UlisesGascon

undici vulnerable to HTTP header injection via Set-Cookie percent-decoding

undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse

undici vulnerable to cross-user information disclosure via shared cache whitespace bypass

undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching

undici WebSocket client vulnerable to denial of service via cumulative fragment bypass

webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies

multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads

multer vulnerable to Denial of Service via deeply nested field names

@fastify/middie vulnerable to middleware bypass via deprecated ignoreDuplicateSlashes option

@fastify/middie vulnerable to middleware authentication bypass in child plugin scopes