TypeORM: migration:generate template-literal code injection

### Summary `typeorm migration:generate` embeds database schema metadata into JS/TS template literals, escaping backtic

历史摘要 · 未重新核验 · GitHub Advisory

Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered

## Summary In the composable `astro/hono` pipeline, the `security.checkOrigin` protection is only installed by the `mid

历史摘要 · 未重新核验 · GitHub Advisory

@astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escaped

## Summary The `@astrojs/netlify` adapter converts each `image.remotePatterns` entry into a regular expression that is

历史摘要 · 未重新核验 · GitHub Advisory

body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement

CVE-2026-12590

### Impact When body-parser is configured with an invalid `limit` option value, such as an unparseable string or `NaN`,

历史摘要 · 未重新核验 · GitHub Advisory

@astrojs/node: Backslash-prefixed paths not recognized as internal by trailing-slash redirect

CVE-2026-59730

### Impact With `trailingSlash: 'always'` configured, the `@astrojs/node` standalone server's static file handler appen

历史摘要 · 未重新核验 · GitHub Advisory

Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)

CVE-2026-59729

## Summary The fix for CVE-2026-54298 (GHSA-jrpj-wcv7-9fh9) added an `INVALID_ATTR_NAME_CHAR` guard to `addAttribute()`

历史摘要 · 未重新核验 · GitHub Advisory

@astrojs/rss: XML Injection via Unescaped RSS Feed Fields

CVE-2026-59728

## Summary In `@astrojs/rss`, the `source.title` and `enclosure.type` item fields are interpolated directly into XML te

历史摘要 · 未重新核验 · GitHub Advisory

Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands

CVE-2026-59727

### Summary When a `transition:persist`, `transition:scope`, or `transition:persist-props` directive is applied to a cl

历史摘要 · 未重新核验 · GitHub Advisory

Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning

## Summary Axios’ Node.js HTTP adapter can route requests through an attacker-controlled proxy when `Object.prototype.p

历史摘要 · 未重新核验 · GitHub Advisory

Axios form serializer maxDepth bypass via {} metatoken

## Summary Axios versions in the fixed lines for GHSA-62hf-57xw-28j9 still contain an incomplete depth-limit bypass in

历史摘要 · 未重新核验 · GitHub Advisory

Axios: Nested axios option objects can consume polluted prototype values

## Summary Axios can consume inherited properties from nested request option objects when the JavaScript process alread

历史摘要 · 未重新核验 · GitHub Advisory

Axios: HTTP/2 streamed uploads bypass `maxBodyLength`

## Summary Axios versions with Node.js HTTP/2 support allow streamed request bodies to bypass `maxBodyLength` enforceme

历史摘要 · 未重新核验 · GitHub Advisory

Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`

## Summary axios’ fetch adapter does not enforce `maxBodyLength` for live WHATWG `ReadableStream` request bodies whose

历史摘要 · 未重新核验 · GitHub Advisory

Axios: Prototype pollution gadgets can alter axios request construction

## Summary axios is vulnerable to read-side prototype-pollution gadgets when `Object.prototype` has already been pollut

历史摘要 · 未重新核验 · GitHub Advisory

Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios

## Summary Axios versions containing `lib/helpers/shouldBypassProxy.js` do not treat `0.0.0.0` as a local address when

历史摘要 · 未重新核验 · GitHub Advisory

protobufjs: Text Format string map parsing can mutate returned map object prototype

CVE-2026-59876

## Summary The protobuf.js text format extension parsed string-keyed map entries using ordinary property assignment. A

历史摘要 · 未重新核验 · GitHub Advisory

protobufjs: Denial of Service via infinite loop in .proto option parsing

CVE-2026-59877

## Summary protobufjs parsed option names by advancing through schema tokens until it reached an `=` token, without che

历史摘要 · 未重新核验 · GitHub Advisory

webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header

CVE-2026-14631

### Impact An unauthenticated peer that can reach the `webpack-dev-server` process can terminate it by sending either a

历史摘要 · 未重新核验 · GitHub Advisory

webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints

CVE-2026-14620

### Impact The internal `/webpack-dev-server/open-editor` and `/webpack-dev-server/invalidate` endpoints perform state-

历史摘要 · 未重新核验 · GitHub Advisory

Astro: Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch

CVE-2026-59731

# Astro 6.4.7 Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch ## Summary As

历史摘要 · 未重新核验 · GitHub Advisory