem breakdown
Advisories
Severity distribution
Findings by ecosystem
Summary
| Ecosystem | Critical | High | Medium | Low | Total |
|---|---|---|---|---|---|
| npm | 3 | 61 | 34 | 7 | 105 |
| Cargo | 0 | 0 | 17 | 0 | 36 |
| Python | 0 | 0 | 0 | 0 | 0 |
| CodeQL | 0 | 0 | 0 | 0 | 0 |
| Dependabot | 0 | 0 | 0 | 0 | 0 |
| Total | 3 | 61 | 51 | 7 | 141 |
npm
| Severity | Package | Advisory | Link |
|---|---|---|---|
| Critical | tar | node-tar: Decompression/parse DoS via unlimited input | Details |
| Critical | vitest | When Vitest UI server is listening, arbitrary file can be… | Details |
| Critical | astro | Astro: Remote code execution through AVIF image optimization | Details |
| High | rollup | Rollup 4 has Arbitrary File Write via Path Traversal | Details |
| High | tar | tar has Hardlink Path Traversal via Drive-Relative Linkpath | Details |
| High | tar | node-tar Symlink Path Traversal via Drive-Relative Linkpath | Details |
| High | path-to-regexp | path-to-regexp vulnerable to Regular Expression Denial of… | Details |
| High | undici | undici vulnerable to TLS certificate validation bypass vi… | Details |
| High | undici | undici WebSocket client vulnerable to denial of service v… | Details |
| High | undici | undici vulnerable to cross-origin request routing via SOC… | Details |
| High | brace-expansion | brace-expansion: DoS via exponential-time expansion of co… | Details |
| High | brace-expansion | brace-expansion: DoS via exponential-time expansion of co… | Details |
| High | js-yaml | js-yaml: YAML merge-key chains can force quadratic CPU co… | Details |
| High | js-yaml | js-yaml: YAML merge-key chains can force quadratic CPU co… | Details |
| High | tar | node-tar: Negative tar entry size causes infinite loop in… | Details |
| High | immutable | Immutable.js List 32-bit trie overflow → unrecoverable DoS | Details |
| High | fast-uri | fast-uri vulnerable to host confusion via literal backsla… | Details |
| High | sharp | sharp inherited vulnerabilities in libvips: CVE-2026-3332… | Details |
| High | brace-expansion | brace-expansion: DoS via unbounded expansion length causi… | Details |
| High | brace-expansion | brace-expansion: DoS via unbounded expansion length causi… | Details |
| High | undici | undici vulnerable to cross-user information disclosure an… | Details |
| High | fast-uri | fast-uri vulnerable to host confusion via backslash autho… | Details |
| High | brace-expansion | brace-expansion: DoS via unbounded intermediate arrays, b… | Details |
| High | brace-expansion | brace-expansion: DoS via unbounded intermediate arrays, b… | Details |
| High | brace-expansion | brace-expansion: DoS via unbounded intermediate arrays, b… | Details |
| High | js-yaml | JS-YAML: Quadratic CPU consumption in !!omap resolution (… | Details |
| High | js-yaml | JS-YAML: Quadratic CPU consumption in !!omap resolution (… | Details |
| High | image-size | image-size: ICNS parser allows denial of service through … | Details |
| High | image-size | image-size: JXL and HEIF parsers allow denial of service … | Details |
| High | fast-xml-parser | fast-xml-parser: Repeated DOCTYPE declarations reset enti… | Details |
| High | deepmerge-ts | DeepmergeTS has stack exhaustion when merging recursive o… | Details |
| High | fast-uri | fast-uri vulnerable to path traversal via percent-encoded… | Details |
| High | tar | node-tar: Uncontrolled recursion in mapHas/filesFilter al… | Details |
| High | fast-uri | fast-uri vulnerable to host confusion via percent-encoded… | Details |
| High | browserslist | Browserslist: Unbounded memory growth (no cache eviction)… | Details |
| High | browserslist | Browserslist: Uncaught crash / prototype write via untrus… | Details |
| High | fast-uri | fast-uri vulnerable to server-side request forgery via ma… | Details |
| High | fast-uri | fast-uri vulnerable to host confusion via percent-encoded… | Details |
| High | immutable | Immutable: Hash-collision algorithmic complexity denial o… | Details |
| High | @xmldom/xmldom | xmldom: HTML raw-text closing-tag case mismatch causes ou… | Details |
| High | @xmldom/xmldom | xmldom PI grammar regex ReDoS: quadratic backtracking on … | Details |
| High | @xmldom/xmldom | xmldom: Element name injection via createElement() bypass… | Details |
| High | @xmldom/xmldom | xmldom: Element name injection via createElement() bypass… | Details |
