Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo

SidraChain/blockscout-frontend

https://github.com/SidraChain/blockscout-frontend · scanned 2026-10-15 12:56 UTC (1 week, 4 days ago)

622 raw signals (0 security + 622 graph)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 1 week, 4 days ago · v1 · 622 actionable findings from 1 signal source. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
63.8
/100
Security checks
64
0 findings
System graph
64
100.0% cov · 622 findings
Critical
6
click to filter
Agents
10
0 votes
Crowd
0
reported
Severity distribution — click a segment to filter
Active filters: excluding tests × Reset all
Severity: Critical 6 High 174 Medium 349 Low 53 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 0 System graph 622 Crowd 0 Layer: Frontend 50 Security 433 Quality 33 Hardware 2 Cicd 1 Dependencies 98 Api 5
Scan summary Repository scanned at 63.8/100 with 100.0% coverage. It contains 7833 nodes across 30 cross-layer flows, written primarily in mixed languages. Engine surfaced 622 findings — concentrated in security (433), dependencies (98), frontend (50). Risk profile is high: 6 critical, 174 high, 349 medium. Recommended next step: open the security layer findings first — that's where the highest-impact wins live.

Showing 554 of 622 actionable findings. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

critical System graph security Trivy conf 1.00 CVE-2026-41242: protobufjs 7.2.5 — yarn.lock
protobufjs: protobufjs: Arbitrary code execution via injected protobuf definition type fields protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1 and 7.5.5, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will …
VulnCve 2026 41242
critical System graph security Trivy conf 1.00 CVE-2026-41242: protobufjs 7.3.2 — yarn.lock
protobufjs: protobufjs: Arbitrary code execution via injected protobuf definition type fields protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1 and 7.5.5, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will …
VulnCve 2026 41242
critical System graph security Trivy conf 1.00 CVE-2026-75604: next 15.5.10 — yarn.lock
next: Next.js: Unauthenticated Remote Code Execution on windows-hosted servers Next.js is a React framework for building full-stack web applications. From 13.4.0 until 15.5.24 and 16.3.3, Next.js applications using Pages Router or App Router without Cache Components on Windows-hosted servers do no…
VulnCve 2026 75604
critical System graph security Trivy conf 1.00 GHSA-2xp9-vwfh-vxw4: next 15.5.10 — yarn.lock
Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used A vulnerability in the underlying `libheif` library used by `sharp` which Next.js uses for image optimization can lead to remote code execution when AVIF files are optimized. Until a fix has propagat…
VulnGhsa 2xp9 vwfh vxw4
critical System graph security Secrets conf 0.82 Runtime dotenv file present in repo: configs/envs/.env.celo
`configs/envs/.env.celo` looks like a runtime dotenv file. It contains secret-looking assignments for NEXT_PUBLIC_VIEWS_ADDRESS_NATIVE_TOKEN_ADDRESS. Move real values to a secret manager and keep only `.env.example` style templates in source control.
configs/envs/.env.celo ConfigEnv fileRuntime env
critical System graph security Secrets conf 0.82 Runtime dotenv file present in repo: configs/envs/.env.celo_sepolia
`configs/envs/.env.celo_sepolia` looks like a runtime dotenv file. It contains secret-looking assignments for NEXT_PUBLIC_VIEWS_ADDRESS_NATIVE_TOKEN_ADDRESS. Move real values to a secret manager and keep only `.env.example` style templates in source control.
configs/envs/.env.celo_sepolia ConfigEnv fileRuntime env
high System graph security Trivy conf 1.00 CVE-2026-101898: axios 1.13.2 — yarn.lock
axios: axios: Security control bypass via unapplied HTTP/2 proxy and DNS settings Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Axios HTTP/2 request setup does not consistently apply proxy settings and caller-supplied DNS lookup policy. An HTTPS reques…
VulnCve 2026 101898
high System graph security Trivy conf 1.00 CVE-2026-101901: axios 1.13.2 — yarn.lock
axios: Axios: Denial of Service via unhandled error in HTTP/2 session initialization Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Http2Sessions does not install adequate error handling for a ClientHttp2Session during Axios HTTP/2 session initializatio…
VulnCve 2026 101901
high System graph security Trivy conf 1.00 CVE-2026-101916: @grpc/grpc-js 1.10.10 — yarn.lock
grpc-js: grpc-js: Authentication bypass via improper peer certificate validation @grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, getAuthContext does not distinguish authorized from unauthorized peer certificates when se…
VulnCve 2026 101916
high System graph security Trivy conf 1.00 CVE-2026-102276: brace-expansion 1.1.12 — deploy/tools/affected-tests/yarn.lock
brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in pars…
VulnCve 2026 102276
high System graph security Trivy conf 1.00 CVE-2026-102276: brace-expansion 2.0.1 — yarn.lock
brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in pars…
VulnCve 2026 102276
high System graph security Trivy conf 1.00 CVE-2026-102278: brace-expansion 1.1.12 — deploy/tools/affected-tests/yarn.lock
brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse on…
VulnCve 2026 102278
high System graph security Trivy conf 1.00 CVE-2026-102278: brace-expansion 2.0.1 — yarn.lock
brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse on…
VulnCve 2026 102278
high System graph security Trivy conf 1.00 CVE-2026-12143: form-data 4.0.4 — yarn.lock
form-data: form-data: Form field override via CRLF injection form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Disposition` header with…
VulnCve 2026 12143
high System graph security Trivy conf 1.00 CVE-2026-12151: undici 6.21.3 — yarn.lock
undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream …
VulnCve 2026 12151
high System graph security Trivy conf 1.00 CVE-2026-13149: brace-expansion 1.1.12 — deploy/tools/affected-tests/yarn.lock
brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a…
VulnCve 2026 13149
high System graph security Trivy conf 1.00 CVE-2026-13149: brace-expansion 2.0.1 — yarn.lock
brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a…
VulnCve 2026 13149
high System graph security Trivy conf 1.00 CVE-2026-14257: brace-expansion 1.1.12 — deploy/tools/affected-tests/yarn.lock
brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the lengt…
VulnCve 2026 14257
high System graph security Trivy conf 1.00 CVE-2026-14257: brace-expansion 2.0.1 — yarn.lock
brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the lengt…
VulnCve 2026 14257
high System graph security Trivy conf 1.00 CVE-2026-1526: undici 6.21.3 — yarn.lock
undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression. When a WebSocket connection negotia…
VulnCve 2026 1526
high System graph security Trivy conf 1.00 CVE-2026-1528: undici 6.21.3 — yarn.lock
undici: undici: Denial of Service via crafted WebSocket frame with large length ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws a fatal TypeError that te…
VulnCve 2026 1528
high System graph security Trivy conf 1.00 CVE-2026-19534: undici 6.21.3 — yarn.lock
undici: undici: Denial of Service via unrequested WebSocket subprotocol undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if th…
VulnCve 2026 19534
high System graph security Trivy conf 1.00 CVE-2026-22028: preact 10.27.2 — yarn.lock
preact: Preact: Arbitrary script execution via JSON serialization protection bypass Preact, a lightweight web development framework, JSON serialization protection to prevent Virtual DOM elements from being constructed from arbitrary JSON. A regression introduced in Preact 10.26.5 caused this prote…
VulnCve 2026 22028
high System graph security Trivy conf 1.00 CVE-2026-2229: undici 6.21.3 — yarn.lock
undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the server_max_window_bits parameter in the permessage-deflate extension. When a WebSocket clie…
VulnCve 2026 2229
high System graph security Trivy conf 1.00 CVE-2026-23527: h3 1.9.0 — yarn.lock
h3: h3: HTTP Request Smuggling due to improper case-sensitive parsing of Transfer-Encoding header H3 is a minimal H(TTP) framework built for high performance and portability. Prior to 1.15.5, there is a critical HTTP Request Smuggling vulnerability. readRawBody is doing a strict case-sensitive che…
VulnCve 2026 23527
high System graph security Trivy conf 1.00 CVE-2026-25639: axios 1.12.0 — yarn.lock
axios: Axios affected by Denial of Service via __proto__ Key in mergeConfig Axios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ a…
VulnCve 2026 25639
high System graph security Trivy conf 1.00 CVE-2026-25639: axios 1.13.2 — yarn.lock
axios: Axios affected by Denial of Service via __proto__ Key in mergeConfig Axios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ a…
VulnCve 2026 25639
high System graph security Trivy conf 1.00 CVE-2026-26996: minimatch 3.1.2 — deploy/tools/affected-tests/yarn.lock
minimatch: minimatch: Denial of Service via specially crafted glob patterns minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains …
VulnCve 2026 26996
high System graph security Trivy conf 1.00 CVE-2026-26996: minimatch 5.1.0 — yarn.lock
minimatch: minimatch: Denial of Service via specially crafted glob patterns minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains …
VulnCve 2026 26996
high System graph security Trivy conf 1.00 CVE-2026-26996: minimatch 7.4.6 — yarn.lock
minimatch: minimatch: Denial of Service via specially crafted glob patterns minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains …
VulnCve 2026 26996
high System graph security Trivy conf 1.00 CVE-2026-27903: minimatch 3.1.2 — deploy/tools/affected-tests/yarn.lock
minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne(…
VulnCve 2026 27903
high System graph security Trivy conf 1.00 CVE-2026-27903: minimatch 5.1.0 — yarn.lock
minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne(…
VulnCve 2026 27903
high System graph security Trivy conf 1.00 CVE-2026-27903: minimatch 7.4.6 — yarn.lock
minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne(…
VulnCve 2026 27903
high System graph security Trivy conf 1.00 CVE-2026-27904: minimatch 3.1.2 — deploy/tools/affected-tests/yarn.lock
minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs prod…
VulnCve 2026 27904
high System graph security Trivy conf 1.00 CVE-2026-27904: minimatch 5.1.0 — yarn.lock
minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs prod…
VulnCve 2026 27904
high System graph security Trivy conf 1.00 CVE-2026-27904: minimatch 7.4.6 — yarn.lock
minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs prod…
VulnCve 2026 27904
high System graph security Trivy conf 1.00 CVE-2026-29045: hono 4.11.4 — yarn.lock
Hono vulnerable to arbitrary file access via serveStatic vulnerability Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, when using serveStatic together with route-based middleware protections (e.g. app.use('/admin/*', ...)), inconsiste…
VulnCve 2026 29045
high System graph security Trivy conf 1.00 CVE-2026-29063: immutable 3.8.2 — yarn.lock
immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.t…
VulnCve 2026 29063
high System graph security Trivy conf 1.00 CVE-2026-33128: h3 1.9.0 — yarn.lock
h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream Fields H3 is a minimal H(TTP) framework. In versions prior to 1.15.6 and between 2.0.0 through 2.0.1-rc.14, createEventStream is vulnerable to Server-Sent Events (SSE) injection due to missing newline sanitization in fo…
VulnCve 2026 33128
high System graph security Trivy conf 1.00 CVE-2026-33151: socket.io-parser 4.2.4 — yarn.lock
socket.io: Socket.IO: Denial of Service due to excessive buffering of specially crafted packets Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. Prior to versions 3.3.5, 3.4.4, and 4.2.6, a specially crafted Socket.IO packet can make the server wait for …
VulnCve 2026 33151
high System graph security Trivy conf 1.00 CVE-2026-33671: picomatch 2.3.1 — deploy/tools/affected-tests/yarn.lock
picomatch: Picomatch: Regular Expression Denial of Service via crafted extglob patterns Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain pattern…
VulnCve 2026 33671
high System graph security Trivy conf 1.00 CVE-2026-33671: picomatch 2.3.1 — deploy/tools/favicon-generator/yarn.lock
picomatch: Picomatch: Regular Expression Denial of Service via crafted extglob patterns Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain pattern…
VulnCve 2026 33671
high System graph security Trivy conf 1.00 CVE-2026-33671: picomatch 2.3.1 — deploy/tools/feature-reporter/yarn.lock
picomatch: Picomatch: Regular Expression Denial of Service via crafted extglob patterns Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain pattern…
VulnCve 2026 33671
high System graph security Trivy conf 1.00 CVE-2026-33671: picomatch 2.3.1 — deploy/tools/sitemap-generator/yarn.lock
picomatch: Picomatch: Regular Expression Denial of Service via crafted extglob patterns Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain pattern…
