fix(deps): vuln minor upgrades — 6 packages (minor: 5 · patch: 1) [samples/client] by gh-worker-campaigns-3e9aa4[bot] · Pull Request #54 · DataDog/max-openapi-generator

gh-worker-campaigns-3e9aa4 · 2026-06-16T07:22:04Z

Summary: Critical-severity security update — 15 packages upgraded (MINOR changes included)

Manifests changed:

samples/client (npm)

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

Updates

Package	From	To	Type	Dep Type	Vulnerabilities Fixed
pbkdf2	3.1.2	3.1.6	patch	Transitive	4 CRITICAL
pbkdf2	3.1.1	3.1.6	patch	Transitive	4 CRITICAL
url-parse	1.4.3	1.5.10	minor	Direct	2 CRITICAL, 12 MEDIUM
axios	1.6.1	1.17.0	minor	Direct	18 HIGH, 11 MEDIUM, 1 LOW
axios	1.6.1	1.17.0	minor	Direct	18 HIGH, 11 MEDIUM, 1 LOW
axios	1.6.1	1.17.0	minor	Direct	18 HIGH, 11 MEDIUM, 1 LOW
axios	1.6.1	1.17.0	minor	Direct	18 HIGH, 11 MEDIUM, 1 LOW
axios	1.6.1	1.17.0	minor	Direct	18 HIGH, 11 MEDIUM, 1 LOW
node-forge	1.3.1	1.4.0	minor	Transitive	12 HIGH, 2 MEDIUM
node-forge	1.3.1	1.4.0	minor	Transitive	12 HIGH, 2 MEDIUM
node-forge	1.3.1	1.4.0	minor	Transitive	12 HIGH, 2 MEDIUM
node-forge	1.3.1	1.4.0	minor	Transitive	12 HIGH, 2 MEDIUM
node-forge	1.3.1	1.4.0	minor	Transitive	12 HIGH, 2 MEDIUM
undici	6.2.1	6.26.0	minor	Transitive	6 HIGH, 10 MEDIUM, 8 LOW
vite	5.0.11	5.2.9	minor	Transitive	5 HIGH, 22 MEDIUM, 4 LOW

