Open Source Vulnerabilities

langfuse

Security fix for GHSA-2464-fhr4-w9xw applied in: langfuse 3.225.9-r9

langfuse-worker

### Summary `qs

langfuse-worker

body-parser is body parsing middleware for Node

qdrant, qdrant, langfuse, langfuse-worker

follow-redirects is a Node

qdrant, qdrant, langfuse, langfuse-worker

follow-redirects is a Node

langfuse, langfuse, langfuse-worker

dd-trace is the Datadog APM client for Node

langfuse, langfuse-worker

undici is an HTTP client library for Node

langfuse, langfuse-worker

Next

npm

PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it

npm, npm

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript

npm, npm

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript

npm, npm

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript

npm, npm

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript

npm

http-cache-semantics through 4

npm, qdrant, qdrant, npm

brace-expansion library generates arbitrary strings containing a common prefix and suffix

npm, qdrant, qdrant, npm

brace-expansion library generates arbitrary strings containing a common prefix and suffix

npm, qdrant, qdrant, npm

brace-expansion library generates arbitrary strings containing a common prefix and suffix

npm, npm

ip-address before 10

npm, qdrant, qdrant, langfuse, langfuse-worker, npm

undici is an HTTP client library for Node

prometheus-alertmanager

Security fix for GHSA-hrxh-6v49-42gf applied in: prometheus-alertmanager 0.31.1-r0

kedacore-http-add-on, kedacore-http-add-on, external-dns-fips, prometheus-alertmanager

gRPC-Go is the Go language implementation of gRPC

kedacore-http-add-on, kedacore-http-add-on, prometheus-alertmanager

gRPC-Go is the Go language implementation of gRPC

caddy, nginx-prometheus-exporter-fips, kube-webhook-certgen, prometheus-node-exporter-fips, memcached-exporter, prometheus-alertmanager

malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW...

caddy, nginx-prometheus-exporter-fips, kube-webhook-certgen, prometheus-node-exporter-fips, memcached-exporter, prometheus-alertmanager

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently

caddy, nginx-prometheus-exporter-fips, kube-webhook-certgen, prometheus-node-exporter-fips, memcached-exporter, prometheus-alertmanager

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request

argo-cd, dex, velero, loki, loki, loki, loki, prometheus-node-exporter-fips, prometheus-operator, prometheus-operator, prometheus-mysqld-exporter, prometheus-mysqld-exporter, prometheus-mysqld-exporter, prometheus-mysqld-exporter, memcached-exporter, nfs-subdir-external-provisioner, opentelemetry-collector-contrib, prometheus-statsd-exporter, prometheus-statsd-exporter, prometheus-statsd-exporter, kyverno, mongodb, mongodb, prometheus-statsd-exporter, mongodb, mongodb, kube-state-metrics, kube-state-metrics, kube-state-metrics, gosu, mailpit, prometheus-alertmanager, prometheus-alertmanager

On most platforms, Go uses the given system root certificates

caddy, nginx-prometheus-exporter-fips, kube-webhook-certgen, prometheus-node-exporter-fips, memcached-exporter, prometheus-alertmanager

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing

caddy, nginx-prometheus-exporter-fips, kube-webhook-certgen, prometheus-node-exporter-fips, memcached-exporter, prometheus-alertmanager

HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a r...

kedacore-http-add-on, trust-manager, dex, kedacore-http-add-on, kedacore-http-add-on, loki, loki, loki, loki, nginx-prometheus-exporter-fips, prometheus-node-exporter-fips, prometheus-node-exporter-fips, prometheus-operator, prometheus-operator, prometheus-operator, memcached-exporter, kyverno, kyverno, mongodb, mongodb, prometheus-alertmanager

In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found

kedacore-http-add-on, trust-manager, dex, kedacore-http-add-on, kedacore-http-add-on, loki, loki, loki, loki, nginx-prometheus-exporter-fips, prometheus-node-exporter-fips, prometheus-node-exporter-fips, prometheus-operator, prometheus-operator, prometheus-operator, memcached-exporter, kyverno, kyverno, mongodb, mongodb, prometheus-alertmanager

When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n

mailpit

package github

rpcbind

rpcbind through 0

kyverno

Security fix for GHSA-j6qf-3m9c-vwj3 applied in: kyverno 1.17.2-r9

kyverno

Security fix for GHSA-vrw8-fxc6-2r93 applied in: kyverno 1.17.2-r11

kyverno

Security fix for GHSA-rjr7-jggh-pgcp applied in: kyverno 1.17.2-r11

kyverno

Security fix for GHSA-9g5q-2w5x-hmxf applied in: kyverno 1.17.2-r11

kyverno

chi versions before v5

kyverno, kyverno

In the Golang Chi web framework, the ClientIPFromXFF middleware skips any X-Forwarded-For entry in a configured trusted CIDR but never verifies that the direct TCP peer in http

dex, vault, vault, loki, loki, loki, loki, kyverno, kyverno

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web To...

caddy, kube-webhook-certgen, prometheus-node-exporter-fips, memcached-exporter

trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped

caddy, kube-webhook-certgen, prometheus-node-exporter-fips, memcached-exporter

When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression

caddy, kube-webhook-certgen, prometheus-node-exporter-fips, memcached-exporter

Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes

caddy, kube-webhook-certgen, prometheus-node-exporter-fips, memcached-exporter

Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specify...

caddy, kube-webhook-certgen, prometheus-node-exporter-fips, memcached-exporter

When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU

caddy, kube-webhook-certgen, prometheus-node-exporter-fips, memcached-exporter

When http

caddy, kube-webhook-certgen, prometheus-node-exporter-fips, memcached-exporter

When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the conne...

caddy, kube-webhook-certgen, prometheus-node-exporter-fips, memcached-exporter

On Windows, when the target of Root

qdrant, qdrant

Vitest is a Vite-native testing framework for JavaScript and TypeScript projects

qdrant, qdrant

Vite is a frontend tooling framework for JavaScript

qdrant, qdrant

Vite is a frontend tooling framework for JavaScript