VulnCve 2026 33671
high System graph security Trivy conf 1.00 CVE-2026-33671: picomatch 2.3.1 — yarn.lock
picomatch: Picomatch: Regular Expression Denial of Service via crafted extglob patterns Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain pattern…
VulnCve 2026 33671
high System graph security Trivy conf 1.00 CVE-2026-33891: node-forge 1.3.2 — yarn.lock
node-forge: node-forge: Denial of Service via infinite loop in BigInteger.modInverse() Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, a Denial of Service (DoS) vulnerability exists in the node-forge library due to an i…
VulnCve 2026 33891
high System graph security Trivy conf 1.00 CVE-2026-33894: node-forge 1.3.2 — yarn.lock
node-forge: Forge: Signature Forgery via Weak RSASSA PKCS#1 v1.5 Verification Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, RSASSA PKCS#1 v1.5 signature verification accepts forged signatures for low public exponent k…
VulnCve 2026 33894
high System graph security Trivy conf 1.00 CVE-2026-33895: node-forge 1.3.2 — yarn.lock
node-forge: Forge: Authentication bypass via forged Ed25519 cryptographic signatures Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, Ed25519 signature verification accepts forged non-canonical signatures where the scala…
VulnCve 2026 33895
high System graph security Trivy conf 1.00 CVE-2026-33896: node-forge 1.3.2 — yarn.lock
node-forge: Forge (node-forge): Certificate validation bypass allows unauthorized certificate issuance Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, `pki.verifyCertificateChain()` does not enforce RFC 5280 basicConstr…
VulnCve 2026 33896
high System graph security Trivy conf 1.00 CVE-2026-35209: defu 6.1.3 — yarn.lock
defu: Prototype pollution via `__proto__` key in defaults argument defu is software that allows uers to assign default properties recursively. Prior to version 6.1.5, applications that pass unsanitized user input (e.g. parsed JSON request bodies, database records, or config files from untrusted so…
VulnCve 2026 35209
high System graph security Trivy conf 1.00 CVE-2026-42033: axios 1.12.0 — yarn.lock
axios: Axios: HTTP Transport Hijacking via Prototype Pollution Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when Object.prototype has been polluted by any co-dependency with keys that axios reads without a hasOwnProperty guard, an attacker can (a) s…
VulnCve 2026 42033
high System graph security Trivy conf 1.00 CVE-2026-42033: axios 1.13.2 — yarn.lock
axios: Axios: HTTP Transport Hijacking via Prototype Pollution Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when Object.prototype has been polluted by any co-dependency with keys that axios reads without a hasOwnProperty guard, an attacker can (a) s…
VulnCve 2026 42033
high System graph security Trivy conf 1.00 CVE-2026-42035: axios 1.12.0 — yarn.lock
axios: Axios: Arbitrary HTTP header injection via prototype pollution Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, a prototype pollution gadget exists in the Axios HTTP adapter (lib/adapters/http.js) that allows an attacker to inject arbitrary HTTP …
VulnCve 2026 42035
high System graph security Trivy conf 1.00 CVE-2026-42035: axios 1.13.2 — yarn.lock
axios: Axios: Arbitrary HTTP header injection via prototype pollution Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, a prototype pollution gadget exists in the Axios HTTP adapter (lib/adapters/http.js) that allows an attacker to inject arbitrary HTTP …
VulnCve 2026 42035
high System graph security Trivy conf 1.00 CVE-2026-42043: axios 1.12.0 — yarn.lock
axios: Axios: NO_PROXY bypass via crafted URL Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, an attacker who can influence the target URL of an Axios request can use any address in the 127.0.0.0/8 range (other than 127.0.0.1) to completely bypass the …
VulnCve 2026 42043
high System graph security Trivy conf 1.00 CVE-2026-42043: axios 1.13.2 — yarn.lock
axios: Axios: NO_PROXY bypass via crafted URL Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, an attacker who can influence the target URL of an Axios request can use any address in the 127.0.0.0/8 range (other than 127.0.0.1) to completely bypass the …
VulnCve 2026 42043
high System graph security Trivy conf 1.00 CVE-2026-42264: axios 1.12.0 — yarn.lock
axios: Axios: Prototype pollution allows information disclosure and request manipulation Axios is a promise based HTTP client for the browser and Node.js. From version 1.0.0 to before version 1.15.2, fFive config properties (auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser) in the…
VulnCve 2026 42264
high System graph security Trivy conf 1.00 CVE-2026-42264: axios 1.13.2 — yarn.lock
axios: Axios: Prototype pollution allows information disclosure and request manipulation Axios is a promise based HTTP client for the browser and Node.js. From version 1.0.0 to before version 1.15.2, fFive config properties (auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser) in the…
VulnCve 2026 42264
high System graph security Trivy conf 1.00 CVE-2026-44289: protobufjs 7.2.5 — yarn.lock
protobufjs: protobufjs: Denial of Service via uncontrolled recursion in protobuf decoding protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs could recurse without a depth limit while decoding nested protobuf data. This affected both skippi…
VulnCve 2026 44289
high System graph security Trivy conf 1.00 CVE-2026-44289: protobufjs 7.3.2 — yarn.lock
protobufjs: protobufjs: Denial of Service via uncontrolled recursion in protobuf decoding protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs could recurse without a depth limit while decoding nested protobuf data. This affected both skippi…
VulnCve 2026 44289
high System graph security Trivy conf 1.00 CVE-2026-44290: protobufjs 7.2.5 — yarn.lock
protobufjs: protobufjs: Denial of Service via crafted schema protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs allowed certain schema option paths to traverse through inherited object properties while applying options. A crafted protobuf …
VulnCve 2026 44290
high System graph security Trivy conf 1.00 CVE-2026-44290: protobufjs 7.3.2 — yarn.lock
protobufjs: protobufjs: Denial of Service via crafted schema protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs allowed certain schema option paths to traverse through inherited object properties while applying options. A crafted protobuf …
VulnCve 2026 44290
high System graph security Trivy conf 1.00 CVE-2026-44291: protobufjs 7.2.5 — yarn.lock
protobufjs: protobufjs: Arbitrary Code Execution via prototype pollution protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs used plain objects with inherited prototypes for internal type lookup tables used by generated encode and decode fu…
VulnCve 2026 44291
high System graph security Trivy conf 1.00 CVE-2026-44291: protobufjs 7.3.2 — yarn.lock
protobufjs: protobufjs: Arbitrary Code Execution via prototype pollution protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs used plain objects with inherited prototypes for internal type lookup tables used by generated encode and decode fu…
VulnCve 2026 44291
high System graph security Trivy conf 1.00 CVE-2026-44293: protobufjs 7.2.5 — yarn.lock
protobufjs: protobufjs: Arbitrary code execution due to unsafe expression generation from crafted protobuf descriptors protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript for toObject conversion could include an unsafe …
VulnCve 2026 44293
high System graph security Trivy conf 1.00 CVE-2026-44293: protobufjs 7.3.2 — yarn.lock
protobufjs: protobufjs: Arbitrary code execution due to unsafe expression generation from crafted protobuf descriptors protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript for toObject conversion could include an unsafe …
VulnCve 2026 44293
high System graph security Trivy conf 1.00 CVE-2026-44486: axios 1.12.0 — yarn.lock
axios: Axios: Information disclosure of proxy credentials via HTTP redirects Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a request is sent throug…
VulnCve 2026 44486
high System graph security Trivy conf 1.00 CVE-2026-44486: axios 1.13.2 — yarn.lock
axios: Axios: Information disclosure of proxy credentials via HTTP redirects Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a request is sent throug…
VulnCve 2026 44486
high System graph security Trivy conf 1.00 CVE-2026-44487: axios 1.12.0 — yarn.lock
axios: Axios: Information disclosure of proxy credentials via redirect flows Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’s Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected origin during specific proxy-to-direct re…
VulnCve 2026 44487
high System graph security Trivy conf 1.00 CVE-2026-44487: axios 1.13.2 — yarn.lock
axios: Axios: Information disclosure of proxy credentials via redirect flows Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’s Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected origin during specific proxy-to-direct re…
VulnCve 2026 44487
high System graph security Trivy conf 1.00 CVE-2026-44488: axios 1.12.0 — yarn.lock
axios: Axios: Denial of Service due to unenforced request and response size limits Axios is a promise based HTTP client for the browser and Node.js. Axios versions 1.7.0 through 1.15.x did not enforce configured request and response size limits when requests were sent with the fetch adapter. Appli…
VulnCve 2026 44488
high System graph security Trivy conf 1.00 CVE-2026-44488: axios 1.13.2 — yarn.lock
axios: Axios: Denial of Service due to unenforced request and response size limits Axios is a promise based HTTP client for the browser and Node.js. Axios versions 1.7.0 through 1.15.x did not enforce configured request and response size limits when requests were sent with the fetch adapter. Appli…
VulnCve 2026 44488
high System graph security Trivy conf 1.00 CVE-2026-44494: axios 1.12.0 — yarn.lock
axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.16.0, the Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution in the applicatio…
VulnCve 2026 44494
high System graph security Trivy conf 1.00 CVE-2026-44494: axios 1.13.2 — yarn.lock
axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.16.0, the Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution in the applicatio…
VulnCve 2026 44494
high System graph security Trivy conf 1.00 CVE-2026-44495: axios 1.12.0 — yarn.lock
axios: Axios: Information disclosure due to prototype pollution vulnerability Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in request config processing. If another vulnerability in the same Jav…
VulnCve 2026 44495
high System graph security Trivy conf 1.00 CVE-2026-44495: axios 1.13.2 — yarn.lock
axios: Axios: Information disclosure due to prototype pollution vulnerability Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in request config processing. If another vulnerability in the same Jav…
VulnCve 2026 44495
high System graph security Trivy conf 1.00 CVE-2026-44496: axios 1.12.0 — yarn.lock
axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name Axios is a promise based HTTP client for the browser and Node.js. Axios versions before 0.32.0 on the 0.x line and before 1.16.0 on the 1.x line build a regular expression from the configured XSRF co…
VulnCve 2026 44496
high System graph security Trivy conf 1.00 CVE-2026-44496: axios 1.13.2 — yarn.lock
axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name Axios is a promise based HTTP client for the browser and Node.js. Axios versions before 0.32.0 on the 0.x line and before 1.16.0 on the 1.x line build a regular expression from the configured XSRF co…
VulnCve 2026 44496
high System graph security Trivy conf 1.00 CVE-2026-44573: next 15.5.10 — yarn.lock
next.js: Next.js: Information disclosure due to middleware bypass in Pages Router with i18n Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, Applications using the Pages Router with i18n configured and middleware/proxy-based authoriza…
VulnCve 2026 44573
high System graph security Trivy conf 1.00 CVE-2026-44574: next 15.5.10 — yarn.lock
Next.js: Next.js: Authorization bypass via crafted query parameters Next.js is a React framework for building full-stack web applications. From 15.4.0 to before 15.5.16 and 16.2.5, applications that rely on middleware to protect dynamic routes can be vulnerable to authorization bypass. In affected…
VulnCve 2026 44574
high System graph security Trivy conf 1.00 CVE-2026-44575: next 15.5.10 — yarn.lock
next.js: Next.js: Unauthorized access to protected content via middleware bypass Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.16 and 16.2.5, App Router applications that rely on middleware or proxy-based checks for authorization can allow unauth…
VulnCve 2026 44575
high System graph security Trivy conf 1.00 CVE-2026-44578: next 15.5.10 — yarn.lock
Next.js: Next.js: Server-Side Request Forgery via crafted WebSocket upgrade requests Next.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in Node.js server can be vulnerable to server-side request…
VulnCve 2026 44578
high System graph security Trivy conf 1.00 CVE-2026-44579: next 15.5.10 — yarn.lock
