Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection through the createPlugin and updatePlugin handlers. An attacker can load arbitrary native code into the gateway process by sending POST /api/plugins or PUT /api/plugins/name with a non-builtin path when dashboar...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection through the createPlugin and updatePlugin handlers. An attacker can load arbitrary native code into the gateway process by sending POST /api/plugins or PUT /api/plugins/name with a non-builtin path when dashboar...

Missing Authorization

Overview pterodactyl/panel is a game management panel. Affected versions of this package are vulnerable to Missing Authorization in StoreTaskRequest and ScheduleController::execute for schedule task handling in app/Http/Requests/Api/Client/Servers/Schedules/StoreTaskRequest.php and...

Insecure Randomness

Overview Affected versions of this package are vulnerable to Insecure Randomness through the JWT signing flow in DefaultSecretProvider and JwtServiceImpl under powerjob-server-auth. An attacker can forge HS256-signed JWTs by using the predictable signing key and then send those tokens to the serv...

Uncaught Exception

Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Uncaught Exception in lib/web/websocket/permessage-deflate.js, whose cleanup calls removeAllListeners on the zlib InflateRaw object, removing the error listener while the...

Origin Validation Error

Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Origin Validation Error leading to cache poisoning in the interceptors.cache and interceptors.deduplicate interceptors, which build cache and deduplication keys without t...

Uncaught Exception

Overview org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Uncaught Exception in the WebSocketStream API, whose socket-close handler calls abort on the writable stream while the application holds a writer lock and...

Uncaught Exception

Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Uncaught Exception in the WebSocketStream API, whose socket-close handler calls abort on the writable stream while the application holds a writer lock and then discards t...

Insufficient Verification of Data Authenticity

Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity in the interceptors.cache interceptor, whose skip-list construction subtracts the configured methods from the safe-method s...

Insufficient Verification of Data Authenticity

Overview org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity in the interceptors.cache interceptor, whose skip-list construction subtracts the configured methods from t...

Improper Certificate Validation

Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Improper Certificate Validation in the BalancedPool class, which deep-clones its connect and tls options with JSON.parseJSON.stringify... and thereby silently drops any...

Improper Certificate Validation

Overview org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Improper Certificate Validation in the BalancedPool class, which deep-clones its connect and tls options with JSON.parseJSON.stringify... and thereby...

Use of Persistent Cookies Containing Sensitive Information

Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Use of Persistent Cookies Containing Sensitive Information in the interceptors.cache interceptor's shared-cache mode type: 'shared', which stores responses without...

Use of Persistent Cookies Containing Sensitive Information

Overview org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Use of Persistent Cookies Containing Sensitive Information in the interceptors.cache interceptor's shared-cache mode type: 'shared', which stores response...

Numeric Truncation Error

Overview org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Numeric Truncation Error in the interceptors.dump interceptor, which, for a chunked response with no Content-Length, does not abort an oversized body but...

Numeric Truncation Error

Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Numeric Truncation Error in the interceptors.dump interceptor, which, for a chunked response with no Content-Length, does not abort an oversized body but terminates after...

HTTP Request Smuggling

Overview org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to HTTP Request Smuggling in the interceptors.retry interceptor, which resumes a partial response and appends the resumed bytes to an already-delivered body,...

HTTP Request Smuggling

Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to HTTP Request Smuggling in the interceptors.retry interceptor, which resumes a partial response and appends the resumed bytes to an already-delivered body, so the delivere...

Uncaught Exception

Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Uncaught Exception in its WebSocket client, in the form of a TypeError inside a queueMicrotask callback when a server's 101 response carries a Sec-WebSocket-Protocol head...

Uncaught Exception

Overview org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Uncaught Exception in its WebSocket client, in the form of a TypeError inside a queueMicrotask callback when a server's 101 response carries a...

Allocation of Resources Without Limits or Throttling

Overview org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the interceptors.decompress interceptor, which caps the decompression chain at 5 layers but does n...

Allocation of Resources Without Limits or Throttling

Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the interceptors.decompress interceptor, which caps the decompression chain at 5 layers but does not bound the tot...

Missing Release of Resource after Effective Lifetime

Overview org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime in the RetryHandler, which can leave a response body pending indefinitely when a retried request...

Missing Release of Resource after Effective Lifetime

Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime in the RetryHandler, which can leave a response body pending indefinitely when a retried request receives a...

Unchecked Input for Loop Condition

Overview smol-toml is an A small, fast, and correct TOML parser/serializer Affected versions of this package are vulnerable to Unchecked Input for Loop Condition due to the skipUntil comment-skipping logic in src/util.ts. An attacker can hang parse by supplying a TOML document with a value in an...

Authentication Bypass Using an Alternate Path or Channel

Overview fastify is an overhead web framework, for Node.js. Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel via malformed URLs in the fourOhFour router in lib/four-oh-four.js. An attacker can reach an encapsulated not-found handler and...

Improper Certificate Validation

Overview snowflake-sdk is a Node.js driver for Snowflake Affected versions of this package are vulnerable to Improper Certificate Validation in the OCSP processing functionality, which accepts an OCSP response without checking that its CertID matches the certificate being validated and treats...

Improper Certificate Validation

Overview snowflake-connector-python is a Snowflake Connector for Python Affected versions of this package are vulnerable to Improper Certificate Validation in the OCSP processing functionality, which accepts an OCSP response without checking that its CertID matches the certificate being validated...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation in the OCSP processing functionality, which accepts an OCSP response without checking that its CertID matches the certificate being validated and treats definitive verification failures as transient. An...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation in the OCSP processing functionality, which accepts an OCSP response without checking that its CertID matches the certificate being validated and treats definitive verification failures as transient. An...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation in the OCSP processing functionality, which accepts an OCSP response without checking that its CertID matches the certificate being validated and treats definitive verification failures as transient. An...

Interpretation Conflict

Overview @fastify/middie is a Middleware engine for Fastify Affected versions of this package are vulnerable to Interpretation Conflict via the request target evaluation. An attacker can gain unauthorized access to protected routes by crafting requests with absolute-form targets that bypass...

Improper Validation of Unsafe Equivalence in Input

Overview fastify is an overhead web framework, for Node.js. Affected versions of this package are vulnerable to Improper Validation of Unsafe Equivalence in Input due to incomplete schema case normalization in lib/validation.js when compiling header schemas. An attacker can bypass schema-enforced...

Improper Validation of Specified Type of Input

Overview fastify is an overhead web framework, for Node.js. Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input via the route schema handling in lib/route.js, lib/schemas.js, and lib/validation.js. An attacker can reach a route handler with arbitrary...

Incorrect Behavior Order: Early Validation

Overview fastify is an overhead web framework, for Node.js. Affected versions of this package are vulnerable to Incorrect Behavior Order: Early Validation through the request validation path in lib/validation.js. An attacker can replace the validated request body, or trigger a validation failure,...

Malicious Package

Overview scw-mobile is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview eaze.com is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview dailyquokkaz3n is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview btree-range-store is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview damagedaspz3n is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview dajouka-d-tac is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview dagda-convict-nova-mongodb is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview daemon-function-throw-file-dog is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and thi...

Malicious Package

Overview eka-donat14-sluey is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview real-router-telemetry is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview eerietakin-biggestdev is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview damaged-salmon-angelfish is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview megan-baileys is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview echo-5sp2s-tkxhc-aurora-project is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and th...

Malicious Package

Overview ordered-kv-index is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...