Security Details

🚨 Critical & High Severity (171 fixed)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In
pbkdf2	GHSA-h7cp-r72f-jxh6	CRITICAL	pbkdf2 returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos	3.1.1	3.1.3
pbkdf2	CVE-2025-6547	CRITICAL	-	3.1.1	-
pbkdf2	GHSA-v62p-rq8g-8h59	CRITICAL	pbkdf2 silently disregards Uint8Array input, returning static keys	3.1.1	3.1.3
pbkdf2	CVE-2025-6545	CRITICAL	-	3.1.1	-
pbkdf2	CVE-2025-6547	CRITICAL	-	3.1.2	-
pbkdf2	GHSA-v62p-rq8g-8h59	CRITICAL	pbkdf2 silently disregards Uint8Array input, returning static keys	3.1.2	3.1.3
pbkdf2	CVE-2025-6545	CRITICAL	-	3.1.2	-
pbkdf2	GHSA-h7cp-r72f-jxh6	CRITICAL	pbkdf2 returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos	3.1.2	3.1.3
url-parse	CVE-2022-0686	CRITICAL	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.4.3	-
url-parse	GHSA-hgjh-723h-mx2j	CRITICAL	Authorization Bypass Through User-Controlled Key in url-parse	1.4.3	1.5.8
axios	GHSA-3g43-6gmg-66jw	HIGH	axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge	1.6.1	1.15.2
axios	GHSA-j5f8-grm9-p9fc	HIGH	Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection	1.6.1	1.16.0
axios	GHSA-43fc-jf86-j433	HIGH	Axios is Vulnerable to Denial of Service via proto Key in mergeConfig	1.6.1	1.13.5
axios	CVE-2026-25639	HIGH	Axios affected by Denial of Service via proto Key in mergeConfig	1.6.1	-
axios	GHSA-pjwm-pj3p-43mv	HIGH	axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)	1.6.1	1.16.0
axios	GHSA-35jp-ww65-95wh	HIGH	axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`	1.6.1	1.16.0
axios	GHSA-4hjh-wcwx-xvwj	HIGH	Axios is vulnerable to DoS attack through lack of data size check	1.6.1	1.12.0
axios	GHSA-p92q-9vqr-4j8v	HIGH	Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter	1.6.1	1.16.0
axios	GHSA-6chq-wfr3-2hj9	HIGH	Axios: Header Injection via Prototype Pollution	1.6.1	1.15.1
axios	CVE-2025-58754	HIGH	Axios is vulnerable to DoS attack through lack of data size check	1.6.1	-
axios	GHSA-pmwg-cvhr-8vh7	HIGH	Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0	1.6.1	1.15.1
axios	GHSA-pf86-5x62-jrwf	HIGH	Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking	1.6.1	1.15.1
axios	GHSA-8hc4-vh64-cxmj	HIGH	Server-Side Request Forgery in axios	1.6.1	1.7.4
axios	CVE-2024-39338	HIGH	-	1.6.1	-
axios	GHSA-jr5f-v2jv-69x6	HIGH	axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL	1.6.1	1.8.2
axios	CVE-2025-27152	HIGH	Possible SSRF and Credential Leakage via Absolute URL in axios Requests	1.6.1	-
axios	GHSA-hfxv-24rg-xrqf	HIGH	Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection	1.6.1	1.16.0
axios	GHSA-q8qp-cvcw-x6jj	HIGH	Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking	1.6.1	1.15.2
axios	GHSA-4hjh-wcwx-xvwj	HIGH	Axios is vulnerable to DoS attack through lack of data size check	1.6.1	1.12.0
axios	GHSA-hfxv-24rg-xrqf	HIGH	Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection	1.6.1	1.16.0
axios	GHSA-q8qp-cvcw-x6jj	HIGH	Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking	1.6.1	1.15.2
axios	GHSA-pmwg-cvhr-8vh7	HIGH	Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0	1.6.1	1.15.1
axios	GHSA-pjwm-pj3p-43mv	HIGH	axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)	1.6.1	1.16.0
axios	CVE-2025-58754	HIGH	Axios is vulnerable to DoS attack through lack of data size check	1.6.1	-
axios	GHSA-43fc-jf86-j433	HIGH	Axios is Vulnerable to Denial of Service via proto Key in mergeConfig	1.6.1	1.13.5
axios	CVE-2026-25639	HIGH	Axios affected by Denial of Service via proto Key in mergeConfig	1.6.1	-
