Skip to content

fix(deps): vuln minor upgrades — 12 packages (minor: 8 · patch: 4) - #295

Draft
gh-worker-campaigns-3e9aa4[bot] wants to merge 1 commit into
mainfrom
engraver-auto-version-upgrade/minorpatch/npm/0-1786950273
Draft

fix(deps): vuln minor upgrades — 12 packages (minor: 8 · patch: 4) #295
gh-worker-campaigns-3e9aa4[bot] wants to merge 1 commit into
mainfrom
engraver-auto-version-upgrade/minorpatch/npm/0-1786950273

Conversation

@gh-worker-campaigns-3e9aa4

@gh-worker-campaigns-3e9aa4 gh-worker-campaigns-3e9aa4 Bot commented Aug 17, 2026

Copy link
Copy Markdown
Contributor

Summary: Critical-severity security update — 15 packages upgraded (MINOR changes included)

Manifests changed:

  • . (yarn)

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

Updates

Package From To Type Dep Type Vulnerabilities Fixed
handlebars 4.7.8 4.7.9 patch Transitive 2 CRITICAL, 8 HIGH, 3 MEDIUM, 1 LOW
basic-ftp 5.0.5 5.3.1 minor Transitive 2 CRITICAL, 5 HIGH
fast-uri 3.0.6 3.1.5 minor Transitive 10 HIGH
undici 6.23.0 6.28.0 minor Transitive 8 HIGH, 12 MEDIUM, 4 LOW
brace-expansion 5.0.4 5.0.9 patch Transitive 6 HIGH, 4 MEDIUM
brace-expansion 2.0.1 2.1.4 minor Transitive 6 HIGH, 2 MEDIUM, 2 LOW
brace-expansion 1.1.11 1.1.18 patch Transitive 6 HIGH, 2 MEDIUM, 2 LOW
minimatch 9.0.5 9.0.9 patch Transitive 6 HIGH
lodash 4.17.21 4.18.1 minor Transitive 4 HIGH, 4 MEDIUM
flatted 3.3.3 3.4.4 minor Transitive 4 HIGH
js-yaml 3.14.2 3.15.1 minor Transitive 3 HIGH, 2 MEDIUM
axios 1.16.0 1.19.0 minor Direct 2 HIGH, 18 MEDIUM
fast-xml-parser 5.5.1 5.10.1 minor Transitive 2 HIGH, 4 MEDIUM
picomatch 2.3.1 2.3.2 patch Transitive 2 HIGH, 2 MEDIUM
picomatch 4.0.3 4.0.5 patch Transitive 2 HIGH, 2 MEDIUM

