UlisesGascon

fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization

lodash vulnerable to Code Injection via `_.template` imports key names

multer vulnerable to Denial of Service via orphaned disk writes on aborted uploads

multiparty vulnerable to Denial of Service via unbounded part-header accumulation

compression vulnerable to Denial of Service via memory leak on premature response close

fast-uri vulnerable to host confusion via failed IDN canonicalization

undici WebSocket client vulnerable to denial of service via fragment count bypass

morgan vulnerable to Log Injection via unescaped double quote in quoted log fields

hbs vulnerable to Denial of Service via unhandled exception in async helper output escaping

cookies vulnerable to Set-Cookie attribute injection via unvalidated domain and path options