Skip to content

fix(deps): vuln minor upgrades — 11 packages (minor: 7 · patch: 4) [hugo/package.json] - #39749

Open
gh-worker-campaigns-3e9aa4[bot] wants to merge 1 commit into
masterfrom
engraver-auto-version-upgrade/minorpatch/npm/hugo/0-1788774857
Open

fix(deps): vuln minor upgrades — 11 packages (minor: 7 · patch: 4) [hugo/package.json]#39749
gh-worker-campaigns-3e9aa4[bot] wants to merge 1 commit into
masterfrom
engraver-auto-version-upgrade/minorpatch/npm/hugo/0-1788774857

Conversation

@gh-worker-campaigns-3e9aa4

@gh-worker-campaigns-3e9aa4 gh-worker-campaigns-3e9aa4 Bot commented Sep 7, 2026

Copy link
Copy Markdown
Contributor

Summary: Critical-severity security update — 15 packages upgraded (MINOR changes included)

Manifests changed:

  • hugo/package.json (yarn)

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

Updates

Package From To Type Dep Type Vulnerabilities Fixed
protobufjs 7.3.0 7.6.6 minor Transitive 2 CRITICAL, 10 HIGH, 10 MEDIUM
basic-ftp 5.0.5 5.3.1 minor Transitive 2 CRITICAL, 5 HIGH
fast-xml-parser 4.2.5 4.5.7 minor Transitive 2 CRITICAL, 4 HIGH, 4 MEDIUM, 2 LOW
simple-git 3.16.0 3.36.0 minor Transitive 2 CRITICAL, 4 HIGH
form-data 2.3.3 2.5.6 minor Transitive 2 CRITICAL, 2 HIGH
form-data 4.0.0 4.0.6 patch Transitive 2 CRITICAL, 2 HIGH
@xhmikosr/decompress 10.2.0 10.2.2 patch Transitive 2 CRITICAL
axios 1.7.2 1.20.0 minor Transitive 28 HIGH, 32 MEDIUM, 2 LOW
node-forge 1.3.1 1.4.0 minor Transitive 13 HIGH, 2 MEDIUM
minimatch 3.0.4 3.1.5 minor Transitive 8 HIGH
brace-expansion 2.0.1 2.1.4 minor Transitive 6 HIGH, 2 MEDIUM, 2 LOW
brace-expansion 1.1.11 1.1.18 patch Transitive 6 HIGH, 2 MEDIUM, 2 LOW
immutable 4.3.5 4.3.9 patch Transitive 6 HIGH
minimatch 5.1.0 5.1.9 patch Transitive 6 HIGH
minimatch 9.0.5 9.0.9 patch Transitive 6 HIGH

