1.9.15 — GHSA-5375-pq7m-f5r2, GHSA-99f4-grh7-6pcq

@grpc/grpc-js: A malformed request can cause a server crash — HIGH

@grpc/grpc-js: An incoming malformed compressed message can cause a client or server crash — HIGH

7.5.4 — GHSA-66ff-xgx4-vchm, GHSA-685m-2w69-288q

protobuf.js: Code injection through bytes field defaults in generated toObject code — HIGH

protobuf.js: Denial of service through unbounded protobuf recursion — HIGH

1.1.12 — GHSA-3jxr-9vmj-r5cp, GHSA-f886-m6hf-6m8v, GHSA-mh99-v99m-4gvg

brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups — devDependency

brace-expansion: Zero-step sequence causes process hang and memory exhaustion — devDependency

brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash — devDependency

4.1.0 — GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj, GHSA-h67p-54hq-rp68

js-yaml: YAML merge-key chains can force quadratic CPU consumption — devDependency

JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported — devDependency

JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases — devDependency

3.1.2 — GHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj

minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions — devDependency

minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern — devDependency

minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments — devDependency

8.5.6 — GHSA-6g55-p6wh-862q, GHSA-fxqj-rqcc-2cmp, GHSA-qx2v-qp2m-jg93

PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments — devDependency

PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset — devDependency

PostCSS has XSS via Unescaped </style> in its CSS Stringify Output — devDependency

6.30.1 — GHSA-2j2x-hqr9-3h42, GHSA-337j-9hxr-rhxg, GHSA-9jcx-v3wj-wh4m

React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation — MODERATE

React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration — MODERATE

React Router has unexpected external redirect via untrusted paths — MODERATE

5.4.19 — GHSA-4w7w-66w2-5vf9, GHSA-93m4-6634-74q7, GHSA-fx2h-pf6j-xcff

Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling — devDependency

vite allows server.fs.deny bypass via backslash on Windows — devDependency

vite: `server.fs.deny` bypass on Windows alternate paths — devDependency

3.3.1 — GHSA-25h7-pfq9-p65f, GHSA-rf6f-7fwh-wjgh

flatted vulnerable to unbounded recursion DoS in parse() revive phase — devDependency

Prototype Pollution via parse() in NodeJS flatted — devDependency

4.17.21 — GHSA-f23m-r3pf-42rh, GHSA-xxjr-mmjv-4gpg

lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` — MODERATE

Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions — MODERATE

3.3.11 — GHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8

nanoid: non-secure generators can loop indefinitely with negative size — devDependency

nanoid: custom generators can loop indefinitely when size is zero — devDependency

2.3.1 — GHSA-3v7f-55p6-f55p, GHSA-c2c7-rcm5-vvqj

Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching — devDependency

Picomatch has a ReDoS vulnerability via extglob quantifiers — devDependency