axios	GHSA-3g43-6gmg-66jw	HIGH	axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge	1.6.1	1.15.2
axios	GHSA-35jp-ww65-95wh	HIGH	axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`	1.6.1	1.16.0
axios	GHSA-6chq-wfr3-2hj9	HIGH	Axios: Header Injection via Prototype Pollution	1.6.1	1.15.1
axios	GHSA-j5f8-grm9-p9fc	HIGH	Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection	1.6.1	1.16.0
axios	GHSA-pf86-5x62-jrwf	HIGH	Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking	1.6.1	1.15.1
axios	GHSA-8hc4-vh64-cxmj	HIGH	Server-Side Request Forgery in axios	1.6.1	1.7.4
axios	CVE-2024-39338	HIGH	-	1.6.1	-
axios	GHSA-jr5f-v2jv-69x6	HIGH	axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL	1.6.1	1.8.2
axios	CVE-2025-27152	HIGH	Possible SSRF and Credential Leakage via Absolute URL in axios Requests	1.6.1	-
axios	GHSA-p92q-9vqr-4j8v	HIGH	Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter	1.6.1	1.16.0
axios	GHSA-3g43-6gmg-66jw	HIGH	axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge	1.6.1	1.15.2
axios	GHSA-6chq-wfr3-2hj9	HIGH	Axios: Header Injection via Prototype Pollution	1.6.1	1.15.1
axios	GHSA-q8qp-cvcw-x6jj	HIGH	Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking	1.6.1	1.15.2
axios	GHSA-pmwg-cvhr-8vh7	HIGH	Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0	1.6.1	1.15.1
axios	GHSA-4hjh-wcwx-xvwj	HIGH	Axios is vulnerable to DoS attack through lack of data size check	1.6.1	1.12.0
axios	CVE-2025-58754	HIGH	Axios is vulnerable to DoS attack through lack of data size check	1.6.1	-
axios	GHSA-43fc-jf86-j433	HIGH	Axios is Vulnerable to Denial of Service via proto Key in mergeConfig	1.6.1	1.13.5
axios	CVE-2026-25639	HIGH	Axios affected by Denial of Service via proto Key in mergeConfig	1.6.1	-
axios	GHSA-p92q-9vqr-4j8v	HIGH	Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter	1.6.1	1.16.0
axios	GHSA-pjwm-pj3p-43mv	HIGH	axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)	1.6.1	1.16.0
axios	GHSA-35jp-ww65-95wh	HIGH	axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`	1.6.1	1.16.0
axios	GHSA-j5f8-grm9-p9fc	HIGH	Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection	1.6.1	1.16.0
axios	GHSA-pf86-5x62-jrwf	HIGH	Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking	1.6.1	1.15.1
axios	GHSA-8hc4-vh64-cxmj	HIGH	Server-Side Request Forgery in axios	1.6.1	1.7.4
axios	CVE-2024-39338	HIGH	-	1.6.1	-
axios	GHSA-jr5f-v2jv-69x6	HIGH	axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL	1.6.1	1.8.2
axios	CVE-2025-27152	HIGH	Possible SSRF and Credential Leakage via Absolute URL in axios Requests	1.6.1	-
axios	GHSA-hfxv-24rg-xrqf	HIGH	Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection	1.6.1	1.16.0
axios	GHSA-43fc-jf86-j433	HIGH	Axios is Vulnerable to Denial of Service via proto Key in mergeConfig	1.6.1	1.13.5
axios	GHSA-hfxv-24rg-xrqf	HIGH	Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection	1.6.1	1.16.0
axios	GHSA-3g43-6gmg-66jw	HIGH	axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge	1.6.1	1.15.2
axios	CVE-2026-25639	HIGH	Axios affected by Denial of Service via proto Key in mergeConfig	1.6.1	-
axios	GHSA-35jp-ww65-95wh	HIGH	axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`	1.6.1	1.16.0
axios	CVE-2025-58754	HIGH	Axios is vulnerable to DoS attack through lack of data size check	1.6.1	-
axios	GHSA-4hjh-wcwx-xvwj	HIGH	Axios is vulnerable to DoS attack through lack of data size check	1.6.1	1.12.0
axios	GHSA-pmwg-cvhr-8vh7	HIGH	Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0	1.6.1	1.15.1
axios	GHSA-q8qp-cvcw-x6jj	HIGH	Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking	1.6.1	1.15.2