Security Details

🚨 Critical & High Severity (120 fixed)
Package CVE Severity Summary Unsafe Version Fixed In Case
@xhmikosr/decompress CVE-2026-53486 CRITICAL decompress: Archive extraction can create files and links outside the target directory 10.2.0 - -
@xhmikosr/decompress GHSA-mp2f-45pm-3cg9 CRITICAL Decompress: Archive extraction can create files and links outside of the target directory 10.2.0 10.2.1 -
basic-ftp GHSA-5rq4-664w-9x2c CRITICAL Basic FTP has Path Traversal Vulnerability in its downloadToDir() method 5.0.5 5.2.0 -
basic-ftp CVE-2026-27699 CRITICAL Basic FTP has Path Traversal Vulnerability in its downloadToDir() method 5.0.5 - -
fast-xml-parser GHSA-m7jm-9gc2-mpf2 CRITICAL fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names 4.2.5 5.3.5 -
fast-xml-parser CVE-2026-25896 CRITICAL fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names 4.2.5 - -
form-data CVE-2025-7783 CRITICAL Usage of unsafe random function in form-data for choosing boundary 2.3.3 - -
form-data GHSA-fjxv-7rqg-78g4 CRITICAL form-data uses unsafe random function in form-data for choosing boundary 2.3.3 2.5.4 -
form-data GHSA-fjxv-7rqg-78g4 CRITICAL form-data uses unsafe random function in form-data for choosing boundary 4.0.0 2.5.4 -
form-data CVE-2025-7783 CRITICAL Usage of unsafe random function in form-data for choosing boundary 4.0.0 - -
protobufjs CVE-2026-41242 CRITICAL protobufjs has an arbitrary code execution issue 7.3.0 - -
protobufjs GHSA-xq3m-2v4x-88gg CRITICAL Arbitrary code execution in protobufjs 7.3.0 8.0.1 -
simple-git GHSA-r275-fr43-pm7q CRITICAL simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key enables RCE 3.16.0 3.32.3 -
simple-git CVE-2026-28292 CRITICAL simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key that enables RCE 3.16.0 - -
axios CVE-2026-44487 HIGH Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter 1.7.2 - -
axios GHSA-hfxv-24rg-xrqf HIGH Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection 1.7.2 1.16.0 -
axios GHSA-4hjh-wcwx-xvwj HIGH Axios is vulnerable to DoS attack through lack of data size check 1.7.2 1.12.0 -
axios GHSA-3g43-6gmg-66jw HIGH axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge 1.7.2 1.15.2 -
axios CVE-2026-44496 HIGH Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection 1.7.2 - -
axios GHSA-8hc4-vh64-cxmj HIGH Server-Side Request Forgery in axios 1.7.2 1.7.4 -
axios GHSA-43fc-jf86-j433 HIGH Axios is Vulnerable to Denial of Service via proto Key in mergeConfig 1.7.2 1.13.5 -
axios CVE-2026-25639 HIGH Axios affected by Denial of Service via proto Key in mergeConfig 1.7.2 - -
axios GHSA-pf86-5x62-jrwf HIGH Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking 1.7.2 1.15.1 -
axios CVE-2026-42033 HIGH Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking 1.7.2 - -
axios GHSA-j5f8-grm9-p9fc HIGH Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection 1.7.2 1.16.0 -
axios CVE-2026-44486 HIGH Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection 1.7.2 - -
axios GHSA-35jp-ww65-95wh HIGH axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in config.proxy 1.7.2 1.16.0 -
axios CVE-2025-58754 HIGH Axios is vulnerable to DoS attack through lack of data size check 1.7.2 - -
axios GHSA-q8qp-cvcw-x6jj HIGH Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking 1.7.2 1.15.2 -
axios CVE-2026-42264 HIGH Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking 1.7.2 - -
axios GHSA-p92q-9vqr-4j8v HIGH Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter 1.7.2 1.16.0 -
axios CVE-2026-44494 HIGH Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in config.proxy 1.7.2 - -
axios CVE-2026-44495 HIGH Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge 1.7.2 - -
axios CVE-2024-39338 HIGH - 1.7.2 - -
axios GHSA-6chq-wfr3-2hj9 HIGH Axios: Header Injection via Prototype Pollution 1.7.2 1.15.1 -
axios CVE-2026-42035 HIGH Axios: Header Injection via Prototype Pollution 1.7.2 - -
axios GHSA-777c-7fjr-54vf HIGH Allocation of Resources Without Limits or Throttling in Axios 1.7.2 1.16.0 -
axios CVE-2026-44488 HIGH Axios: Allocation of Resources Without Limits or Throttling in axios 1.7.2 - -
