google_gax

googlegax parcheado Fork parcheado de googlegax v0.4.1 para compatibilidad con Tesla = 1.18.3. Por qué existe este fork Tesla 1.18.3 2 de junio de 2026 introdujo una validación estricta de nombres de campos multipart a través de assertquotedstringsafe!/2 como parte de las correcciones de segurida...

GHSA-WC9G-MQFW-JRWM multer vulnerable to Denial of Service via crafted multipart field names

Impact A vulnerability in multer allows a remote, unauthenticated attacker to crash the Node.js process with a single multipart/form-data request. Two specially crafted text field names cause an uncaught RangeError: Invalid array length inside multer's field parsing, which is not routed to the...

NPM: multer vulnerable to Denial of Service via crafted multipart field names

NPM: multer vulnerable to Denial of Service via crafted multipart field names vulnerability discovered by ? in WordPress Npm multer versions 2.3.0...

multer vulnerable to Denial of Service via crafted multipart field names

Impact A vulnerability in multer allows a remote, unauthenticated attacker to crash the Node.js process with a single multipart/form-data request. Two specially crafted text field names cause an uncaught RangeError: Invalid array length inside multer's field parsing, which is not routed to the...

GHSA-535W-7CP7-47Q4 multer vulnerable to Denial of Service via oversized array index in field names

Impact multer is vulnerable to a Denial of Service DoS via a crafted array index in multipart field names. The append-field dependency parses bracket notation in field names, and a large numeric index such as items4294967294 forces allocation of a maximum-length sparse array. A following field wi...

CVE-2026-77078 multer vulnerable to Denial of Service via crafted multipart field names

multer is a middleware for handling multipart/form-data in Node.js. A small multipart request containing two specially crafted text field names can cause an uncaught RangeError Invalid array length that terminates the Node.js process. The first field uses a very large numeric array index to...

CVE-2026-77078

multer , a popular Node.js middleware for handling multipart/form-data, is vulnerable to a remote denial-of-service in all versions before 2.3.0 . A small multipart request containing two specially crafted text field names triggers an uncaught RangeError (Invalid array length) : the first field a...

CVE-2026-12143 form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)

form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the field argument to FormDataappend and the filename option are concatenated verbatim into the Content-Disposition header without escaping carriage return CR, line feed LF, or double-quote "...

CVE-2026-34517

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, for some multipart form fields, aiohttp read the entire field into memory before checking clientmaxsize. This issue has been patched in version 3.13.4...

CVE-2026-34517

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, for some multipart form fields, aiohttp read the entire field into memory before checking clientmaxsize. This issue has been patched in version 3.13.4...