Data

Tools

Indexes

Applications

Experiments

Dependabot

An open index of dependabot pull requests across open source projects.

chore(deps): bump the npm_and_yarn group across 2 directories with 16 updates

Open
Number: #941
Type: Pull Request
State: Open
Author: dependabot[bot] dependabot[bot]
Association: Unknown
Comments: 2
Created: May 07, 2026 at 05:48 AM UTC
(about 1 month ago)
Updated: May 15, 2026 at 01:18 AM UTC
(24 days ago)
Labels:
dependencies no-pr-activity javascript
Description:

Bumps the npm_and_yarn group with 14 updates in the / directory:

Package From To
fastify 4.29.0 5.8.5
undici 6.20.1 6.24.0
ajv 8.17.1 8.20.0
defu 6.1.4 6.1.7
follow-redirects 1.15.9 1.16.0
h3 1.13.0 1.15.11
handlebars 4.7.8 4.7.9
lodash 4.17.21 4.18.1
markdown-it 14.1.0 14.1.1
node-forge 1.3.1 1.4.0
path-to-regexp 0.1.12 0.1.13
picomatch 2.3.1 2.3.2
rollup 4.28.1 4.60.3
underscore 1.13.7 1.13.8

Bumps the npm_and_yarn group with 4 updates in the /sdk directory: brace-expansion, minimatch, picomatch and rollup.

Updates fastify from 4.29.0 to 5.8.5

Release notes

Sourced from fastify's releases.

v5.8.5

⚠️ Security Release

This fixes CVE CVE-2026-33806 https://github.com/fastify/fastify/security/advisories/GHSA-247c-9743-5963.

What's Changed

New Contributors

Full Changelog: https://github.com/fastify/fastify/compare/v5.8.4...v5.8.5

v5.8.4

Full Changelog: https://github.com/fastify/fastify/compare/v5.8.3...v5.8.4

v5.8.3

⚠️ Security Release

This fixes CVE CVE-2026-3635 https://github.com/fastify/fastify/security/advisories/GHSA-444r-cwp2-x5xf.

What's Changed

New Contributors

... (truncated)

Commits
  • 3983cce Bumped v5.8.5
  • 3ce3ae6 Merge commit from fork
  • b06a196 docs(ecosystem): add @​pompelmi/fastify-plugin (#6610)
  • 909c5d5 chore: Bump actions/dependency-review-action from 4.8.3 to 4.9.0 (#6630)
  • 4db21a3 chore: Bump borp from 0.21.0 to 1.0.0 (#6633)
  • 0f4e544 chore: Bump markdownlint-cli2 from 0.21.0 to 0.22.0 (#6632)
  • 33a2fcd chore: Bump pnpm/action-setup from 4.2.0 to 5.0.0 (#6629)
  • fd35d82 ci: reduce cron schedules from daily/weekly to monthly (#6623)
  • 8dee9be fix: restore trustProxy function for number and string types, add null check ...
  • d457aed chore: upgrade to typescript v6.0.2 (#6605)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by climba03003, a new releaser for fastify since your current version.


Updates undici from 6.20.1 to 6.24.0

Release notes

Sourced from undici's releases.

v6.24.0

Undici v6.24.0 Security Release Notes (LTS)

This release backports fixes for security vulnerabilities affecting the v6 line.

Upgrade guidance

All users on v6 should upgrade to v6.24.0 or later.

Fixed advisories

  • GHSA-2mjp-6q6p-2qxm / CVE-2026-1525 (Medium)
    Inconsistent interpretation of HTTP requests (request/response smuggling class issue).

  • GHSA-f269-vfmq-vjvj / CVE-2026-1528 (High)
    Malicious WebSocket 64-bit frame length handling could crash the client.

  • GHSA-4992-7rv2-5pvq / CVE-2026-1527 (Medium)
    CRLF injection via the upgrade option.

  • GHSA-v9p9-hfj2-hcw8 / CVE-2026-2229 (High)
    Unhandled exception from invalid server_max_window_bits in WebSocket permessage-deflate negotiation.