axios CVE-2026-42043 HIGH Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0 1.7.2 - -
axios GHSA-pmwg-cvhr-8vh7 HIGH Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0 1.7.2 1.15.1 -
axios GHSA-jr5f-v2jv-69x6 HIGH axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL 1.7.2 1.8.2 -
axios CVE-2025-27152 HIGH Possible SSRF and Credential Leakage via Absolute URL in axios Requests 1.7.2 - -
basic-ftp GHSA-rp42-5vxx-qpwr HIGH basic-ftp vulnerable to denial of service via unbounded memory consumption in Client.list() 5.0.5 5.3.0 -
basic-ftp CVE-2026-41324 HIGH basic-ftp vulnerable to denial of service via unbounded memory consumption in Client.list() 5.0.5 - -
basic-ftp GHSA-6v7q-wjvx-w8wg HIGH basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Execution via Credentials and MKD Commands 5.0.5 5.2.2 -
basic-ftp GHSA-rpmf-866q-6p89 HIGH basic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response buffering 5.0.5 5.3.1 -
basic-ftp CVE-2026-44240 HIGH basic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response buffering 5.0.5 - -
brace-expansion GHSA-3jxr-9vmj-r5cp HIGH brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups 1.1.11 5.0.7 -
brace-expansion GHSA-rgw5-rvv9-x895 HIGH brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation 1.1.11 1.1.18 -
brace-expansion CVE-2026-14257 HIGH brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash 2.0.1 - -
brace-expansion GHSA-mh99-v99m-4gvg HIGH brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash 2.0.1 5.0.8 -
brace-expansion CVE-2026-69152 HIGH brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation 2.0.1 - -
brace-expansion GHSA-rgw5-rvv9-x895 HIGH brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation 2.0.1 1.1.18 -
brace-expansion CVE-2026-13149 HIGH - 2.0.1 - -
brace-expansion CVE-2026-14257 HIGH brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash 1.1.11 - -
brace-expansion GHSA-mh99-v99m-4gvg HIGH brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash 1.1.11 5.0.8 -
brace-expansion CVE-2026-13149 HIGH - 1.1.11 - -
brace-expansion GHSA-3jxr-9vmj-r5cp HIGH brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups 2.0.1 5.0.7 -
brace-expansion CVE-2026-69152 HIGH brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation 1.1.11 - -
fast-xml-parser CVE-2026-33036 HIGH fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278) 4.2.5 - -
fast-xml-parser GHSA-jmr7-xgp7-cmfj HIGH fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit) 4.2.5 4.5.4 -
fast-xml-parser CVE-2026-26278 HIGH fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit) 4.2.5 - -
fast-xml-parser GHSA-8gc5-j5rx-235r HIGH fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278) 4.2.5 5.5.6 -
form-data CVE-2026-12143 HIGH form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection) 2.3.3 - -
form-data GHSA-hmw2-7cc7-3qxx HIGH form-data: CRLF injection in form-data via unescaped multipart field names and filenames 2.3.3 2.5.6 -
form-data GHSA-hmw2-7cc7-3qxx HIGH form-data: CRLF injection in form-data via unescaped multipart field names and filenames 4.0.0 2.5.6 -
form-data CVE-2026-12143 HIGH form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection) 4.0.0 - -
immutable GHSA-v56q-mh7h-f735 HIGH Immutable.js List 32-bit trie overflow → unrecoverable DoS 4.3.5 4.3.9 -
immutable CVE-2026-29063 HIGH Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable 4.3.5 - -
immutable GHSA-wf6x-7x77-mvgw HIGH Immutable is vulnerable to Prototype Pollution 4.3.5 4.3.8 -
immutable GHSA-xvcm-6775-5m9r HIGH Immutable: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set 4.3.5 4.3.9 -
immutable CVE-2026-59879 HIGH Immutable.js List 32-bit trie overflow → unrecoverable DoS 4.3.5 - -
immutable CVE-2026-59880 HIGH Immutable.js: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set 4.3.5 - -
minimatch CVE-2026-27903 HIGH minimatch has a ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments 5.1.0 - -
minimatch GHSA-7r86-cg39-jmmj HIGH minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments 5.1.0 10.2.3 -
minimatch CVE-2026-26996 HIGH minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern 3.0.4 - -
minimatch GHSA-23c5-xmqv-rm74 HIGH minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions 5.1.0 10.2.3 -
minimatch CVE-2026-27904 HIGH minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions 5.1.0 - -
minimatch CVE-2026-27904 HIGH minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions 3.0.4 - -
minimatch GHSA-3ppc-4f35-3m26 HIGH minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern 5.1.0 10.2.1 -
minimatch CVE-2026-26996 HIGH minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern 5.1.0 - -
minimatch GHSA-3ppc-4f35-3m26 HIGH minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern 3.0.4 10.2.1 -
minimatch CVE-2022-3517 HIGH - 3.0.4 - -
minimatch CVE-2026-27903 HIGH minimatch has a ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments 3.0.4 - -
minimatch GHSA-7r86-cg39-jmmj HIGH minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments 9.0.5 10.2.3 -
minimatch CVE-2026-27903 HIGH minimatch has a ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments 9.0.5 - -
minimatch GHSA-3ppc-4f35-3m26 HIGH minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern 9.0.5 10.2.1 -
minimatch GHSA-7r86-cg39-jmmj HIGH minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments 3.0.4 10.2.3 -
minimatch CVE-2026-27904 HIGH minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions 9.0.5 - -
minimatch GHSA-f8q6-p94x-37v3 HIGH minimatch ReDoS vulnerability 3.0.4 3.0.5 -
minimatch GHSA-23c5-xmqv-rm74 HIGH minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions 3.0.4 10.2.3 -
minimatch CVE-2026-26996 HIGH minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern 9.0.5 - -
minimatch GHSA-23c5-xmqv-rm74 HIGH minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions 9.0.5 10.2.3 -
node-forge CVE-2026-33894 HIGH Forge has signature forgery in RSA-PKCS due to ASN.1 extra field 1.3.1 - -
node-forge CVE-2025-12816 HIGH CVE-2025-12816 1.3.1 - -
node-forge GHSA-2328-f5f3-gj25 HIGH Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation) 1.3.1 1.4.0 -
node-forge GHSA-5gfm-wpxj-wjgq HIGH node-forge has an Interpretation Conflict vulnerability via its ASN.1 Validator Desynchronization 1.3.1 1.3.2 -
node-forge CVE-2026-33896 HIGH Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation) 1.3.1 - -
node-forge GHSA-554w-wpv2-vw27 HIGH node-forge has ASN.1 Unbounded Recursion 1.3.1 1.3.2 -
node-forge CVE-2025-66031 HIGH node-forge ASN.1 Unbounded Recursion 1.3.1 - -
node-forge GHSA-ppp5-5v6c-4jwp HIGH Forge has signature forgery in RSA-PKCS due to ASN.1 extra field 1.3.1 1.4.0 -
node-forge CVE-2026-85393 HIGH node-forge through 1.4.0 RSA PKCS#1 v1.5 Signature Forgery via Nested DigestAlgorithm Padding 1.3.1 - -
node-forge CVE-2026-33891 HIGH Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input 1.3.1 - -
node-forge GHSA-q67f-28xg-22rw HIGH Forge has signature forgery in Ed25519 due to missing S > L check 1.3.1 1.4.0 -
node-forge CVE-2026-33895 HIGH Forge has signature forgery in Ed25519 due to missing S > L check 1.3.1 - -
node-forge GHSA-5m6q-g25r-mvwx HIGH Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input 1.3.1 1.4.0 -
protobufjs CVE-2026-48712 HIGH protobufjs: Denial of service through unbounded Any expansion during JSON conversion 7.3.0 - -
protobufjs CVE-2026-44293 HIGH protobufjs: Code injection through bytes field defaults in generated toObject code 7.3.0 - -
protobufjs CVE-2026-44289 HIGH protobufjs: Denial of service through unbounded protobuf recursion 7.3.0 - -
protobufjs GHSA-jvwf-75h9-cwgg HIGH protobuf.js: Process-wide denial of service through unsafe option paths 7.3.0 7.5.6 -
protobufjs CVE-2026-44290 HIGH protobufjs: Process-wide denial of service through unsafe option paths 7.3.0 - -
protobufjs GHSA-75px-5xx7-5xc7 HIGH protobuf.js: Code generation gadget after prototype pollution 7.3.0 7.5.6 -
protobufjs GHSA-685m-2w69-288q HIGH protobuf.js: Denial of service through unbounded protobuf recursion 7.3.0 7.5.6 -
protobufjs CVE-2026-44291 HIGH protobufjs: Code generation gadget after prototype pollution 7.3.0 - -