axios	GHSA-p92q-9vqr-4j8v	HIGH	Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter	1.6.1	1.16.0
axios	GHSA-6chq-wfr3-2hj9	HIGH	Axios: Header Injection via Prototype Pollution	1.6.1	1.15.1
axios	GHSA-j5f8-grm9-p9fc	HIGH	Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection	1.6.1	1.16.0
axios	GHSA-pf86-5x62-jrwf	HIGH	Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking	1.6.1	1.15.1
axios	GHSA-8hc4-vh64-cxmj	HIGH	Server-Side Request Forgery in axios	1.6.1	1.7.4
axios	CVE-2024-39338	HIGH	-	1.6.1	-
axios	GHSA-jr5f-v2jv-69x6	HIGH	axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL	1.6.1	1.8.2
axios	CVE-2025-27152	HIGH	Possible SSRF and Credential Leakage via Absolute URL in axios Requests	1.6.1	-
axios	GHSA-pjwm-pj3p-43mv	HIGH	axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)	1.6.1	1.16.0
axios	GHSA-jr5f-v2jv-69x6	HIGH	axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL	1.6.1	1.8.2
axios	GHSA-p92q-9vqr-4j8v	HIGH	Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter	1.6.1	1.16.0
axios	GHSA-q8qp-cvcw-x6jj	HIGH	Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking	1.6.1	1.15.2
axios	GHSA-pmwg-cvhr-8vh7	HIGH	Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0	1.6.1	1.15.1
axios	GHSA-4hjh-wcwx-xvwj	HIGH	Axios is vulnerable to DoS attack through lack of data size check	1.6.1	1.12.0
axios	CVE-2025-58754	HIGH	Axios is vulnerable to DoS attack through lack of data size check	1.6.1	-
axios	GHSA-43fc-jf86-j433	HIGH	Axios is Vulnerable to Denial of Service via proto Key in mergeConfig	1.6.1	1.13.5
axios	CVE-2026-25639	HIGH	Axios affected by Denial of Service via proto Key in mergeConfig	1.6.1	-
axios	GHSA-3g43-6gmg-66jw	HIGH	axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge	1.6.1	1.15.2
axios	GHSA-35jp-ww65-95wh	HIGH	axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`	1.6.1	1.16.0
axios	GHSA-6chq-wfr3-2hj9	HIGH	Axios: Header Injection via Prototype Pollution	1.6.1	1.15.1
axios	GHSA-j5f8-grm9-p9fc	HIGH	Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection	1.6.1	1.16.0
axios	GHSA-pf86-5x62-jrwf	HIGH	Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking	1.6.1	1.15.1
axios	GHSA-8hc4-vh64-cxmj	HIGH	Server-Side Request Forgery in axios	1.6.1	1.7.4
axios	CVE-2024-39338	HIGH	-	1.6.1	-
axios	GHSA-hfxv-24rg-xrqf	HIGH	Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection	1.6.1	1.16.0
axios	CVE-2025-27152	HIGH	Possible SSRF and Credential Leakage via Absolute URL in axios Requests	1.6.1	-
axios	GHSA-pjwm-pj3p-43mv	HIGH	axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)	1.6.1	1.16.0
node-forge	CVE-2025-66031	HIGH	node-forge ASN.1 Unbounded Recursion	1.3.1	-
node-forge	CVE-2026-33895	HIGH	Forge has signature forgery in Ed25519 due to missing S > L check	1.3.1	-
node-forge	GHSA-q67f-28xg-22rw	HIGH	Forge has signature forgery in Ed25519 due to missing S > L check	1.3.1	1.4.0
node-forge	CVE-2026-33896	HIGH	Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)	1.3.1	-
node-forge	GHSA-2328-f5f3-gj25	HIGH	Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)	1.3.1	1.4.0
node-forge	CVE-2025-12816	HIGH	-	1.3.1	-
node-forge	GHSA-5gfm-wpxj-wjgq	HIGH	node-forge has an Interpretation Conflict vulnerability via its ASN.1 Validator Desynchronization	1.3.1	1.3.2
node-forge	CVE-2026-33894	HIGH	Forge has signature forgery in RSA-PKCS due to ASN.1 extra field	1.3.1	-
node-forge	GHSA-ppp5-5v6c-4jwp	HIGH	Forge has signature forgery in RSA-PKCS due to ASN.1 extra field	1.3.1	1.4.0
node-forge	GHSA-554w-wpv2-vw27	HIGH	node-forge has ASN.1 Unbounded Recursion	1.3.1	1.3.2