next.js: Next.js: Denial of Service via crafted POST requests to server actions Next.js is a React framework for building full-stack web applications. From to before 15.5.16 and 16.2.5, applications using Partial Prerendering through the Cache Components feature can be vulnerable to connection ex…
VulnCve 2026 44579
high System graph security Trivy conf 1.00 CVE-2026-44902: @opentelemetry/auto-instrumentations-node 0.43.0 — yarn.lock
opentelemetry-js: opentelemetry/exporter-prometheus: opentelemetry-js: Denial of Service via malformed HTTP request opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 0.217.0, a single malformed HTTP request crashes any Node.js process running the OpenTelemetry JS Prometheus exporte…
VulnCve 2026 44902
high System graph security Trivy conf 1.00 CVE-2026-44902: @opentelemetry/sdk-node 0.49.1 — yarn.lock
opentelemetry-js: opentelemetry/exporter-prometheus: opentelemetry-js: Denial of Service via malformed HTTP request opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 0.217.0, a single malformed HTTP request crashes any Node.js process running the OpenTelemetry JS Prometheus exporte…
VulnCve 2026 44902
high System graph security Trivy conf 1.00 CVE-2026-45109: next 15.5.10 — yarn.lock
next.js: Next.js: Information disclosure via security fix bypass in middleware with Turbopack Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.18 and 16.2.6, it was found that the fix addressing CVE-2026-44575 did not apply to middleware.ts with Tur…
VulnCve 2026 45109
high System graph security Trivy conf 1.00 CVE-2026-45623: postcss 8.4.31 — yarn.lock
postcss: PostCSS: Information disclosure and denial of service via crafted CSS input PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PA…
VulnCve 2026 45623
high System graph security Trivy conf 1.00 CVE-2026-45623: postcss 8.4.33 — deploy/tools/affected-tests/yarn.lock
postcss: PostCSS: Information disclosure and denial of service via crafted CSS input PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PA…
VulnCve 2026 45623
high System graph security Trivy conf 1.00 CVE-2026-45623: postcss 8.5.6 — yarn.lock
postcss: PostCSS: Information disclosure and denial of service via crafted CSS input PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PA…
VulnCve 2026 45623
high System graph security Trivy conf 1.00 CVE-2026-45783: @libp2p/kad-dht 15.0.2 — yarn.lock
@libp2p/kad-dht: Unvalidated PUT_VALUE records allow unbounded disk exhaustion on DHT server nodes libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 16.2.6, an unauthenticated remote peer can exhaust the disk storage of any @libp2p/kad-dht node running in server mo…
VulnCve 2026 45783
high System graph security Trivy conf 1.00 CVE-2026-46625: js-cookie 3.0.1 — yarn.lock
js-cookie: JavaScript Cookie: Cookie attribute manipulation via prototype pollution JavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-cookie's internal assign() helper copies properties with for...in + plain assignment. When the source object is pr…
VulnCve 2026 46625
high System graph security Trivy conf 1.00 CVE-2026-4800: lodash 4.17.21 — yarn.lock
lodash: lodash: Arbitrary code execution via untrusted input in template imports Impact: The fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both p…
VulnCve 2026 4800
high System graph security Trivy conf 1.00 CVE-2026-48068: @grpc/grpc-js 1.10.10 — yarn.lock
grpc-js: @grpc/grpc-js: Server crash via malformed HTTP/2 stream initiation @grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming HTTP/2 stream initiation can cause a serv…
VulnCve 2026 48068
high System graph security Trivy conf 1.00 CVE-2026-48069: @grpc/grpc-js 1.10.10 — yarn.lock
grpc-js: @grpc/grpc-js: Client or server crash via malformed compressed message @grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming compressed message can cause a client…
VulnCve 2026 48069
high System graph security Trivy conf 1.00 CVE-2026-48712: protobufjs 7.2.5 — yarn.lock
protobufjs: protobufjs: Denial of Service via uncontrolled recursion with crafted protobuf payload protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.1 and 8.4.1, protobufjs could recurse without a depth limit while converting decoded messages to plain objects or…
VulnCve 2026 48712
high System graph security Trivy conf 1.00 CVE-2026-48712: protobufjs 7.3.2 — yarn.lock
protobufjs: protobufjs: Denial of Service via uncontrolled recursion with crafted protobuf payload protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.1 and 8.4.1, protobufjs could recurse without a depth limit while converting decoded messages to plain objects or…
VulnCve 2026 48712
high System graph security Trivy conf 1.00 CVE-2026-48779: ws 7.5.10 — yarn.lock
ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memor…
VulnCve 2026 48779
high System graph security Trivy conf 1.00 CVE-2026-48779: ws 8.17.1 — yarn.lock
ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memor…
VulnCve 2026 48779
high System graph security Trivy conf 1.00 CVE-2026-48779: ws 8.18.2 — yarn.lock
ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memor…
VulnCve 2026 48779
high System graph security Trivy conf 1.00 CVE-2026-48779: ws 8.18.3 — deploy/tools/essential-dapps-chains-config-generator/yarn.lock
ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memor…
VulnCve 2026 48779
high System graph security Trivy conf 1.00 CVE-2026-48779: ws 8.18.3 — yarn.lock
ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memor…
VulnCve 2026 48779
high System graph security Trivy conf 1.00 CVE-2026-48801: linkify-it 5.0.0 — yarn.lock
linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability linkify-it is a links recognition library with full Unicode support. Prior to 5.0.1, LinkifyIt.prototype.match, the package's primary public API, has O(N²) algorithmic complexity for inputs containing many fuzzy lin…
VulnCve 2026 48801
high System graph security Trivy conf 1.00 CVE-2026-4926: path-to-regexp 8.1.0 — yarn.lock
path-to-regexp: path-to-regexp: Denial of Service via crafted regular expressions Impact: A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as `{a}{b}{c}:z`. The generated regex grows exponentially with the number of groups, cau…
VulnCve 2026 4926
high System graph security Trivy conf 1.00 CVE-2026-54290: hono 4.11.4 — yarn.lock
hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, with credentials: true and no explicit origin (the default wildcard), the CORS Middleware reflec…
VulnCve 2026 54290
high System graph security Trivy conf 1.00 CVE-2026-59869: js-yaml 4.1.1 — yarn.lock
js-yaml: js-yaml: Denial of Service via crafted YAML documents js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where…
VulnCve 2026 59869
high System graph security Trivy conf 1.00 CVE-2026-59879: immutable 3.8.2 — yarn.lock
immutable-js: Immutable.js: Denial of Service due to mishandling of large index values in List operations Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, List#set, List#setSize, List#setIn, List#updateIn, and the functional set, setIn, and updateIn mishan…
VulnCve 2026 59879
high System graph security Trivy conf 1.00 CVE-2026-59880: immutable 3.8.2 — yarn.lock
Immutable.js provides many Persistent Immutable data structures. Prior ... Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, Immutable.Map and Immutable.Set keep keys that share the same 32-bit hash in a HashCollisionNode collision bucket that is scanned li…
VulnCve 2026 59880
high System graph security Trivy conf 1.00 CVE-2026-59887: linkify-it 5.0.0 — yarn.lock
linkify-it: linkify-it: Denial of Service via crafted mailto: links linkify-it is a links recognition library with full Unicode support. Prior to 5.0.2, the mailto: schema validator used by .test() and .match() can be invoked at every mailto: occurrence and scan the remaining input through src_ema…
VulnCve 2026 59887
high System graph security Trivy conf 1.00 CVE-2026-59892: @opentelemetry/propagator-jaeger 1.22.0 — yarn.lock
@opentelemetry/propagator-jaeger: OpenTelemetry JavaScript: Denial of Service via malformed HTTP header decoding OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. Prior to 2.9.0, @opentelemetry/propagator-jaeger decodes incoming uber-trace-id and uberctx-* HTTP header values with de…
VulnCve 2026 59892
high System graph security Trivy conf 1.00 CVE-2026-64641: next 15.5.10 — yarn.lock
next: Next.js: Denial of Service via crafted requests to App Router with Server Actions Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router with at lea…
VulnCve 2026 64641
high System graph security Trivy conf 1.00 CVE-2026-64645: next 15.5.10 — yarn.lock
next: Next.js: Server-Side Request Forgery vulnerability Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a rewrites() or redirects() rule that builds its external destination hostname from request-controlled inp…
VulnCve 2026 64645
high System graph security Trivy conf 1.00 CVE-2026-64649: next 15.5.10 — yarn.lock
next: Next.js: Server-Side Request Forgery via malicious host redirection in Server Actions Next.js is a React framework for building full-stack web applications. In versions 14.1.1 through 15.5.20 and 16.0.0 through 16.2.10, when a Server Action forwards or redirects a request, an attacker can ca…
VulnCve 2026 64649
high System graph security Trivy conf 1.00 CVE-2026-67213: nanoid 3.3.11 — yarn.lock
nanoid: nanoid: Denial of Service via infinite loop in random ID generation nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit conditio…
VulnCve 2026 67213
high System graph security Trivy conf 1.00 CVE-2026-67213: nanoid 3.3.8 — deploy/tools/affected-tests/yarn.lock
nanoid: nanoid: Denial of Service via infinite loop in random ID generation nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit conditio…
VulnCve 2026 67213
high System graph security Trivy conf 1.00 CVE-2026-67213: nanoid 3.3.8 — yarn.lock
nanoid: nanoid: Denial of Service via infinite loop in random ID generation nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit conditio…
VulnCve 2026 67213
high System graph security Trivy conf 1.00 CVE-2026-67213: nanoid 5.1.5 — yarn.lock
nanoid: nanoid: Denial of Service via infinite loop in random ID generation nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit conditio…
VulnCve 2026 67213
high System graph security Trivy conf 1.00 CVE-2026-67214: nanoid 3.3.11 — yarn.lock
nanoid: nanoid: Denial of Service via negative size input in non-secure module functions nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the …
VulnCve 2026 67214
high System graph security Trivy conf 1.00 CVE-2026-67214: nanoid 3.3.8 — deploy/tools/affected-tests/yarn.lock
nanoid: nanoid: Denial of Service via negative size input in non-secure module functions nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the …
VulnCve 2026 67214
high System graph security Trivy conf 1.00 CVE-2026-67214: nanoid 3.3.8 — yarn.lock
nanoid: nanoid: Denial of Service via negative size input in non-secure module functions nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the …
VulnCve 2026 67214
high System graph security Trivy conf 1.00 CVE-2026-67214: nanoid 5.1.5 — yarn.lock
nanoid: nanoid: Denial of Service via negative size input in non-secure module functions nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the …
VulnCve 2026 67214
high System graph security Trivy conf 1.00 CVE-2026-67214: nanoid 5.1.6 — yarn.lock
nanoid: nanoid: Denial of Service via negative size input in non-secure module functions nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the …
VulnCve 2026 67214
high System graph security Trivy conf 1.00 CVE-2026-69152: brace-expansion 1.1.12 — deploy/tools/affected-tests/yarn.lock
brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-altern…
VulnCve 2026 69152
high System graph security Trivy conf 1.00 CVE-2026-69152: brace-expansion 2.0.1 — yarn.lock
brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-altern…
VulnCve 2026 69152
high System graph security Trivy conf 1.00 CVE-2026-69185: socket.io-parser 4.2.4 — yarn.lock
socket.io-parser: Socket.IO: Denial of Service via memory exhaustion from crafted packets Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary a…
VulnCve 2026 69185
high System graph security Trivy conf 1.00 CVE-2026-73086: nanoid 3.3.11 — yarn.lock
nanoid: nanoid: Predictable ID generation due to integer overflow nanoid is a secure, URL-friendly, unique string ID generator for JavaScript. Prior to versions 3.3.12 and 5.1.11, the nanoid(size) function in index.js and index.cjs coerces the user-influenced size parameter to a signed 32-bit inte…
VulnCve 2026 73086
high System graph security Trivy conf 1.00 CVE-2026-73086: nanoid 3.3.8 — deploy/tools/affected-tests/yarn.lock
nanoid: nanoid: Predictable ID generation due to integer overflow nanoid is a secure, URL-friendly, unique string ID generator for JavaScript. Prior to versions 3.3.12 and 5.1.11, the nanoid(size) function in index.js and index.cjs coerces the user-influenced size parameter to a signed 32-bit inte…
VulnCve 2026 73086
high System graph security Trivy conf 1.00 CVE-2026-73086: nanoid 3.3.8 — yarn.lock
