Your dependencies cross-checked against the OSV vulnerability database.
-
Serious GHSA-phwq-j96m-2c2q ejs template injection vulnerability
/workdirs/scan-1a17c7ae-8cba-435d-93e0-db3d5c47d8db/yarn.lock
A package you depend on has a known security hole (CVE-2022-29078). Fix: Update that package to its patched version.
-
Serious GHSA-fjxv-7rqg-78g4 form-data uses unsafe random function in form-data for choosing boundary
/workdirs/scan-1a17c7ae-8cba-435d-93e0-db3d5c47d8db/yarn.lock
A package you depend on has a known security hole (CVE-2025-7783). Fix: Update that package to its patched version.
-
Serious GHSA-76p3-8jx3-jpfq Prototype pollution in webpack loader-utils
/workdirs/scan-1a17c7ae-8cba-435d-93e0-db3d5c47d8db/yarn.lock
A package you depend on has a known security hole (CVE-2022-37601). Fix: Update that package to its patched version.
-
Worth fixing GHSA-grv7-fg5c-xmjg Uncontrolled resource consumption in braces
/workdirs/scan-1a17c7ae-8cba-435d-93e0-db3d5c47d8db/yarn.lock
A package you depend on has a known security hole (CVE-2024-4068). Fix: Update that package to its patched version.
-
Worth fixing GHSA-3xgq-45jj-v275 Regular Expression Denial of Service (ReDoS) in cross-spawn
/workdirs/scan-1a17c7ae-8cba-435d-93e0-db3d5c47d8db/yarn.lock
A package you depend on has a known security hole (CVE-2024-21538). Fix: Update that package to its patched version.
-
Worth fixing GHSA-ghr5-ch3p-vcr6 ejs lacks certain pollution protection
/workdirs/scan-1a17c7ae-8cba-435d-93e0-db3d5c47d8db/yarn.lock
A package you depend on has a known security hole (CVE-2024-33883). Fix: Update that package to its patched version.
-
Worth fixing GHSA-848j-6mx2-7j84 Elliptic Uses a Cryptographic Primitive with a Risky Implementation
/workdirs/scan-1a17c7ae-8cba-435d-93e0-db3d5c47d8db/yarn.lock
A package you depend on has a known security hole (CVE-2025-14505). Fix: Update that package to its patched version.
-
Worth fixing GHSA-hmw2-7cc7-3qxx form-data: CRLF injection in form-data via unescaped multipart field names and filenames
/workdirs/scan-1a17c7ae-8cba-435d-93e0-db3d5c47d8db/yarn.lock
A package you depend on has a known security hole (CVE-2026-12143). Fix: Update that package to its patched version.
-
Worth fixing GHSA-pfq8-rq6v-vf5m kangax html-minifier REDoS vulnerability
/workdirs/scan-1a17c7ae-8cba-435d-93e0-db3d5c47d8db/yarn.lock
A package you depend on has a known security hole (CVE-2022-37620). Fix: Update that package to its patched version.
-
Worth fixing GHSA-64mm-vxmg-q3vj http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass
/workdirs/scan-1a17c7ae-8cba-435d-93e0-db3d5c47d8db/yarn.lock
A package you depend on has a known security hole (CVE-2026-55602). Fix: Update that package to its patched version.
-
Worth fixing GHSA-c7qv-q95q-8v27 Denial of service in http-proxy-middleware
/workdirs/scan-1a17c7ae-8cba-435d-93e0-db3d5c47d8db/yarn.lock
A package you depend on has a known security hole (CVE-2024-21536). Fix: Update that package to its patched version.
-
Worth fixing GHSA-2p57-rm9w-gvfp ip SSRF improper categorization in isPublic
/workdirs/scan-1a17c7ae-8cba-435d-93e0-db3d5c47d8db/yarn.lock
A package you depend on has a known security hole (CVE-2024-29415). Fix: Update that package to its patched version.
-
Worth fixing GHSA-9c47-m6qq-7p4h Prototype Pollution in JSON5 via Parse Method
/workdirs/scan-1a17c7ae-8cba-435d-93e0-db3d5c47d8db/yarn.lock
A package you depend on has a known security hole (CVE-2022-46175). Fix: Update that package to its patched version.