Security Details

🚨 Critical & High Severity (78 fixed)
Package CVE Severity Summary Unsafe Version Fixed In Case
basic-ftp CVE-2026-27699 CRITICAL Basic FTP has Path Traversal Vulnerability in its downloadToDir() method 5.0.5 - -
basic-ftp GHSA-5rq4-664w-9x2c CRITICAL Basic FTP has Path Traversal Vulnerability in its downloadToDir() method 5.0.5 5.2.0 -
handlebars CVE-2026-33937 CRITICAL Handlebars.js has JavaScript Injection via AST Type Confusion 4.7.8 - -
handlebars GHSA-2w6w-674q-4c4q CRITICAL Handlebars.js has JavaScript Injection via AST Type Confusion 4.7.8 4.7.9 -
axios GHSA-gcfj-64vw-6mp9 HIGH Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning 1.16.0 0.33.0 -
axios CVE-2026-67320 HIGH axios before 0.33.0 Prototype Pollution via Node HTTP adapter 1.16.0 - -
basic-ftp CVE-2026-44240 HIGH basic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response buffering 5.0.5 - -
basic-ftp GHSA-rpmf-866q-6p89 HIGH basic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response buffering 5.0.5 5.3.1 -
basic-ftp GHSA-6v7q-wjvx-w8wg HIGH basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Execution via Credentials and MKD Commands 5.0.5 5.2.2 -
basic-ftp CVE-2026-41324 HIGH basic-ftp vulnerable to denial of service via unbounded memory consumption in Client.list() 5.0.5 - -
basic-ftp GHSA-rp42-5vxx-qpwr HIGH basic-ftp vulnerable to denial of service via unbounded memory consumption in Client.list() 5.0.5 5.3.0 -
brace-expansion CVE-2026-69152 HIGH brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation 5.0.4 - -
brace-expansion CVE-2026-13149 HIGH - 5.0.4 - -
brace-expansion GHSA-3jxr-9vmj-r5cp HIGH brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups 5.0.4 5.0.7 -
brace-expansion CVE-2026-13149 HIGH - 2.0.1 - -
brace-expansion GHSA-3jxr-9vmj-r5cp HIGH brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups 2.0.1 5.0.7 -
brace-expansion CVE-2026-69152 HIGH brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation 2.0.1 - -
brace-expansion GHSA-mh99-v99m-4gvg HIGH brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash 1.1.11 5.0.8 -
brace-expansion CVE-2026-14257 HIGH brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash 5.0.4 - -
brace-expansion GHSA-rgw5-rvv9-x895 HIGH brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation 5.0.4 1.1.18 -
brace-expansion GHSA-rgw5-rvv9-x895 HIGH brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation 2.0.1 1.1.18 -
brace-expansion GHSA-mh99-v99m-4gvg HIGH brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash 5.0.4 5.0.8 -
brace-expansion CVE-2026-13149 HIGH - 1.1.11 - -
brace-expansion GHSA-3jxr-9vmj-r5cp HIGH brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups 1.1.11 5.0.7 -
brace-expansion CVE-2026-69152 HIGH brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation 1.1.11 - -
brace-expansion GHSA-rgw5-rvv9-x895 HIGH brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation 1.1.11 1.1.18 -
brace-expansion CVE-2026-14257 HIGH brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash 1.1.11 - -
brace-expansion GHSA-mh99-v99m-4gvg HIGH brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash 2.0.1 5.0.8 -
brace-expansion CVE-2026-14257 HIGH brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash 2.0.1 - -
fast-uri GHSA-7p8r-x3mc-p8w7 HIGH fast-uri vulnerable to host confusion via backslash authority introducer 3.0.6 2.4.4 -
fast-uri CVE-2026-18446 HIGH fast-uri vulnerable to host confusion via backslash authority introducer 3.0.6 - -
fast-uri CVE-2026-6321 HIGH fast-uri vulnerable to path traversal via percent-encoded dot segments 3.0.6 - -
fast-uri GHSA-q3j6-qgpj-74h6 HIGH fast-uri vulnerable to path traversal via percent-encoded dot segments 3.0.6 3.1.1 -
fast-uri GHSA-4c8g-83qw-93j6 HIGH fast-uri vulnerable to host confusion via failed IDN canonicalization 3.0.6 4.0.1 -
fast-uri CVE-2026-16221 HIGH fast-uri vulnerable to host confusion via literal backslash authority delimiter 3.0.6 - -
fast-uri GHSA-v2hh-gcrm-f6hx HIGH fast-uri vulnerable to host confusion via literal backslash authority delimiter 3.0.6 2.4.3 -
fast-uri CVE-2026-13676 HIGH fast-uri vulnerable to host confusion via failed IDN canonicalization 3.0.6 - -
