{ "auditReportVersion": 2, "vulnerabilities": { "@babel/core": { "name": "@babel/core", "severity": "low", "isDirect": false, "via": [ { "source": 1123528, "name": "@babel/core", "dependency": "@babel/core", "title": "@babel/core: Arbitrary File Read via sourceMappingURL Comment", "url": "https://github.com/advisories/GHSA-4x5r-pxfx-6jf8", "severity": "low", "cwe": [ "CWE-22", "CWE-200" ], "cvss": { "score": 3.2, "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N" }, "range": "<=7.29.0" } ], "effects": [], "range": "<=7.29.0", "nodes": [ "node_modules/@babel/core" ], "fixAvailable": true }, "@babel/helpers": { "name": "@babel/helpers", "severity": "moderate", "isDirect": false, "via": [ { "source": 1104001, "name": "@babel/helpers", "dependency": "@babel/helpers", "title": "Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups", "url": "https://github.com/advisories/GHSA-968p-4wvh-cqc8", "severity": "moderate", "cwe": [ "CWE-1333" ], "cvss": { "score": 6.2, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<7.26.10" } ], "effects": [], "range": "<7.26.10", "nodes": [ "node_modules/@babel/helpers" ], "fixAvailable": true }, "@babel/plugin-transform-modules-systemjs": { "name": "@babel/plugin-transform-modules-systemjs", "severity": "high", "isDirect": false, "via": [ { "source": 1120258, "name": "@babel/plugin-transform-modules-systemjs", "dependency": "@babel/plugin-transform-modules-systemjs", "title": "@babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input", "url": "https://github.com/advisories/GHSA-fv7c-fp4j-7gwp", "severity": "high", "cwe": [ "CWE-94", "CWE-843" ], "cvss": { "score": 8.2, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H" }, "range": ">=7.12.0 <=7.29.3" } ], "effects": [], "range": "7.12.0 - 7.29.0", "nodes": [ "node_modules/@babel/plugin-transform-modules-systemjs" ], "fixAvailable": true }, "@babel/runtime": { "name": "@babel/runtime", "severity": "moderate", "isDirect": false, "via": [ { "source": 1104000, "name": "@babel/runtime", "dependency": "@babel/runtime", "title": "Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups", "url": "https://github.com/advisories/GHSA-968p-4wvh-cqc8", "severity": "moderate", "cwe": [ "CWE-1333" ], "cvss": { "score": 6.2, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<7.26.10" } ], "effects": [], "range": "<7.26.10", "nodes": [ "node_modules/@babel/runtime" ], "fixAvailable": true }, "@parcel/watcher": { "name": "@parcel/watcher", "severity": "high", "isDirect": false, "via": [ "chokidar" ], "effects": [ "parcel-bundler" ], "range": "<=1.12.1", "nodes": [ "node_modules/@parcel/watcher" ], "fixAvailable": false }, "@puppeteer/browsers": { "name": "@puppeteer/browsers", "severity": "high", "isDirect": false, "via": [ "extract-zip" ], "effects": [ "puppeteer", "puppeteer-core" ], "range": "<=2.13.2", "nodes": [ "node_modules/@puppeteer/browsers" ], "fixAvailable": { "name": "puppeteer", "version": "25.16.0", "isSemVerMajor": true } }, "ajv": { "name": "ajv", "severity": "moderate", "isDirect": true, "via": [ { "source": 1113714, "name": "ajv", "dependency": "ajv", "title": "ajv has ReDoS when using `$data` option", "url": "https://github.com/advisories/GHSA-2g4f-4pwh-qvx6", "severity": "moderate", "cwe": [ "CWE-400", "CWE-1333" ], "cvss": { "score": 0, "vectorString": null }, "range": "<6.14.0" } ], "effects": [], "range": "<6.14.0", "nodes": [ "node_modules/ajv" ], "fixAvailable": true }, "anymatch": { "name": "anymatch", "severity": "moderate", "isDirect": false, "via": [ "micromatch" ], "effects": [ "chokidar" ], "range": "1.2.0 - 2.0.0", "nodes": [ "node_modules/anymatch" ], "fixAvailable": false }, "axios": { "name": "axios", "severity": "high", "isDirect": true, "via": [ { "source": 1097679, "name": "axios", "dependency": "axios", "title": "Axios Cross-Site Request Forgery Vulnerability", "url": "https://github.com/advisories/GHSA-wf5p-g6vw-rhxx", "severity": "moderate", "cwe": [ "CWE-352" ], "cvss": { "score": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N" }, "range": ">=0.8.1 <0.28.0" }, { "source": 1111034, "name": "axios", "dependency": "axios", "title": "axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL", "url": "https://github.com/advisories/GHSA-jr5f-v2jv-69x6", "severity": "high", "cwe": [ "CWE-918" ], "cvss": { "score": 0, "vectorString": null }, "range": "<0.30.0" }, { "source": 1111035, "name": "axios", "dependency": "axios", "title": "axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL", "url": "https://github.com/advisories/GHSA-jr5f-v2jv-69x6", "severity": "high", "cwe": [ "CWE-918" ], "cvss": { "score": 0, "vectorString": null }, "range": ">=1.0.0 <1.8.2" }, { "source": 1112195, "name": "axios", "dependency": "axios", "title": "Axios is vulnerable to DoS attack through lack of data size check", "url": "https://github.com/advisories/GHSA-4hjh-wcwx-xvwj", "severity": "high", "cwe": [ "CWE-770" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": ">=1.0.0 <1.12.0" }, { "source": 1116672, "name": "axios", "dependency": "axios", "title": "Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF", "url": "https://github.com/advisories/GHSA-3p68-rc4w-qgx5", "severity": "moderate", "cwe": [ "CWE-441", "CWE-918" ], "cvss": { "score": 4.8, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N" }, "range": "<0.31.0" }, { "source": 1116673, "name": "axios", "dependency": "axios", "title": "Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF", "url": "https://github.com/advisories/GHSA-3p68-rc4w-qgx5", "severity": "moderate", "cwe": [ "CWE-441", "CWE-918" ], "cvss": { "score": 4.8, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N" }, "range": ">=1.0.0 <1.15.0" }, { "source": 1117573, "name": "axios", "dependency": "axios", "title": "Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy", "url": "https://github.com/advisories/GHSA-w9j2-pvgh-6h63", "severity": "moderate", "cwe": [ "CWE-287", "CWE-1321" ], "cvss": { "score": 4.8, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N" }, "range": "<=0.31.0" }, { "source": 1117574, "name": "axios", "dependency": "axios", "title": "Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy", "url": "https://github.com/advisories/GHSA-w9j2-pvgh-6h63", "severity": "moderate", "cwe": [ "CWE-287", "CWE-1321" ], "cvss": { "score": 4.8, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N" }, "range": ">=1.0.0 <1.15.1" }, { "source": 1117575, "name": "axios", "dependency": "axios", "title": "Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0", "url": "https://github.com/advisories/GHSA-pmwg-cvhr-8vh7", "severity": "high", "cwe": [ "CWE-183", "CWE-441", "CWE-918" ], "cvss": { "score": 7.2, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N" }, "range": "<=0.31.0" }, { "source": 1117576, "name": "axios", "dependency": "axios", "title": "Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0", "url": "https://github.com/advisories/GHSA-pmwg-cvhr-8vh7", "severity": "high", "cwe": [ "CWE-183", "CWE-441", "CWE-918" ], "cvss": { "score": 7.2, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N" }, "range": ">=1.0.0 <1.15.1" }, { "source": 1117577, "name": "axios", "dependency": "axios", "title": "Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`", "url": "https://github.com/advisories/GHSA-3w6x-2g7m-8v23", "severity": "moderate", "cwe": [ "CWE-915", "CWE-1321" ], "cvss": { "score": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N" }, "range": ">=1.0.0 <1.15.2" }, { "source": 1117579, "name": "axios", "dependency": "axios", "title": "Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams", "url": "https://github.com/advisories/GHSA-xhjh-pmcv-23jw", "severity": "low", "cwe": [ "CWE-116", "CWE-626" ], "cvss": { "score": 3.7, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N" }, "range": "<=0.31.0" }, { "source": 1117580, "name": "axios", "dependency": "axios", "title": "Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams", "url": "https://github.com/advisories/GHSA-xhjh-pmcv-23jw", "severity": "low", "cwe": [ "CWE-116", "CWE-626" ], "cvss": { "score": 3.7, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N" }, "range": ">=1.0.0 <1.15.1" }, { "source": 1117581, "name": "axios", "dependency": "axios", "title": "Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream", "url": "https://github.com/advisories/GHSA-445q-vr5w-6q77", "severity": "moderate", "cwe": [ "CWE-93" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" }, "range": ">=1.0.0 <1.15.1" }, { "source": 1117582, "name": "axios", "dependency": "axios", "title": "Axios: no_proxy bypass via IP alias allows SSRF", "url": "https://github.com/advisories/GHSA-m7pr-hjqh-92cm", "severity": "moderate", "cwe": [ "CWE-918" ], "cvss": { "score": 6.8, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N" }, "range": "<=0.31.0" }, { "source": 1117583, "name": "axios", "dependency": "axios", "title": "Axios: no_proxy bypass via IP alias allows SSRF", "url": "https://github.com/advisories/GHSA-m7pr-hjqh-92cm", "severity": "moderate", "cwe": [ "CWE-918" ], "cvss": { "score": 6.8, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N" }, "range": ">=1.0.0 <1.15.1" }, { "source": 1117586, "name": "axios", "dependency": "axios", "title": "Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0", "url": "https://github.com/advisories/GHSA-5c9x-8gcm-mpgx", "severity": "moderate", "cwe": [ "CWE-770" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": "<=0.31.0" }, { "source": 1117587, "name": "axios", "dependency": "axios", "title": "Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0", "url": "https://github.com/advisories/GHSA-5c9x-8gcm-mpgx", "severity": "moderate", "cwe": [ "CWE-770" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": ">=1.0.0 <1.15.1" }, { "source": 1117588, "name": "axios", "dependency": "axios", "title": "Axios: HTTP adapter streamed responses bypass maxContentLength", "url": "https://github.com/advisories/GHSA-vf2m-468p-8v99", "severity": "moderate", "cwe": [ "CWE-770" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": "<=0.31.0" }, { "source": 1117589, "name": "axios", "dependency": "axios", "title": "Axios: HTTP adapter streamed responses bypass maxContentLength", "url": "https://github.com/advisories/GHSA-vf2m-468p-8v99", "severity": "moderate", "cwe": [ "CWE-770" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": ">=1.0.0 <1.15.1" }, { "source": 1117590, "name": "axios", "dependency": "axios", "title": "Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking", "url": "https://github.com/advisories/GHSA-pf86-5x62-jrwf", "severity": "high", "cwe": [ "CWE-1321" ], "cvss": { "score": 7.4, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N" }, "range": "<=0.31.0" }, { "source": 1117591, "name": "axios", "dependency": "axios", "title": "Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking", "url": "https://github.com/advisories/GHSA-pf86-5x62-jrwf", "severity": "high", "cwe": [ "CWE-1321" ], "cvss": { "score": 7.4, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N" }, "range": ">=1.0.0 <1.15.1" }, { "source": 1117592, "name": "axios", "dependency": "axios", "title": "Axios: Header Injection via Prototype Pollution", "url": "https://github.com/advisories/GHSA-6chq-wfr3-2hj9", "severity": "high", "cwe": [ "CWE-113", "CWE-1321" ], "cvss": { "score": 7.4, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N" }, "range": "<=0.31.0" }, { "source": 1117593, "name": "axios", "dependency": "axios", "title": "Axios: Header Injection via Prototype Pollution", "url": "https://github.com/advisories/GHSA-6chq-wfr3-2hj9", "severity": "high", "cwe": [ "CWE-113", "CWE-1321" ], "cvss": { "score": 7.4, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N" }, "range": ">=1.0.0 <1.15.1" }, { "source": 1117594, "name": "axios", "dependency": "axios", "title": "Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion", "url": "https://github.com/advisories/GHSA-xx6v-rp6x-q39c", "severity": "moderate", "cwe": [ "CWE-183", "CWE-201" ], "cvss": { "score": 5.