3.1.2 — GHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj

minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions — HIGH

minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern — HIGH

minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments — HIGH

1.1.11 — GHSA-3jxr-9vmj-r5cp, GHSA-mh99-v99m-4gvg

brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups — HIGH

brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash — HIGH

3.3.1 — GHSA-25h7-pfq9-p65f, GHSA-rf6f-7fwh-wjgh

flatted vulnerable to unbounded recursion DoS in parse() revive phase — HIGH

Prototype Pollution via parse() in NodeJS flatted — HIGH

4.1.0 — GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj

js-yaml: YAML merge-key chains can force quadratic CPU consumption — HIGH

JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported — HIGH

3.3.7 — GHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8

nanoid: non-secure generators can loop indefinitely with negative size — HIGH

nanoid: custom generators can loop indefinitely when size is zero — HIGH

6.14.0 — GHSA-6rw7-vpxm-498p, GHSA-q8mj-m7cp-5q26, GHSA-w7fw-mjwx-w883

qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion — MODERATE

qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set — MODERATE

qs's arrayLimit bypass in comma parsing allows denial of service — LOW

4.17.21 — GHSA-f23m-r3pf-42rh, GHSA-xxjr-mmjv-4gpg

lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` — MODERATE

Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions — MODERATE

13.5.1 — GHSA-3g8h-86w9-wvmq, GHSA-3h52-269p-cp9r

Next.js's Middleware / Proxy redirects can be cache-poisoned — LOW

Information exposure in Next.js dev server due to lack of origin verification — LOW

8.4.30 — GHSA-7fh5-64p2-3v2j, GHSA-fxqj-rqcc-2cmp

PostCSS line return parsing error — MODERATE

PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset — MODERATE