Skip to content

fix(deps): vuln minor upgrades — 11 packages (minor: 7 · patch: 4) [rum-expo-react-navigation/package.json] - #130

Open
gh-worker-campaigns-3e9aa4[bot] wants to merge 1 commit into
mainfrom
engraver-auto-version-upgrade/minorpatch/npm/rum-expo-react-navigation/3-1788158124
Open

fix(deps): vuln minor upgrades — 11 packages (minor: 7 · patch: 4) [rum-expo-react-navigation/package.json]#130
gh-worker-campaigns-3e9aa4[bot] wants to merge 1 commit into
mainfrom
engraver-auto-version-upgrade/minorpatch/npm/rum-expo-react-navigation/3-1788158124

Conversation

@gh-worker-campaigns-3e9aa4

@gh-worker-campaigns-3e9aa4 gh-worker-campaigns-3e9aa4 Bot commented Aug 31, 2026

Copy link
Copy Markdown

Summary: Critical-severity security update — 15 packages upgraded (MINOR changes included)

Manifests changed:

  • rum-expo-react-navigation/package.json (yarn)

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

Updates

Package From To Type Dep Type Vulnerabilities Fixed
protobufjs 7.3.0 7.6.6 minor Transitive 2 CRITICAL, 10 HIGH, 10 MEDIUM
basic-ftp 5.0.5 5.3.1 minor Transitive 2 CRITICAL, 5 HIGH
fast-xml-parser 4.2.5 4.5.7 minor Transitive 2 CRITICAL, 4 HIGH, 4 MEDIUM, 2 LOW
simple-git 3.16.0 3.36.0 minor Transitive 2 CRITICAL, 4 HIGH
shell-quote 1.8.1 1.10.0 minor Transitive 2 CRITICAL, 2 HIGH
form-data 4.0.0 4.0.6 patch Transitive 2 CRITICAL, 2 HIGH
form-data 2.5.1 2.5.6 patch Transitive 2 CRITICAL, 2 HIGH
form-data 3.0.1 3.0.5 patch Transitive 2 CRITICAL, 2 HIGH
axios 1.7.2 1.20.0 minor Transitive 28 HIGH, 32 MEDIUM, 2 LOW
node-forge 1.3.1 1.4.0 minor Transitive 12 HIGH, 2 MEDIUM
@xmldom/xmldom 0.8.10 0.8.15 patch Transitive 10 HIGH
brace-expansion 2.0.1 2.1.4 minor Transitive 6 HIGH, 2 MEDIUM, 2 LOW
brace-expansion 1.1.11 1.1.18 patch Transitive 6 HIGH, 2 MEDIUM, 2 LOW
minimatch 3.1.2 3.1.5 patch Transitive 6 HIGH
minimatch 9.0.4 9.0.9 patch Transitive 6 HIGH