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N" }, "range": "<=0.31.0" }, { "source": 1117595, "name": "axios", "dependency": "axios", "title": "Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion", "url": "https://github.com/advisories/GHSA-xx6v-rp6x-q39c", "severity": "moderate", "cwe": [ "CWE-183", "CWE-201" ], "cvss": { "score": 5.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N" }, "range": ">=1.0.0 <1.15.1" }, { "source": 1117857, "name": "axios", "dependency": "axios", "title": "Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig", "url": "https://github.com/advisories/GHSA-43fc-jf86-j433", "severity": "high", "cwe": [ "CWE-754", "CWE-1321" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<=0.30.2" }, { "source": 1117858, "name": "axios", "dependency": "axios", "title": "Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig", "url": "https://github.com/advisories/GHSA-43fc-jf86-j433", "severity": "high", "cwe": [ "CWE-754", "CWE-1321" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": ">=1.0.0 <=1.13.4" }, { "source": 1118607, "name": "axios", "dependency": "axios", "title": "Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking", "url": "https://github.com/advisories/GHSA-q8qp-cvcw-x6jj", "severity": "high", "cwe": [ "CWE-1321" ], "cvss": { "score": 7.4, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N" }, "range": ">=1.0.0 <1.15.2" }, { "source": 1119403, "name": "axios", "dependency": "axios", "title": "Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain", "url": "https://github.com/advisories/GHSA-fvcv-3m26-pcqx", "severity": "moderate", "cwe": [ "CWE-113", "CWE-444", "CWE-918" ], "cvss": { "score": 4.8, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N" }, "range": "<0.31.0" }, { "source": 1119404, "name": "axios", "dependency": "axios", "title": "Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain", "url": "https://github.com/advisories/GHSA-fvcv-3m26-pcqx", "severity": "moderate", "cwe": [ "CWE-113", "CWE-444", "CWE-918" ], "cvss": { "score": 4.8, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N" }, "range": ">=1.0.0 <1.15.0" }, { "source": 1120124, "name": "axios", "dependency": "axios", "title": "Axios: unbounded recursion in toFormData causes DoS via deeply nested request data", "url": "https://github.com/advisories/GHSA-62hf-57xw-28j9", "severity": "moderate", "cwe": [ "CWE-674" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<=0.31.0" }, { "source": 1120125, "name": "axios", "dependency": "axios", "title": "Axios: unbounded recursion in toFormData causes DoS via deeply nested request data", "url": "https://github.com/advisories/GHSA-62hf-57xw-28j9", "severity": "moderate", "cwe": [ "CWE-674" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": ">=1.0.0 <1.15.1" }, { "source": 1120546, "name": "axios", "dependency": "axios", "title": "Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection", "url": "https://github.com/advisories/GHSA-hfxv-24rg-xrqf", "severity": "high", "cwe": [ "CWE-400", "CWE-1333" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<=0.31.1" }, { "source": 1120547, "name": "axios", "dependency": "axios", "title": "Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection", "url": "https://github.com/advisories/GHSA-hfxv-24rg-xrqf", "severity": "high", "cwe": [ "CWE-400", "CWE-1333" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": ">=1.0.0 <1.16.0" }, { "source": 1120643, "name": "axios", "dependency": "axios", "title": "Allocation of Resources Without Limits or Throttling in Axios", "url": "https://github.com/advisories/GHSA-777c-7fjr-54vf", "severity": "high", "cwe": [ "CWE-770" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": ">=1.7.0 <1.16.0" }, { "source": 1120644, "name": "axios", "dependency": "axios", "title": "Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter", "url": "https://github.com/advisories/GHSA-p92q-9vqr-4j8v", "severity": "high", "cwe": [ "CWE-201" ], "cvss": { "score": 0, "vectorString": null }, "range": "<=0.31.1" }, { "source": 1120645, "name": "axios", "dependency": "axios", "title": "Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter", "url": "https://github.com/advisories/GHSA-p92q-9vqr-4j8v", "severity": "high", "cwe": [ "CWE-201" ], "cvss": { "score": 0, "vectorString": null }, "range": ">=1.0.0 <1.16.0" }, { "source": 1120646, "name": "axios", "dependency": "axios", "title": "Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection", "url": "https://github.com/advisories/GHSA-j5f8-grm9-p9fc", "severity": "high", "cwe": [ "CWE-200" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, "range": "<=0.31.1" }, { "source": 1120647, "name": "axios", "dependency": "axios", "title": "Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection", "url": "https://github.com/advisories/GHSA-j5f8-grm9-p9fc", "severity": "high", "cwe": [ "CWE-200" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, "range": ">=1.0.0 <1.16.0" }, { "source": 1120648, "name": "axios", "dependency": "axios", "title": "axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge", "url": "https://github.com/advisories/GHSA-3g43-6gmg-66jw", "severity": "high", "cwe": [ "CWE-94", "CWE-1321" ], "cvss": { "score": 7, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L" }, "range": ">=0.19.0 <0.31.1" }, { "source": 1120649, "name": "axios", "dependency": "axios", "title": "axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge", "url": "https://github.com/advisories/GHSA-3g43-6gmg-66jw", "severity": "high", "cwe": [ "CWE-94", "CWE-1321" ], "cvss": { "score": 7, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L" }, "range": ">=1.0.0 <1.15.2" }, { "source": 1120650, "name": "axios", "dependency": "axios", "title": "axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`", "url": "https://github.com/advisories/GHSA-35jp-ww65-95wh", "severity": "high", "cwe": [ "CWE-441", "CWE-1321" ], "cvss": { "score": 8.7, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N" }, "range": ">=1.0.0 <1.16.0" }, { "source": 1120651, "name": "axios", "dependency": "axios", "title": "axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions", "url": "https://github.com/advisories/GHSA-898c-q2cr-xwhg", "severity": "moderate", "cwe": [ "CWE-1321" ], "cvss": { "score": 4.8, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L" }, "range": "<=0.31.1" }, { "source": 1120652, "name": "axios", "dependency": "axios", "title": "axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions", "url": "https://github.com/advisories/GHSA-898c-q2cr-xwhg", "severity": "moderate", "cwe": [ "CWE-1321" ], "cvss": { "score": 4.8, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L" }, "range": ">=1.0.0 <1.16.0" }, { "source": 1123825, "name": "axios", "dependency": "axios", "title": "axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)", "url": "https://github.com/advisories/GHSA-pjwm-pj3p-43mv", "severity": "high", "cwe": [ "CWE-289", "CWE-918" ], "cvss": { "score": 8.6, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N" }, "range": "<=0.31.1" }, { "source": 1147948, "name": "axios", "dependency": "axios", "title": "Axios: Prototype pollution gadgets can alter axios request construction", "url": "https://github.com/advisories/GHSA-mmx7-hfxf-jppx", "severity": "moderate", "cwe": [ "CWE-1321" ], "cvss": { "score": 0, "vectorString": null }, "range": "<0.33.0" }, { "source": 1147949, "name": "axios", "dependency": "axios", "title": "Axios: Prototype pollution gadgets can alter axios request construction", "url": "https://github.com/advisories/GHSA-mmx7-hfxf-jppx", "severity": "moderate", "cwe": [ "CWE-1321" ], "cvss": { "score": 0, "vectorString": null }, "range": ">=1.0.0 <1.18.0" }, { "source": 1147950, "name": "axios", "dependency": "axios", "title": "Axios: Deep formToJSON Key Recursion Can Cause Denial of Service", "url": "https://github.com/advisories/GHSA-pmv8-rq9r-6j72", "severity": "moderate", "cwe": [ "CWE-400", "CWE-770" ], "cvss": { "score": 0, "vectorString": null }, "range": ">=1.0.0 <1.18.0" }, { "source": 1153180, "name": "axios", "dependency": "axios", "title": "Axios: Nested axios option objects can consume polluted prototype values", "url": "https://github.com/advisories/GHSA-7q8q-rj6j-mhjq", "severity": "moderate", "cwe": [ "CWE-1321" ], "cvss": { "score": 0, "vectorString": null }, "range": ">=1.0.0 <1.18.0" }, { "source": 1153181, "name": "axios", "dependency": "axios", "title": "Axios: Nested axios option objects can consume polluted prototype values", "url": "https://github.com/advisories/GHSA-7q8q-rj6j-mhjq", "severity": "moderate", "cwe": [ "CWE-1321" ], "cvss": { "score": 0, "vectorString": null }, "range": ">=0.8.0 <0.33.0" }, { "source": 1153182, "name": "axios", "dependency": "axios", "title": "Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`", "url": "https://github.com/advisories/GHSA-jqh4-m9w3-8hp9", "severity": "moderate", "cwe": [ "CWE-770" ], "cvss": { "score": 0, "vectorString": null }, "range": ">=1.7.0 <1.18.0" }, { "source": 1153185, "name": "axios", "dependency": "axios", "title": "Axios: Excessive recursion in formDataToJSON can cause denial of service", "url": "https://github.com/advisories/GHSA-42h9-826w-cgv3", "severity": "moderate", "cwe": [ "CWE-400", "CWE-674" ], "cvss": { "score": 0, "vectorString": null }, "range": ">=1.0.0 <1.18.0" }, { "source": 1240600, "name": "axios", "dependency": "axios", "title": "Axios: Prototype pollution gadget in fetch adapter can alter outbound requests", "url": "https://github.com/advisories/GHSA-vh66-26gq-q6x8", "severity": "moderate", "cwe": [ "CWE-1321" ], "cvss": { "score": 0, "vectorString": null }, "range": ">=1.7.0 <1.20.0" }, { "source": 1240601, "name": "axios", "dependency": "axios", "title": "Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method", "url": "https://github.com/advisories/GHSA-9fr6-4gfg-395g", "severity": "moderate", "cwe": [ "CWE-1321" ], "cvss": { "score": 0, "vectorString": null }, "range": ">=1.0.0 <1.20.0" }, { "source": 1240626, "name": "axios", "dependency": "axios", "title": "Axios: Header Injection via Inherited headers After Minimal Interceptor", "url": "https://github.com/advisories/GHSA-j8rh-479h-cp32", "severity": "moderate", "cwe": [ "CWE-74", "CWE-1321" ], "cvss": { "score": 0, "vectorString": null }, "range": ">=1.0.0 <1.20.0" } ], "effects": [ "youtube-search-api" ], "range": "<=0.32.0 || 1.0.0 - 1.19.0", "nodes": [ "node_modules/axios", "node_modules/youtube-search-api/node_modules/axios" ], "fixAvailable": { "name": "youtube-search-api", "version": "2.0.1", "isSemVerMajor": true } }, "baseline-browser-mapping": { "name": "baseline-browser-mapping", "severity": "moderate", "isDirect": false, "via": [ { "source": 1193686, "name": "baseline-browser-mapping", "dependency": "baseline-browser-mapping", "title": "baseline-browser-mapping process termination on invalid input causes denial of service", "url": "https://github.com/advisories/GHSA-w5vr-8v7q-w6rv", "severity": "moderate", "cwe": [ "CWE-705" ], "cvss": { "score": 0, "vectorString": null }, "range": ">=2.0.0 <2.11.0" } ], "effects": [], "range": ">=2.0.0 <2.11.0", "nodes": [ "node_modules/baseline-browser-mapping" ], "fixAvailable": true }, "basic-ftp": { "name": "basic-ftp", "severity": "critical", "isDirect": false, "via": [ { "source": 1113518, "name": "basic-ftp", "dependency": "basic-ftp", "title": "Basic FTP has Path Traversal Vulnerability in its downloadToDir() method", "url": "https://github.com/advisories/GHSA-5rq4-664w-9x2c", "severity": "critical", "cwe": [ "CWE-22" ], "cvss": { "score": 9.