fast-uri CVE-2026-6322 HIGH fast-uri vulnerable to host confusion via percent-encoded authority delimiters 3.0.6 - -
fast-uri GHSA-v39h-62p7-jpjc HIGH fast-uri vulnerable to host confusion via percent-encoded authority delimiters 3.0.6 3.1.2 -
fast-xml-parser CVE-2026-33036 HIGH fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278) 5.5.1 - -
fast-xml-parser GHSA-8gc5-j5rx-235r HIGH fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278) 5.5.1 5.5.6 -
flatted GHSA-rf6f-7fwh-wjgh HIGH Prototype Pollution via parse() in NodeJS flatted 3.3.3 3.4.2 -
flatted CVE-2026-32141 HIGH flatted: Unbounded recursion DoS in parse() revive phase 3.3.3 - -
flatted GHSA-25h7-pfq9-p65f HIGH flatted vulnerable to unbounded recursion DoS in parse() revive phase 3.3.3 3.4.0 -
flatted CVE-2026-33228 HIGH flatted: Prototype Pollution via parse() 3.3.3 - -
handlebars CVE-2026-33940 HIGH Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial 4.7.8 - -
handlebars GHSA-3mfm-83xf-c92r HIGH Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block 4.7.8 4.7.9 -
handlebars CVE-2026-33938 HIGH Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block 4.7.8 - -
handlebars GHSA-xjpj-3mr7-gcpf HIGH Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options 4.7.8 4.7.9 -
handlebars CVE-2026-33941 HIGH Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options 4.7.8 - -
handlebars GHSA-xhpv-hc6g-r9c6 HIGH Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial 4.7.8 4.7.9 -
handlebars GHSA-9cx6-37pm-9jff HIGH Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation 4.7.8 4.7.9 -
handlebars CVE-2026-33939 HIGH Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation 4.7.8 - -
js-yaml GHSA-52cp-r559-cp3m HIGH js-yaml: YAML merge-key chains can force quadratic CPU consumption 3.14.2 3.15.0 -
js-yaml GHSA-5p4m-2wfm-xmqj HIGH JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported 3.14.2 4.3.1 -
js-yaml CVE-2026-59869 HIGH js-yaml: YAML merge-key chains can force quadratic CPU consumption 3.14.2 - -
lodash GHSA-r5fr-rjxr-66jc HIGH lodash vulnerable to Code Injection via _.template imports key names 4.17.21 4.18.0 -
lodash GHSA-35jh-r3h4-6jhm HIGH Command Injection in lodash 4.17.21 4.17.21 -
lodash CVE-2026-4800 HIGH lodash vulnerable to Code Injection via _.template imports key names 4.17.21 - -
lodash CVE-2021-23337 HIGH - 4.17.21 - -
minimatch GHSA-23c5-xmqv-rm74 HIGH minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions 9.0.5 10.2.3 -
minimatch CVE-2026-26996 HIGH minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern 9.0.5 - -
minimatch GHSA-3ppc-4f35-3m26 HIGH minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern 9.0.5 10.2.1 -
minimatch CVE-2026-27904 HIGH minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions 9.0.5 - -
minimatch CVE-2026-27903 HIGH minimatch has a ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments 9.0.5 - -
minimatch GHSA-7r86-cg39-jmmj HIGH minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments 9.0.5 10.2.3 -
picomatch GHSA-c2c7-rcm5-vvqj HIGH Picomatch has a ReDoS vulnerability via extglob quantifiers 2.3.1 4.0.4 -
picomatch CVE-2026-33671 HIGH Picomatch has a ReDoS vulnerability via extglob quantifiers 2.3.1 - -
picomatch GHSA-c2c7-rcm5-vvqj HIGH Picomatch has a ReDoS vulnerability via extglob quantifiers 4.0.3 4.0.4 -
picomatch CVE-2026-33671 HIGH Picomatch has a ReDoS vulnerability via extglob quantifiers 4.0.3 - -
undici CVE-2026-1526 HIGH undici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate Decompression 6.23.0 - -
undici GHSA-v9p9-hfj2-hcw8 HIGH Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation 6.23.0 6.24.0 -
undici GHSA-vxpw-j846-p89q HIGH undici WebSocket client vulnerable to denial of service via fragment count bypass 6.23.0 6.27.0 -
undici CVE-2026-12151 HIGH undici WebSocket client vulnerable to denial of service via fragment count bypass 6.23.0 - -
undici GHSA-vrm6-8vpv-qv8q HIGH Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression 6.23.0 6.24.0 -
undici CVE-2026-1528 HIGH undici is vulnerable to Malicious WebSocket 64-bit length overflows undici parser and crashes the client 6.23.0 - -