nanoid: nanoid: Predictable ID generation due to integer overflow nanoid is a secure, URL-friendly, unique string ID generator for JavaScript. Prior to versions 3.3.12 and 5.1.11, the nanoid(size) function in index.js and index.cjs coerces the user-influenced size parameter to a signed 32-bit inte…
VulnCve 2026 73086
high System graph security Trivy conf 1.00 CVE-2026-73086: nanoid 5.1.5 — yarn.lock
nanoid: nanoid: Predictable ID generation due to integer overflow nanoid is a secure, URL-friendly, unique string ID generator for JavaScript. Prior to versions 3.3.12 and 5.1.11, the nanoid(size) function in index.js and index.cjs coerces the user-influenced size parameter to a signed 32-bit inte…
VulnCve 2026 73086
high System graph security Trivy conf 1.00 CVE-2026-73086: nanoid 5.1.6 — yarn.lock
nanoid: nanoid: Predictable ID generation due to integer overflow nanoid is a secure, URL-friendly, unique string ID generator for JavaScript. Prior to versions 3.3.12 and 5.1.11, the nanoid(size) function in index.js and index.cjs coerces the user-influenced size parameter to a signed 32-bit inte…
VulnCve 2026 73086
high System graph security Trivy conf 1.00 CVE-2026-73088: browserslist 4.24.2 — deploy/tools/favicon-generator/yarn.lock
browserslist: Browserslist: Prototype pollution leading to denial of service Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, reached unconditionally through getStat() and loadStat() on ever…
VulnCve 2026 73088
high System graph security Trivy conf 1.00 CVE-2026-73088: browserslist 4.24.2 — deploy/tools/feature-reporter/yarn.lock
browserslist: Browserslist: Prototype pollution leading to denial of service Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, reached unconditionally through getStat() and loadStat() on ever…
VulnCve 2026 73088
high System graph security Trivy conf 1.00 CVE-2026-73089: browserslist 4.24.2 — deploy/tools/favicon-generator/yarn.lock
browserslist: Browserslist: Denial of Service via unbounded memory growth from distinct query results Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct `(queries, context)` result in cache…
VulnCve 2026 73089
high System graph security Trivy conf 1.00 CVE-2026-73089: browserslist 4.24.2 — deploy/tools/feature-reporter/yarn.lock
browserslist: Browserslist: Denial of Service via unbounded memory growth from distinct query results Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct `(queries, context)` result in cache…
VulnCve 2026 73089
high System graph security Trivy conf 1.00 CVE-2026-73646: postcss 8.4.31 — yarn.lock
postcss: PostCSS: Information disclosure via path traversal in source map auto-loading PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sour…
VulnCve 2026 73646
high System graph security Trivy conf 1.00 CVE-2026-73646: postcss 8.4.33 — deploy/tools/affected-tests/yarn.lock
postcss: PostCSS: Information disclosure via path traversal in source map auto-loading PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sour…
VulnCve 2026 73646
high System graph security Trivy conf 1.00 CVE-2026-73646: postcss 8.5.6 — yarn.lock
postcss: PostCSS: Information disclosure via path traversal in source map auto-loading PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sour…
VulnCve 2026 73646
high System graph security Trivy conf 1.00 CVE-2026-84375: js-yaml 4.1.1 — yarn.lock
js-yaml: js-yaml: Denial of Service vulnerability in YAML parsing js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2, 4.3.2, and 5.4.1, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key <<. An attac…
VulnCve 2026 84375
high System graph security Trivy conf 1.00 CVE-2026-85393: node-forge 1.3.2 — yarn.lock
node-forge: node-forge: Signature forgery vulnerability in RSA PKCS#1 v1.5 verification node-forge through 1.4.0 fails to validate element count in nested DigestAlgorithm sequences during RSA PKCS#1 v1.5 signature verification. Attackers can embed garbage bytes inside the DigestAlgorithm sequence …
VulnCve 2026 85393
high System graph security Trivy conf 1.00 CVE-2026-86039: @libp2p/peer-store 11.1.4 — yarn.lock
libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addresses libp2p is a JavaScript implementation of the libp2p networking stack. From 8.0.0 until 12.0.24, @libp2p/peer-store in packages/peer-store/src/index.ts uses consumePeerRecord to verify…
VulnCve 2026 86039
high System graph security Trivy conf 1.00 CVE-2026-92599: joi 17.13.3 — yarn.lock
joi: joi: Denial of Service via `isoDate` validation regular expression joi (npm package `joi`, hapi.js) versions >=17.2.0 <17.13.7 and >=18.0.0 <18.2.6 are vulnerable to regular expression denial of service in the `Joi.string().isoDate()` validation rule. One of the regular expressions the rule a…
VulnCve 2026 92599
high System graph security Trivy conf 1.00 CVE-2026-93687: braces 3.0.3 — deploy/tools/affected-tests/yarn.lock
braces: braces: Denial of Service via Stack Overflow from Deeply Nested Patterns braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack a…
VulnCve 2026 93687
high System graph security Trivy conf 1.00 CVE-2026-93687: braces 3.0.3 — deploy/tools/favicon-generator/yarn.lock
braces: braces: Denial of Service via Stack Overflow from Deeply Nested Patterns braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack a…
VulnCve 2026 93687
high System graph security Trivy conf 1.00 CVE-2026-93687: braces 3.0.3 — deploy/tools/feature-reporter/yarn.lock
braces: braces: Denial of Service via Stack Overflow from Deeply Nested Patterns braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack a…
VulnCve 2026 93687
high System graph security Trivy conf 1.00 CVE-2026-93687: braces 3.0.3 — deploy/tools/sitemap-generator/yarn.lock
braces: braces: Denial of Service via Stack Overflow from Deeply Nested Patterns braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack a…
VulnCve 2026 93687
high System graph security Trivy conf 1.00 CVE-2026-93687: braces 3.0.3 — yarn.lock
braces: braces: Denial of Service via Stack Overflow from Deeply Nested Patterns braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack a…
VulnCve 2026 93687
high System graph security Trivy conf 1.00 CVE-2026-93749: source-map-js 1.0.2 — deploy/tools/affected-tests/yarn.lock
source-map-js: source-map-js: Denial of Service via malformed indexed source maps source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values …
VulnCve 2026 93749
high System graph security Trivy conf 1.00 CVE-2026-93749: source-map-js 1.2.1 — yarn.lock
source-map-js: source-map-js: Denial of Service via malformed indexed source maps source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values …
VulnCve 2026 93749
high System graph api Wiring conf 0.90 Dangling fetch: POST /node-api/monitoring/invalid-api-schema (lib/solidityScan/useFetchReport.ts:40)
`lib/solidityScan/useFetchReport.ts:40` calls `POST /node-api/monitoring/invalid-api-schema` but no backend route in the scanned graph matches that path. This is a likely runtime 404 unless an external gateway or unsupported router provides it. Tool: fetch Normalized path used for matching: `/node…
lib/solidityScan/useFetchReport.ts:40 Dangling fetchFetch
high System graph api Wiring conf 0.90 Dangling fetch: POST /node-api/monitoring/invalid-api-schema (lib/xStarScore/useFetchXStarScore.ts:40)
`lib/xStarScore/useFetchXStarScore.ts:40` calls `POST /node-api/monitoring/invalid-api-schema` but no backend route in the scanned graph matches that path. This is a likely runtime 404 unless an external gateway or unsupported router provides it. Tool: fetch Normalized path used for matching: `/no…
lib/xStarScore/useFetchXStarScore.ts:40 Dangling fetchFetch
high System graph api Wiring conf 0.90 Dangling fetch: POST /node-api/monitoring/invalid-api-schema (ui/address/details/AddressSaveOnGas.tsx:57)
`ui/address/details/AddressSaveOnGas.tsx:57` calls `POST /node-api/monitoring/invalid-api-schema` but no backend route in the scanned graph matches that path. This is a likely runtime 404 unless an external gateway or unsupported router provides it. Tool: fetch Normalized path used for matching: `…
ui/address/details/AddressSaveOnGas.tsx:57 Dangling fetchFetch
high System graph api Wiring conf 0.90 Dangling fetch: POST /node-api/monitoring/pageview (lib/monitoring/usePageViewTracking.ts:48)
`lib/monitoring/usePageViewTracking.ts:48` calls `POST /node-api/monitoring/pageview` but no backend route in the scanned graph matches that path. This is a likely runtime 404 unless an external gateway or unsupported router provides it. Tool: fetch Normalized path used for matching: `/node-api/mo…
lib/monitoring/usePageViewTracking.ts:48 Dangling fetchFetch
high System graph security Trivy conf 1.00 DS-0025: 'apk add' is missing '--no-cache' — Dockerfile
'apk add' is missing '--no-cache' '--no-cache' is missed: apk add git Rule: DS-0025 Severity: HIGH Target: Dockerfile
Misconfig
high System graph security Trivy conf 1.00 GHSA-5c6j-r48x-rmvq: serialize-javascript 6.0.2 — deploy/tools/favicon-generator/yarn.lock
Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString() ### Impact The serialize-javascript npm package (versions <= 7.0.2) contains a code injection vulnerability. It is an incomplete fix for CVE-2020-7660. While `RegExp.source` is sanitized, `RegExp.flags` i…
VulnGhsa 5c6j r48x rmvq
high System graph security Trivy conf 1.00 GHSA-5c6j-r48x-rmvq: serialize-javascript 6.0.2 — deploy/tools/feature-reporter/yarn.lock
Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString() ### Impact The serialize-javascript npm package (versions <= 7.0.2) contains a code injection vulnerability. It is an incomplete fix for CVE-2020-7660. While `RegExp.source` is sanitized, `RegExp.flags` i…
VulnGhsa 5c6j r48x rmvq
high System graph security Trivy conf 1.00 GHSA-5p4m-2wfm-xmqj: js-yaml 4.1.1 — yarn.lock
JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported # Quadratic CPU consumption in `!!omap` resolution (js-yaml 3.x and 4.x) ## Summary `resolveYamlOmap()` enforces key uniqueness for `!!omap` sequences with a linear scan (`objectKeys.indexOf…
VulnGhsa 5p4m 2wfm xmqj
high System graph security Trivy conf 1.00 GHSA-8h8q-6873-q5fj: next 15.5.10 — yarn.lock
Next.js Vulnerable to Denial of Service with Server Components A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as [CVE-…
VulnGhsa 8h8q 6873 q5fj
high System graph security Trivy conf 1.00 GHSA-f88m-g3jw-g9cj: sharp 0.33.5 — deploy/tools/favicon-generator/yarn.lock
sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 ### Impact A number of vulnerabilities, two rated as "High" severity using CVSSv4, have been discovered and fixed in the upstream libvips dependency. Those processing untrusted input with v…
VulnGhsa f88m g3jw g9cj
high System graph security Trivy conf 1.00 GHSA-f88m-g3jw-g9cj: sharp 0.34.3 — yarn.lock
sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 ### Impact A number of vulnerabilities, two rated as "High" severity using CVSSv4, have been discovered and fixed in the upstream libvips dependency. Those processing untrusted input with v…
VulnGhsa f88m g3jw g9cj
high System graph security Trivy conf 1.00 GHSA-q4gf-8mx6-v5v3: next 15.5.10 — yarn.lock
Next.js has a Denial of Service with Server Components A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as [CVE-2026-238…
VulnGhsa q4gf 8mx6 v5v3
high System graph security Trivy conf 1.00 GHSA-rgj7-g3m4-5g8c: sharp 0.33.5 — deploy/tools/favicon-generator/yarn.lock
sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545 ### Impact A number of vulnerabilities, two rated as "Critical" severity using CVSSv3, have been discovered and fixed in the upstream libheif dependency. These can lead to possible remote code execution (RCE) on glibc-b…
VulnGhsa rgj7 g3m4 5g8c
high System graph security Trivy conf 1.00 GHSA-rgj7-g3m4-5g8c: sharp 0.34.3 — yarn.lock
sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545 ### Impact A number of vulnerabilities, two rated as "Critical" severity using CVSSv3, have been discovered and fixed in the upstream libheif dependency. These can lead to possible remote code execution (RCE) on glibc-b…
VulnGhsa rgj7 g3m4 5g8c
high System graph security Trivy conf 1.00 GHSA-wq5f-xc86-pv6w: sharp 0.33.5 — deploy/tools/favicon-generator/yarn.lock
sharp : Vulnerability in librsvg dependency CVE-2026-96889 ### Impact A memory-related vulnerability has been discovered and fixed in the upstream librsvg dependency. When certain runtime-specific conditions apply, this vulnerability can lead to possible remote code execution (RCE) on glibc-based…
VulnGhsa wq5f xc86 pv6w
high System graph security Trivy conf 1.00 GHSA-wq5f-xc86-pv6w: sharp 0.34.3 — yarn.lock
sharp : Vulnerability in librsvg dependency CVE-2026-96889 ### Impact A memory-related vulnerability has been discovered and fixed in the upstream librsvg dependency. When certain runtime-specific conditions apply, this vulnerability can lead to possible remote code execution (RCE) on glibc-based…
VulnGhsa wq5f xc86 pv6w
high System graph security Secrets conf 0.72 Possible secret in stubs/account.ts
Detected 1 occurrence(s) matching generic_api_key. Rotate real credentials and move them to a secret manager.
