grocery_app (1.0.0) potentially affected by CVE-2025-67419 via @evershop/evershop (2.2.1)

@evershop/evershop NPM version 2.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on @evershop/evershop and may be impacted: - groceryapp 1.0.0 Source cves: CVE-2025-67419 Source advisory: SNYK:JS-EVERSHOPEVERSHOP-14872349...

Excessive Platform Resource Consumption within a Loop

Overview @evershop/evershop is a The React Ecommerce platform. Built with React and Postgres. Open-source and free. Fast and customizable. Affected versions of this package are vulnerable to Excessive Platform Resource Consumption within a Loop via the GET /images API endpoint when processing SVG...

CVE-2025-67419

A Denial of Service DoS vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to exhaust the application server's resources via the "GET /images" API. The application fails to limit the height of the use-element shadow tree or the dimensions of pattern tiles during the...