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H" }, "range": "<5.2.0" }, { "source": 1116454, "name": "basic-ftp", "dependency": "basic-ftp", "title": "basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Execution via Credentials and MKD Commands", "url": "https://github.com/advisories/GHSA-6v7q-wjvx-w8wg", "severity": "high", "cwe": [ "CWE-93" ], "cvss": { "score": 8.2, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L" }, "range": "<=5.2.1" }, { "source": 1117083, "name": "basic-ftp", "dependency": "basic-ftp", "title": "basic-ftp vulnerable to denial of service via unbounded memory consumption in Client.list()", "url": "https://github.com/advisories/GHSA-rp42-5vxx-qpwr", "severity": "high", "cwe": [ "CWE-400", "CWE-770" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<=5.2.2" }, { "source": 1118825, "name": "basic-ftp", "dependency": "basic-ftp", "title": "basic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response buffering", "url": "https://github.com/advisories/GHSA-rpmf-866q-6p89", "severity": "high", "cwe": [ "CWE-400", "CWE-770" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<=5.3.0" }, { "source": 1240853, "name": "basic-ftp", "dependency": "basic-ftp", "title": "basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)", "url": "https://github.com/advisories/GHSA-c475-qrg2-pj4r", "severity": "high", "cwe": [ "CWE-1333" ], "cvss": { "score": 0, "vectorString": null }, "range": "<=6.2.0" } ], "effects": [], "range": "<=6.2.0", "nodes": [ "node_modules/basic-ftp" ], "fixAvailable": true }, "bn.js": { "name": "bn.js", "severity": "moderate", "isDirect": false, "via": [ { "source": 1113441, "name": "bn.js", "dependency": "bn.js", "title": "bn.js affected by an infinite loop", "url": "https://github.com/advisories/GHSA-378v-28hj-76wf", "severity": "moderate", "cwe": [ "CWE-835" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": ">=5.0.0 <5.2.3" }, { "source": 1113442, "name": "bn.js", "dependency": "bn.js", "title": "bn.js affected by an infinite loop", "url": "https://github.com/advisories/GHSA-378v-28hj-76wf", "severity": "moderate", "cwe": [ "CWE-835" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": "<4.12.3" } ], "effects": [], "range": ">=5.0.0 <5.2.3 || <4.12.3", "nodes": [ "node_modules/asn1.js/node_modules/bn.js", "node_modules/bn.js", "node_modules/create-ecdh/node_modules/bn.js", "node_modules/diffie-hellman/node_modules/bn.js", "node_modules/elliptic/node_modules/bn.js", "node_modules/miller-rabin/node_modules/bn.js", "node_modules/public-encrypt/node_modules/bn.js" ], "fixAvailable": true }, "body-parser": { "name": "body-parser", "severity": "high", "isDirect": false, "via": [ { "source": 1099520, "name": "body-parser", "dependency": "body-parser", "title": "body-parser vulnerable to denial of service when url encoding is enabled", "url": "https://github.com/advisories/GHSA-qwcr-r2fm-qrc7", "severity": "high", "cwe": [ "CWE-405" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<1.20.3" }, { "source": 1123977, "name": "body-parser", "dependency": "body-parser", "title": "body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement", "url": "https://github.com/advisories/GHSA-v422-hmwv-36x6", "severity": "low", "cwe": [ "CWE-770" ], "cvss": { "score": 3.7, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": "<1.20.6" }, "qs" ], "effects": [ "express" ], "range": "<=1.20.6 || 2.0.0-beta.1 - 2.0.2", "nodes": [ "node_modules/body-parser" ], "fixAvailable": true }, "brace-expansion": { "name": "brace-expansion", "severity": "high", "isDirect": false, "via": [ { "source": 1105443, "name": "brace-expansion", "dependency": "brace-expansion", "title": "brace-expansion Regular Expression Denial of Service vulnerability", "url": "https://github.com/advisories/GHSA-v6h2-p8h4-qcjw", "severity": "low", "cwe": [ "CWE-400" ], "cvss": { "score": 3.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L" }, "range": ">=1.0.0 <=1.1.11" }, { "source": 1115540, "name": "brace-expansion", "dependency": "brace-expansion", "title": "brace-expansion: Zero-step sequence causes process hang and memory exhaustion", "url": "https://github.com/advisories/GHSA-f886-m6hf-6m8v", "severity": "moderate", "cwe": [ "CWE-400" ], "cvss": { "score": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, "range": "<1.1.13" }, { "source": 1123897, "name": "brace-expansion", "dependency": "brace-expansion", "title": "brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups", "url": "https://github.com/advisories/GHSA-3jxr-9vmj-r5cp", "severity": "high", "cwe": [ "CWE-400", "CWE-407" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": "<1.1.16" }, { "source": 1130588, "name": "brace-expansion", "dependency": "brace-expansion", "title": "brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash", "url": "https://github.com/advisories/GHSA-mh99-v99m-4gvg", "severity": "high", "cwe": [ "CWE-400", "CWE-770" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<1.1.17" }, { "source": 1130737, "name": "brace-expansion", "dependency": "brace-expansion", "title": "brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation", "url": "https://github.com/advisories/GHSA-rgw5-rvv9-x895", "severity": "high", "cwe": [ "CWE-400", "CWE-770" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<1.1.18" }, { "source": 1240100, "name": "brace-expansion", "dependency": "brace-expansion", "title": "brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service", "url": "https://github.com/advisories/GHSA-q2hr-2g5m-vwhr", "severity": "moderate", "cwe": [ "CWE-400", "CWE-407" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": "<1.1.21" }, { "source": 1240104, "name": "brace-expansion", "dependency": "brace-expansion", "title": "brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion", "url": "https://github.com/advisories/GHSA-qhr7-859c-m2p7", "severity": "high", "cwe": [ "CWE-400", "CWE-674" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<1.1.20" }, { "source": 1240108, "name": "brace-expansion", "dependency": "brace-expansion", "title": "brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion", "url": "https://github.com/advisories/GHSA-6j4f-fj2g-mc7p", "severity": "high", "cwe": [ "CWE-400", "CWE-674" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<1.1.19" } ], "effects": [], "range": "<=1.1.20", "nodes": [ "node_modules/brace-expansion" ], "fixAvailable": true }, "braces": { "name": "braces", "severity": "high", "isDirect": false, "via": [ { "source": 1098094, "name": "braces", "dependency": "braces", "title": "Uncontrolled resource consumption in braces", "url": "https://github.com/advisories/GHSA-grv7-fg5c-xmjg", "severity": "high", "cwe": [ "CWE-400", "CWE-1050" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<3.0.3" } ], "effects": [ "chokidar", "micromatch" ], "range": "<3.0.3", "nodes": [ "node_modules/braces" ], "fixAvailable": false }, "browserslist": { "name": "browserslist", "severity": "high", "isDirect": false, "via": [ { "source": 1153171, "name": "browserslist", "dependency": "browserslist", "title": "Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM", "url": "https://github.com/advisories/GHSA-c83g-rgw3-j3cx", "severity": "high", "cwe": [ "CWE-770" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<=4.28.6" }, { "source": 1153172, "name": "browserslist", "dependency": "browserslist", "title": "Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)", "url": "https://github.com/advisories/GHSA-73wf-gq98-2v4g", "severity": "high", "cwe": [ "CWE-248", "CWE-1321" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<=4.28.6" } ], "effects": [], "range": "<=4.28.6", "nodes": [ "node_modules/browserslist" ], "fixAvailable": true }, "chokidar": { "name": "chokidar", "severity": "high", "isDirect": false, "via": [ "anymatch", "braces", "readdirp" ], "effects": [ "@parcel/watcher" ], "range": "1.3.0 - 2.1.8", "nodes": [ "node_modules/chokidar" ], "fixAvailable": false }, "cipher-base": { "name": "cipher-base", "severity": "critical", "isDirect": false, "via": [ { "source": 1109536, "name": "cipher-base", "dependency": "cipher-base", "title": "cipher-base is missing type checks, leading to hash rewind and passing on crafted data", "url": "https://github.com/advisories/GHSA-cpq7-6gpm-g9rc", "severity": "critical", "cwe": [ "CWE-20" ], "cvss": { "score": 9.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H" }, "range": "<=1.0.4" } ], "effects": [], "range": "<=1.0.4", "nodes": [ "node_modules/cipher-base" ], "fixAvailable": true }, "cookie": { "name": "cookie", "severity": "low", "isDirect": false, "via": [ { "source": 1103907, "name": "cookie", "dependency": "cookie", "title": "cookie accepts cookie name, path, and domain with out of bounds characters", "url": "https://github.com/advisories/GHSA-pxg6-pf52-xh8x", "severity": "low", "cwe": [ "CWE-74" ], "cvss": { "score": 0, "vectorString": null }, "range": "<0.7.0" } ], "effects": [ "express" ], "range": "<0.7.0", "nodes": [ "node_modules/cookie" ], "fixAvailable": true }, "cross-spawn": { "name": "cross-spawn", "severity": "high", "isDirect": false, "via": [ { "source": 1104663, "name": "cross-spawn", "dependency": "cross-spawn", "title": "Regular Expression Denial of Service (ReDoS) in cross-spawn", "url": "https://github.com/advisories/GHSA-3xgq-45jj-v275", "severity": "high", "cwe": [ "CWE-1333" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<6.0.6" }, { "source": 1104664, "name": "cross-spawn", "dependency": "cross-spawn", "title": "Regular Expression Denial of Service (ReDoS) in cross-spawn", "url": "https://github.com/advisories/GHSA-3xgq-45jj-v275", "severity": "high", "cwe": [ "CWE-1333" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": ">=7.0.0 <7.0.5" } ], "effects": [], "range": "<6.0.6 || >=7.0.0 <7.0.5", "nodes": [ "node_modules/cross-spawn", "node_modules/parcel-bundler/node_modules/cross-spawn" ], "fixAvailable": true }, "css-declaration-sorter": { "name": "css-declaration-sorter", "severity": "moderate", "isDirect": false, "via": [ "postcss" ], "effects": [], "range": "<=5.1.2", "nodes": [ "node_modules/css-declaration-sorter" ], "fixAvailable": true }, "css-modules-loader-core": { "name": "css-modules-loader-core", "severity": "moderate", "isDirect": false, "via": [ "postcss", "postcss-modules-extract-imports", "postcss-modules-local-by-default", "postcss-modules-scope", "postcss-modules-values" ], "effects": [ "parcel-bundler" ], "range": "*", "nodes": [ "node_modules/css-modules-loader-core" ], "fixAvailable": false }, "css-select": { "name": "css-select", "severity": "high", "isDirect": false, "via": [ "nth-check" ], "effects": [ "svgo" ], "range": "<=3.1.0", "nodes": [ "node_modules/css-select" ], "fixAvailable": false }, "cssnano": { "name": "cssnano", "severity": "moderate", "isDirect": false, "via": [ "cssnano-preset-default", "postcss" ], "effects": [ "htmlnano" ], "range": "<=4.1.11", "nodes": [ "node_modules/cssnano" ], "fixAvailable": false }, "cssnano-preset-default": { "name": "cssnano-preset-default", "severity": "moderate", "isDirect": false, "via": [ "css-declaration-sorter", "cssnano-util-raw-cache", "postcss", "postcss-calc", "postcss-colormin", "postcss-convert-values", "postcss-discard-comments", "postcss-discard-duplicates", "postcss-discard-empty", "postcss-discard-overridden", "postcss-merge-longhand", "postcss-merge-rules", "postcss-minify-font-values", "postcss-minify-gradients", "postcss-minify-params", "postcss-minify-selectors", "postcss-normalize-charset", "postcss-normalize-display-values", "postcss-normalize-positions", "postcss-normalize-repeat-style", "postcss-normalize-string", "postcss-normalize-timing-functions", "postcss-normalize-unicode", "postcss-normalize-url", "postcss-normalize-whitespace", "postcss-ordered-values", "postcss-reduce-initial", "postcss-reduce-transforms", "postcss-svgo", "postcss-unique-selectors" ], "effects": [ "cssnano" ], "range": "<=4.0.8", "nodes": [ "node_modules/cssnano-preset-default" ], "fixAvailable": false }, "cssnano-util-raw-cache": { "name": "cssnano-util-raw-cache", "severity": "moderate", "isDirect": false, "via": [ "postcss" ], "effects": [], "range": "*", "nodes": [ "node_modules/cssnano-util-raw-cache" ], "fixAvailable": true }, "decode-uri-component": { "name": "decode-uri-component", "severity": "moderate", "isDirect": false, "via": [ { "source": 1147955, "name": "decode-uri-component", "dependency": "decode-uri-component", "title": "decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input", "url": "https://github.com/advisories/GHSA-vcc3-ghjq-m6fr", "severity": "moderate", "cwe": [ "CWE-400", "CWE-405", "CWE-407", "CWE-1176" ], "cvss": { "score": 0, "vectorString": null }, "range": "<=0.4.2" } ], "effects": [ "source-map-resolve" ], "range": "<=0.4.2", "nodes": [ "node_modules/decode-uri-component" ], "fixAvailable": true }, "elliptic": { "name": "elliptic", "severity": "critical", "isDirect": false, "via": [ { "source": 1102901, "name": "elliptic", "dependency": "elliptic", "title": "Elliptic's private key extraction in ECDSA upon signing a malformed input (e.g. a string)", "url": "https://github.com/advisories/GHSA-vjh7-7g9h-fjfh", "severity": "critical", "cwe": [ "CWE-200" ], "cvss": { "score": 0, "vectorString": null }, "range": "<=6.6.0" }, { "source": 1111036, "name": "elliptic", "dependency": "elliptic", "title": "Valid ECDSA signatures erroneously rejected in Elliptic", "url": "https://github.com/advisories/GHSA-fc9h-whq2-v747", "severity": "low", "cwe": [ "CWE-347" ], "cvss": { "score": 4.8, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L" }, "range": "<6.6.0" }, { "source": 1112030, "name": "elliptic", "dependency": "elliptic", "title": "Elliptic Uses a Cryptographic Primitive with a Risky Implementation", "url": "https://github.com/advisories/GHSA-848j-6mx2-7j84", "severity": "low", "cwe": [ "CWE-1240" ], "cvss": { "score": 5.6, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L" }, "range": "<=6.6.1" } ], "effects": [], "range": "*", "nodes": [ "node_modules/elliptic" ], "fixAvailable": true }, "express": { "name": "express", "severity": "high", "isDirect": false, "via": [ { "source": 1100530, "name": "express", "dependency": "express", "title": "express vulnerable to XSS via response.redirect()", "url": "https://github.com/advisories/GHSA-qw6h-vgh9-j6wx", "severity": "low", "cwe": [ "CWE-79" ], "cvss": { "score": 5, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L" }, "range": "<4.20.0" }, "body-parser", "cookie", "path-to-regexp", "qs", "send", "serve-static" ], "effects": [], "range": "<=4.22.2 || 5.0.0-alpha.1 - 5.0.1", "nodes": [ "node_modules/express" ], "fixAvailable": true }, "extract-zip": { "name": "extract-zip", "severity": "high", "isDirect": false, "via": [ { "source": 1139346, "name": "extract-zip", "dependency": "extract-zip", "title": "extract-zip unvalidated symlink path traversal", "url": "https://github.com/advisories/GHSA-jmr9-qjv8-65gv", "severity": "high", "cwe": [ "CWE-22" ], "cvss": { "score": 8.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" }, "range": "<=2.0.1" }, { "source": 1193685, "name": "extract-zip", "dependency": "extract-zip", "title": "extract-zip allows arbitrary file writes through symlink archive entries", "url": "https://github.com/advisories/GHSA-7pqw-9j4j-h8q3", "severity": "high", "cwe": [ "CWE-22" ], "cvss": { "score": 8.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H" }, "range": "<=2.0.1" } ], "effects": [ "@puppeteer/browsers" ], "range": "*", "nodes": [ "node_modules/extract-zip" ], "fixAvailable": { "name": "puppeteer", "version": "25.16.0", "isSemVerMajor": true } }, "fast-glob": { "name": "fast-glob", "severity": "moderate", "isDirect": false, "via": [ "micromatch" ], "effects": [ "parcel-bundler" ], "range": "<=2.2.7", "nodes": [ "node_modules/fast-glob" ], "fixAvailable": false }, "fast-uri": { "name": "fast-uri", "severity": "high", "isDirect": false, "via": [ { "source": 1158521, "name": "fast-uri", "dependency": "fast-uri", "title": "fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references", "url": "https://github.com/advisories/GHSA-5jgf-p345-68v8", "severity": "high", "cwe": [ "CWE-436" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, "range": ">=3.1.3 <3.1.6" }, { "source": 1158524, "name": "fast-uri", "dependency": "fast-uri", "title": "fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization", "url": "https://github.com/advisories/GHSA-f65p-4m7j-42xc", "severity": "high", "cwe": [ "CWE-20", "CWE-918" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, "range": ">=3.0.0 <3.1.6" }, { "source": 1158527, "name": "fast-uri", "dependency": "fast-uri", "title": "fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding", "url": "https://github.com/advisories/GHSA-fph4-wmhf-6fwf", "severity": "high", "cwe": [ "CWE-174", "CWE-918" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, "range": ">=3.1.2 <3.1.6" }, { "source": 1158530, "name": "fast-uri", "dependency": "fast-uri", "title": "fast-uri vulnerable to host confusion via percent-encoded scheme normalization", "url": "https://github.com/advisories/GHSA-jqff-g426-hqxp", "severity": "high", "cwe": [ "CWE-177" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, "range": ">=3.0.0 <3.1.6" }, { "source": 1239943, "name": "fast-uri", "dependency": "fast-uri", "title": "fast-uri vulnerable to authority injection via an unvalidated port in serialize", "url": "https://github.com/advisories/GHSA-qw65-cvwx-89v3", "severity": "high", "cwe": [ "CWE-116" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, "range": ">=3.0.0 <3.1.7" }, { "source": 1240091, "name": "fast-uri", "dependency": "fast-uri", "title": "fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets", "url": "https://github.com/advisories/GHSA-hrr3-gc8f-f4qj", "severity": "moderate", "cwe": [ "CWE-178" ], "cvss": { "score": 4.8, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N" }, "range": ">=3.0.0 <3.1.8" } ], "effects": [], "range": "3.0.0 - 3.1.7", "nodes": [ "node_modules/fast-uri" ], "fixAvailable": true }, "file-type": { "name": "file-type", "severity": "moderate", "isDirect": true, "via": [ { "source": 1114301, "name": "file-type", "dependency": "file-type", "title": "file-type affected by infinite loop in ASF parser on malformed input with zero-size sub-header", "url": "https://github.com/advisories/GHSA-5v7r-6r5c-r473", "severity": "moderate", "cwe": [ "CWE-835" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": ">=13.0.0 <21.3.1" } ], "effects": [], "range": "13.0.0 - 21.3.0", "nodes": [ "node_modules/file-type" ], "fixAvailable": { "name": "file-type", "version": "22.2.0", "isSemVerMajor": true } }, "flatted": { "name": "flatted", "severity": "high", "isDirect": false, "via": [ { "source": 1114526, "name": "flatted", "dependency": "flatted", "title": "flatted vulnerable to unbounded recursion DoS in parse() revive phase", "url": "https://github.com/advisories/GHSA-25h7-pfq9-p65f", "severity": "high", "cwe": [ "CWE-674" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<3.4.0" }, { "source": 1241196, "name": "flatted", "dependency": "flatted", "title": "Prototype Pollution via parse() in NodeJS flatted", "url": "https://github.com/advisories/GHSA-rf6f-7fwh-wjgh", "severity": "high", "cwe": [ "CWE-915", "CWE-1321" ], "cvss": { "score": 0, "vectorString": null }, "range": "<=3.4.1" } ], "effects": [], "range": "<=3.4.1", "nodes": [ "node_modules/flatted" ], "fixAvailable": true }, "follow-redirects": { "name": "follow-redirects", "severity": "moderate", "isDirect": false, "via": [ { "source": 1116560, "name": "follow-redirects", "dependency": "follow-redirects", "title": "follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets", "url": "https://github.com/advisories/GHSA-r4q5-vmmm-2653", "severity": "moderate", "cwe": [ "CWE-200" ], "cvss": { "score": 0, "vectorString": null }, "range": "<=1.15.11" } ], "effects": [], "range": "<=1.15.11", "nodes": [ "node_modules/follow-redirects" ], "fixAvailable": true }, "form-data": { "name": "form-data", "severity": "critical", "isDirect": false, "via": [ { "source": 1109538, "name": "form-data", "dependency": "form-data", "title": "form-data uses unsafe random function in form-data for choosing boundary", "url": "https://github.com/advisories/GHSA-fjxv-7rqg-78g4", "severity": "critical", "cwe": [ "CWE-330" ], "cvss": { "score": 0, "vectorString": null }, "range": ">=4.0.0 <4.0.4" }, { "source": 1109540, "name": "form-data", "dependency": "form-data", "title": "form-data uses unsafe random function in form-data for choosing boundary", "url": "https://github.com/advisories/GHSA-fjxv-7rqg-78g4", "severity": "critical", "cwe": [ "CWE-330" ], "cvss": { "score": 0, "vectorString": null }, "range": "<2.5.4" }, { "source": 1120743, "name": "form-data", "dependency": "form-data", "title": "form-data: CRLF injection in form-data via unescaped multipart field names and filenames", "url": "https://github.com/advisories/GHSA-hmw2-7cc7-3qxx", "severity": "high", "cwe": [ "CWE-93" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, "range": ">=4.0.0 <4.0.6" }, { "source": 1120745, "name": "form-data", "dependency": "form-data", "title": "form-data: CRLF injection in form-data via unescaped multipart field names and filenames", "url": "https://github.com/advisories/GHSA-hmw2-7cc7-3qxx", "severity": "high", "cwe": [ "CWE-93" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, "range": "<2.5.6" } ], "effects": [ "request" ], "range": "<=2.5.5 || 4.0.0 - 4.0.5", "nodes": [ "node_modules/form-data", "node_modules/request/node_modules/form-data" ], "fixAvailable": false }, "gaxios": { "name": "gaxios", "severity": "moderate", "isDirect": false, "via": [ "uuid" ], "effects": [], "range": "6.4.0 - 6.7.1", "nodes": [ "node_modules/gaxios" ], "fixAvailable": true }, "googleapis": { "name": "googleapis", "severity": "moderate", "isDirect": true, "via": [ "googleapis-common" ], "effects": [], "range": "33.0.0 - 149.0.0", "nodes": [ "node_modules/googleapis" ], "fixAvailable": { "name": "googleapis", "version": "188.0.0", "isSemVerMajor": true } }, "googleapis-common": { "name": "googleapis-common", "severity": "moderate", "isDirect": false, "via": [ "uuid" ], "effects": [ "googleapis" ], "range": "<=7.2.0", "nodes": [ "node_modules/googleapis-common" ], "fixAvailable": { "name": "googleapis", "version": "188.0.0", "isSemVerMajor": true } }, "htmlnano": { "name": "htmlnano", "severity": "high", "isDirect": false, "via": [ "cssnano", "purgecss", "svgo", "uncss" ], "effects": [ "parcel-bundler" ], "range": ">=0.1.1", "nodes": [ "node_modules/htmlnano" ], "fixAvailable": false }, "ip-address": { "name": "ip-address", "severity": "high", "isDirect": false, "via": [ { "source": 1118827, "name": "ip-address", "dependency": "ip-address", "title": "ip-address has XSS in Address6 HTML-emitting methods", "url": "https://github.com/advisories/GHSA-v2v4-37r5-5v8g", "severity": "moderate", "cwe": [ "CWE-79" ], "cvss": { "score": 0, "vectorString": null }, "range": "<=10.1.0" }, { "source": 1130722, "name": "ip-address", "dependency": "ip-address", "title": "ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass", "url": "https://github.com/advisories/GHSA-mwp4-54f8-5fhr", "severity": "high", "cwe": [ "CWE-20", "CWE-918" ], "cvss": { "score": 0, "vectorString": null }, "range": "<=10.3.0" }, { "source": 1239948, "name": "ip-address", "dependency": "ip-address", "title": "ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts", "url": "https://github.com/advisories/GHSA-rpw4-54j3-4h4q", "severity": "moderate", "cwe": [ "CWE-697", "CWE-918" ], "cvss": { "score": 0, "vectorString": null }, "range": "<=10.5.0" }, { "source": 1240097, "name": "ip-address", "dependency": "ip-address", "title": "ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range", "url": "https://github.com/advisories/GHSA-j6r3-76f7-8jcv", "severity": "moderate", "cwe": [ "CWE-697", "CWE-843" ], "cvss": { "score": 0, "vectorString": null }, "range": "<=10.7.0" }, { "source": 1240098, "name": "ip-address", "dependency": "ip-address", "title": "ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process", "url": "https://github.com/advisories/GHSA-h3mg-xc3c-68pw", "severity": "moderate", "cwe": [ "CWE-400", "CWE-770" ], "cvss": { "score": 0, "vectorString": null }, "range": "<=10.7.0" }, { "source": 1242883, "name": "ip-address", "dependency": "ip-address", "title": "ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process", "url": "https://github.com/advisories/GHSA-rxp7-6hxx-x8q5", "severity": "moderate", "cwe": [ "CWE-1333" ], "cvss": { "score": 0, "vectorString": null }, "range": "<=10.7.3" } ], "effects": [ "socks" ], "range": "<=10.7.3", "nodes": [ "node_modules/ip-address" ], "fixAvailable": true }, "joi": { "name": "joi", "severity": "high", "isDirect": true, "via": [ { "source": 1120656, "name": "joi", "dependency": "joi", "title": "joi has an uncaught RangeError on deeply nested input through recursive `link()` schemas", "url": "https://github.com/advisories/GHSA-q7cg-457f-vx79", "severity": "moderate", "cwe": [ "CWE-248", "CWE-400" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": "<17.13.4" }, { "source": 1193674, "name": "joi", "dependency": "joi", "title": "joi: Prototype pollution via a `__proto__` language key in custom messages", "url": "https://github.com/advisories/GHSA-6w3j-5fw6-r9vr", "severity": "low", "cwe": [ "CWE-1321" ], "cvss": { "score": 3.7, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N" }, "range": ">=17.2.0 <17.13.6" }, { "source": 1193679, "name": "joi", "dependency": "joi", "title": "joi: object().rename() with a template target can set the validated object's prototype", "url": "https://github.com/advisories/GHSA-gg4h-3hg2-grpc", "severity": "low", "cwe": [ "CWE-1321" ], "cvss": { "score": 3.7, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N" }, "range": ">=16.0.0 <17.13.5" }, { "source": 1241212, "name": "joi", "dependency": "joi", "title": "joi messages compilation allows prototype replacement through __proto__ error codes", "url": "https://github.com/advisories/GHSA-wr44-6hxh-3jwq", "severity": "moderate", "cwe": [ "CWE-1321" ], "cvss": { "score": 3.7, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N" }, "range": "<17.13.8" }, { "source": 1241279, "name": "joi", "dependency": "joi", "title": "joi: Quadratic regular-expression backtracking in `Joi.string().isoDate()`", "url": "https://github.com/advisories/GHSA-6h2x-m376-mqjq", "severity": "high", "cwe": [ "CWE-1333" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": ">=17.2.0 <17.13.7" } ], "effects": [], "range": "<=17.13.7", "nodes": [ "node_modules/joi" ], "fixAvailable": true }, "js-yaml": { "name": "js-yaml", "severity": "high", "isDirect": false, "via": [ { "source": 1112714, "name": "js-yaml", "dependency": "js-yaml", "title": "js-yaml has prototype pollution in merge (<<)", "url": "https://github.com/advisories/GHSA-mh29-5h37-fv8m", "severity": "moderate", "cwe": [ "CWE-1321" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" }, "range": "<3.14.2" }, { "source": 1112715, "name": "js-yaml", "dependency": "js-yaml", "title": "js-yaml has prototype pollution in merge (<<)", "url": "https://github.com/advisories/GHSA-mh29-5h37-fv8m", "severity": "moderate", "cwe": [ "CWE-1321" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" }, "range": ">=4.0.0 <4.1.1" }, { "source": 1121859, "name": "js-yaml", "dependency": "js-yaml", "title": "JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases", "url": "https://github.com/advisories/GHSA-h67p-54hq-rp68", "severity": "moderate", "cwe": [ "CWE-407" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": "<3.15.0" }, { "source": 1121860, "name": "js-yaml", "dependency": "js-yaml", "title": "JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases", "url": "https://github.com/advisories/GHSA-h67p-54hq-rp68", "severity": "moderate", "cwe": [ "CWE-407" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": ">=4.0.0 <=4.1.1" }, { "source": 1123911, "name": "js-yaml", "dependency": "js-yaml", "title": "js-yaml: YAML merge-key chains can force quadratic CPU consumption", "url": "https://github.com/advisories/GHSA-52cp-r559-cp3m", "severity": "high", "cwe": [ "CWE-400", "CWE-407" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": ">=4.0.0 <4.3.0" }, { "source": 1123912, "name": "js-yaml", "dependency": "js-yaml", "title": "js-yaml: YAML merge-key chains can force quadratic CPU consumption", "url": "https://github.com/advisories/GHSA-52cp-r559-cp3m", "severity": "high", "cwe": [ "CWE-400", "CWE-407" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": ">=3.0.0 <3.15.0" }, { "source": 1138114, "name": "js-yaml", "dependency": "js-yaml", "title": "JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported", "url": "https://github.com/advisories/GHSA-5p4m-2wfm-xmqj", "severity": "high", "cwe": [ "CWE-407" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": ">=3.0.0 <3.15.1" }, { "source": 1138115, "name": "js-yaml", "dependency": "js-yaml", "title": "JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported", "url": "https://github.com/advisories/GHSA-5p4m-2wfm-xmqj", "severity": "high", "cwe": [ "CWE-407" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": ">=4.0.0 <4.3.1" }, { "source": 1193726, "name": "js-yaml", "dependency": "js-yaml", "title": "js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources", "url": "https://github.com/advisories/GHSA-2883-xcg3-v3hh", "severity": "high", "cwe": [ "CWE-400", "CWE-407" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": ">=3.0.0 <3.15.2" }, { "source": 1193727, "name": "js-yaml", "dependency": "js-yaml", "title": "js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources", "url": "https://github.com/advisories/GHSA-2883-xcg3-v3hh", "severity": "high", "cwe": [ "CWE-400", "CWE-407" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": ">=4.0.0 <4.3.2" } ], "effects": [], "range": "<=3.15.1 || 4.0.0 - 4.3.1", "nodes": [ "node_modules/cosmiconfig/node_modules/js-yaml", "node_modules/js-yaml", "node_modules/parcel-bundler/node_modules/js-yaml", "node_modules/svgo/node_modules/js-yaml" ], "fixAvailable": true }, "jsdom": { "name": "jsdom", "severity": "moderate", "isDirect": false, "via": [ "request", "request-promise-native", "tough-cookie" ], "effects": [ "uncss" ], "range": "0.1.20 || 0.2.0 - 16.5.3", "nodes": [ "node_modules/jsdom" ], "fixAvailable": false }, "jsondiffpatch": { "name": "jsondiffpatch", "severity": "high", "isDirect": true, "via": [ { "source": 1108189, "name": "jsondiffpatch", "dependency": "jsondiffpatch", "title": "jsondiffpatch is vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin", "url": "https://github.com/advisories/GHSA-33vc-wfww-vjfv", "severity": "moderate", "cwe": [ "CWE-79" ], "cvss": { "score": 4.7, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N" }, "range": "<0.7.2" }, { "source": 1147954, "name": "jsondiffpatch", "dependency": "jsondiffpatch", "title": " jsondiffpatch patch APIs are vulnerable to prototype pollution", "url": "https://github.com/advisories/GHSA-j4fx-xxwh-2485", "severity": "high", "cwe": [ "CWE-1321" ], "cvss": { "score": 8.2, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L" }, "range": "<0.7.6" } ], "effects": [], "range": "<=0.7.5", "nodes": [ "node_modules/jsondiffpatch" ], "fixAvailable": { "name": "jsondiffpatch", "version": "0.7.6", "isSemVerMajor": true } }, "jws": { "name": "jws", "severity": "high", "isDirect": false, "via": [ { "source": 1111243, "name": "jws", "dependency": "jws", "title": "auth0/node-jws Improperly Verifies HMAC Signature", "url": "https://github.com/advisories/GHSA-869p-cjfg-cm3x", "severity": "high", "cwe": [ "CWE-347" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, "range": "=4.0.0" }, { "source": 1111244, "name": "jws", "dependency": "jws", "title": "auth0/node-jws Improperly Verifies HMAC Signature", "url": "https://github.com/advisories/GHSA-869p-cjfg-cm3x", "severity": "high", "cwe": [ "CWE-347" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, "range": "<3.2.3" } ], "effects": [], "range": "=4.0.0 || <3.2.3", "nodes": [ "node_modules/jsonwebtoken/node_modules/jws", "node_modules/jws" ], "fixAvailable": true }, "lodash": { "name": "lodash", "severity": "high", "isDirect": false, "via": [ { "source": 1115806, "name": "lodash", "dependency": "lodash", "title": "lodash vulnerable to Code Injection via `_.template` imports key names", "url": "https://github.com/advisories/GHSA-r5fr-rjxr-66jc", "severity": "high", "cwe": [ "CWE-94" ], "cvss": { "score": 8.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" }, "range": ">=4.0.0 <=4.17.23" }, { "source": 1115810, "name": "lodash", "dependency": "lodash", "title": "lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`", "url": "https://github.com/advisories/GHSA-f23m-r3pf-42rh", "severity": "moderate", "cwe": [ "CWE-1321" ], "cvss": { "score": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L" }, "range": "<=4.17.23" }, { "source": 1120370, "name": "lodash", "dependency": "lodash", "title": "Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions", "url": "https://github.com/advisories/GHSA-xxjr-mmjv-4gpg", "severity": "moderate", "cwe": [ "CWE-1321" ], "cvss": { "score": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L" }, "range": ">=4.0.0 <=4.17.22" } ], "effects": [], "range": "<=4.17.23", "nodes": [ "node_modules/lodash" ], "fixAvailable": true }, "micromatch": { "name": "micromatch", "severity": "high", "isDirect": false, "via": [ { "source": 1098681, "name": "micromatch", "dependency": "micromatch", "title": "Regular Expression Denial of Service (ReDoS) in micromatch", "url": "https://github.com/advisories/GHSA-952p-6rrq-rcjv", "severity": "moderate", "cwe": [ "CWE-1333" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": "<4.0.8" }, "braces" ], "effects": [ "anymatch", "fast-glob", "readdirp" ], "range": "<=4.0.7", "nodes": [ "node_modules/micromatch" ], "fixAvailable": false }, "minimatch": { "name": "minimatch", "severity": "high", "isDirect": false, "via": [ { "source": 1113459, "name": "minimatch", "dependency": "minimatch", "title": "minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern", "url": "https://github.com/advisories/GHSA-3ppc-4f35-3m26", "severity": "high", "cwe": [ "CWE-1333" ], "cvss": { "score": 0, "vectorString": null }, "range": "<3.1.3" }, { "source": 1113538, "name": "minimatch", "dependency": "minimatch", "title": "minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments", "url": "https://github.com/advisories/GHSA-7r86-cg39-jmmj", "severity": "high", "cwe": [ "CWE-407" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<3.1.3" }, { "source": 1113546, "name": "minimatch", "dependency": "minimatch", "title": "minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions", "url": "https://github.com/advisories/GHSA-23c5-xmqv-rm74", "severity": "high", "cwe": [ "CWE-1333" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<3.1.4" } ], "effects": [], "range": "<=3.1.3", "nodes": [ "node_modules/minimatch" ], "fixAvailable": true }, "node-forge": { "name": "node-forge", "severity": "high", "isDirect": false, "via": [ { "source": 1088227, "name": "node-forge", "dependency": "node-forge", "title": "Prototype Pollution in node-forge debug API.", "url": "https://github.com/advisories/GHSA-5rrq-pxf6-6jx5", "severity": "low", "cwe": [ "CWE-1321" ], "cvss": { "score": 0, "vectorString": null }, "range": "<1.0.0" }, { "source": 1088229, "name": "node-forge", "dependency": "node-forge", "title": "URL parsing in node-forge could lead to undesired behavior.", "url": "https://github.com/advisories/GHSA-gf8q-jrpm-jvxq", "severity": "low", "cwe": [ "CWE-601" ], "cvss": { "score": 0, "vectorString": null }, "range": "<1.0.0" }, { "source": 1088746, "name": "node-forge", "dependency": "node-forge", "title": "Improper Verification of Cryptographic Signature in `node-forge`", "url": "https://github.com/advisories/GHSA-2r2c-g63r-vccr", "severity": "moderate", "cwe": [ "CWE-347" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" }, "range": "<1.3.0" }, { "source": 1093719, "name": "node-forge", "dependency": "node-forge", "title": "Open Redirect in node-forge", "url": "https://github.com/advisories/GHSA-8fr3-hfg3-gpgp", "severity": "moderate", "cwe": [ "CWE-601" ], "cvss": { "score": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, "range": "<1.0.0" }, { "source": 1102321, "name": "node-forge", "dependency": "node-forge", "title": "Improper Verification of Cryptographic Signature in node-forge", "url": "https://github.com/advisories/GHSA-x4jg-mjrx-434g", "severity": "high", "cwe": [ "CWE-347" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, "range": "<1.3.0" }, { "source": 1102322, "name": "node-forge", "dependency": "node-forge", "title": "Improper Verification of Cryptographic Signature in node-forge", "url": "https://github.com/advisories/GHSA-cfm4-qjh2-4765", "severity": "high", "cwe": [ "CWE-347" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, "range": "<1.3.0" }, { "source": 1110996, "name": "node-forge", "dependency": "node-forge", "title": "node-forge has ASN.1 Unbounded Recursion", "url": "https://github.com/advisories/GHSA-554w-wpv2-vw27", "severity": "high", "cwe": [ "CWE-674" ], "cvss": { "score": 0, "vectorString": null }, "range": "<1.3.2" }, { "source": 1110998, "name": "node-forge", "dependency": "node-forge", "title": "node-forge has an Interpretation Conflict vulnerability via its ASN.1 Validator Desynchronization", "url": "https://github.com/advisories/GHSA-5gfm-wpxj-wjgq", "severity": "high", "cwe": [ "CWE-436" ], "cvss": { "score": 8.6, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N" }, "range": "<1.3.2" }, { "source": 1111068, "name": "node-forge", "dependency": "node-forge", "title": "node-forge is vulnerable to ASN.1 OID Integer Truncation", "url": "https://github.com/advisories/GHSA-65ch-62r8-g69g", "severity": "moderate", "cwe": [ "CWE-190" ], "cvss": { "score": 0, "vectorString": null }, "range": "<1.3.2" }, { "source": 1115545, "name": "node-forge", "dependency": "node-forge", "title": "Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)", "url": "https://github.com/advisories/GHSA-2328-f5f3-gj25", "severity": "high", "cwe": [ "CWE-295" ], "cvss": { "score": 7.4, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N" }, "range": "<=1.3.3" }, { "source": 1115546, "name": "node-forge", "dependency": "node-forge", "title": "Forge has signature forgery in Ed25519 due to missing S > L check", "url": "https://github.com/advisories/GHSA-q67f-28xg-22rw", "severity": "high", "cwe": [ "CWE-347" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, "range": "<1.4.0" }, { "source": 1115548, "name": "node-forge", "dependency": "node-forge", "title": "Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input", "url": "https://github.com/advisories/GHSA-5m6q-g25r-mvwx", "severity": "high", "cwe": [ "CWE-835" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<1.4.0" }, { "source": 1115612, "name": "node-forge", "dependency": "node-forge", "title": "Forge has signature forgery in RSA-PKCS due to ASN.1 extra field ", "url": "https://github.com/advisories/GHSA-ppp5-5v6c-4jwp", "severity": "high", "cwe": [ "CWE-20", "CWE-347" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, "range": "<1.4.0" }, { "source": 1240912, "name": "node-forge", "dependency": "node-forge", "title": "node-forge RSA PKCS#1 v1.5 signature verification accepts extra nested DigestAlgorithm elements", "url": "https://github.com/advisories/GHSA-86w9-cpqp-85rv", "severity": "high", "cwe": [ "CWE-347" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, "range": "<=1.4.0" } ], "effects": [ "parcel-bundler" ], "range": "*", "nodes": [ "node_modules/node-forge" ], "fixAvailable": false }, "node-tesseract-ocr": { "name": "node-tesseract-ocr", "severity": "critical", "isDirect": true, "via": [ { "source": 1115526, "name": "node-tesseract-ocr", "dependency": "node-tesseract-ocr", "title": "node-tesseract-ocr is vulnerable to OS Command Injection through unsanitized recognize() function parameter", "url": "https://github.com/advisories/GHSA-8j44-735h-w4w2", "severity": "critical", "cwe": [ "CWE-78" ], "cvss": { "score": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, "range": "<=2.2.1" } ], "effects": [], "range": "*", "nodes": [ "node_modules/node-tesseract-ocr" ], "fixAvailable": false }, "nth-check": { "name": "nth-check", "severity": "high", "isDirect": false, "via": [ { "source": 1095141, "name": "nth-check", "dependency": "nth-check", "title": "Inefficient Regular Expression Complexity in nth-check", "url": "https://github.com/advisories/GHSA-rp65-9cf3-cjxr", "severity": "high", "cwe": [ "CWE-1333" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<2.0.1" } ], "effects": [ "css-select" ], "range": "<2.0.1", "nodes": [ "node_modules/nth-check" ], "fixAvailable": false }, "parcel-bundler": { "name": "parcel-bundler", "severity": "high", "isDirect": true, "via": [ "@parcel/watcher", "css-modules-loader-core", "cssnano", "fast-glob", "htmlnano", "micromatch", "node-forge", "postcss", "terser" ], "effects": [], "range": "*", "nodes": [ "node_modules/parcel-bundler" ], "fixAvailable": false }, "path-to-regexp": { "name": "path-to-regexp", "severity": "high", "isDirect": false, "via": [ { "source": 1101850, "name": "path-to-regexp", "dependency": "path-to-regexp", "title": "path-to-regexp outputs backtracking regular expressions", "url": "https://github.com/advisories/GHSA-9wv6-86v2-598j", "severity": "high", "cwe": [ "CWE-1333" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<0.1.10" }, { "source": 1105199, "name": "path-to-regexp", "dependency": "path-to-regexp", "title": "path-to-regexp contains a ReDoS", "url": "https://github.com/advisories/GHSA-rhx6-c78j-4q9w", "severity": "high", "cwe": [ "CWE-1333" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<0.1.12" }, { "source": 1115527, "name": "path-to-regexp", "dependency": "path-to-regexp", "title": "path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters", "url": "https://github.com/advisories/GHSA-37ch-88jc-xwx2", "severity": "high", "cwe": [ "CWE-1333" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<0.1.13" } ], "effects": [ "express" ], "range": "<=0.1.12", "nodes": [ "node_modules/path-to-regexp" ], "fixAvailable": true }, "pbkdf2": { "name": "pbkdf2", "severity": "critical", "isDirect": false, "via": [ { "source": 1105692, "name": "pbkdf2", "dependency": "pbkdf2", "title": "pbkdf2 returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos", "url": "https://github.com/advisories/GHSA-h7cp-r72f-jxh6", "severity": "critical", "cwe": [ "CWE-20" ], "cvss": { "score": 0, "vectorString": null }, "range": ">=3.0.10 <=3.1.2" }, { "source": 1113204, "name": "pbkdf2", "dependency": "pbkdf2", "title": "pbkdf2 silently disregards Uint8Array input, returning static keys", "url": "https://github.com/advisories/GHSA-v62p-rq8g-8h59", "severity": "critical", "cwe": [ "CWE-20" ], "cvss": { "score": 0, "vectorString": null }, "range": ">=1.0.0 <=3.1.2" }, { "source": 1241333, "name": "pbkdf2", "dependency": "pbkdf2", "title": "pbkdf2 rehashes long passwords on every iteration, enabling denial of service", "url": "https://github.com/advisories/GHSA-477h-4r7f-fvrx", "severity": "moderate", "cwe": [ "CWE-400" ], "cvss": { "score": 3.7, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": "<=3.1.6" } ], "effects": [], "range": "<=3.1.6", "nodes": [ "node_modules/pbkdf2" ], "fixAvailable": true }, "postcss": { "name": "postcss", "severity": "high", "isDirect": false, "via": [ { "source": 1089729, "name": "postcss", "dependency": "postcss", "title": "Regular Expression Denial of Service in postcss", "url": "https://github.com/advisories/GHSA-hwj9-h5mp-3pm3", "severity": "moderate", "cwe": [ "CWE-400" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": ">=7.0.0 <7.0.36" }, { "source": 1093539, "name": "postcss", "dependency": "postcss", "title": "Regular Expression Denial of Service in postcss", "url": "https://github.com/advisories/GHSA-566m-qj78-rww5", "severity": "moderate", "cwe": [ "CWE-400" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": "<7.0.36" }, { "source": 1109574, "name": "postcss", "dependency": "postcss", "title": "PostCSS line return parsing error", "url": "https://github.com/advisories/GHSA-7fh5-64p2-3v2j", "severity": "moderate", "cwe": [ "CWE-74", "CWE-144" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" }, "range": "<8.4.31" }, { "source": 1117015, "name": "postcss", "dependency": "postcss", "title": "PostCSS has XSS via Unescaped in its CSS Stringify Output", "url": "https://github.com/advisories/GHSA-qx2v-qp2m-jg93", "severity": "moderate", "cwe": [ "CWE-79" ], "cvss": { "score": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, "range": "<8.5.10" }, { "source": 1124252, "name": "postcss", "dependency": "postcss", "title": "PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments", "url": "https://github.com/advisories/GHSA-6g55-p6wh-862q", "severity": "high", "cwe": [ "CWE-22", "CWE-200" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, "range": "<=8.5.11" }, { "source": 1130709, "name": "postcss", "dependency": "postcss", "title": "PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset", "url": "https://github.com/advisories/GHSA-fxqj-rqcc-2cmp", "severity": "moderate", "cwe": [ "CWE-22", "CWE-200" ], "cvss": { "score": 0, "vectorString": null }, "range": "<=8.5.22" }, { "source": 1139510, "name": "postcss", "dependency": "postcss", "title": "PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure", "url": "https://github.com/advisories/GHSA-r28c-9q8g-f849", "severity": "high", "cwe": [ "CWE-22" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, "range": "<=8.5.17" } ], "effects": [ "css-declaration-sorter", "css-modules-loader-core", "cssnano", "cssnano-preset-default", "cssnano-util-raw-cache", "parcel-bundler", "postcss-calc", "postcss-colormin", "postcss-convert-values", "postcss-discard-comments", "postcss-discard-duplicates", "postcss-discard-empty", "postcss-discard-overridden", "postcss-merge-longhand", "postcss-merge-rules", "postcss-minify-font-values", "postcss-minify-gradients", "postcss-minify-params", "postcss-minify-selectors", "postcss-modules-extract-imports", "postcss-modules-local-by-default", "postcss-modules-scope", "postcss-modules-values", "postcss-normalize-charset", "postcss-normalize-display-values", "postcss-normalize-positions", "postcss-normalize-repeat-style", "postcss-normalize-string", "postcss-normalize-timing-functions", "postcss-normalize-unicode", "postcss-normalize-url", "postcss-normalize-whitespace", "postcss-ordered-values", "postcss-reduce-initial", "postcss-reduce-transforms", "postcss-svgo", "postcss-unique-selectors", "purgecss", "stylehacks", "uncss" ], "range": "<=8.5.22", "nodes": [ "node_modules/css-modules-loader-core/node_modules/postcss", "node_modules/postcss", "node_modules/postcss-modules-extract-imports/node_modules/postcss", "node_modules/postcss-modules-local-by-default/node_modules/postcss", "node_modules/postcss-modules-scope/node_modules/postcss", "node_modules/postcss-modules-values/node_modules/postcss", "node_modules/purgecss/node_modules/postcss" ], "fixAvailable": false }, "postcss-calc": { "name": "postcss-calc", "severity": "moderate", "isDirect": false, "via": [ "postcss", "postcss-selector-parser" ], "effects": [], "range": "4.1.0 - 10.0.2", "nodes": [ "node_modules/postcss-calc" ], "fixAvailable": true }, "postcss-colormin": { "name": "postcss-colormin", "severity": "moderate", "isDirect": false, "via": [ "postcss" ], "effects": [], "range": "<=4.0.3", "nodes": [ "node_modules/postcss-colormin" ], "fixAvailable": true }, "postcss-convert-values": { "name": "postcss-convert-values", "severity": "moderate", "isDirect": false, "via": [ "postcss" ], "effects": [], "range": "<=4.0.1", "nodes": [ "node_modules/postcss-convert-values" ], "fixAvailable": true }, "postcss-discard-comments": { "name": "postcss-discard-comments", "severity": "moderate", "isDirect": false, "via": [ "postcss" ], "effects": [], "range": "<=4.0.2", "nodes": [ "node_modules/postcss-discard-comments" ], "fixAvailable": true }, "postcss-discard-duplicates": { "name": "postcss-discard-duplicates", "severity": "moderate", "isDirect": false, "via": [ "postcss" ], "effects": [], "range": "1.1.0 - 4.0.2", "nodes": [ "node_modules/postcss-discard-duplicates" ], "fixAvailable": true }, "postcss-discard-empty": { "name": "postcss-discard-empty", "severity": "moderate", "isDirect": false, "via": [ "postcss" ], "effects": [], "range": "1.1.0 - 4.0.1", "nodes": [ "node_modules/postcss-discard-empty" ], "fixAvailable": true }, "postcss-discard-overridden": { "name": "postcss-discard-overridden", "severity": "moderate", "isDirect": false, "via": [ "postcss" ], "effects": [], "range": "<=4.0.1", "nodes": [ "node_modules/postcss-discard-overridden" ], "fixAvailable": true }, "postcss-merge-longhand": { "name": "postcss-merge-longhand", "severity": "moderate", "isDirect": false, "via": [ "postcss", "stylehacks" ], "effects": [], "range": "<=4.0.11", "nodes": [ "node_modules/postcss-merge-longhand" ], "fixAvailable": true }, "postcss-merge-rules": { "name": "postcss-merge-rules", "severity": "moderate", "isDirect": false, "via": [ "postcss", "postcss-selector-parser" ], "effects": [], "range": "<=7.0.4", "nodes": [ "node_modules/postcss-merge-rules" ], "fixAvailable": true }, "postcss-minify-font-values": { "name": "postcss-minify-font-values", "severity": "moderate", "isDirect": false, "via": [ "postcss" ], "effects": [], "range": "<=4.0.2", "nodes": [ "node_modules/postcss-minify-font-values" ], "fixAvailable": true }, "postcss-minify-gradients": { "name": "postcss-minify-gradients", "severity": "moderate", "isDirect": false, "via": [ "postcss" ], "effects": [], "range": "<=4.0.2", "nodes": [ "node_modules/postcss-minify-gradients" ], "fixAvailable": true }, "postcss-minify-params": { "name": "postcss-minify-params", "severity": "moderate", "isDirect": false, "via": [ "postcss" ], "effects": [], "range": "<=4.0.2", "nodes": [ "node_modules/postcss-minify-params" ], "fixAvailable": true }, "postcss-minify-selectors": { "name": "postcss-minify-selectors", "severity": "moderate", "isDirect": false, "via": [ "postcss", "postcss-selector-parser" ], "effects": [], "range": "<=7.0.4", "nodes": [ "node_modules/postcss-minify-selectors" ], "fixAvailable": true }, "postcss-modules-extract-imports": { "name": "postcss-modules-extract-imports", "severity": "moderate", "isDirect": false, "via": [ "postcss" ], "effects": [], "range": "<=2.0.0", "nodes": [ "node_modules/postcss-modules-extract-imports" ], "fixAvailable": true }, "postcss-modules-local-by-default": { "name": "postcss-modules-local-by-default", "severity": "moderate", "isDirect": false, "via": [ "postcss" ], "effects": [], "range": "<=3.0.3", "nodes": [ "node_modules/postcss-modules-local-by-default" ], "fixAvailable": true }, "postcss-modules-scope": { "name": "postcss-modules-scope", "severity": "moderate", "isDirect": false, "via": [ "postcss" ], "effects": [], "range": "<=2.2.0", "nodes": [ "node_modules/postcss-modules-scope" ], "fixAvailable": true }, "postcss-modules-values": { "name": "postcss-modules-values", "severity": "moderate", "isDirect": false, "via": [ "postcss" ], "effects": [ "css-modules-loader-core" ], "range": "<=3.0.0", "nodes": [ "node_modules/postcss-modules-values" ], "fixAvailable": false }, "postcss-normalize-charset": { "name": "postcss-normalize-charset", "severity": "moderate", "isDirect": false, "via": [ "postcss" ], "effects": [], "range": "<=4.0.1", "nodes": [ "node_modules/postcss-normalize-charset" ], "fixAvailable": true }, "postcss-normalize-display-values": { "name": "postcss-normalize-display-values", "severity": "moderate", "isDirect": false, "via": [ "postcss" ], "effects": [], "range": "<=4.0.2", "nodes": [ "node_modules/postcss-normalize-display-values" ], "fixAvailable": true }, "postcss-normalize-positions": { "name": "postcss-normalize-positions", "severity": "moderate", "isDirect": false, "via": [ "postcss" ], "effects": [], "range": "<=4.0.2", "nodes": [ "node_modules/postcss-normalize-positions" ], "fixAvailable": true }, "postcss-normalize-repeat-style": { "name": "postcss-normalize-repeat-style", "severity": "moderate", "isDirect": false, "via": [ "postcss" ], "effects": [], "range": "<=4.0.2", "nodes": [ "node_modules/postcss-normalize-repeat-style" ], "fixAvailable": true }, "postcss-normalize-string": { "name": "postcss-normalize-string", "severity": "moderate", "isDirect": false, "via": [ "postcss" ], "effects": [], "range": "<=4.0.2", "nodes": [ "node_modules/postcss-normalize-string" ], "fixAvailable": true }, "postcss-normalize-timing-functions": { "name": "postcss-normalize-timing-functions", "severity": "moderate", "isDirect": false, "via": [ "postcss" ], "effects": [], "range": "<=4.0.2", "nodes": [ "node_modules/postcss-normalize-timing-functions" ], "fixAvailable": true }, "postcss-normalize-unicode": { "name": "postcss-normalize-unicode", "severity": "moderate", "isDirect": false, "via": [ "postcss" ], "effects": [], "range": "<=4.0.1", "nodes": [ "node_modules/postcss-normalize-unicode" ], "fixAvailable": true }, "postcss-normalize-url": { "name": "postcss-normalize-url", "severity": "moderate", "isDirect": false, "via": [ "postcss" ], "effects": [], "range": "1.1.0 - 4.0.1", "nodes": [ "node_modules/postcss-normalize-url" ], "fixAvailable": true }, "postcss-normalize-whitespace": { "name": "postcss-normalize-whitespace", "severity": "moderate", "isDirect": false, "via": [ "postcss" ], "effects": [], "range": "<=4.0.2", "nodes": [ "node_modules/postcss-normalize-whitespace" ], "fixAvailable": true }, "postcss-ordered-values": { "name": "postcss-ordered-values", "severity": "moderate", "isDirect": false, "via": [ "postcss" ], "effects": [], "range": "<=4.1.2", "nodes": [ "node_modules/postcss-ordered-values" ], "fixAvailable": true }, "postcss-reduce-initial": { "name": "postcss-reduce-initial", "severity": "moderate", "isDirect": false, "via": [ "postcss" ], "effects": [], "range": "<=4.0.3", "nodes": [ "node_modules/postcss-reduce-initial" ], "fixAvailable": true }, "postcss-reduce-transforms": { "name": "postcss-reduce-transforms", "severity": "moderate", "isDirect": false, "via": [ "postcss" ], "effects": [], "range": "<=4.0.2", "nodes": [ "node_modules/postcss-reduce-transforms" ], "fixAvailable": true }, "postcss-selector-parser": { "name": "postcss-selector-parser", "severity": "moderate", "isDirect": false, "via": [ { "source": 1241232, "name": "postcss-selector-parser", "dependency": "postcss-selector-parser", "title": "PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion", "url": "https://github.com/advisories/GHSA-rj75-hqrm-r3gf", "severity": "moderate", "cwe": [ "CWE-400", "CWE-407" ], "cvss": { "score": 5.9, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<7.1.6" } ], "effects": [ "postcss-calc", "postcss-merge-rules", "postcss-minify-selectors", "purgecss", "stylehacks", "uncss" ], "range": "<7.1.6", "nodes": [ "node_modules/postcss-merge-rules/node_modules/postcss-selector-parser", "node_modules/postcss-minify-selectors/node_modules/postcss-selector-parser", "node_modules/postcss-selector-parser", "node_modules/stylehacks/node_modules/postcss-selector-parser", "node_modules/uncss/node_modules/postcss-selector-parser" ], "fixAvailable": false }, "postcss-svgo": { "name": "postcss-svgo", "severity": "high", "isDirect": false, "via": [ "postcss", "svgo" ], "effects": [], "range": "<=5.0.0-rc.2", "nodes": [ "node_modules/postcss-svgo" ], "fixAvailable": true }, "postcss-unique-selectors": { "name": "postcss-unique-selectors", "severity": "moderate", "isDirect": false, "via": [ "postcss" ], "effects": [], "range": "<=4.0.1", "nodes": [ "node_modules/postcss-unique-selectors" ], "fixAvailable": true }, "proxy-addr": { "name": "proxy-addr", "severity": "critical", "isDirect": false, "via": [ { "source": 1241210, "name": "proxy-addr", "dependency": "proxy-addr", "title": "proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet", "url": "https://github.com/advisories/GHSA-jqcg-44mw-7w3h", "severity": "critical", "cwe": [ "CWE-290", "CWE-348", "CWE-697" ], "cvss": { "score": 9.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" }, "range": ">=1.1.0 <2.0.8" } ], "effects": [], "range": "1.1.0 - 2.0.7", "nodes": [ "node_modules/proxy-addr" ], "fixAvailable": true }, "puppeteer": { "name": "puppeteer", "severity": "high", "isDirect": true, "via": [ "@puppeteer/browsers", "puppeteer-core" ], "effects": [], "range": "19.8.1 - 24.43.1", "nodes": [ "node_modules/puppeteer" ], "fixAvailable": { "name": "puppeteer", "version": "25.16.0", "isSemVerMajor": true } }, "puppeteer-core": { "name": "puppeteer-core", "severity": "high", "isDirect": false, "via": [ "@puppeteer/browsers" ], "effects": [ "puppeteer" ], "range": "19.8.4 - 24.43.1", "nodes": [ "node_modules/puppeteer-core" ], "fixAvailable": { "name": "puppeteer", "version": "25.16.0", "isSemVerMajor": true } }, "purgecss": { "name": "purgecss", "severity": "moderate", "isDirect": false, "via": [ "postcss", "postcss-selector-parser" ], "effects": [ "htmlnano" ], "range": "<=7.0.2", "nodes": [ "node_modules/purgecss" ], "fixAvailable": false }, "qs": { "name": "qs", "severity": "moderate", "isDirect": false, "via": [ { "source": 1113161, "name": "qs", "dependency": "qs", "title": "qs's arrayLimit bypass in comma parsing allows denial of service", "url": "https://github.com/advisories/GHSA-w7fw-mjwx-w883", "severity": "low", "cwe": [ "CWE-20" ], "cvss": { "score": 3.7, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": ">=6.7.0 <=6.14.1" }, { "source": 1113719, "name": "qs", "dependency": "qs", "title": "qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion", "url": "https://github.com/advisories/GHSA-6rw7-vpxm-498p", "severity": "moderate", "cwe": [ "CWE-20" ], "cvss": { "score": 3.7, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": "<6.14.1" }, { "source": 1119502, "name": "qs", "dependency": "qs", "title": "qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set", "url": "https://github.com/advisories/GHSA-q8mj-m7cp-5q26", "severity": "moderate", "cwe": [ "CWE-476" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": ">=6.11.1 <=6.15.1" }, { "source": 1158507, "name": "qs", "dependency": "qs", "title": "qs: Denial of Service via Attacker Controlled isBuffer", "url": "https://github.com/advisories/GHSA-4mjr-xmp4-gh2g", "severity": "moderate", "cwe": [ "CWE-248", "CWE-703" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": ">=2.2.5 <6.16.0" } ], "effects": [ "body-parser", "express", "request" ], "range": "<=6.15.3", "nodes": [ "node_modules/qs", "node_modules/request/node_modules/qs", "node_modules/url/node_modules/qs" ], "fixAvailable": false }, "readdirp": { "name": "readdirp", "severity": "moderate", "isDirect": false, "via": [ "micromatch" ], "effects": [ "chokidar" ], "range": "2.2.0 - 2.2.1", "nodes": [ "node_modules/readdirp" ], "fixAvailable": false }, "request": { "name": "request", "severity": "critical", "isDirect": false, "via": [ { "source": 1096727, "name": "request", "dependency": "request", "title": "Server-Side Request Forgery in Request", "url": "https://github.com/advisories/GHSA-p8p7-x288-28g6", "severity": "moderate", "cwe": [ "CWE-918" ], "cvss": { "score": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, "range": "<=2.88.2" }, "form-data", "qs", "tough-cookie", "uuid" ], "effects": [ "jsdom", "request-promise-core", "request-promise-native", "uncss" ], "range": "*", "nodes": [ "node_modules/request" ], "fixAvailable": false }, "request-promise-core": { "name": "request-promise-core", "severity": "moderate", "isDirect": false, "via": [ "request" ], "effects": [ "request-promise-native" ], "range": "*", "nodes": [ "node_modules/request-promise-core" ], "fixAvailable": false }, "request-promise-native": { "name": "request-promise-native", "severity": "moderate", "isDirect": false, "via": [ "request", "request-promise-core", "tough-cookie" ], "effects": [ "jsdom" ], "range": ">=1.0.0", "nodes": [ "node_modules/request-promise-native" ], "fixAvailable": false }, "send": { "name": "send", "severity": "low", "isDirect": false, "via": [ { "source": 1109556, "name": "send", "dependency": "send", "title": "send vulnerable to template injection that can lead to XSS", "url": "https://github.com/advisories/GHSA-m6fv-jmcg-4jfg", "severity": "low", "cwe": [ "CWE-79" ], "cvss": { "score": 5, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L" }, "range": "<0.19.0" } ], "effects": [ "express", "serve-static" ], "range": "<0.19.0", "nodes": [ "node_modules/send" ], "fixAvailable": true }, "serve-static": { "name": "serve-static", "severity": "low", "isDirect": false, "via": [ { "source": 1100528, "name": "serve-static", "dependency": "serve-static", "title": "serve-static vulnerable to template injection that can lead to XSS", "url": "https://github.com/advisories/GHSA-cm22-4g7w-348p", "severity": "low", "cwe": [ "CWE-79" ], "cvss": { "score": 5, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L" }, "range": "<1.16.0" }, "send" ], "effects": [], "range": "<=1.16.0", "nodes": [ "node_modules/serve-static" ], "fixAvailable": true }, "sha.js": { "name": "sha.js", "severity": "critical", "isDirect": false, "via": [ { "source": 1109535, "name": "sha.js", "dependency": "sha.js", "title": "sha.js is missing type checks leading to hash rewind and passing on crafted data", "url": "https://github.com/advisories/GHSA-95m3-7q98-8xr5", "severity": "critical", "cwe": [ "CWE-20" ], "cvss": { "score": 9.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H" }, "range": "<=2.4.11" } ], "effects": [], "range": "<=2.4.11", "nodes": [ "node_modules/sha.js" ], "fixAvailable": true }, "socks": { "name": "socks", "severity": "moderate", "isDirect": false, "via": [ "ip-address" ], "effects": [], "range": "2.7.2 - 2.8.6", "nodes": [ "node_modules/socks" ], "fixAvailable": true }, "source-map-resolve": { "name": "source-map-resolve", "severity": "moderate", "isDirect": false, "via": [ "decode-uri-component" ], "effects": [], "range": ">=0.5.1", "nodes": [ "node_modules/source-map-resolve" ], "fixAvailable": true }, "stylehacks": { "name": "stylehacks", "severity": "moderate", "isDirect": false, "via": [ "postcss", "postcss-selector-parser" ], "effects": [ "postcss-merge-longhand" ], "range": "<=7.0.4", "nodes": [ "node_modules/stylehacks" ], "fixAvailable": true }, "svgo": { "name": "svgo", "severity": "high", "isDirect": false, "via": [ { "source": 1139520, "name": "svgo", "dependency": "svgo", "title": "SVGO removeScripts plugin leaves some executable scripts intact", "url": "https://github.com/advisories/GHSA-2p49-hgcm-8545", "severity": "high", "cwe": [ "CWE-79", "CWE-184" ], "cvss": { "score": 8.2, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N" }, "range": ">=1.0.0 <2.8.3" }, { "source": 1193737, "name": "svgo", "dependency": "svgo", "title": "SVGO: removeScripts allows executable links through namespace and control-character bypasses", "url": "https://github.com/advisories/GHSA-w27v-7q3p-w38r", "severity": "high", "cwe": [ "CWE-79", "CWE-184" ], "cvss": { "score": 8.2, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N" }, "range": ">=1.0.0 <2.8.4" }, { "source": 1193740, "name": "svgo", "dependency": "svgo", "title": "SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements", "url": "https://github.com/advisories/GHSA-4vpr-x523-8j87", "severity": "moderate", "cwe": [ "CWE-79" ], "cvss": { "score": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, "range": ">=1.0.0 <2.8.4" }, "css-select" ], "effects": [ "htmlnano", "postcss-svgo" ], "range": "1.0.0 - 2.8.3", "nodes": [ "node_modules/svgo" ], "fixAvailable": false }, "tar-fs": { "name": "tar-fs", "severity": "high", "isDirect": false, "via": [ { "source": 1109534, "name": "tar-fs", "dependency": "tar-fs", "title": "tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball", "url": "https://github.com/advisories/GHSA-vj76-c3g6-qr5v", "severity": "high", "cwe": [ "CWE-22", "CWE-61" ], "cvss": { "score": 0, "vectorString": null }, "range": ">=3.0.0 <3.1.1" }, { "source": 1109542, "name": "tar-fs", "dependency": "tar-fs", "title": "tar-fs can extract outside the specified dir with a specific tarball", "url": "https://github.com/advisories/GHSA-8cj5-5rvv-wf4v", "severity": "high", "cwe": [ "CWE-22" ], "cvss": { "score": 0, "vectorString": null }, "range": ">=3.0.0 <3.0.9" }, { "source": 1109551, "name": "tar-fs", "dependency": "tar-fs", "title": "tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File", "url": "https://github.com/advisories/GHSA-pq67-2wwv-3xjx", "severity": "high", "cwe": [ "CWE-22" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, "range": ">=3.0.0 <3.0.7" } ], "effects": [], "range": "3.0.0 - 3.1.0", "nodes": [ "node_modules/tar-fs" ], "fixAvailable": true }, "terser": { "name": "terser", "severity": "high", "isDirect": false, "via": [ { "source": 1091691, "name": "terser", "dependency": "terser", "title": "Terser insecure use of regular expressions leads to ReDoS", "url": "https://github.com/advisories/GHSA-4wf5-vphf-c2xc", "severity": "high", "cwe": [ "CWE-1333" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<4.8.1" } ], "effects": [ "parcel-bundler" ], "range": "<4.8.1", "nodes": [ "node_modules/terser" ], "fixAvailable": false }, "tough-cookie": { "name": "tough-cookie", "severity": "moderate", "isDirect": false, "via": [ { "source": 1097682, "name": "tough-cookie", "dependency": "tough-cookie", "title": "tough-cookie Prototype Pollution vulnerability", "url": "https://github.com/advisories/GHSA-72xf-g2v4-qvf3", "severity": "moderate", "cwe": [ "CWE-1321" ], "cvss": { "score": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" }, "range": "<4.1.3" } ], "effects": [ "jsdom", "request", "request-promise-native" ], "range": "<4.1.3", "nodes": [ "node_modules/tough-cookie" ], "fixAvailable": false }, "uncss": { "name": "uncss", "severity": "moderate", "isDirect": false, "via": [ "jsdom", "postcss", "postcss-selector-parser", "request" ], "effects": [ "htmlnano" ], "range": ">=0.7.0", "nodes": [ "node_modules/uncss" ], "fixAvailable": false }, "uuid": { "name": "uuid", "severity": "moderate", "isDirect": false, "via": [ { "source": 1119441, "name": "uuid", "dependency": "uuid", "title": "uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided", "url": "https://github.com/advisories/GHSA-w5hq-g745-h8pq", "severity": "moderate", "cwe": [ "CWE-787", "CWE-1285" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, "range": "<11.1.1" } ], "effects": [ "gaxios", "googleapis-common", "request" ], "range": "<11.1.1", "nodes": [ "node_modules/gaxios/node_modules/uuid", "node_modules/googleapis-common/node_modules/uuid", "node_modules/uuid" ], "fixAvailable": false }, "validator": { "name": "validator", "severity": "high", "isDirect": false, "via": [ { "source": 1109241, "name": "validator", "dependency": "validator", "title": "validator.js has a URL validation bypass vulnerability in its isURL function", "url": "https://github.com/advisories/GHSA-9965-vmph-33xx", "severity": "moderate", "cwe": [ "CWE-79" ], "cvss": { "score": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, "range": "<13.15.20" }, { "source": 1112713, "name": "validator", "dependency": "validator", "title": "Validator is Vulnerable to Incomplete Filtering of One or More Instances of Special Elements", "url": "https://github.com/advisories/GHSA-vghf-hv5q-vc2g", "severity": "high", "cwe": [ "CWE-172", "CWE-792" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<13.15.22" } ], "effects": [], "range": "<=13.15.20", "nodes": [ "node_modules/validator" ], "fixAvailable": true }, "ws": { "name": "ws", "severity": "high", "isDirect": false, "via": [ { "source": 1119108, "name": "ws", "dependency": "ws", "title": "ws: Uninitialized memory disclosure", "url": "https://github.com/advisories/GHSA-58qx-3vcg-4xpx", "severity": "moderate", "cwe": [ "CWE-908" ], "cvss": { "score": 4.4, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N" }, "range": ">=8.0.0 <8.20.1" }, { "source": 1123259, "name": "ws", "dependency": "ws", "title": "ws: Memory exhaustion DoS from tiny fragments and data chunks", "url": "https://github.com/advisories/GHSA-96hv-2xvq-fx4p", "severity": "high", "cwe": [ "CWE-400", "CWE-770", "CWE-1050" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": ">=8.0.0 <8.21.0" }, { "source": 1123261, "name": "ws", "dependency": "ws", "title": "ws: Memory exhaustion DoS from tiny fragments and data chunks", "url": "https://github.com/advisories/GHSA-96hv-2xvq-fx4p", "severity": "high", "cwe": [ "CWE-400", "CWE-770", "CWE-1050" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": ">=6.0.0 <6.2.4" }, { "source": 1123262, "name": "ws", "dependency": "ws", "title": "ws: Memory exhaustion DoS from tiny fragments and data chunks", "url": "https://github.com/advisories/GHSA-96hv-2xvq-fx4p", "severity": "high", "cwe": [ "CWE-400", "CWE-770", "CWE-1050" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": ">=1.1.0 <5.2.5" } ], "effects": [], "range": "1.1.0 - 5.2.4 || 6.0.0 - 6.2.3 || 8.0.0 - 8.20.1", "nodes": [ "node_modules/jsdom/node_modules/ws", "node_modules/peer/node_modules/ws", "node_modules/puppeteer-core/node_modules/ws", "node_modules/ws" ], "fixAvailable": true }, "youtube-search-api": { "name": "youtube-search-api", "severity": "high", "isDirect": true, "via": [ "axios" ], "effects": [], "range": "<=1.2.2", "nodes": [ "node_modules/youtube-search-api" ], "fixAvailable": { "name": "youtube-search-api", "version": "2.0.1", "isSemVerMajor": true } } }, "metadata": { "vulnerabilities": { "info": 0, "low": 4, "moderate": 61, "high": 38, "critical": 9, "total": 112 }, "dependencies": { "prod": 422, "dev": 813, "optional": 12, "peer": 0, "peerOptional": 0, "total": 1243 } } }