stubs/account.ts:53 Generic api key
high System graph dependencies dependencies conf 1.00 Vulnerable dependency @opentelemetry/auto-instrumentations-node 0.43.0: GHSA-q7rr-3cgh-j5r3
OSV.dev reports `@opentelemetry/auto-instrumentations-node` at version `0.43.0` (resolved in `yarn.lock`) is affected by GHSA-q7rr-3cgh-j5r3 (aka CVE-2026-44902). Prometheus exporter process crash via malformed HTTP request Aliases: CVE-2026-44902 Advisory: https://osv.dev/vulnerability/GHSA-q7rr…
package.json ScaOsvGhsa q7rr 3cgh j5r3
high System graph dependencies dependencies conf 1.00 Vulnerable dependency @opentelemetry/sdk-node 0.49.1: GHSA-q7rr-3cgh-j5r3
OSV.dev reports `@opentelemetry/sdk-node` at version `0.49.1` (resolved in `yarn.lock`) is affected by GHSA-q7rr-3cgh-j5r3 (aka CVE-2026-44902). Prometheus exporter process crash via malformed HTTP request Aliases: CVE-2026-44902 Advisory: https://osv.dev/vulnerability/GHSA-q7rr-3cgh-j5r3 Fix: up…
package.json ScaOsvGhsa q7rr 3cgh j5r3
high System graph dependencies dependencies conf 0.90 Vulnerable dependency nanoid 3.3.11: GHSA-28wg-ghj8-5hjv
OSV.dev reports `nanoid` at version `3.3.11` (resolved in `deploy/tools/envs-validator/yarn.lock`) is affected by GHSA-28wg-ghj8-5hjv (aka CVE-2026-67214). Note: `nanoid` is a transitive dependency — pulled in by another package, not declared directly in a manifest. nanoid: non-secure generators c…
deploy/tools/envs-validator/yarn.lock ScaOsvGhsa 28wg ghj8 5hjv
high System graph dependencies dependencies conf 0.90 Vulnerable dependency nanoid 3.3.11: GHSA-2v37-7h3g-55p8
OSV.dev reports `nanoid` at version `3.3.11` (resolved in `deploy/tools/envs-validator/yarn.lock`) is affected by GHSA-2v37-7h3g-55p8 (aka CVE-2026-67213). Note: `nanoid` is a transitive dependency — pulled in by another package, not declared directly in a manifest. nanoid: custom generators can l…
deploy/tools/envs-validator/yarn.lock ScaOsvGhsa 2v37 7h3g 55p8
high System graph dependencies dependencies conf 0.90 Vulnerable dependency picomatch 4.0.3: GHSA-c2c7-rcm5-vvqj
OSV.dev reports `picomatch` at version `4.0.3` (resolved in `deploy/tools/envs-validator/yarn.lock`) is affected by GHSA-c2c7-rcm5-vvqj (aka CVE-2026-33671). Note: `picomatch` is a transitive dependency — pulled in by another package, not declared directly in a manifest. Picomatch has a ReDoS vuln…
deploy/tools/envs-validator/yarn.lock ScaOsvGhsa c2c7 rcm5 vvqj
high System graph dependencies dependencies conf 0.90 Vulnerable dependency postcss 8.5.6: GHSA-6g55-p6wh-862q
OSV.dev reports `postcss` at version `8.5.6` (resolved in `deploy/tools/envs-validator/yarn.lock`) is affected by GHSA-6g55-p6wh-862q (aka CVE-2026-45623). Note: `postcss` is a transitive dependency — pulled in by another package, not declared directly in a manifest. PostCSS: Arbitrary file read a…
deploy/tools/envs-validator/yarn.lock ScaOsvGhsa 6g55 p6wh 862q
high System graph dependencies dependencies conf 0.90 Vulnerable dependency rollup 4.52.4: GHSA-mw96-cpmx-2vgc
OSV.dev reports `rollup` at version `4.52.4` (resolved in `deploy/tools/essential-dapps-chains-config-generator/yarn.lock`) is affected by GHSA-mw96-cpmx-2vgc (aka CVE-2026-27606). Note: `rollup` is a transitive dependency — pulled in by another package, not declared directly in a manifest. Rollup…
deploy/tools/essential-dapps-chains-config-generator/yarn.lock ScaOsvGhsa mw96 cpmx 2vgc
high System graph dependencies dependencies conf 0.90 Vulnerable dependency rollup 4.53.2: GHSA-mw96-cpmx-2vgc
OSV.dev reports `rollup` at version `4.53.2` (resolved in `deploy/tools/envs-validator/yarn.lock`) is affected by GHSA-mw96-cpmx-2vgc (aka CVE-2026-27606). Note: `rollup` is a transitive dependency — pulled in by another package, not declared directly in a manifest. Rollup 4 has Arbitrary File Wri…
deploy/tools/envs-validator/yarn.lock ScaOsvGhsa mw96 cpmx 2vgc
high System graph dependencies dependencies conf 0.90 Vulnerable dependency source-map-js 1.2.1: GHSA-68fv-2mgg-jv7q
OSV.dev reports `source-map-js` at version `1.2.1` (resolved in `deploy/tools/envs-validator/yarn.lock`) is affected by GHSA-68fv-2mgg-jv7q (aka CVE-2026-93749). Note: `source-map-js` is a transitive dependency — pulled in by another package, not declared directly in a manifest. source-map-js allo…
deploy/tools/envs-validator/yarn.lock ScaOsvGhsa 68fv 2mgg jv7q
high System graph dependencies dependencies conf 0.70 Vulnerable dependency ws 8.17.1: GHSA-96hv-2xvq-fx4p
OSV.dev reports `ws` at version `8.17.1` (declared in `package.json`) is affected by GHSA-96hv-2xvq-fx4p (aka CVE-2026-48779). Note: `8.17.1` is the declared floor of a range — the installed version may be newer. ws: Memory exhaustion DoS from tiny fragments and data chunks Aliases: CVE-2026-4877…
package.json ScaOsvGhsa 96hv 2xvq fx4p
high System graph dependencies dependencies conf 0.90 Vulnerable dependency ws 8.18.3: GHSA-96hv-2xvq-fx4p
OSV.dev reports `ws` at version `8.18.3` (resolved in `deploy/tools/essential-dapps-chains-config-generator/yarn.lock`) is affected by GHSA-96hv-2xvq-fx4p (aka CVE-2026-48779). ws: Memory exhaustion DoS from tiny fragments and data chunks Aliases: CVE-2026-48779 Advisory: https://osv.dev/vulnerab…
deploy/tools/essential-dapps-chains-config-generator/yarn.lock ScaOsvGhsa 96hv 2xvq fx4p
medium System graph frontend Frontend quality conf 0.80 `dangerouslySetInnerHTML` used in a React component — ui/address/details/AddressAlerts.tsx:46
Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html
ui/address/details/AddressAlerts.tsx:46 Fq dangerous html
medium System graph frontend Frontend quality conf 0.80 `dangerouslySetInnerHTML` used in a React component — ui/address/details/AddressQrCode.tsx:93
Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html
ui/address/details/AddressQrCode.tsx:93 Fq dangerous html
medium System graph frontend Frontend quality conf 0.80 `dangerouslySetInnerHTML` used in a React component — ui/searchResults/SearchResultEntityTag.tsx:25
Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html
ui/searchResults/SearchResultEntityTag.tsx:25 Fq dangerous html
medium System graph frontend Frontend quality conf 0.80 `dangerouslySetInnerHTML` used in a React component — ui/searchResults/SearchResultListItem.tsx:79
Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html
ui/searchResults/SearchResultListItem.tsx:79 Fq dangerous html
medium System graph frontend Frontend quality conf 0.80 `dangerouslySetInnerHTML` used in a React component — ui/searchResults/SearchResultTableItem.tsx:85
Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html
ui/searchResults/SearchResultTableItem.tsx:85 Fq dangerous html
medium System graph frontend Frontend quality conf 0.80 `dangerouslySetInnerHTML` used in a React component — ui/shared/entities/address/AddressIdenticon.tsx:56
Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html
ui/shared/entities/address/AddressIdenticon.tsx:56 Fq dangerous html
medium System graph frontend Frontend quality conf 0.80 `dangerouslySetInnerHTML` used in a React component — ui/snippets/header/alerts/MaintenanceAlert.tsx:15
Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html
ui/snippets/header/alerts/MaintenanceAlert.tsx:15 Fq dangerous html
medium System graph frontend Frontend quality conf 0.80 `dangerouslySetInnerHTML` used in a React component — ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestAddress.tsx:67
Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html
ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestAddress.tsx:67 Fq dangerous html
medium System graph frontend Frontend quality conf 0.80 `dangerouslySetInnerHTML` used in a React component — ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestApp.tsx:46
Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html
ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestApp.tsx:46 Fq dangerous html
medium System graph frontend Frontend quality conf 0.80 `dangerouslySetInnerHTML` used in a React component — ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestBlock.tsx:46
Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html
ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestBlock.tsx:46 Fq dangerous html
medium System graph frontend Frontend quality conf 0.80 `dangerouslySetInnerHTML` used in a React component — ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestCluster.tsx:34
Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html
ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestCluster.tsx:34 Fq dangerous html
medium System graph frontend Frontend quality conf 0.80 `dangerouslySetInnerHTML` used in a React component — ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestDomain.tsx:31
Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html
ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestDomain.tsx:31 Fq dangerous html
medium System graph frontend Frontend quality conf 0.80 `dangerouslySetInnerHTML` used in a React component — ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestToken.tsx:42
Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html
ui/snippets/searchBar/SearchBarSuggest/SearchBarSuggestToken.tsx:42 Fq dangerous html
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .cursor/commands/deploy-demo.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.cursor/commands/deploy-demo.md VerificationCursor rule
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .cursor/commands/get-checks-status.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.cursor/commands/get-checks-status.md VerificationCursor rule
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .cursor/commands/prepare-release.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.cursor/commands/prepare-release.md VerificationCursor rule
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .cursor/mcp.json
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.cursor/mcp.json VerificationMcp config
medium System graph quality Agent instructions conf 1.00 Agent instructions exist but release-hardening basics are missing
AI-coder instruction files were found, but the repo is missing ci. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable.