Security Details

🚨 Critical & High Severity (121 fixed)
Package CVE Severity Summary Unsafe Version Fixed In Case
basic-ftp CVE-2026-27699 CRITICAL Basic FTP has Path Traversal Vulnerability in its downloadToDir() method 5.0.5 - -
basic-ftp GHSA-5rq4-664w-9x2c CRITICAL Basic FTP has Path Traversal Vulnerability in its downloadToDir() method 5.0.5 5.2.0 -
fast-xml-parser CVE-2026-25896 CRITICAL fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names 4.2.5 - -
fast-xml-parser GHSA-m7jm-9gc2-mpf2 CRITICAL fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names 4.2.5 5.3.5 -
form-data GHSA-fjxv-7rqg-78g4 CRITICAL form-data uses unsafe random function in form-data for choosing boundary 3.0.1 2.5.4 -
form-data CVE-2025-7783 CRITICAL Usage of unsafe random function in form-data for choosing boundary 3.0.1 - -
form-data CVE-2025-7783 CRITICAL Usage of unsafe random function in form-data for choosing boundary 2.5.1 - -
form-data GHSA-fjxv-7rqg-78g4 CRITICAL form-data uses unsafe random function in form-data for choosing boundary 2.5.1 2.5.4 -
form-data CVE-2025-7783 CRITICAL Usage of unsafe random function in form-data for choosing boundary 4.0.0 - -
form-data GHSA-fjxv-7rqg-78g4 CRITICAL form-data uses unsafe random function in form-data for choosing boundary 4.0.0 2.5.4 -
protobufjs GHSA-xq3m-2v4x-88gg CRITICAL Arbitrary code execution in protobufjs 7.3.0 8.0.1 -
protobufjs CVE-2026-41242 CRITICAL protobufjs has an arbitrary code execution issue 7.3.0 - -
shell-quote GHSA-w7jw-789q-3m8p CRITICAL shell-quote quote() does not escape newlines in object .op values 1.8.1 1.8.4 -
shell-quote CVE-2026-9277 CRITICAL shell-quote quote() does not validate object-token shapes, allowing command injection via line terminators in .op 1.8.1 - -
simple-git CVE-2026-28292 CRITICAL simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key that enables RCE 3.16.0 - -
simple-git GHSA-r275-fr43-pm7q CRITICAL simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key enables RCE 3.16.0 3.32.3 -
@xmldom/xmldom CVE-2026-41672 HIGH xmldom: XML node injection through unvalidated comment serialization 0.8.10 - -
@xmldom/xmldom CVE-2026-34601 HIGH xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion 0.8.10 - -
@xmldom/xmldom GHSA-2v35-w6hq-6mfw HIGH xmldom: Uncontrolled recursion in XML serialization leads to DoS 0.8.10 0.8.13 -
@xmldom/xmldom CVE-2026-41673 HIGH xmldom: Denial of service via uncontrolled recursion in XML serialization 0.8.10 - -
@xmldom/xmldom GHSA-j759-j44w-7fr8 HIGH xmldom has XML node injection through unvalidated comment serialization 0.8.10 0.8.13 -
@xmldom/xmldom GHSA-x6wf-f3px-wcqx HIGH xmldom has XML node injection through unvalidated processing instruction serialization 0.8.10 0.8.13 -
@xmldom/xmldom CVE-2026-41675 HIGH xmldom: XML node injection through unvalidated processing instruction serialization 0.8.10 - -
@xmldom/xmldom GHSA-wh4c-j3r5-mjhp HIGH xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion 0.8.10 0.8.12 -
@xmldom/xmldom CVE-2026-41674 HIGH xmldom: XML injection through unvalidated DocumentType serialization 0.8.10 - -
@xmldom/xmldom GHSA-f6ww-3ggp-fr8h HIGH xmldom has XML injection through unvalidated DocumentType serialization 0.8.10 0.8.13 -
axios CVE-2026-44494 HIGH Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in config.proxy 1.7.2 - -
axios GHSA-p92q-9vqr-4j8v HIGH Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter 1.7.2 1.16.0 -
axios GHSA-j5f8-grm9-p9fc HIGH Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection 1.7.2 1.16.0 -
axios CVE-2026-42035 HIGH Axios: Header Injection via Prototype Pollution 1.7.2 - -
axios GHSA-q8qp-cvcw-x6jj HIGH Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking 1.7.2 1.15.2 -
axios CVE-2026-42264 HIGH Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking 1.7.2 - -
axios GHSA-6chq-wfr3-2hj9 HIGH Axios: Header Injection via Prototype Pollution 1.7.2 1.15.1 -
axios CVE-2026-25639 HIGH Axios affected by Denial of Service via proto Key in mergeConfig 1.7.2 - -
axios GHSA-pf86-5x62-jrwf HIGH Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking 1.7.2 1.15.1 -
axios CVE-2026-44487 HIGH Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter 1.7.2 - -