protobufjs GHSA-66ff-xgx4-vchm HIGH protobuf.js: Code injection through bytes field defaults in generated toObject code 7.3.0 7.5.6 -
protobufjs GHSA-wcpc-wj8m-hjx6 HIGH protobufjs: Denial of service through unbounded Any expansion during JSON conversion 7.3.0 7.6.1 -
simple-git GHSA-jcxm-m3jx-f287 HIGH simple-git Affected by Command Execution via Option-Parsing Bypass 3.16.0 3.32.0 -
simple-git CVE-2026-6951 HIGH - 3.16.0 - -
simple-git CVE-2026-28291 HIGH simple-git has Command Execution via Option-Parsing Bypass 3.16.0 - -
simple-git GHSA-hffm-xvc3-vprc HIGH simple-git is vulnerable to Remote Code Execution 3.16.0 3.36.0 -
ℹ️ Other Vulnerabilities (60)
Package CVE Severity Summary Unsafe Version Fixed In Case
axios GHSA-fvcv-3m26-pcqx MODERATE Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain 1.7.2 1.15.0 -
axios GHSA-62hf-57xw-28j9 MODERATE Axios: unbounded recursion in toFormData causes DoS via deeply nested request data 1.7.2 1.15.1 -
axios GHSA-898c-q2cr-xwhg MODERATE axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions 1.7.2 1.16.0 -
axios GHSA-m7pr-hjqh-92cm MODERATE Axios: no_proxy bypass via IP alias allows SSRF 1.7.2 1.15.1 -
axios CVE-2026-42038 MODERATE Axios: no_proxy bypass via IP alias allows SSRF 1.7.2 - -
axios GHSA-jqh4-m9w3-8hp9 MODERATE Axios: Fetch adapter ReadableStream uploads bypass maxBodyLength 1.7.2 1.18.0 -
axios CVE-2025-62718 MODERATE Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF 1.7.2 - -
axios GHSA-42h9-826w-cgv3 MODERATE Axios: Excessive recursion in formDataToJSON can cause denial of service 1.7.2 0.33.0 -
axios CVE-2026-67317 MODERATE axios 1.7.0 before 1.18.0 maxBodyLength Bypass via ReadableStream 1.7.2 - -
axios GHSA-xx6v-rp6x-q39c MODERATE Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in withXSRFToken Boolean Coercion 1.7.2 1.15.1 -
axios CVE-2026-42042 MODERATE Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in withXSRFToken Boolean Coercion 1.7.2 - -
axios GHSA-pmv8-rq9r-6j72 MODERATE Axios: Deep formToJSON Key Recursion Can Cause Denial of Service 1.7.2 0.33.0 -
axios GHSA-5c9x-8gcm-mpgx MODERATE Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0 1.7.2 1.15.1 -
axios CVE-2026-67313 MODERATE axios 0.28.0 before 1.18.0 Denial of Service via formDataToJSON 1.7.2 - -
axios CVE-2026-67312 MODERATE axios 0.28.0 before 0.33.0 Denial of Service via formToJSON 1.7.2 - -
axios GHSA-3p68-rc4w-qgx5 MODERATE Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF 1.7.2 1.15.0 -
axios GHSA-mmx7-hfxf-jppx MODERATE Axios: Prototype pollution gadgets can alter axios request construction 1.7.2 1.18.0 -
axios CVE-2026-42036 MODERATE Axios: HTTP adapter streamed responses bypass maxContentLength 1.7.2 - -
axios CVE-2026-42034 MODERATE Axios: HTTP adapter streamed uploads bypass maxBodyLength when maxRedirects: 0 1.7.2 - -
axios CVE-2026-67316 MODERATE axios before 1.18.0 Prototype Pollution via bodyless methods 1.7.2 - -
axios GHSA-7q8q-rj6j-mhjq MODERATE Axios: Nested axios option objects can consume polluted prototype values 1.7.2 0.33.0 -
axios CVE-2026-42037 MODERATE Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream 1.7.2 - -
axios GHSA-w9j2-pvgh-6h63 MODERATE Axios: Authentication Bypass via Prototype Pollution Gadget in validateStatus Merge Strategy 1.7.2 1.15.1 -
axios CVE-2026-40175 MODERATE Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain 1.7.2 - -
axios CVE-2026-44490 MODERATE Axios: DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions 1.7.2 - -
axios GHSA-vf2m-468p-8v99 MODERATE Axios: HTTP adapter streamed responses bypass maxContentLength 1.7.2 1.15.1 -
axios GHSA-445q-vr5w-6q77 MODERATE Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream 1.7.2 1.15.1 -
axios CVE-2026-42041 MODERATE Axios: Authentication Bypass via Prototype Pollution Gadget in validateStatus Merge Strategy 1.7.2 - -
axios CVE-2026-42044 MODERATE Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in parseReviver 1.7.2 - -
axios GHSA-3w6x-2g7m-8v23 MODERATE Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in parseReviver 1.7.2 1.15.2 -