-
Worth fixing GHSA-952p-6rrq-rcjv Regular Expression Denial of Service (ReDoS) in micromatch
/workdirs/scan-1a17c7ae-8cba-435d-93e0-db3d5c47d8db/yarn.lock
A package you depend on has a known security hole (CVE-2024-4067). Fix: Update that package to its patched version.
-
Worth fixing GHSA-2v37-7h3g-55p8 nanoid: custom generators can loop indefinitely when size is zero
/workdirs/scan-1a17c7ae-8cba-435d-93e0-db3d5c47d8db/yarn.lock
A package you depend on has a known security hole (CVE-2026-67213). Fix: Update that package to its patched version.
-
Worth fixing GHSA-2328-f5f3-gj25 Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)
/workdirs/scan-1a17c7ae-8cba-435d-93e0-db3d5c47d8db/yarn.lock
A package you depend on has a known security hole (CVE-2026-33896). Fix: Update that package to its patched version.
-
Worth fixing GHSA-2r2c-g63r-vccr Improper Verification of Cryptographic Signature in `node-forge`
/workdirs/scan-1a17c7ae-8cba-435d-93e0-db3d5c47d8db/yarn.lock
A package you depend on has a known security hole (CVE-2022-24773). Fix: Update that package to its patched version.
-
Worth fixing GHSA-554w-wpv2-vw27 node-forge has ASN.1 Unbounded Recursion
/workdirs/scan-1a17c7ae-8cba-435d-93e0-db3d5c47d8db/yarn.lock
A package you depend on has a known security hole (CVE-2025-66031). Fix: Update that package to its patched version.
-
Worth fixing GHSA-5gfm-wpxj-wjgq node-forge has an Interpretation Conflict vulnerability via its ASN.1 Validator Desynchronization
/workdirs/scan-1a17c7ae-8cba-435d-93e0-db3d5c47d8db/yarn.lock
A package you depend on has a known security hole (CVE-2025-12816). Fix: Update that package to its patched version.
-
Worth fixing GHSA-5m6q-g25r-mvwx Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input
/workdirs/scan-1a17c7ae-8cba-435d-93e0-db3d5c47d8db/yarn.lock
A package you depend on has a known security hole (CVE-2026-33891). Fix: Update that package to its patched version.
-
Worth fixing GHSA-65ch-62r8-g69g node-forge is vulnerable to ASN.1 OID Integer Truncation
/workdirs/scan-1a17c7ae-8cba-435d-93e0-db3d5c47d8db/yarn.lock
A package you depend on has a known security hole (CVE-2025-66030). Fix: Update that package to its patched version.
-
Worth fixing GHSA-8fr3-hfg3-gpgp Open Redirect in node-forge
/workdirs/scan-1a17c7ae-8cba-435d-93e0-db3d5c47d8db/yarn.lock
A package you depend on has a known security hole (CVE-2022-0122). Fix: Update that package to its patched version.
-
Worth fixing GHSA-cfm4-qjh2-4765 Improper Verification of Cryptographic Signature in node-forge
/workdirs/scan-1a17c7ae-8cba-435d-93e0-db3d5c47d8db/yarn.lock
A package you depend on has a known security hole (CVE-2022-24771). Fix: Update that package to its patched version.
-
Worth fixing GHSA-ppp5-5v6c-4jwp Forge has signature forgery in RSA-PKCS due to ASN.1 extra field
/workdirs/scan-1a17c7ae-8cba-435d-93e0-db3d5c47d8db/yarn.lock
A package you depend on has a known security hole (CVE-2026-33894). Fix: Update that package to its patched version.
-
Worth fixing GHSA-q67f-28xg-22rw Forge has signature forgery in Ed25519 due to missing S > L check
/workdirs/scan-1a17c7ae-8cba-435d-93e0-db3d5c47d8db/yarn.lock
A package you depend on has a known security hole (CVE-2026-33895). Fix: Update that package to its patched version.