Vulnerabilities

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js.

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js.

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js.

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js.

fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv, that added a mailto scheme parser in version 4.1.3.

fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv.

fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error.

fast-uri serializes the port component of a URI without validating it.

fast-uri is a URI parser for Node.js.

fast-uri is a URI parser for Node.js.

fast-uri is a URI parser for Node.js.

fast-uri is a URI parser for Node.js.

fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based introducer in place of it (backslash backslash, forward slash backs…

Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter.

Impact: In body-parser versions prior to 1.20.6 (1.x line) and 2.3.0 (2.x line), when the parser is configured with an invalid limit option value such as an unparseable string or NaN, bytes.parse returns null and the req…

fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs.

nvm (Node Version Manager) through 0.40.4 executes arbitrary commands from version strings supplied by the configured Node.js/io.js mirror.

WebdriverIO is a test automation framework for unit, e2e and component testing using WebDriver, WebDriver BiDi and Appium.

Marko is a declarative, HTML-based language for building web apps.

fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization.

fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions.

Stack overflow vulnerability in eslint before 9.26.0 when serializing objects with circular references in eslint/lib/shared/serialization.js.

The messageformat package, an implementation of the Unicode MessageFormat 2 specification for JavaScript, is vulnerable to prototype pollution due to improper handling of message key paths in versions prior to 2.3.0.

A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in the Link header when unsanitized data is used.

body-parser is Node.js body parsing middleware.