UlisesGascon

undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering

undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor

fastify vulnerable to header validation bypass via case-sensitive propertyNames

undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake

lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`

lodash vulnerable to Code Injection via `_.template` imports key names

@fastify/reply-from vulnerable to improper certificate validation in built-in HTTPS transports

@fastify/jwt vulnerable to missing token expiration when temporal options cannot be parsed

@fastify/auth vulnerable to Authorization Bypass via order-dependent evaluation of composed auth

@fastify/proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet