1.1.11 — GHSA-3jxr-9vmj-r5cp, GHSA-f886-m6hf-6m8v, GHSA-mh99-v99m-4gvg

brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups — devDependency

brace-expansion: Zero-step sequence causes process hang and memory exhaustion — devDependency

brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash — devDependency

3.14.1 — GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj, GHSA-h67p-54hq-rp68

js-yaml: YAML merge-key chains can force quadratic CPU consumption — devDependency

JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported — devDependency

JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases — devDependency

3.0.4 — GHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj

minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions — devDependency

minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern — devDependency

minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments — devDependency

1.16.3 — GHSA-8cj5-5rvv-wf4v, GHSA-pq67-2wwv-3xjx, GHSA-vj76-c3g6-qr5v

tar-fs can extract outside the specified dir with a specific tarball — devDependency

tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File — devDependency

tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball — devDependency

3.2.2 — GHSA-25h7-pfq9-p65f, GHSA-rf6f-7fwh-wjgh

flatted vulnerable to unbounded recursion DoS in parse() revive phase — devDependency

Prototype Pollution via parse() in NodeJS flatted — devDependency

2.3.3 — GHSA-fjxv-7rqg-78g4, GHSA-hmw2-7cc7-3qxx

form-data uses unsafe random function in form-data for choosing boundary — devDependency

form-data: CRLF injection in form-data via unescaped multipart field names and filenames — devDependency

2.3.0 — GHSA-3v7f-55p6-f55p, GHSA-c2c7-rcm5-vvqj

Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching — devDependency

Picomatch has a ReDoS vulnerability via extglob quantifiers — devDependency

6.5.2 — GHSA-6rw7-vpxm-498p, GHSA-hrpp-h998-j3pp

qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion — devDependency

qs vulnerable to Prototype Pollution — devDependency