| High | @xmldom/xmldom | xmldom: Attribute name injection via setAttribute() bypas… | Details |
| High | @xmldom/xmldom | xmldom: Attribute name injection via setAttribute() bypas… | Details |
| High | @xmldom/xmldom | xmldom: Processing Instruction Target Injection Bypasses … | Details |
| High | @xmldom/xmldom | xmldom: Processing Instruction Target Injection Bypasses … | Details |
| High | @xmldom/xmldom | xmldom: DocType name Injection Bypasses requireWellFormed | Details |
| High | @xmldom/xmldom | xmldom: DocType name Injection Bypasses requireWellFormed | Details |
| High | @xmldom/xmldom | xmldom: Creation-time XML Name/QName validation is bypass… | Details |
| High | @xmldom/xmldom | xmldom: requireWellFormed DocType publicId/systemId valid… | Details |
| High | @xmldom/xmldom | xmldom: Quadratic-time attribute deduplication | Details |
| High | @xmldom/xmldom | xmldom: Quadratic-time attribute deduplication | Details |
| High | @xmldom/xmldom | xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic b… | Details |
| High | @xmldom/xmldom | xmldom: Quadratic-memory consumption | Details |
| High | @xmldom/xmldom | xmldom: Quadratic-memory consumption | Details |
| High | @xmldom/xmldom | xmldom: Quadratic-time parsing via the malformed-input re… | Details |
| High | @xmldom/xmldom | xmldom: Quadratic-time parsing via the malformed-input re… | Details |
| High | sharp | sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 an… | Details |
| High | js-yaml | js-yaml: maxTotalMergeKeys does not limit CPU use for emp… | Details |
| High | js-yaml | js-yaml: maxTotalMergeKeys does not limit CPU use for emp… | Details |
| High | svgo | SVGO: removeScripts allows executable links through names… | Details |
| High | smol-toml | smol-toml: Denial of Service via malformed TOML documents | Details |
| High | fast-uri | fast-uri vulnerable to host confusion via failed IDN cano… | Details |
| Medium | mdast-util-to-hast | mdast-util-to-hast has unsanitized class attribute | Details |
| Medium | brace-expansion | brace-expansion: Zero-step sequence causes process hang a… | Details |
| Medium | yaml | yaml is vulnerable to Stack Overflow via deeply nested YA… | Details |
| Medium | yaml | yaml is vulnerable to Stack Overflow via deeply nested YA… | Details |
| Medium | serialize-javascript | Serialize JavaScript has CPU Exhaustion Denial of Service… | Details |
| Medium | uuid | uuid: Missing buffer bounds check in v3/v5/v6 when buf is… | Details |
| Medium | tar | node-tar applies PAX size override to intermediary GNU lo… | Details |
| Medium | undici | undici vulnerable to HTTP header injection via Set-Cookie… | Details |
| Medium | undici | undici vulnerable to cross-user information disclosure vi… | Details |
| Medium | js-yaml | JS-YAML: Quadratic-complexity DoS in merge key handling v… | Details |
| Medium | js-yaml | JS-YAML: Quadratic-complexity DoS in merge key handling v… | Details |
| Medium | tar | node-tar: Process crash via PAX numeric path type confusion | Details |
| Medium | tar | node-tar: Uncaught Exception DoS via NUL byte in PAX path… | Details |
| Medium | undici | undici vulnerable to downstream response desynchronizatio… | Details |
| Medium | undici | undici vulnerable to downstream response desynchronizatio… | Details |
| Medium | undici | undici vulnerable to CRLF Injection via blob-like body ‘t… | Details |
| Medium | undici | undici vulnerable to CRLF Injection via blob-like body ‘t… | Details |
| Medium | undici | undici vulnerable to cross-user information disclosure vi… | Details |
| Medium | undici | undici vulnerable to cookie attribute injection via unsan… | Details |
| Medium | undici | undici vulnerable to cookie attribute injection via unsan… | Details |
| Medium | decode-uri-component | decode-uri-component: Denial of service via exponential d… | Details |
| Medium | qs | qs array-limit bypass via bracket-key comma parsing | Details |
| Medium | qs | qs: Denial of Service via Attacker Controlled isBuffer | Details |
| Medium | @xmldom/xmldom | xmldom: XML fragment injection via invalid EntityReferenc… | Details |
| Medium | @xmldom/xmldom | xmldom: XML fragment injection via invalid EntityReferenc… | Details |
| Medium | fflate | fflate unzipSync can enter an infinite loop when parsing … | Details |
| Medium | fflate | fflate unzipSync can enter an infinite loop when parsing … | Details |
