3.3.12 — GHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8

nanoid: non-secure generators can loop indefinitely with negative size — HIGH

nanoid: custom generators can loop indefinitely when size is zero — HIGH

8.4.31 — GHSA-6g55-p6wh-862q, GHSA-fxqj-rqcc-2cmp, GHSA-qx2v-qp2m-jg93

PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments — devDependency

PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset — devDependency

PostCSS has XSS via Unescaped </style> in its CSS Stringify Output — devDependency

8.5.15 — GHSA-fxqj-rqcc-2cmp

PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset — MODERATE

0.21.5 — GHSA-67mh-4wv8-2f99

esbuild enables any website to send any requests to the development server and read the response — MODERATE

0.28.0 — GHSA-g7r4-m6w7-qqqr

esbuild allows arbitrary file read when running the development server on Windows — LOW

14.2.35 — GHSA-3g8h-86w9-wvmq, GHSA-3x4c-7xq6-9pq8

Next.js's Middleware / Proxy redirects can be cache-poisoned — LOW

Next.js: Unbounded next/image disk cache growth can exhaust storage — MODERATE

5.4.21 — GHSA-4w7w-66w2-5vf9, GHSA-v6wh-96g9-6wx3

Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling — MODERATE

launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows — MODERATE