Repo hardeningGenerated repo pattern
medium System graph quality Placeholder conf 1.00 Critical user flow still appears backed by mock or placeholder data
A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded.
Mock dataCritical flowGenerated repo pattern
medium System graph security Trivy conf 1.00 CVE-2025-13465: lodash 4.17.21 — yarn.lock
lodash: prototype pollution in _.unset and _.omit functions Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion o…
VulnCve 2025 13465
medium System graph security Trivy conf 1.00 CVE-2025-15599: dompurify 3.2.6 — yarn.lock
DOMPurify: DOMPurify: Cross-site scripting DOMPurify 3.1.3 through 3.2.6 and 2.5.3 through 2.5.8 contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting missing textarea rawtext element validation in the SAFE_FOR_XML regex. Attackers can in…
VulnCve 2025 15599
medium System graph security Trivy conf 1.00 CVE-2025-62718: axios 1.12.0 — yarn.lock
axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname normalization when checking NO_PROXY rules. Requests to loopback …
VulnCve 2025 62718
medium System graph security Trivy conf 1.00 CVE-2025-62718: axios 1.13.2 — yarn.lock
axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname normalization when checking NO_PROXY rules. Requests to loopback …
VulnCve 2025 62718
medium System graph security Trivy conf 1.00 CVE-2025-69873: ajv 6.12.6 — deploy/tools/favicon-generator/yarn.lock
ajv: ReDoS via $data reference ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaS…
VulnCve 2025 69873
medium System graph security Trivy conf 1.00 CVE-2025-69873: ajv 6.12.6 — deploy/tools/feature-reporter/yarn.lock
ajv: ReDoS via $data reference ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaS…
VulnCve 2025 69873
medium System graph security Trivy conf 1.00 CVE-2026-0540: dompurify 3.2.6 — yarn.lock
DOMPurify: DOMPurify: Cross-site scripting vulnerability DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, fixed in commit 2726c74, contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting five missing rawtext elements (noscript, xmp, n…
VulnCve 2026 0540
medium System graph security Trivy conf 1.00 CVE-2026-101900: axios 1.12.0 — yarn.lock
axios: Axios: Outbound HTTP header injection via prototype pollution in fetch adapter Axios is a promise-based HTTP client for the browser and Node.js. From 1.12.0 until 1.20.0, ResolveConfig reads inherited Symbol.toStringTag, append, and getHeaders properties while resolving FormData headers. A …
VulnCve 2026 101900
medium System graph security Trivy conf 1.00 CVE-2026-101900: axios 1.13.2 — yarn.lock
axios: Axios: Outbound HTTP header injection via prototype pollution in fetch adapter Axios is a promise-based HTTP client for the browser and Node.js. From 1.12.0 until 1.20.0, ResolveConfig reads inherited Symbol.toStringTag, append, and getHeaders properties while resolving FormData headers. A …
VulnCve 2026 101900
medium System graph security Trivy conf 1.00 CVE-2026-101902: axios 1.12.0 — yarn.lock
axios: axios: Unintended HTTP method override via prototype pollution gadget Axios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype.…
VulnCve 2026 101902
medium System graph security Trivy conf 1.00 CVE-2026-101902: axios 1.13.2 — yarn.lock
axios: axios: Unintended HTTP method override via prototype pollution gadget Axios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype.…
VulnCve 2026 101902
medium System graph security Trivy conf 1.00 CVE-2026-101904: axios 1.12.0 — yarn.lock
axios: Axios: HTTP header injection via inherited prototype properties Axios is a promise-based HTTP client for the browser and Node.js. From 1.0.0 until 1.20.0, the dispatchRequest function normalizes inherited Object.prototype.headers from a replacement request configuration. A separate same-pro…
VulnCve 2026 101904
medium System graph security Trivy conf 1.00 CVE-2026-101904: axios 1.13.2 — yarn.lock
axios: Axios: HTTP header injection via inherited prototype properties Axios is a promise-based HTTP client for the browser and Node.js. From 1.0.0 until 1.20.0, the dispatchRequest function normalizes inherited Object.prototype.headers from a replacement request configuration. A separate same-pro…
VulnCve 2026 101904
medium System graph security Trivy conf 1.00 CVE-2026-101908: axios 1.12.0 — yarn.lock
axios: Axios: Outbound HTTP request manipulation via fetch adapter prototype pollution Axios is a promise-based HTTP client for the browser and Node.js. From 1.7.0 until 1.20.0, the fetch adapter constructs a Request with sanitized resolvedOptions but then calls fetch with the original fetchOption…
VulnCve 2026 101908
medium System graph security Trivy conf 1.00 CVE-2026-101908: axios 1.13.2 — yarn.lock
axios: Axios: Outbound HTTP request manipulation via fetch adapter prototype pollution Axios is a promise-based HTTP client for the browser and Node.js. From 1.7.0 until 1.20.0, the fetch adapter constructs a Request with sanitized resolvedOptions but then calls fetch with the original fetchOption…
VulnCve 2026 101908
medium System graph security Trivy conf 1.00 CVE-2026-102277: brace-expansion 1.1.12 — deploy/tools/affected-tests/yarn.lock
brace-expansion: brace-expansion: Denial of Service via crafted brace patterns The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing c…
VulnCve 2026 102277
medium System graph security Trivy conf 1.00 CVE-2026-102277: brace-expansion 2.0.1 — yarn.lock
brace-expansion: brace-expansion: Denial of Service via crafted brace patterns The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing c…
VulnCve 2026 102277
medium System graph security Trivy conf 1.00 CVE-2026-104182: stream-json 1.9.1 — yarn.lock
stream-json: stream-json: Denial of Service via inefficient comment scanning stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, the JSONC parser at stream-json/jsonc/parser.js and verifier at stream-json/jsonc/verifier…
VulnCve 2026 104182
medium System graph security Trivy conf 1.00 CVE-2026-104183: stream-json 1.9.1 — yarn.lock
stream-json: stream-json: Object prototype manipulation via crafted JSON input stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, Assembler materializes object properties with plain assignment, so an input key named __…
VulnCve 2026 104183
medium System graph security Trivy conf 1.00 CVE-2026-104872: @opentelemetry/instrumentation-cassandra-driver 0.36.0 — yarn.lock
@opentelemetry/instrumentation-cassandra-driver: @opentelemetry/instrumentation-knex: @opentelemetry/instrumentation-mongoose: @opentelemetry/instrumentation-mysql: @opentelemetry/instrumentation-mysql2: @opentelemetry/instrumentation-oracledb: @opentelemetry/instrumentation-pg: @opentelemetry/inst…
VulnCve 2026 104872
medium System graph security Trivy conf 1.00 CVE-2026-104872: @opentelemetry/instrumentation-knex 0.34.0 — yarn.lock
@opentelemetry/instrumentation-cassandra-driver: @opentelemetry/instrumentation-knex: @opentelemetry/instrumentation-mongoose: @opentelemetry/instrumentation-mysql: @opentelemetry/instrumentation-mysql2: @opentelemetry/instrumentation-oracledb: @opentelemetry/instrumentation-pg: @opentelemetry/inst…
VulnCve 2026 104872
medium System graph security Trivy conf 1.00 CVE-2026-104872: @opentelemetry/instrumentation-mongoose 0.36.0 — yarn.lock
@opentelemetry/instrumentation-cassandra-driver: @opentelemetry/instrumentation-knex: @opentelemetry/instrumentation-mongoose: @opentelemetry/instrumentation-mysql: @opentelemetry/instrumentation-mysql2: @opentelemetry/instrumentation-oracledb: @opentelemetry/instrumentation-pg: @opentelemetry/inst…
VulnCve 2026 104872
medium System graph security Trivy conf 1.00 CVE-2026-104872: @opentelemetry/instrumentation-mysql 0.36.0 — yarn.lock
@opentelemetry/instrumentation-cassandra-driver: @opentelemetry/instrumentation-knex: @opentelemetry/instrumentation-mongoose: @opentelemetry/instrumentation-mysql: @opentelemetry/instrumentation-mysql2: @opentelemetry/instrumentation-oracledb: @opentelemetry/instrumentation-pg: @opentelemetry/inst…
VulnCve 2026 104872
medium System graph security Trivy conf 1.00 CVE-2026-104872: @opentelemetry/instrumentation-mysql2 0.36.0 — yarn.lock
@opentelemetry/instrumentation-cassandra-driver: @opentelemetry/instrumentation-knex: @opentelemetry/instrumentation-mongoose: @opentelemetry/instrumentation-mysql: @opentelemetry/instrumentation-mysql2: @opentelemetry/instrumentation-oracledb: @opentelemetry/instrumentation-pg: @opentelemetry/inst…
VulnCve 2026 104872
medium System graph security Trivy conf 1.00 CVE-2026-104872: @opentelemetry/instrumentation-pg 0.39.1 — yarn.lock
@opentelemetry/instrumentation-cassandra-driver: @opentelemetry/instrumentation-knex: @opentelemetry/instrumentation-mongoose: @opentelemetry/instrumentation-mysql: @opentelemetry/instrumentation-mysql2: @opentelemetry/instrumentation-oracledb: @opentelemetry/instrumentation-pg: @opentelemetry/inst…
VulnCve 2026 104872
medium System graph security Trivy conf 1.00 CVE-2026-104872: @opentelemetry/instrumentation-tedious 0.8.0 — yarn.lock
@opentelemetry/instrumentation-cassandra-driver: @opentelemetry/instrumentation-knex: @opentelemetry/instrumentation-mongoose: @opentelemetry/instrumentation-mysql: @opentelemetry/instrumentation-mysql2: @opentelemetry/instrumentation-oracledb: @opentelemetry/instrumentation-pg: @opentelemetry/inst…
VulnCve 2026 104872
medium System graph security Trivy conf 1.00 CVE-2026-15157: undici 6.21.3 — yarn.lock
undici: undici: HTTP header injection via unvalidated blob-like body type property undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and f…
VulnCve 2026 15157
medium System graph security Trivy conf 1.00 CVE-2026-1525: undici 6.21.3 — yarn.lock
undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-length). This produces malformed HTTP/1.1 requests w…
VulnCve 2026 1525
medium System graph security Trivy conf 1.00 CVE-2026-1527: undici 6.21.3 — yarn.lock
undici: Undici: HTTP header injection and request smuggling vulnerability ImpactWhen an application passes user-controlled input to the upgrade option of client.request(), an attacker can inject CRLF sequences (\r\n) to: * Inject arbitrary HTTP headers * Terminate the HTTP request premature…
VulnCve 2026 1527
medium System graph security Trivy conf 1.00 CVE-2026-16728: undici 6.21.3 — yarn.lock
undici: undici: Response desynchronization via retry interceptor with mismatched Content-Length undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response. In undici before 6.…
VulnCve 2026 16728
medium System graph security Trivy conf 1.00 CVE-2026-16729: undici 6.21.3 — yarn.lock
undici: Undici: Cookie attribute injection allows bypassing security protections undici's setCookie function does not fully sanitize cookie attributes. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a domain value is not checked for semicolons and entri…
VulnCve 2026 16729
medium System graph security Trivy conf 1.00 CVE-2026-22036: undici 6.21.3 — yarn.lock
undici: Undici: Denial of Service via excessive decompression steps Undici is an HTTP/1.1 client for Node.js. Prior to 7.18.0 and 6.23.0, the number of links in the decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert thousands compression steps leadin…
VulnCve 2026 22036
medium System graph security Trivy conf 1.00 CVE-2026-2327: markdown-it 14.1.0 — yarn.lock
markdown-it: markdown-it: Denial of Service via Regular Expression Denial of Service in linkify function Versions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of the regex /\*+$/ in the linkify function. An a…
VulnCve 2026 2327
medium System graph security Trivy conf 1.00 CVE-2026-24398: hono 4.11.4 — yarn.lock
Hono IPv4 address validation bypass in IP Restriction Middleware allows IP spoofing Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, IP Restriction Middleware in Hono is vulnerable to an IP address validation bypass. The `IPV4_REGEX` pa…
VulnCve 2026 24398
medium System graph security Trivy conf 1.00 CVE-2026-24472: hono 4.11.4 — yarn.lock
Hono cache middleware ignores "Cache-Control: private" leading to Web Cache Deception Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, Cache Middleware contains an information disclosure vulnerability caused by improper handling of HTTP…
VulnCve 2026 24472