  • GHSA-vrm6-8vpv-qv8q / CVE-2026-1526 (High)
    Unbounded memory consumption in WebSocket permessage-deflate decompression.

Not applicable to v6

Affected and patched ranges (v6)

  • CVE-2026-1525: affected < 6.24.0, patched 6.24.0
  • CVE-2026-1528: affected >= 6.0.0 < 6.24.0, patched 6.24.0
  • CVE-2026-1527: affected < 6.24.0, patched 6.24.0
  • CVE-2026-2229: affected < 6.24.0, patched 6.24.0
  • CVE-2026-1526: affected < 6.24.0, patched 6.24.0

References

v6.23.0

⚠️ Security Release

... (truncated)

Commits
  • 8873c94 Bumped v6.24.0
  • 411bd01 test(websocket): use node:assert for Node 18 compatibility
  • 844bf59 test: fix http2 lint regressions in backport
  • a444e4f test: stabilize h2 and tls-cert-leak under current test runner
  • dc032a1 fix: h2 CI (#4395)
  • 4cd3f4b test: increase bitness in test/fixtures/*.pem (#3659)
  • 7df6442 fix: adapt websocket frame-limit handling for v6 parser
  • 4e0179a fix: reject duplicate content-length and host headers
  • 5a97f08 Fix websocket 64-bit length overflow
  • e43e898 fix: validate upgrade header to prevent CRLF injection
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for undici since your current version.


Updates ajv from 8.17.1 to 8.20.0

Release notes

Sourced from ajv's releases.

v8.20.0

What's Changed

Full Changelog: https://github.com/ajv-validator/ajv/compare/v8.19.0...v8.20.0

v8.19.0

What's Changed

Full Changelog: https://github.com/ajv-validator/ajv/compare/v8.18.0...v8.19.0

v8.18.0

What's Changed

New Contributors

Full Changelog: https://github.com/ajv-validator/ajv/compare/v8.17.1...v8.18.0

Commits

Updates defu from 6.1.4 to 6.1.7

Release notes

Sourced from defu's releases.

v6.1.7

compare changes

📦 Build

  • Correct the types export entry (#160)
  • Export Defu types (#157)

❤️ Contributors

v6.1.6

compare changes

📦 Build

v6.1.5

compare changes

🩹 Fixes

  • Prevent prototype pollution via __proto__ in defaults (#156)
  • Ignore inherited enumerable properties (11ba022)

✅ Tests

  • Add more tests for plain objects (b65f603)

❤️ Contributors

Changelog

Sourced from defu's changelog.

v6.1.7

compare changes

🩹 Fixes

  • defu.d.cts: Export Defu types (#157)

📦 Build

  • Correct the types export entry (#160)

❤️ Contributors

v6.1.6

compare changes

📦 Build

❤️ Contributors

v6.1.5

compare changes

🩹 Fixes

  • Prevent prototype pollution via __proto__ in defaults (#156)
  • Ignore inherited enumerable properties (11ba022)

🏡 Chore

✅ Tests

  • Add more tests for plain objects (b65f603)

🤖 CI

... (truncated)

Commits
  • 80c0146 chore(release): v6.1.7
  • 40d7ef4 fix(defu.d.cts): export Defu types (#157)
  • 3d3a7c8 build: correct the types export entry (#160)
  • 001c290 chore(release): v6.1.6
  • 407b516 build: fix mixed types
  • 23e59e6 chore(release): v6.1.5
  • 11ba022 fix: ignore inherited enumerable properties
  • 3942bfb fix: prevent prototype pollution via __proto__ in defaults (#156)
  • d3ef16d chore(deps): update actions/checkout action to v6 (#151)
  • 869a053 chore(deps): update actions/setup-node action to v6 (#149)
  • Additional commits viewable in compare view

Updates follow-redirects from 1.15.9 to 1.16.0

Commits
  • 0c23a22 Release version 1.16.0 of the npm package.
  • 844c4d3 Add sensitiveHeaders option.
  • 5e8b8d0 ci: add Node.js 24.x to the CI matrix
  • 7953e22 ci: upgrade GitHub Actions to use setup-node@v6 and checkout@v6
  • 86dc1f8 Sanitizing input.
  • 21ef28a Release version 1.15.11 of the npm package.
  • 7c88135 Roll back tree shaking.
  • 6e389ba Release version 1.15.10 of the npm package.
  • 5bc496e Shake me up before you go-go.
  • 694d6b4 Bump minimist from 1.2.5 to 1.2.8
  • See full diff in compare view

Updates h3 from 1.13.0 to 1.15.11

Release notes

Sourced from h3's releases.

v1.15.11

compare changes

🏡 Chore

v1.15.10

compare changes

🩹 Fixes

  • Preserve percent-encoded req.url in app event handler (#1355)

❤️ Contributors

v1.15.9

compare changes

🩹 Fixes

  • Preserve %25 in pathname (1103df6)
  • static: Prevent path traversal via double-encoded dot segments (%252e%252e) (c56683d)
  • sse: Sanitize carriage returns in event stream data and comments (ba3c3fe)

v1.15.8

compare changes

🩹 Fixes

  • Preserve %25 in pathname (1103df6)

v1.15.7

compare changes

🩹 Fixes

  • static: Narrow path traversal check to match .. as a path segment only (c049dc0)
  • app: Decode percent-encoded path segments to prevent auth bypass (313ea52)

💅 Refactors

  • Remove implicit event handler conversion warning (#1340)

❤️ Contributors

... (truncated)

Changelog

Sourced from h3's changelog.

v1.15.11

compare changes

🏡 Chore

❤️ Contributors

v1.15.10

compare changes

🩹 Fixes

  • Preserve percent-encoded req.url in app event handler (#1355)

🏡 Chore

❤️ Contributors

v1.15.9

compare changes

🩹 Fixes

  • Preserve %25 in pathname (1103df6)
  • static: Prevent path traversal via double-encoded dot segments (%252e%252e) (c56683d)
  • sse: Sanitize carriage returns in event stream data and comments (ba3c3fe)

🏡 Chore

❤️ Contributors

... (truncated)

Commits

Updates handlebars from 4.7.8 to 4.7.9

Release notes

Sourced from handlebars's releases.

v4.7.9

Commits

Changelog

Sourced from handlebars's changelog.

v4.7.9 - March 26th, 2026

  • fix: enable shell mode for spawn to resolve Windows EINVAL issue - e0137c2
  • fix type "RuntimeOptions" also accepting string partials - eab1d14
  • feat(types): set hash to be a Record<string, any> - de4414d
  • fix non-contiguous program indices - 4512766
  • refactor: rename i to startPartIndex - e497a35
  • security: fix security issues - 68d8df5

Commits

Commits
  • dce542c v4.7.9
  • 8a41389 Update release notes
  • 68d8df5 Fix security issues
  • b2a0831 Fix browser tests
  • 9f98c16 Fix release script
  • 45443b4 Revert "Improve partial indenting performance"
  • 8841a5f Fix CI errors with linting
  • e0137c2 fix: enable shell mode for spawn to resolve Windows EINVAL issue
  • e914d60 Improve rendering performance
  • 7de4b41 Upgrade GitHub Actions checkout and setup-node on 4.x branch
  • Additional commits viewable in compare view

Updates lodash from 4.17.21 to 4.18.1

Release notes

Sourced from lodash's releases.

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

4.18.0

v4.18.0

Full Changelog: https://github.com/lodash/lodash/compare/4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

  • Add security notice for _.template in threat model and API docs (#6099)
  • Document lower > upper behavior in _.random (#6115)
  • Fix quotes in _.compact jsdoc (#6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

Commits
  • cb0b9b9 release(patch): bump main to 4.18.1 (#6177)
  • 75535f5 chore: prune stale advisory refs (#6170)
  • 62e91bc docs: remove n_ Node.js < 6 REPL note from README (#6165)
  • 59be2de release(minor): bump to 4.18.0 (#6161)
  • af63457 fix: broken tests for _.template 879aaa9
  • 1073a76 fix: linting issues
  • 879aaa9 fix: validate imports keys in _.template
  • fe8d32e fix: block prototype pollution in baseUnset via constructor/prototype traversal
  • 18ba0a3 refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)
  • b819080 ci: add dist sync validation workflow (#6137)
  • Additional commits viewable in compare view

Updates markdown-it from 14.1.0 to 14.1.1

Changelog

Sourced from markdown-it's changelog.

[14.1.1] - 2026-01-11

Security

  • Fixed regression from v13 in linkify inline rule. Specific patterns could cause high CPU use. Thanks to @​ltduc147 for report.
Commits

Updates node-forge from 1.3.1 to 1.4.0

Changelog

Sourced from node-forge's changelog.

1.4.0 - 2026-03-24

Security

  • HIGH: Denial of Service in BigInteger.modInverse()
    • A Denial of Service (DoS) vulnerability exists due to an infinite loop in the BigInteger.modInverse() function (inherited from the bundled jsbn library). When modInverse() is called with a zero value as input, the internal Extended Euclidean Algorithm enters an unreachable exit condition, causing the process to hang indefinitely and consume 100% CPU.
    • Reported by Kr0emer.
    • CVE ID: CVE-2026-33891
    • GHSA ID: GHSA-5gfm-wpxj-wjgq
  • HIGH: Signature forgery in RSA-PKCS due to ASN.1 extra field.
    • RSASSA PKCS#1 v1.5 signature verification accepts forged signatures for low public exponent keys (e=3). Attackers can forge signatures by stuffing "garbage" bytes within the ASN.1 structure in order to construct a signature that passes verification, enabling Bleichenbacher style forgery. This issue is similar to CVE-2022-24771, but adds bytes in an addition field within the ASN.1 structure, rather than outside of it.
    • Additionally, forge does not validate that signatures include a minimum of 8 bytes of padding as defined by the specification, providing attackers additional space to construct Bleichenbacher forgeries.
    • Reported as part of a U.C. Berkeley security research project by:
      • Austin Chu, Sohee Kim, and Corban Villa.
    • CVE ID: CVE-2026-33894
    • GHSA ID: GHSA-ppp5-5v6c-4jwp
  • HIGH: Signature forgery in Ed25519 due to missing S < L check.
    • Ed25519 signature verification accepts forged non-canonical signatures where the scalar S is not reduced modulo the group order (S >= L). A valid signature and its S + L variant both verify in forge, while Node.js crypto.verify (OpenSSL-backed) rejects the S + L variant, as defined by the specification. This class of signature malleability has been exploited in practice to bypass authentication and authorization logic (see CVE-2026-25793, CVE-2022-35961). Applications relying on signature uniqueness (i.e., dedup by signature bytes, replay tracking, signed-object canonicalization checks) may be bypassed.
    • Reported as part of a U.C. Berkeley security research project by:
      • Austin Chu, Sohee Kim, and Corban Villa.
    • CVE ID: CVE-2026-33895
    • GHSA ID: GHSA-q67f-28xg-22rw
  • HIGH: basicConstraints bypass in certificate chain verification.
    • pki.verifyCertificateChain() does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the basicConstraints and keyUsage extensions. This allows any leaf certificate (without these extensions) to act as a CA and sign other certificates, which node-forge will accept as valid.
    • Reported by Doruk Tan Ozturk (@​peaktwilight) - doruk.ch
    • CVE ID: CVE-2026-33896
    • GHSA ID: GHSA-2328-f5f3-gj25

... (truncated)

Commits

Updates path-to-regexp from 0.1.12 to 0.1.13

Release notes

Sourced from path-to-regexp's releases.

0.1.13

Important

Full Changelog: https://github.com/pillarjs/path-to-regexp/compare/v0.1.12...v.0.1.13

Changelog

Sourced from path-to-regexp's changelog.

0.1.13 / 2026-03-26

0.1.7 / 2015-07-28

  • Fixed regression with escaped round brackets and matching groups.

0.1.6 / 2015-06-19

  • Replace index feature by outputting all parameters, unnamed and named.

0.1.5 / 2015-05-08

  • Add an index property for position in match result.

0.1.4 / 2015-03-05

  • Add license information

0.1.3 / 2014-07-06

  • Better array support
  • Improved support for trailing slash in non-ending mode

0.1.0 / 2014-03-06

  • add options.end

0.0.2 / 2013-02-10

  • Update to match current express
  • add .license property to component.json
Commits
Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for path-to-regexp since your current version.


Updates picomatch from 2.3.1 to 2.3.2

Release notes

Sourced from picomatch's releases.

2.3.2

This is a security release fixing several security relevant issues.

What's Changed

Full Changelog: https://github.com/micromatch/picomatch/compare/2.3.1...2.3.2

Changelog

Sourced from picomatch's changelog.

Release history

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

  • Changelogs are for humans, not machines.
  • There should be an entry for every single version.
  • The same types of changes should be grouped.
  • Versions and sections should be linkable.
  • The latest version comes first.
  • The release date of each versions is displayed.
  • Mention whether you follow Semantic Versioning.

Changelog entries are classified using the following labels (from keep-a-changelog):

  • Added for new features.
  • Changed for changes in existing functionality.
  • Deprecated for soon-to-be removed features.
  • Removed for now removed features.
  • Fixed for any bug fixes.
  • Security in case of vulnerabilities.

4.0.0 (2024-02-07)

Fixes

Changed

3.0.1

Fixes

... (truncated)

Commits

Updates rollup f...

Description has been truncated

Package Dependencies
Package:
undici
Ecosystem:
npm
Version Change:
6.20.1 → 6.24.0
Update Type:
Minor
Package:
rollup
Ecosystem:
npm
Version Change:
4.28.1 → 4.60.3
Update Type:
Minor
Package:
follow-redirects
Ecosystem:
npm
Version Change:
1.15.9 → 1.16.0
Update Type:
Minor
Package:
lodash
Ecosystem:
npm
Version Change:
4.17.21 → 4.18.1
Update Type:
Minor
Package:
path-to-regexp
Ecosystem:
npm
Version Change:
0.1.12 → 0.1.13
Update Type:
Patch
Package:
fastify
Ecosystem:
npm
Version Change:
4.29.0 → 5.8.5
Update Type:
Major
Package:
handlebars
Ecosystem:
npm
Version Change:
4.7.8 → 4.7.9
Update Type:
Patch
Package:
ajv
Ecosystem:
npm
Version Change:
8.17.1 → 8.20.0
Update Type:
Minor
Package:
node-forge
Ecosystem:
npm
Version Change:
1.3.1 → 1.4.0
Update Type:
Minor
Package:
h3
Ecosystem:
npm
Version Change:
1.13.0 → 1.15.11
Update Type:
Minor
Package:
markdown-it
Ecosystem:
npm
Version Change:
14.1.0 → 14.1.1
Update Type:
Patch
Package:
picomatch
Ecosystem:
npm
Version Change:
2.3.1 → 2.3.2
Update Type:
Patch
Package:
underscore
Ecosystem:
npm
Version Change:
1.13.7 → 1.13.8
Update Type:
Patch
Package:
defu
Ecosystem:
npm
Version Change:
6.1.4 → 6.1.7
Update Type:
Patch
Security Advisories
Command Injection in lodash
GHSA-35jh-r3h4-6jhm CVE-2021-23337 HIGH
`lodash` versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
Improper Verification of Cryptographic Signature in node-forge
GHSA-cfm4-qjh2-4765 CVE-2022-24771 HIGH
### Impact RSA PKCS#1 v1.5 signature verification code is lenient in checking the digest algorithm structure. This can allow a crafted structure that steals padding bytes and uses unchecked portio...
OpenZeppelin Contracts vulnerable to ECDSA signature malleability
GHSA-4h98-2769-gh6h CVE-2022-35961 HIGH
### Impact The functions `ECDSA.recover` and `ECDSA.tryRecover` are vulnerable to a kind of signature malleability due to accepting EIP-2098 compact signatures in addition to the traditional 65 by...
node-forge has an Interpretation Conflict vulnerability via its ASN.1 Validator Desynchronization
GHSA-5gfm-wpxj-wjgq CVE-2025-12816 HIGH
### Summary CVE-2025-12816 has been reserved by CERT/CC **Description** An Interpretation Conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated a...
Blocklist Bypass possible via ECDSA Signature Malleability
GHSA-69x3-g4r3-p962 CVE-2026-25793 HIGH
### Impact When using P256 certificates (which is not the default configuration), it is possible to evade a blocklist entry created against the fingerprint of a certificate by using ECDSA Signatur...
ajv has ReDoS when using `$data` option
GHSA-2g4f-4pwh-qvx6 CVE-2025-69873 MODERATE
ajv (Another JSON Schema Validator) through version 8.17.1 is vulnerable to Regular Expression Denial of Service (ReDoS) when the `$data` option is enabled. The pattern keyword accepts runtime data...
lodash vulnerable to Code Injection via `_.template` imports key names
GHSA-r5fr-rjxr-66jc CVE-2026-4800 HIGH
### Impact The fix for [CVE-2021-23337](https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the `variable` option in `_.template` but did not apply the same validation to `opti...
lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`
GHSA-f23m-r3pf-42rh CVE-2026-2950 MODERATE
### Impact Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the `_.unset` and `_.omit` functions. The fix for [CVE-2025-13465](https://github.com/lodash/lodash/security...
Handlebars.js has a Prototype Method Access Control Gap via Missing __lookupSetter__ Blocklist Entry
GHSA-7rx3-28cr-v5wh MODERATE
## Summary The prototype method blocklist in `lib/handlebars/internal/proto-access.js` blocks `constructor`, `__defineGetter__`, `__defineSetter__`, and `__lookupGetter__`, but omits the symmetric...
Handlebars.js has a Property Access Validation Bypass in container.lookup
GHSA-442j-39wm-28r2 LOW
## Summary In `lib/handlebars/runtime.js`, the `container.lookup()` function uses `container.lookupProperty()` as a gate check to enforce prototype-access controls, but then discards the validated...
path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters
GHSA-37ch-88jc-xwx2 CVE-2026-4867 HIGH
### Impact A bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period (`.`). For example, `/:a-:b-:c` or ...
Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options
GHSA-xjpj-3mr7-gcpf CVE-2026-33941 HIGH
## Summary The Handlebars CLI precompiler (`bin/handlebars` / `lib/precompiler.js`) concatenates user-controlled strings — template file names and several CLI options — directly into the JavaScrip...
Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial
GHSA-xhpv-hc6g-r9c6 CVE-2026-33940 HIGH
## Summary A crafted object placed in the template context can bypass all conditional guards in `resolvePartial()` and cause `invokePartial()` to return `undefined`. The Handlebars runtime then tr...
Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation
GHSA-9cx6-37pm-9jff CVE-2026-33939 HIGH
## Summary When a Handlebars template contains decorator syntax referencing an unregistered decorator (e.g. `{{*n}}`), the compiled template calls `lookupProperty(decorators, "n")`, which returns ...
Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block
GHSA-3mfm-83xf-c92r CVE-2026-33938 HIGH
## Summary The `@partial-block` special variable is stored in the template data context and is reachable and mutable from within a template via helpers that accept arbitrary objects. When a helper...
Handlebars.js has JavaScript Injection via AST Type Confusion
GHSA-2w6w-674q-4c4q CVE-2026-33937 CRITICAL
## Summary `Handlebars.compile()` accepts a pre-parsed AST object in addition to a template string. The `value` field of a `NumberLiteral` AST node is emitted directly into the generated JavaScrip...
Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection
GHSA-2qvq-rjwj-gvw9 CVE-2026-33916 MODERATE
## Summary `resolvePartial()` in the Handlebars runtime resolves partial names via a plain property lookup on `options.partials` without guarding against prototype-chain traversal. When `Object.pr...
Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)
GHSA-2328-f5f3-gj25 CVE-2026-33896 HIGH
## Summary `pki.verifyCertificateChain()` does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the `basicConstraints` and `keyUsage` extensions. This...
Forge has signature forgery in Ed25519 due to missing S > L check
GHSA-q67f-28xg-22rw CVE-2026-33895 HIGH
## Summary Ed25519 signature verification accepts forged non-canonical signatures where the scalar S is not reduced modulo the group order (`S >= L`). A valid signature and its `S + L` variant both...
Forge has signature forgery in RSA-PKCS due to ASN.1 extra field
GHSA-ppp5-5v6c-4jwp CVE-2026-33894 HIGH
## Summary RSASSA PKCS#1 v1.5 signature verification accepts forged signatures for low public exponent keys (e=3). Attackers can forge signatures by stuffing “garbage” bytes within the ASN structur...
Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input
GHSA-5m6q-g25r-mvwx CVE-2026-33891 HIGH
## Summary A Denial of Service (DoS) vulnerability exists in the node-forge library due to an infinite loop in the BigInteger.modInverse() function (inherited from the bundled jsbn library). When ...
Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching
GHSA-3v7f-55p6-f55p CVE-2026-33672 MODERATE
### Impact picomatch is vulnerable to a **method injection vulnerability (CWE-1321)** affecting the `POSIX_REGEX_SOURCE` object. Because the object inherits from `Object.prototype`, specially craft...
Picomatch has a ReDoS vulnerability via extglob quantifiers
GHSA-c2c7-rcm5-vvqj CVE-2026-33671 HIGH
### Impact `picomatch` is vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain patterns using extglob quantifiers such as `+()` and `*()`, es...
fastify: request.protocol and request.host Spoofable via X-Forwarded-Proto/Host from Untrusted Connections
GHSA-444r-cwp2-x5xf CVE-2026-3635 MODERATE
## Summary When `trustProxy` is configured with a restrictive trust function (e.g., a specific IP like `trustProxy: '10.0.0.1'`, a subnet, a hop count, or a custom function), the `request.protocol...
Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression
GHSA-vrm6-8vpv-qv8q CVE-2026-1526 HIGH
## Description The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression. When a WebSocket connection negotia...
Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation
GHSA-v9p9-hfj2-hcw8 CVE-2026-2229 HIGH
### Impact The undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the `server_max_window_bits` parameter in the permessage-deflate extension. When a ...
Undici has CRLF Injection in undici via `upgrade` option
GHSA-4992-7rv2-5pvq CVE-2026-1527 MODERATE
### Impact When an application passes user-controlled input to the `upgrade` option of `client.request()`, an attacker can inject CRLF sequences (`\r\n`) to: 1. Inject arbitrary HTTP headers 2. T...
Undici has Unbounded Memory Consumption in its DeduplicationHandler via Response Buffering that leads to DoS
GHSA-phc3-fgpg-7m6h CVE-2026-2581 MODERATE
## Impact This is an uncontrolled resource consumption vulnerability (CWE-400) that can lead to Denial of Service (DoS). In vulnerable Undici versions, when `interceptors.deduplicate()` is enabled...
Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client
GHSA-f269-vfmq-vjvj CVE-2026-1528 HIGH
### Impact A server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws...
Undici has an HTTP Request/Response Smuggling issue
GHSA-2mjp-6q6p-2qxm CVE-2026-1525 MODERATE
### Impact Undici allows duplicate HTTP `Content-Length` headers when they are provided in an array with case-variant names (e.g., `Content-Length` and `content-length`). This produces malformed H...
Fastify has a Body Schema Validation Bypass via Leading Space in Content-Type Header
GHSA-247c-9743-5963 CVE-2026-33806 HIGH
### Summary A validation bypass vulnerability exists in Fastify v5.x where request body validation schemas specified via `schema.body.content` can be completely circumvented by prepending a single ...
Actions
View on GitHub View Repository All Dependabot PRs
Technical Details
ID: 15803225
UUID: 4396438199
Node ID: PR_kwDOJEmqjs7ZBgAc
Host: GitHub
Repository: thirdweb-dev/engine