undici GHSA-f269-vfmq-vjvj HIGH Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client 6.23.0 6.24.0 -
undici CVE-2026-2229 HIGH undici is vulnerable to Unhandled Exception in undici WebSocket Client Due to Invalid server_max_window_bits Validation 6.23.0 - -
ℹ️ Other Vulnerabilities (64)
Package CVE Severity Summary Unsafe Version Fixed In Case
axios CVE-2026-67315 MODERATE axios 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 NO_PROXY Bypass via 0.0.0.0 1.16.0 - -
axios CVE-2026-67314 MODERATE axios before 1.18.0 Prototype Pollution via auth subfields 1.16.0 - -
axios CVE-2026-67313 MODERATE axios 0.28.0 before 1.18.0 Denial of Service via formDataToJSON 1.16.0 - -
axios GHSA-hcpx-6fm6-wx23 MODERATE Axios form serializer maxDepth bypass via {} metatoken 1.16.0 0.33.0 -
axios CVE-2026-67319 MODERATE axios before 0.33.0 Prototype Pollution via nested option objects 1.16.0 - -
axios GHSA-42h9-826w-cgv3 MODERATE Axios: Excessive recursion in formDataToJSON can cause denial of service 1.16.0 0.33.0 -
axios GHSA-f4gw-2p7v-4548 MODERATE Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios 1.16.0 1.18.0 -
axios CVE-2026-67318 MODERATE axios 1.13.0 before 1.18.0 maxBodyLength Bypass via HTTP/2 1.16.0 - -
axios CVE-2026-67321 MODERATE axios 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 Denial of Service via maxDepth bypass 1.16.0 - -
axios GHSA-mmx7-hfxf-jppx MODERATE Axios: Prototype pollution gadgets can alter axios request construction 1.16.0 1.18.0 -
axios CVE-2026-67316 MODERATE axios before 1.18.0 Prototype Pollution via bodyless methods 1.16.0 - -
axios GHSA-pmv8-rq9r-6j72 MODERATE Axios: Deep formToJSON Key Recursion Can Cause Denial of Service 1.16.0 0.33.0 -
axios CVE-2026-67312 MODERATE axios 0.28.0 before 0.33.0 Denial of Service via formToJSON 1.16.0 - -
axios GHSA-jqh4-m9w3-8hp9 MODERATE Axios: Fetch adapter ReadableStream uploads bypass maxBodyLength 1.16.0 1.18.0 -
axios CVE-2026-67317 MODERATE axios 1.7.0 before 1.18.0 maxBodyLength Bypass via ReadableStream 1.16.0 - -
axios GHSA-mwf2-3pr3-8698 MODERATE Axios: HTTP/2 streamed uploads bypass maxBodyLength 1.16.0 1.18.0 -
axios GHSA-xj6q-8x83-jv6g MODERATE Axios: Prototype pollution auth subfields can inject Basic auth 1.16.0 1.18.0 -
axios GHSA-7q8q-rj6j-mhjq MODERATE Axios: Nested axios option objects can consume polluted prototype values 1.16.0 0.33.0 -
brace-expansion CVE-2026-33750 MODERATE brace-expansion: Zero-step sequence causes process hang and memory exhaustion 5.0.4 - -
brace-expansion GHSA-f886-m6hf-6m8v MODERATE brace-expansion: Zero-step sequence causes process hang and memory exhaustion 2.0.1 5.0.5 -
brace-expansion GHSA-f886-m6hf-6m8v MODERATE brace-expansion: Zero-step sequence causes process hang and memory exhaustion 5.0.4 5.0.5 -
brace-expansion CVE-2026-33750 MODERATE brace-expansion: Zero-step sequence causes process hang and memory exhaustion 2.0.1 - -
brace-expansion CVE-2026-45149 MODERATE brace-expansion: Large numeric range defeats documented max DoS protection 5.0.4 - -
brace-expansion GHSA-jxxr-4gwj-5jf2 MODERATE brace-expansion: Large numeric range defeats documented max DoS protection 5.0.4 5.0.6 -
brace-expansion GHSA-f886-m6hf-6m8v MODERATE brace-expansion: Zero-step sequence causes process hang and memory exhaustion 1.1.11 5.0.5 -
brace-expansion CVE-2026-33750 MODERATE brace-expansion: Zero-step sequence causes process hang and memory exhaustion 1.1.11 - -
fast-xml-parser GHSA-gh4j-gqv2-49f6 MODERATE fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters 5.5.1 5.7.0 -
fast-xml-parser CVE-2026-33349 MODERATE fast-xml-parser: Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation 5.5.1 - -
fast-xml-parser GHSA-jp2q-39xq-3w4g MODERATE Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parser 5.5.1 4.5.5 -
fast-xml-parser CVE-2026-41650 MODERATE fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters 5.5.1 - -
handlebars GHSA-7rx3-28cr-v5wh MODERATE Handlebars.js has a Prototype Method Access Control Gap via Missing lookupSetter Blocklist Entry 4.7.8 4.7.9 -
handlebars CVE-2026-33916 MODERATE Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection 4.7.8 - -
handlebars GHSA-2qvq-rjwj-gvw9 MODERATE Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection 4.7.8 4.7.9 -
js-yaml GHSA-h67p-54hq-rp68 MODERATE JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases 3.14.2 4.2.0 -
js-yaml CVE-2026-53550 MODERATE js-yaml: Quadratic-complexity DoS in merge key handling via repeated aliases 3.14.2 - -
lodash GHSA-xxjr-mmjv-4gpg MODERATE Lodash has Prototype Pollution Vulnerability in _.unset and _.omit functions 4.17.21 4.17.23 -
lodash GHSA-f23m-r3pf-42rh MODERATE lodash vulnerable to Prototype Pollution via array path bypass in _.unset and _.omit 4.17.21 4.18.0 -
lodash CVE-2026-2950 MODERATE lodash vulnerable to Prototype Pollution via array path bypass in _.unset and _.omit 4.17.21 - -
lodash CVE-2025-13465 MODERATE Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions 4.17.21 - -
picomatch CVE-2026-33672 MODERATE Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching 2.3.1 - -
picomatch GHSA-3v7f-55p6-f55p MODERATE Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching 2.3.1 4.0.4 -
picomatch GHSA-3v7f-55p6-f55p MODERATE Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching 4.0.3 4.0.4 -
picomatch CVE-2026-33672 MODERATE Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching 4.0.3 - -
undici CVE-2026-16729 MODERATE undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields 6.23.0 - -
undici GHSA-m8rv-5g2x-5cg5 MODERATE undici vulnerable to CRLF Injection via blob-like body 'type' property 6.23.0 6.28.0 -
undici GHSA-4992-7rv2-5pvq MODERATE Undici has CRLF Injection in undici via upgrade option 6.23.0 6.24.0 -
undici CVE-2026-15157 MODERATE undici vulnerable to CRLF Injection via blob-like body 'type' property 6.23.0 - -
undici CVE-2026-1527 MODERATE undici is vulnerable to CRLF Injection via upgrade option 6.23.0 - -
undici GHSA-2mjp-6q6p-2qxm MODERATE Undici has an HTTP Request/Response Smuggling issue 6.23.0 6.24.0 -
undici CVE-2026-1525 MODERATE undici is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') 6.23.0 - -
undici GHSA-8xcm-r25x-g524 MODERATE undici vulnerable to downstream response desynchronization via retry interceptor 6.23.0 6.28.0 -
undici GHSA-v3r7-h72x-cjcm MODERATE undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields 6.23.0 6.28.0 -
undici CVE-2026-16728 MODERATE undici vulnerable to downstream response desynchronization via retry interceptor 6.23.0 - -
undici GHSA-p88m-4jfj-68fv MODERATE undici vulnerable to HTTP header injection via Set-Cookie percent-decoding 6.23.0 6.27.0 -
undici CVE-2026-9679 MODERATE undici vulnerable to HTTP header injection via Set-Cookie percent-decoding 6.23.0 - -
brace-expansion GHSA-v6h2-p8h4-qcjw LOW brace-expansion Regular Expression Denial of Service vulnerability 1.1.11 2.0.2 -
brace-expansion GHSA-v6h2-p8h4-qcjw LOW brace-expansion Regular Expression Denial of Service vulnerability 2.0.1 2.0.2 -
brace-expansion CVE-2025-5889 LOW juliangruber brace-expansion index.js expand redos 1.1.11 - -
brace-expansion CVE-2025-5889 LOW juliangruber brace-expansion index.js expand redos 2.0.1 - -
handlebars GHSA-442j-39wm-28r2 LOW Handlebars.js has a Property Access Validation Bypass in container.lookup 4.7.8 4.7.9 -
undici CVE-2026-6733 LOW undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse 6.23.0 - -
undici GHSA-g8m3-5g58-fq7m LOW undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching 6.23.0 6.27.0 -
undici CVE-2026-11525 LOW undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching 6.23.0 - -
undici GHSA-35p6-xmwp-9g52 LOW undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse 6.23.0 6.27.0 -

Review Checklist

Standard review:

  • Review changes for compatibility with your code
  • Check for breaking changes in release notes
  • Run tests locally or wait for CI
  • Approve and merge this PR

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

adms-critical-severity adms-dependency-update adms-high-severity adms-low-severity adms-medium-severity adms-minor-update adms-mode-all-vulns adms-npm campaigner-automated-change

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants