THREATIST.IORead the docs Red Hat OpenShift Service Mesh 2.2.7 security update
Released 2023-06-15 · Red Hat rating Moderate · View on Red Hat →
qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used.
In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution.
The package terser before 4.8.1, from 5.0.0 and before 5.14.2 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure usage of regular expressions.
Specific cstrings input may not be properly validated in the MongoDB Go Driver when marshalling Go objects into BSON.