axios CVE-2026-42043 HIGH Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0 1.7.2 - -
axios GHSA-pmwg-cvhr-8vh7 HIGH Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0 1.7.2 1.15.1 -
axios CVE-2026-44486 HIGH Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection 1.7.2 - -
axios CVE-2025-27152 HIGH Possible SSRF and Credential Leakage via Absolute URL in axios Requests 1.7.2 - -
axios CVE-2024-39338 HIGH - 1.7.2 - -
axios GHSA-jr5f-v2jv-69x6 HIGH axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL 1.7.2 1.8.2 -
axios GHSA-35jp-ww65-95wh HIGH axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in config.proxy 1.7.2 1.16.0 -
axios CVE-2025-58754 HIGH Axios is vulnerable to DoS attack through lack of data size check 1.7.2 - -
axios GHSA-3g43-6gmg-66jw HIGH axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge 1.7.2 1.15.2 -
axios CVE-2026-44495 HIGH Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge 1.7.2 - -
axios GHSA-8hc4-vh64-cxmj HIGH Server-Side Request Forgery in axios 1.7.2 1.7.4 -
axios CVE-2026-44496 HIGH Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection 1.7.2 - -
axios GHSA-777c-7fjr-54vf HIGH Allocation of Resources Without Limits or Throttling in Axios 1.7.2 1.16.0 -
axios CVE-2026-44488 HIGH Axios: Allocation of Resources Without Limits or Throttling in axios 1.7.2 - -
axios GHSA-43fc-jf86-j433 HIGH Axios is Vulnerable to Denial of Service via proto Key in mergeConfig 1.7.2 1.13.5 -
axios GHSA-hfxv-24rg-xrqf HIGH Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection 1.7.2 1.16.0 -
axios CVE-2026-42033 HIGH Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking 1.7.2 - -
axios GHSA-4hjh-wcwx-xvwj HIGH Axios is vulnerable to DoS attack through lack of data size check 1.7.2 1.12.0 -
basic-ftp GHSA-rp42-5vxx-qpwr HIGH basic-ftp vulnerable to denial of service via unbounded memory consumption in Client.list() 5.0.5 5.3.0 -
basic-ftp GHSA-6v7q-wjvx-w8wg HIGH basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Execution via Credentials and MKD Commands 5.0.5 5.2.2 -
basic-ftp CVE-2026-44240 HIGH basic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response buffering 5.0.5 - -
basic-ftp GHSA-rpmf-866q-6p89 HIGH basic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response buffering 5.0.5 5.3.1 -
basic-ftp CVE-2026-41324 HIGH basic-ftp vulnerable to denial of service via unbounded memory consumption in Client.list() 5.0.5 - -
brace-expansion CVE-2026-14257 HIGH brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash 1.1.11 - -
brace-expansion CVE-2026-69152 HIGH brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation 1.1.11 - -
brace-expansion CVE-2026-13149 HIGH - 1.1.11 - -
brace-expansion GHSA-mh99-v99m-4gvg HIGH brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash 2.0.1 5.0.8 -
brace-expansion GHSA-3jxr-9vmj-r5cp HIGH brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups 1.1.11 5.0.7 -
brace-expansion GHSA-mh99-v99m-4gvg HIGH brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash 1.1.11 5.0.8 -
brace-expansion CVE-2026-13149 HIGH - 2.0.1 - -
brace-expansion CVE-2026-14257 HIGH brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash 2.0.1 - -
brace-expansion GHSA-3jxr-9vmj-r5cp HIGH brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups 2.0.1 5.0.7 -
brace-expansion GHSA-rgw5-rvv9-x895 HIGH brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation 1.1.11 1.1.18 -
brace-expansion GHSA-rgw5-rvv9-x895 HIGH brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation 2.0.1 1.1.18 -
brace-expansion CVE-2026-69152 HIGH brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation 2.0.1 - -
fast-xml-parser CVE-2026-26278 HIGH fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit) 4.2.5 - -
fast-xml-parser GHSA-8gc5-j5rx-235r HIGH fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278) 4.2.5 5.5.6 -
fast-xml-parser GHSA-jmr7-xgp7-cmfj HIGH fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit) 4.2.5 4.5.4 -
fast-xml-parser CVE-2026-33036 HIGH fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278) 4.2.5 - -
form-data CVE-2026-12143 HIGH form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection) 4.0.0 - -
form-data GHSA-hmw2-7cc7-3qxx HIGH form-data: CRLF injection in form-data via unescaped multipart field names and filenames 2.5.1 2.5.6 -
form-data CVE-2026-12143 HIGH form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection) 2.5.1 - -
form-data GHSA-hmw2-7cc7-3qxx HIGH form-data: CRLF injection in form-data via unescaped multipart field names and filenames 3.0.1 2.5.6 -
form-data CVE-2026-12143 HIGH form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection) 3.0.1 - -
form-data GHSA-hmw2-7cc7-3qxx HIGH form-data: CRLF injection in form-data via unescaped multipart field names and filenames 4.0.0 2.5.6 -
minimatch GHSA-23c5-xmqv-rm74 HIGH minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions 3.1.2 10.2.3 -
minimatch GHSA-23c5-xmqv-rm74 HIGH minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions 9.0.4 10.2.3 -
minimatch CVE-2026-27903 HIGH minimatch has a ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments 3.1.2 - -
minimatch GHSA-7r86-cg39-jmmj HIGH minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments 3.1.2 10.2.3 -
minimatch CVE-2026-26996 HIGH minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern 3.1.2 - -
minimatch GHSA-3ppc-4f35-3m26 HIGH minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern 3.1.2 10.2.1 -
minimatch GHSA-3ppc-4f35-3m26 HIGH minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern 9.0.4 10.2.1 -
minimatch CVE-2026-26996 HIGH minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern 9.0.4 - -
minimatch GHSA-7r86-cg39-jmmj HIGH minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments 9.0.4 10.2.3 -
minimatch CVE-2026-27903 HIGH minimatch has a ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments 9.0.4 - -
minimatch CVE-2026-27904 HIGH minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions 9.0.4 - -
minimatch CVE-2026-27904 HIGH minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions 3.1.2 - -
node-forge CVE-2025-12816 HIGH CVE-2025-12816 1.3.1 - -
node-forge CVE-2026-33896 HIGH Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation) 1.3.1 - -
node-forge GHSA-ppp5-5v6c-4jwp HIGH Forge has signature forgery in RSA-PKCS due to ASN.1 extra field 1.3.1 1.4.0 -
node-forge CVE-2026-33894 HIGH Forge has signature forgery in RSA-PKCS due to ASN.1 extra field 1.3.1 - -
node-forge GHSA-5m6q-g25r-mvwx HIGH Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input 1.3.1 1.4.0 -
node-forge CVE-2026-33891 HIGH Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input 1.3.1 - -
node-forge GHSA-554w-wpv2-vw27 HIGH node-forge has ASN.1 Unbounded Recursion 1.3.1 1.3.2 -
node-forge CVE-2025-66031 HIGH node-forge ASN.1 Unbounded Recursion 1.3.1 - -
node-forge GHSA-2328-f5f3-gj25 HIGH Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation) 1.3.1 1.4.0 -
node-forge GHSA-5gfm-wpxj-wjgq HIGH node-forge has an Interpretation Conflict vulnerability via its ASN.1 Validator Desynchronization 1.3.1 1.3.2 -
node-forge GHSA-q67f-28xg-22rw HIGH Forge has signature forgery in Ed25519 due to missing S > L check 1.3.1 1.4.0 -
node-forge CVE-2026-33895 HIGH Forge has signature forgery in Ed25519 due to missing S > L check 1.3.1 - -
protobufjs CVE-2026-44291 HIGH protobufjs: Code generation gadget after prototype pollution 7.3.0 - -
protobufjs CVE-2026-44289 HIGH protobufjs: Denial of service through unbounded protobuf recursion 7.3.0 - -
protobufjs CVE-2026-48712 HIGH protobufjs: Denial of service through unbounded Any expansion during JSON conversion 7.3.0 - -
protobufjs GHSA-75px-5xx7-5xc7 HIGH protobuf.js: Code generation gadget after prototype pollution 7.3.0 7.5.6 -
protobufjs GHSA-66ff-xgx4-vchm HIGH protobuf.js: Code injection through bytes field defaults in generated toObject code 7.3.0 7.5.6 -
protobufjs CVE-2026-44293 HIGH protobufjs: Code injection through bytes field defaults in generated toObject code 7.3.0 - -
protobufjs GHSA-685m-2w69-288q HIGH protobuf.js: Denial of service through unbounded protobuf recursion 7.3.0 7.5.6 -
protobufjs GHSA-wcpc-wj8m-hjx6 HIGH protobufjs: Denial of service through unbounded Any expansion during JSON conversion 7.3.0 7.6.1 -
protobufjs GHSA-jvwf-75h9-cwgg HIGH protobuf.js: Process-wide denial of service through unsafe option paths 7.3.0 7.5.6 -
protobufjs CVE-2026-44290 HIGH protobufjs: Process-wide denial of service through unsafe option paths 7.3.0 - -
shell-quote CVE-2026-13311 HIGH shell-quote parse() is quadratic in token count, enabling denial of service 1.8.1 - -
shell-quote GHSA-395f-4hp3-45gv HIGH shell-quote: Quadratic-complexity Denial of Service in parse() (CWE-407) 1.8.1 1.9.0 -
simple-git CVE-2026-28291 HIGH simple-git has Command Execution via Option-Parsing Bypass 3.16.0 - -
simple-git GHSA-jcxm-m3jx-f287 HIGH simple-git Affected by Command Execution via Option-Parsing Bypass 3.16.0 3.32.0 -
simple-git GHSA-hffm-xvc3-vprc HIGH simple-git is vulnerable to Remote Code Execution 3.16.0 3.36.0 -
simple-git CVE-2026-6951 HIGH - 3.16.0 - -
ℹ️ Other Vulnerabilities (60)
Package CVE Severity Summary Unsafe Version Fixed In Case
axios GHSA-42h9-826w-cgv3 MODERATE Axios: Excessive recursion in formDataToJSON can cause denial of service 1.7.2 0.33.0 -
axios GHSA-3p68-rc4w-qgx5 MODERATE Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF 1.7.2 1.15.0 -
axios CVE-2026-44490 MODERATE Axios: DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions 1.7.2 - -
axios GHSA-898c-q2cr-xwhg MODERATE axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions 1.7.2 1.16.0 -
axios CVE-2026-40175 MODERATE Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain 1.7.2 - -
axios GHSA-fvcv-3m26-pcqx MODERATE Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain 1.7.2 1.15.0 -
axios CVE-2026-42041 MODERATE Axios: Authentication Bypass via Prototype Pollution Gadget in validateStatus Merge Strategy 1.7.2 - -
axios GHSA-w9j2-pvgh-6h63 MODERATE Axios: Authentication Bypass via Prototype Pollution Gadget in validateStatus Merge Strategy 1.7.2 1.15.1 -
axios CVE-2026-42034 MODERATE Axios: HTTP adapter streamed uploads bypass maxBodyLength when maxRedirects: 0 1.7.2 - -
axios GHSA-5c9x-8gcm-mpgx MODERATE Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0 1.7.2 1.15.1 -
axios CVE-2026-42038 MODERATE Axios: no_proxy bypass via IP alias allows SSRF 1.7.2 - -
axios GHSA-m7pr-hjqh-92cm MODERATE Axios: no_proxy bypass via IP alias allows SSRF 1.7.2 1.15.1 -
axios CVE-2026-67316 MODERATE axios before 1.18.0 Prototype Pollution via bodyless methods 1.7.2 - -
axios GHSA-3w6x-2g7m-8v23 MODERATE Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in parseReviver 1.7.2 1.15.2 -
axios CVE-2026-42044 MODERATE Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in parseReviver 1.7.2 - -
axios CVE-2026-42039 MODERATE Axios: unbounded recursion in toFormData causes DoS via deeply nested request data 1.7.2 - -
axios CVE-2026-42042 MODERATE Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in withXSRFToken Boolean Coercion 1.7.2 - -
axios GHSA-xx6v-rp6x-q39c MODERATE Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in withXSRFToken Boolean Coercion 1.7.2 1.15.1 -
axios CVE-2026-67312 MODERATE axios 0.28.0 before 0.33.0 Denial of Service via formToJSON 1.7.2 - -
axios GHSA-pmv8-rq9r-6j72 MODERATE Axios: Deep formToJSON Key Recursion Can Cause Denial of Service 1.7.2 0.33.0 -
axios CVE-2026-67313 MODERATE axios 0.28.0 before 1.18.0 Denial of Service via formDataToJSON 1.7.2 - -
axios CVE-2025-62718 MODERATE Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF 1.7.2 - -
axios GHSA-mmx7-hfxf-jppx MODERATE Axios: Prototype pollution gadgets can alter axios request construction 1.7.2 1.18.0 -
axios GHSA-vf2m-468p-8v99 MODERATE Axios: HTTP adapter streamed responses bypass maxContentLength 1.7.2 1.15.1 -
axios CVE-2026-67317 MODERATE axios 1.7.0 before 1.18.0 maxBodyLength Bypass via ReadableStream 1.7.2 - -
axios GHSA-jqh4-m9w3-8hp9 MODERATE Axios: Fetch adapter ReadableStream uploads bypass maxBodyLength 1.7.2 1.18.0 -
axios CVE-2026-42036 MODERATE Axios: HTTP adapter streamed responses bypass maxContentLength 1.7.2 - -
axios GHSA-445q-vr5w-6q77 MODERATE Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream 1.7.2 1.15.1 -
axios CVE-2026-42037 MODERATE Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream 1.7.2 - -
axios GHSA-62hf-57xw-28j9 MODERATE Axios: unbounded recursion in toFormData causes DoS via deeply nested request data 1.7.2 1.15.1 -
axios CVE-2026-67319 MODERATE axios before 0.33.0 Prototype Pollution via nested option objects 1.7.2 - -
axios GHSA-7q8q-rj6j-mhjq MODERATE Axios: Nested axios option objects can consume polluted prototype values 1.7.2 0.33.0 -
brace-expansion GHSA-f886-m6hf-6m8v MODERATE brace-expansion: Zero-step sequence causes process hang and memory exhaustion 1.1.11 5.0.5 -
brace-expansion GHSA-f886-m6hf-6m8v MODERATE brace-expansion: Zero-step sequence causes process hang and memory exhaustion 2.0.1 5.0.5 -
brace-expansion CVE-2026-33750 MODERATE brace-expansion: Zero-step sequence causes process hang and memory exhaustion 2.0.1 - -
brace-expansion CVE-2026-33750 MODERATE brace-expansion: Zero-step sequence causes process hang and memory exhaustion 1.1.11 - -
fast-xml-parser CVE-2026-33349 MODERATE fast-xml-parser: Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation 4.2.5 - -
fast-xml-parser GHSA-gh4j-gqv2-49f6 MODERATE fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters 4.2.5 5.7.0 -
fast-xml-parser CVE-2026-41650 MODERATE fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters 4.2.5 - -
fast-xml-parser GHSA-jp2q-39xq-3w4g MODERATE Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parser 4.2.5 4.5.5 -
node-forge CVE-2025-66030 MODERATE node-forge ASN.1 OID Integer Truncation 1.3.1 - -
node-forge GHSA-65ch-62r8-g69g MODERATE node-forge is vulnerable to ASN.1 OID Integer Truncation 1.3.1 1.3.2 -
protobufjs GHSA-fx83-v9x8-x52w MODERATE protobuf.js: Prototype injection in generated message constructors 7.3.0 7.5.6 -
protobufjs CVE-2026-44292 MODERATE protobufjs: Prototype injection in generated message constructors 7.3.0 - -
protobufjs CVE-2026-44294 MODERATE protobufjs: Denial of service from crafted field names in generated code 7.3.0 - -
protobufjs GHSA-q6x5-8v7m-xcrf MODERATE protobufjs has overlong UTF-8 decoding 7.3.0 7.5.6 -
protobufjs CVE-2026-54269 MODERATE protobufjs: Schema-derived names can shadow runtime-significant properties 7.3.0 - -
protobufjs GHSA-f38q-mgvj-vph7 MODERATE protobufjs : Schema-derived names can shadow runtime-significant properties 7.3.0 7.6.3 -
protobufjs CVE-2026-44288 MODERATE protobufjs: Overlong UTF-8 decoding 7.3.0 - -
protobufjs GHSA-2pr8-phx7-x9h3 MODERATE protobuf.js: Denial of service from crafted field names in generated code 7.3.0 7.5.6 -
protobufjs CVE-2026-45740 MODERATE protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion 7.3.0 - -
protobufjs GHSA-jggg-4jg4-v7c6 MODERATE protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion 7.3.0 7.5.8 -
axios CVE-2026-42040 LOW Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams 1.7.2 - -
axios GHSA-xhjh-pmcv-23jw LOW Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams 1.7.2 1.15.1 -
brace-expansion CVE-2025-5889 LOW juliangruber brace-expansion index.js expand redos 1.1.11 - -
brace-expansion GHSA-v6h2-p8h4-qcjw LOW brace-expansion Regular Expression Denial of Service vulnerability 1.1.11 2.0.2 -
brace-expansion CVE-2025-5889 LOW juliangruber brace-expansion index.js expand redos 2.0.1 - -
brace-expansion GHSA-v6h2-p8h4-qcjw LOW brace-expansion Regular Expression Denial of Service vulnerability 2.0.1 2.0.2 -
fast-xml-parser GHSA-fj3w-jwp8-x2g3 LOW fast-xml-parser has stack overflow in XMLBuilder with preserveOrder 4.2.5 5.3.8 -
fast-xml-parser CVE-2026-27942 LOW fast-xml-parser has stack overflow in XMLBuilder with preserveOrder 4.2.5 - -

Review Checklist

Standard review:

  • Review changes for compatibility with your code
  • Check for breaking changes in release notes
  • Run tests locally or wait for CI
  • Approve and merge this PR

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System

@dd-octo-sts
dd-octo-sts Bot marked this pull request as ready for review August 31, 2026 19:07
@dd-octo-sts
dd-octo-sts Bot requested a review from a team as a code owner August 31, 2026 19:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

adms-critical-severity adms-custom-action-failed adms-dependency-update adms-high-severity adms-low-severity adms-medium-severity adms-minor-update adms-mode-all-vulns adms-npm campaigner-automated-change

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants