GHSA-Q2QQ-HMJ6-3WPP vulnerabilities

Vulnerabilities for packages: deno, vector, linkerd2-proxy, shadowsocks-rust, ztunnel...

GHSA-Q2QQ-HMJ6-3WPP vulnerabilities

Vulnerabilities for packages: deno, ztunnel, shadowsocks-rust, vector, komodo, linkerd2-proxy, ztunnel-fips...

GHSA-XP3W-R5P5-63RR vulnerabilities

Vulnerabilities for packages: deno, guestproxyagent, rustup, sccache, rustls-openssl-client, sdp-k8s-injector, vector, sqlx, sentry-cli, komodo, typst, bootc, rpm-sequoia, valkey-ldap, ztunnel-fips...

CVE-2023-26103

Versions of the package deno before 1.31.0 are vulnerable to Regular Expression Denial of Service ReDoS due to the upgradeWebSocket function, which contains regexes in the form of /s,s/, used for splitting the Connection/Upgrade header. A specially crafted Connection/Upgrade header can be used to...

GHSA-H97M-WW89-6JMQ vulnerabilities

Vulnerabilities for packages: xh, linkerd2-proxy, zellij, lychee, buck2, tealdeer, sccache, oranda, sdp-k8s-injector, shadowsocks-rust, nushell, qdrant, berg, wizer, atuin, samply, rust-analyzer, rye, wasmcloud, wadm, geckodriver, wasmtime, linkerd2, convco, rustup, wash, deno, netavark, kdash,...

CVE-2024-12224 vulnerabilities

Vulnerabilities for packages: xh, linkerd2-proxy, zellij, lychee, buck2, tealdeer, sccache, oranda, sdp-k8s-injector, shadowsocks-rust, nushell, qdrant, berg, wizer, atuin, samply, rust-analyzer, rye, wasmcloud, wadm, geckodriver, wasmtime, linkerd2, convco, rustup, wash, deno, netavark, kdash,...

CVE-2023-26103

Versions of the package deno before 1.31.0 are vulnerable to Regular Expression Denial of Service ReDoS due to the upgradeWebSocket function, which contains regexes in the form of /s,s/, used for splitting the Connection/Upgrade header. A specially crafted Connection/Upgrade header can be used to...

Design/Logic Flaw

Versions of the package deno before 1.31.0 are vulnerable to Regular Expression Denial of Service ReDoS due to the upgradeWebSocket function, which contains regexes in the form of /s,s/, used for splitting the Connection/Upgrade header. A specially crafted Connection/Upgrade header can be used to...

CVE-2023-26103

Versions of the package deno before 1.31.0 are vulnerable to Regular Expression Denial of Service ReDoS due to the upgradeWebSocket function, which contains regexes in the form of /s,s/, used for splitting the Connection/Upgrade header. A specially crafted Connection/Upgrade header can be used to...

Sensitive data exposure in NATS

Preview versions of two NPM packages and one Deno package from the NATS project contain an information disclosure flaw, leaking options to the NATS server; for one package, this includes TLS private credentials. The connection configuration options in these JavaScript-based implementations were...