medium System graph security Trivy conf 1.00 CVE-2026-24473: hono 4.11.4 — yarn.lock
Hono has an Arbitrary Key Read in Serve static Middleware (Cloudflare Workers Adapter) Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, Serve static Middleware for the Cloudflare Workers adapter contains an information disclosure vulner…
VulnCve 2026 24473
medium System graph security Trivy conf 1.00 CVE-2026-24771: hono 4.11.4 — yarn.lock
Hono vulnerable to XSS through ErrorBoundary component Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, a Cross-Site Scripting (XSS) vulnerability exists in the `ErrorBoundary` component of the hono/jsx library. Under certain usage pat…
VulnCve 2026 24771
medium System graph security Trivy conf 1.00 CVE-2026-2739: bn.js 5.2.1 — yarn.lock
bn.js: bn.js: Denial of Service via calling maskn(0) This affects versions of the package bn.js before 5.2.3. Calling maskn(0) on any BN instance corrupts the internal state, causing toString(), divmod(), and other methods to enter an infinite loop, hanging the process indefinitely. Package: bn.j…
VulnCve 2026 2739
medium System graph security Trivy conf 1.00 CVE-2026-2739: bn.js 5.2.2 — yarn.lock
bn.js: bn.js: Denial of Service via calling maskn(0) This affects versions of the package bn.js before 5.2.3. Calling maskn(0) on any BN instance corrupts the internal state, causing toString(), divmod(), and other methods to enter an infinite loop, hanging the process indefinitely. Package: bn.j…
VulnCve 2026 2739
medium System graph security Trivy conf 1.00 CVE-2026-27980: next 15.5.10 — yarn.lock
next.js: Next.js: Unbounded next/image disk cache growth can exhaust storage Next.js is a React framework for building full-stack web applications. Starting in version 10.0.0 and prior to version 16.1.7, the default Next.js image optimization disk cache (`/_next/image`) did not have a configurable…
VulnCve 2026 27980
medium System graph security Trivy conf 1.00 CVE-2026-29057: next 15.5.10 — yarn.lock
next.js: Next.js: HTTP request smuggling in rewrites Next.js is a React framework for building full-stack web applications. Starting in version 9.5.0 and prior to versions 15.5.13 and 16.1.7, when Next.js rewrites proxy traffic to an external backend, a crafted `DELETE`/`OPTIONS` request using `Tr…
VulnCve 2026 29057
medium System graph security Trivy conf 1.00 CVE-2026-29085: hono 4.11.4 — yarn.lock
Hono Vulnerable to SSE Control Field Injection via CR/LF in writeSSE() Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, when using streamSSE() in Streaming Helper, the event, id, and retry fields were not validated for carriage return (…
VulnCve 2026 29085
medium System graph security Trivy conf 1.00 CVE-2026-29086: hono 4.11.4 — yarn.lock
Hono Vulnerable to Cookie Attribute Injection via Unsanitized domain and path in setCookie() Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, the setCookie() utility did not validate semicolons (;), carriage returns (\r), or newline cha…
VulnCve 2026 29086
medium System graph security Trivy conf 1.00 CVE-2026-2950: lodash 4.17.21 — yarn.lock
lodash: Lodash: Prototype pollution allows deletion of built-in prototype properties via array path bypass Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for (CVE-2025-13465: https://github.com/lodash/lodash/security/…
VulnCve 2026 2950
medium System graph security Trivy conf 1.00 CVE-2026-31808: file-type 20.5.0 — yarn.lock
file-type: file-type: Denial of Service due to infinite loop in ASF file parsing file-type detects the file type of a file, stream, or data. Prior to 21.3.1, a denial of service vulnerability exists in the ASF (WMV/WMA) file type detection parser. When parsing a crafted input where an ASF sub-head…
VulnCve 2026 31808
medium System graph security Trivy conf 1.00 CVE-2026-32630: file-type 20.5.0 — yarn.lock
file-type: file-type: Denial of Service via excessive memory growth from crafted ZIP files file-type detects the file type of a file, stream, or data. From 20.0.0 to 21.3.1, a crafted ZIP file can trigger excessive memory growth during type detection in file-type when using fileTypeFromBuffer(), f…
VulnCve 2026 32630
medium System graph security Trivy conf 1.00 CVE-2026-33532: yaml 1.10.2 — yarn.lock
yaml: yaml: Denial of Service via deeply nested YAML document parsing `yaml` is a YAML parser and serialiser for JavaScript. Parsing a YAML document with a version of `yaml` on the 1.x branch prior to 1.10.3 or on the 2.x branch prior to 2.8.3 may throw a RangeError due to a stack overflow. The no…
VulnCve 2026 33532
medium System graph security Trivy conf 1.00 CVE-2026-33672: picomatch 2.3.1 — deploy/tools/affected-tests/yarn.lock
picomatch: Picomatch: Data integrity compromised via method injection with crafted POSIX bracket expressions Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to a method injection vulnerability affecting the `POSIX_REGEX_SOURCE` object. Becau…
VulnCve 2026 33672
medium System graph security Trivy conf 1.00 CVE-2026-33672: picomatch 2.3.1 — deploy/tools/favicon-generator/yarn.lock
picomatch: Picomatch: Data integrity compromised via method injection with crafted POSIX bracket expressions Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to a method injection vulnerability affecting the `POSIX_REGEX_SOURCE` object. Becau…
VulnCve 2026 33672
medium System graph security Trivy conf 1.00 CVE-2026-33672: picomatch 2.3.1 — deploy/tools/feature-reporter/yarn.lock
picomatch: Picomatch: Data integrity compromised via method injection with crafted POSIX bracket expressions Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to a method injection vulnerability affecting the `POSIX_REGEX_SOURCE` object. Becau…
VulnCve 2026 33672
medium System graph security Trivy conf 1.00 CVE-2026-33672: picomatch 2.3.1 — deploy/tools/sitemap-generator/yarn.lock
picomatch: Picomatch: Data integrity compromised via method injection with crafted POSIX bracket expressions Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to a method injection vulnerability affecting the `POSIX_REGEX_SOURCE` object. Becau…
VulnCve 2026 33672
medium System graph security Trivy conf 1.00 CVE-2026-33672: picomatch 2.3.1 — yarn.lock
picomatch: Picomatch: Data integrity compromised via method injection with crafted POSIX bracket expressions Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to a method injection vulnerability affecting the `POSIX_REGEX_SOURCE` object. Becau…
VulnCve 2026 33672
medium System graph security Trivy conf 1.00 CVE-2026-33750: brace-expansion 1.1.12 — deploy/tools/affected-tests/yarn.lock
brace-expansion: brace-expansion: Denial of Service via zero step value in brace pattern The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) caus…
VulnCve 2026 33750
medium System graph security Trivy conf 1.00 CVE-2026-33750: brace-expansion 2.0.1 — yarn.lock
brace-expansion: brace-expansion: Denial of Service via zero step value in brace pattern The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) caus…
VulnCve 2026 33750
medium System graph security Trivy conf 1.00 CVE-2026-34043: serialize-javascript 6.0.2 — deploy/tools/favicon-generator/yarn.lock
serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object serialization Serialize JavaScript to a superset of JSON that includes regular expressions and functions. Prior to version 7.0.5, there is a Denial of Service (DoS) vulnerability caused by CPU exh…
VulnCve 2026 34043
medium System graph security Trivy conf 1.00 CVE-2026-34043: serialize-javascript 6.0.2 — deploy/tools/feature-reporter/yarn.lock
serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object serialization Serialize JavaScript to a superset of JSON that includes regular expressions and functions. Prior to version 7.0.5, there is a Denial of Service (DoS) vulnerability caused by CPU exh…
VulnCve 2026 34043
medium System graph security Trivy conf 1.00 CVE-2026-39407: hono 4.11.4 — yarn.lock
Hono: Middleware bypass via repeated slashes in serveStatic Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, a path handling inconsistency in serveStatic allows protected static files to be accessed by using repeated slashes (//) in the reques…
VulnCve 2026 39407
medium System graph security Trivy conf 1.00 CVE-2026-39408: hono 4.11.4 — yarn.lock
Hono: Path traversal in toSSG() allows writing files outside the output directory Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, a path traversal issue in toSSG() allows files to be written outside the configured output directory during stat…
VulnCve 2026 39408
medium System graph security Trivy conf 1.00 CVE-2026-39409: hono 4.11.4 — yarn.lock
Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, ipRestriction() does not canonicalize IPv4-mapped IPv6 client addresses (e.g. ::ffff:127.0.0.1) before applying I…
VulnCve 2026 39409
medium System graph security Trivy conf 1.00 CVE-2026-39410: hono 4.11.4 — yarn.lock
Hono: Non-breaking space prefix bypass in cookie name handling in getCookie() Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, a discrepancy between browser cookie parsing and parse() handling allows cookie prefix protections to be bypassed. C…
VulnCve 2026 39410
medium System graph security Trivy conf 1.00 CVE-2026-40175: axios 1.12.0 — yarn.lock
axios: Axios: Remote Code Execution via Prototype Pollution escalation Axios is a promise based HTTP client for the browser and Node.js. Versions prior to 1.15.0 and 0.3.1 are vulnerable to a specific gadget-style attack chain in which prototype pollution in a third-party dependency may be leverag…
VulnCve 2026 40175
medium System graph security Trivy conf 1.00 CVE-2026-40175: axios 1.13.2 — yarn.lock
axios: Axios: Remote Code Execution via Prototype Pollution escalation Axios is a promise based HTTP client for the browser and Node.js. Versions prior to 1.15.0 and 0.3.1 are vulnerable to a specific gadget-style attack chain in which prototype pollution in a third-party dependency may be leverag…
VulnCve 2026 40175
medium System graph security Trivy conf 1.00 CVE-2026-41238: dompurify 3.2.6 — yarn.lock
DOMPurify: DOMPurify: Cross-Site Scripting bypass via prototype pollution DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions 3.0.1 through 3.3.3 are vulnerable to a prototype pollution-based XSS bypass. When an application uses `DOMPurify.sanitize()` with th…
VulnCve 2026 41238
medium System graph security Trivy conf 1.00 CVE-2026-41239: dompurify 3.2.6 — yarn.lock
DOMPurify: Vue 2: DOMPurify: Cross-site scripting due to incomplete sanitization of template expressions DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Starting in version 1.0.10 and prior to version 3.4.0, `SAFE_FOR_TEMPLATES` strips `{{...}}` expressions from u…
VulnCve 2026 41239
medium System graph security Trivy conf 1.00 CVE-2026-41240: dompurify 3.2.6 — yarn.lock
DOMPurify: DOMPurify: Cross-Site Scripting (XSS) via inconsistent tag sanitization DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions prior to 3.4.0 have an inconsistency between FORBID_TAGS and FORBID_ATTR handling when function-based ADD_TAGS is used. Comm…
VulnCve 2026 41240
medium System graph security Trivy conf 1.00 CVE-2026-41305: postcss 8.4.31 — yarn.lock
postcss: PostCSS: Cross-Site Scripting (XSS) via improper escaping of style closing tags PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape `</style>` sequences when stringifyin…
VulnCve 2026 41305
medium System graph security Trivy conf 1.00 CVE-2026-41305: postcss 8.4.33 — deploy/tools/affected-tests/yarn.lock
postcss: PostCSS: Cross-Site Scripting (XSS) via improper escaping of style closing tags PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape `</style>` sequences when stringifyin…
VulnCve 2026 41305
medium System graph security Trivy conf 1.00 CVE-2026-41305: postcss 8.5.6 — yarn.lock
postcss: PostCSS: Cross-Site Scripting (XSS) via improper escaping of style closing tags PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape `</style>` sequences when stringifyin…
VulnCve 2026 41305
medium System graph security Trivy conf 1.00 CVE-2026-41907: uuid 8.3.2 — yarn.lock
uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silen…
VulnCve 2026 41907
medium System graph security Trivy conf 1.00 CVE-2026-41907: uuid 9.0.1 — yarn.lock
uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silen…
VulnCve 2026 41907
medium System graph security Trivy conf 1.00 CVE-2026-42034: axios 1.12.0 — yarn.lock
axios: Axios: Denial of Service via oversized streamed uploads bypassing body limits Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, for stream request bodies, maxBodyLength is bypassed when maxRedirects is set to 0 (native http/https transport path). …
VulnCve 2026 42034
medium System graph security Trivy conf 1.00 CVE-2026-42034: axios 1.13.2 — yarn.lock
axios: Axios: Denial of Service via oversized streamed uploads bypassing body limits Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, for stream request bodies, maxBodyLength is bypassed when maxRedirects is set to 0 (native http/https transport path). …
VulnCve 2026 42034
medium System graph security Trivy conf 1.00 CVE-2026-42036: axios 1.12.0 — yarn.lock
axios: Axios: Denial of Service via unbounded stream consumption when 'responseType: 'stream'' is used Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when responseType: 'stream' is used, Axios returns the response stream without enforcing maxContentLe…
VulnCve 2026 42036
medium System graph security Trivy conf 1.00 CVE-2026-42036: axios 1.13.2 — yarn.lock
axios: Axios: Denial of Service via unbounded stream consumption when 'responseType: 'stream'' is used Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when responseType: 'stream' is used, Axios returns the response stream without enforcing maxContentLe…
VulnCve 2026 42036
medium System graph security Trivy conf 1.00 CVE-2026-42037: axios 1.12.0 — yarn.lock
axios: Node.js: Axios: Information disclosure via CRLF injection in multipart Content-Type header Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.1, the FormDataPart constructor in lib/helpers/formDataToStream.js interpolates value.type directly into the…
VulnCve 2026 42037
medium System graph security Trivy conf 1.00 CVE-2026-42037: axios 1.13.2 — yarn.lock
axios: Node.js: Axios: Information disclosure via CRLF injection in multipart Content-Type header Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.1, the FormDataPart constructor in lib/helpers/formDataToStream.js interpolates value.type directly into the…
VulnCve 2026 42037
medium System graph security Trivy conf 1.00 CVE-2026-42038: axios 1.12.0 — yarn.lock
axios: Axios: Information disclosure due to `no_proxy` bypass Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, he fix for no_proxy hostname normalization bypass is incomplete. When no_proxy=localhost is set, requests to 127.0.0.1 and [::1] still route t…
VulnCve 2026 42038
medium System graph security Trivy conf 1.00 CVE-2026-42038: axios 1.13.2 — yarn.lock
axios: Axios: Information disclosure due to `no_proxy` bypass Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, he fix for no_proxy hostname normalization bypass is incomplete. When no_proxy=localhost is set, requests to 127.0.0.1 and [::1] still route t…
VulnCve 2026 42038
medium System graph security Trivy conf 1.00 CVE-2026-42039: axios 1.12.0 — yarn.lock
axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects with no depth limit, so a deeply nested value pas…
VulnCve 2026 42039
medium System graph security Trivy conf 1.00 CVE-2026-42039: axios 1.13.2 — yarn.lock
axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects with no depth limit, so a deeply nested value pas…
VulnCve 2026 42039
medium System graph security Trivy conf 1.00 CVE-2026-42041: axios 1.12.0 — yarn.lock
axios: Axios: Authentication bypass due to prototype pollution of HTTP error handling Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution to…
VulnCve 2026 42041
medium System graph security Trivy conf 1.00 CVE-2026-42041: axios 1.13.2 — yarn.lock
axios: Axios: Authentication bypass due to prototype pollution of HTTP error handling Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution to…
VulnCve 2026 42041
medium System graph security Trivy conf 1.00 CVE-2026-42042: axios 1.12.0 — yarn.lock
axios: Axios: XSRF token bypass leading to information disclosure Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library's XSRF token protection logic uses JavaScript truthy/falsy semantics instead of strict boolean comparison for the withXS…
VulnCve 2026 42042
medium System graph security Trivy conf 1.00 CVE-2026-42042: axios 1.13.2 — yarn.lock
axios: Axios: XSRF token bypass leading to information disclosure Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library's XSRF token protection logic uses JavaScript truthy/falsy semantics instead of strict boolean comparison for the withXS…
VulnCve 2026 42042
medium System graph security Trivy conf 1.00 CVE-2026-42044: axios 1.12.0 — yarn.lock
axios: Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.2, he Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution in the ap…
VulnCve 2026 42044
medium System graph security Trivy conf 1.00 CVE-2026-42044: axios 1.13.2 — yarn.lock
axios: Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.2, he Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution in the ap…
VulnCve 2026 42044
medium System graph security Trivy conf 1.00 CVE-2026-44288: @protobufjs/utf8 1.1.0 — yarn.lock
protobufjs: protobufjs: Security control bypass due to improper handling of overlong UTF-8 sequences protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs includes a minimal UTF-8 decoder that accepted overlong UTF-8 byte sequences and decode…
VulnCve 2026 44288
medium System graph security Trivy conf 1.00 CVE-2026-44288: protobufjs 7.2.5 — yarn.lock
protobufjs: protobufjs: Security control bypass due to improper handling of overlong UTF-8 sequences protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs includes a minimal UTF-8 decoder that accepted overlong UTF-8 byte sequences and decode…
VulnCve 2026 44288
medium System graph security Trivy conf 1.00 CVE-2026-44288: protobufjs 7.3.2 — yarn.lock
protobufjs: protobufjs: Security control bypass due to improper handling of overlong UTF-8 sequences protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs includes a minimal UTF-8 decoder that accepted overlong UTF-8 byte sequences and decode…
VulnCve 2026 44288
medium System graph security Trivy conf 1.00 CVE-2026-44292: protobufjs 7.2.5 — yarn.lock
protobufjs: protobufjs: Data integrity impact due to prototype pollution protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated message constructors copied enumerable properties from a provided properties object without filtering the…
VulnCve 2026 44292
medium System graph security Trivy conf 1.00 CVE-2026-44292: protobufjs 7.3.2 — yarn.lock
protobufjs: protobufjs: Data integrity impact due to prototype pollution protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated message constructors copied enumerable properties from a provided properties object without filtering the…
VulnCve 2026 44292
medium System graph security Trivy conf 1.00 CVE-2026-44294: protobufjs 7.2.5 — yarn.lock
protobufjs: protobufjs: Denial of Service due to unescaped control characters in field names protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript property accessors from schema-controlled field and oneof names. Certain c…
VulnCve 2026 44294
medium System graph security Trivy conf 1.00 CVE-2026-44294: protobufjs 7.3.2 — yarn.lock
protobufjs: protobufjs: Denial of Service due to unescaped control characters in field names protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript property accessors from schema-controlled field and oneof names. Certain c…
VulnCve 2026 44294
medium System graph security Trivy conf 1.00 CVE-2026-44455: hono 4.11.4 — yarn.lock
hono/jsx has Unvalidated JSX Tag Names that May Allow HTML Injection Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.16, Improper handling of JSX element tag names in hono/jsx allowed unvalidated tag names to be directly inserted into the generat…
VulnCve 2026 44455
medium System graph security Trivy conf 1.00 CVE-2026-44456: hono 4.11.4 — yarn.lock
Hono: bodyLimit() can be bypassed for chunked / unknown-length requests Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.16, bodyLimit() does not reliably enforce maxSize for requests without a usable Content-Length (e.g. Transfer-Encoding: chunke…
VulnCve 2026 44456
medium System graph security Trivy conf 1.00 CVE-2026-44457: hono 4.11.4 — yarn.lock
Hono's Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, Cache Middleware does not skip caching for responses that declare per-user variance via Var…
VulnCve 2026 44457
medium System graph security Trivy conf 1.00 CVE-2026-44458: hono 4.11.4 — yarn.lock
Hono has CSS Declaration Injection via Style Object Values in JSX SSR Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, the JSX renderer escapes style attribute object values for HTML but not for CSS. Untrusted input in a style object value or …
VulnCve 2026 44458
medium System graph security Trivy conf 1.00 CVE-2026-44490: axios 1.12.0 — yarn.lock
axios: Axios: Information disclosure and denial of service due to prototype pollution Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, axios exposes two read-side prototype-pollution gadgets. When Object.prototype is polluted by an upstream dependency i…
VulnCve 2026 44490
medium System graph security Trivy conf 1.00 CVE-2026-44490: axios 1.13.2 — yarn.lock
axios: Axios: Information disclosure and denial of service due to prototype pollution Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, axios exposes two read-side prototype-pollution gadgets. When Object.prototype is polluted by an upstream dependency i…
VulnCve 2026 44490
medium System graph security Trivy conf 1.00 CVE-2026-44576: next 15.5.10 — yarn.lock
Next.js: Next.js: Cache poisoning vulnerability in React Server Components Next.js is a React framework for building full-stack web applications. From 14.2.0 to before 15.5.16 and 16.2.5, applications using React Server Components can be vulnerable to cache poisoning when shared caches do not corr…
VulnCve 2026 44576
medium System graph security Trivy conf 1.00 CVE-2026-44577: next 15.5.10 — yarn.lock
Next.js: Next.js: Denial of Service via Image Optimization API Next.js is a React framework for building full-stack web applications. From 10.0.0 to before 15.5.16 and 16.2.5, when self-hosting Next.js with the default image loader, the Image Optimization API fetches local images entirely into mem…
VulnCve 2026 44577
medium System graph security Trivy conf 1.00 CVE-2026-44580: next 15.5.10 — yarn.lock
next.js: Next.js: Cross-site scripting allows arbitrary code execution via untrusted script content Next.js is a React framework for building full-stack web applications. From 13.0.0 to before 15.5.16 and 16.2.5, applications that use beforeInteractive scripts together with untrusted content can b…
VulnCve 2026 44580
medium System graph security Trivy conf 1.00 CVE-2026-44581: next 15.5.10 — yarn.lock
next.js: Next.js: Stored Cross-Site Scripting via malformed nonce values in cached responses Next.js is a React framework for building full-stack web applications. From 13.4.0 to before 15.5.16 and 16.2.5, App Router applications that rely on CSP nonces can be vulnerable to stored cross-site scrip…
VulnCve 2026 44581
medium System graph security Trivy conf 1.00 CVE-2026-45736: ws 8.17.1 — yarn.lock
ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray` ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument.…
VulnCve 2026 45736
medium System graph security Trivy conf 1.00 CVE-2026-45736: ws 8.18.2 — yarn.lock
ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray` ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument.…
VulnCve 2026 45736
medium System graph security Trivy conf 1.00 CVE-2026-45736: ws 8.18.3 — deploy/tools/essential-dapps-chains-config-generator/yarn.lock
ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray` ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument.…
VulnCve 2026 45736

Showing first 300 of 554. Refine filters or use the findings page for deep search.

For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/47fd2768-aaf7-41d1-8bb9-34854e5b2338/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/47fd2768-aaf7-41d1-8bb9-34854e5b2338/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.