| Medium | vitest | Vitest: Path Traversal / Arbitrary File Read via @vitest/… | Details |
| Medium | @vitest/mocker | Vitest: Path Traversal / Arbitrary File Read via @vitest/… | Details |
| Medium | baseline-browser-mapping | baseline-browser-mapping process termination on invalid i… | Details |
| Medium | @xmldom/xmldom | xmldom: Parser silently accepts a not-well-formed end tag… | Details |
| Medium | @xmldom/xmldom | xmldom: Parser silently accepts a not-well-formed end tag… | Details |
| Medium | astro | Astro: Authorization bypass from missing path-segment bou… | Details |
| Medium | svgo | SVGO: removeScripts incompletely sanitizes executable HTM… | Details |
| Low | diff | jsdiff has a Denial of Service vulnerability in parsePatc… | Details |
| Low | undici | undici vulnerable to Set-Cookie SameSite attribute downgr… | Details |
| Low | undici | undici vulnerable to HTTP response queue poisoning via ke… | Details |
| Low | postcss-selector-parser | postcss-selector-parser allows denial of service through … | Details |
| Low | @ai-sdk/provider-utils | @ai-sdk/provider-utils has an Uncontrolled Resource Consu… | Details |
| Low | joi | joi: Prototype pollution via a __proto__ language key i… | Details |
| Low | joi | joi: object().rename() with a template target can set the… | Details |
Cargo
| Severity | Package | Advisory | Link |
|---|---|---|---|
| Medium | ammonia | XSS in ammonia via SVG animate and set animation tags | |
| Medium | h2 | h2 unbounded empty DATA frames | Details |
| Medium | h2 | h2 unbounded empty DATA frames | Details |
| Medium | quick-xml | Quadratic run time when checking a start tag for duplicat… | Details |
| Medium | quick-xml | Unbounded namespace-declaration allocation in NsReader … | Details |
| Medium | rkyv | Insufficient archive validation can cause out-of-bounds r… | Details |
| Medium | rsa | Marvin Attack: potential key recovery through timing side… | Details |
| Medium | rustls | TLS 1.3 handshake messages incorrectly accepted across en… | Details |
| Medium | rustls-webpki | Name constraints for URI names were incorrectly accepted | |
| Medium | rustls-webpki | Reachable panic in certificate revocation list parsing | |
| Medium | rustls-webpki | Name constraints were accepted for certificates asserting… | |
| Medium | rustls-webpki | CRLs not considered authoritative by Distribution Point d… | |
| Medium | rustls-webpki | Name constraints for URI names were incorrectly accepted | |
| Medium | rustls-webpki | Reachable panic in certificate revocation list parsing | |
| Medium | rustls-webpki | Name constraints were accepted for certificates asserting… | |
| Medium | sqlx | Binary Protocol Misinterpretation caused by Truncating or… | Details |
| Medium | steamworks | Denial of service in Steamworks game clients/servers usin… | Details |
| Info | bincode | Bincode is unmaintained | Details |
| Info | crypto-hash | crypto-hash crate is unmaintained | Details |
| Info | derivative | derivative is unmaintained; consider using an alternative | Details |
| Info | paste | paste - no longer maintained | Details |
| Info | proc-macro-error | proc-macro-error is unmaintained | Details |
| Info | rustls-pemfile | rustls-pemfile is unmaintained | Details |
| Info | rustls-pemfile | rustls-pemfile is unmaintained | Details |
| Info | serde_cbor | serde_cbor is unmaintained | Details |
| Info | ttf-parser | ttf-parser is unmaintained | Details |
| Info | unic-char-property | unic-char-property is unmaintained | Details |
| Info | unic-char-range | unic-char-range is unmaintained | Details |
| Info | unic-common | unic-common is unmaintained | Details |
| Info | unic-ucd-ident | unic-ucd-ident is unmaintained | Details |
| Info | unic-ucd-version | unic-ucd-version is unmaintained | Details |
| Info | event-listener | event-listener allows !Send tags to cross thread boun… | Details |
| Info | glib | Unsoundness in Iterator and DoubleEndedIterator impls… | Details |
| Info | lru | Potential use-after-free due to lack of panic safety in `… | Details |
| Info | lru | Potential use-after-free due to lack of panic safety in `… | Details |
| Info | chacha20 |
Python
All Clear
No python advisories found.
CodeQL
All Clear
No open CodeQL alerts.
Dependabot
All Clear
No open Dependabot alerts.
Auto-generated by ci-daily-content.yml