axios CVE-2026-42039 MODERATE Axios: unbounded recursion in toFormData causes DoS via deeply nested request data 1.7.2 - -
axios CVE-2026-67319 MODERATE axios before 0.33.0 Prototype Pollution via nested option objects 1.7.2 - -
brace-expansion CVE-2026-33750 MODERATE brace-expansion: Zero-step sequence causes process hang and memory exhaustion 1.1.11 - -
brace-expansion GHSA-f886-m6hf-6m8v MODERATE brace-expansion: Zero-step sequence causes process hang and memory exhaustion 1.1.11 5.0.5 -
brace-expansion CVE-2026-33750 MODERATE brace-expansion: Zero-step sequence causes process hang and memory exhaustion 2.0.1 - -
brace-expansion GHSA-f886-m6hf-6m8v MODERATE brace-expansion: Zero-step sequence causes process hang and memory exhaustion 2.0.1 5.0.5 -
fast-xml-parser CVE-2026-41650 MODERATE fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters 4.2.5 - -
fast-xml-parser GHSA-gh4j-gqv2-49f6 MODERATE fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters 4.2.5 5.7.0 -
fast-xml-parser CVE-2026-33349 MODERATE fast-xml-parser: Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation 4.2.5 - -
fast-xml-parser GHSA-jp2q-39xq-3w4g MODERATE Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parser 4.2.5 4.5.5 -
node-forge GHSA-65ch-62r8-g69g MODERATE node-forge is vulnerable to ASN.1 OID Integer Truncation 1.3.1 1.3.2 -
node-forge CVE-2025-66030 MODERATE node-forge ASN.1 OID Integer Truncation 1.3.1 - -
protobufjs GHSA-jggg-4jg4-v7c6 MODERATE protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion 7.3.0 7.5.8 -
protobufjs CVE-2026-45740 MODERATE protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion 7.3.0 - -
protobufjs GHSA-fx83-v9x8-x52w MODERATE protobuf.js: Prototype injection in generated message constructors 7.3.0 7.5.6 -
protobufjs CVE-2026-44288 MODERATE protobufjs: Overlong UTF-8 decoding 7.3.0 - -
protobufjs GHSA-q6x5-8v7m-xcrf MODERATE protobufjs has overlong UTF-8 decoding 7.3.0 7.5.6 -
protobufjs CVE-2026-54269 MODERATE protobufjs: Schema-derived names can shadow runtime-significant properties 7.3.0 - -
protobufjs GHSA-f38q-mgvj-vph7 MODERATE protobufjs : Schema-derived names can shadow runtime-significant properties 7.3.0 7.6.3 -
protobufjs CVE-2026-44294 MODERATE protobufjs: Denial of service from crafted field names in generated code 7.3.0 - -
protobufjs GHSA-2pr8-phx7-x9h3 MODERATE protobuf.js: Denial of service from crafted field names in generated code 7.3.0 7.5.6 -
protobufjs CVE-2026-44292 MODERATE protobufjs: Prototype injection in generated message constructors 7.3.0 - -
axios GHSA-xhjh-pmcv-23jw LOW Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams 1.7.2 1.15.1 -
axios CVE-2026-42040 LOW Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams 1.7.2 - -
brace-expansion GHSA-v6h2-p8h4-qcjw LOW brace-expansion Regular Expression Denial of Service vulnerability 2.0.1 2.0.2 -
brace-expansion CVE-2025-5889 LOW juliangruber brace-expansion index.js expand redos 1.1.11 - -
brace-expansion GHSA-v6h2-p8h4-qcjw LOW brace-expansion Regular Expression Denial of Service vulnerability 1.1.11 2.0.2 -
brace-expansion CVE-2025-5889 LOW juliangruber brace-expansion index.js expand redos 2.0.1 - -
fast-xml-parser CVE-2026-27942 LOW fast-xml-parser has stack overflow in XMLBuilder with preserveOrder 4.2.5 - -
fast-xml-parser GHSA-fj3w-jwp8-x2g3 LOW fast-xml-parser has stack overflow in XMLBuilder with preserveOrder 4.2.5 5.3.8 -

Review Checklist

Standard review:

  • Review changes for compatibility with your code
  • Check for breaking changes in release notes
  • Run tests locally or wait for CI
  • Approve and merge this PR

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System

@dd-octo-sts
dd-octo-sts Bot marked this pull request as ready for review September 7, 2026 20:11
@dd-octo-sts
dd-octo-sts Bot requested review from a team as code owners September 7, 2026 20:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

adms-critical-severity adms-dependency-update adms-high-severity adms-low-severity adms-medium-severity adms-minor-update adms-mode-all-vulns adms-npm campaigner-automated-change

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants