CLSA-2026-1781619738 Fix CVE(s): CVE-2026-45358, CVE-2026-49218, CVE-2026-53463

SECURITY UPDATE: off-by-one out-of-bounds read in the meta 8BIM/IPTC decoder - debian/patches/CVE-2026-45358.patch: bound taglength against the remaining extent in GetIPTCStream in coders/meta.c - CVE-2026-45358 SECURITY UPDATE: missing dimension check in the DCM decoder -...

Prototype Pollution

@aedart/support is vulnerable to Prototype Pollution. The vulnerability exists in the resolveMetadataRecord function of meta.ts when merged with a base class metadata object in the meta decoder, which allows an attacker to inject properties into existing prototypes via the MetadataRecord attribut...