node-forge	GHSA-5m6q-g25r-mvwx	HIGH	Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input	1.3.1	1.4.0
node-forge	CVE-2026-33891	HIGH	Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input	1.3.1	-
node-forge	GHSA-2328-f5f3-gj25	HIGH	Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)	1.3.1	1.4.0
node-forge	GHSA-5m6q-g25r-mvwx	HIGH	Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input	1.3.1	1.4.0
node-forge	CVE-2026-33894	HIGH	Forge has signature forgery in RSA-PKCS due to ASN.1 extra field	1.3.1	-
node-forge	GHSA-5gfm-wpxj-wjgq	HIGH	node-forge has an Interpretation Conflict vulnerability via its ASN.1 Validator Desynchronization	1.3.1	1.3.2
node-forge	CVE-2025-12816	HIGH	-	1.3.1	-
node-forge	CVE-2026-33891	HIGH	Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input	1.3.1	-
node-forge	CVE-2026-33896	HIGH	Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)	1.3.1	-
node-forge	GHSA-q67f-28xg-22rw	HIGH	Forge has signature forgery in Ed25519 due to missing S > L check	1.3.1	1.4.0
node-forge	CVE-2026-33895	HIGH	Forge has signature forgery in Ed25519 due to missing S > L check	1.3.1	-
node-forge	GHSA-554w-wpv2-vw27	HIGH	node-forge has ASN.1 Unbounded Recursion	1.3.1	1.3.2
node-forge	CVE-2025-66031	HIGH	node-forge ASN.1 Unbounded Recursion	1.3.1	-
node-forge	GHSA-ppp5-5v6c-4jwp	HIGH	Forge has signature forgery in RSA-PKCS due to ASN.1 extra field	1.3.1	1.4.0
node-forge	CVE-2025-66031	HIGH	node-forge ASN.1 Unbounded Recursion	1.3.1	-
node-forge	CVE-2026-33891	HIGH	Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input	1.3.1	-
node-forge	GHSA-5m6q-g25r-mvwx	HIGH	Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input	1.3.1	1.4.0
node-forge	GHSA-ppp5-5v6c-4jwp	HIGH	Forge has signature forgery in RSA-PKCS due to ASN.1 extra field	1.3.1	1.4.0
node-forge	CVE-2026-33894	HIGH	Forge has signature forgery in RSA-PKCS due to ASN.1 extra field	1.3.1	-
node-forge	GHSA-5gfm-wpxj-wjgq	HIGH	node-forge has an Interpretation Conflict vulnerability via its ASN.1 Validator Desynchronization	1.3.1	1.3.2
node-forge	CVE-2025-12816	HIGH	-	1.3.1	-
node-forge	GHSA-2328-f5f3-gj25	HIGH	Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)	1.3.1	1.4.0
node-forge	CVE-2026-33896	HIGH	Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)	1.3.1	-
node-forge	GHSA-q67f-28xg-22rw	HIGH	Forge has signature forgery in Ed25519 due to missing S > L check	1.3.1	1.4.0
node-forge	CVE-2026-33895	HIGH	Forge has signature forgery in Ed25519 due to missing S > L check	1.3.1	-
node-forge	GHSA-554w-wpv2-vw27	HIGH	node-forge has ASN.1 Unbounded Recursion	1.3.1	1.3.2
node-forge	CVE-2026-33895	HIGH	Forge has signature forgery in Ed25519 due to missing S > L check	1.3.1	-
node-forge	GHSA-554w-wpv2-vw27	HIGH	node-forge has ASN.1 Unbounded Recursion	1.3.1	1.3.2
node-forge	CVE-2026-33891	HIGH	Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input	1.3.1	-
node-forge	GHSA-5m6q-g25r-mvwx	HIGH	Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input	1.3.1	1.4.0
node-forge	CVE-2025-66031	HIGH	node-forge ASN.1 Unbounded Recursion	1.3.1	-
node-forge	GHSA-ppp5-5v6c-4jwp	HIGH	Forge has signature forgery in RSA-PKCS due to ASN.1 extra field	1.3.1	1.4.0
node-forge	CVE-2026-33894	HIGH	Forge has signature forgery in RSA-PKCS due to ASN.1 extra field	1.3.1	-
node-forge	GHSA-5gfm-wpxj-wjgq	HIGH	node-forge has an Interpretation Conflict vulnerability via its ASN.1 Validator Desynchronization	1.3.1	1.3.2
node-forge	CVE-2025-12816	HIGH	-	1.3.1	-
node-forge	GHSA-2328-f5f3-gj25	HIGH	Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)	1.3.1	1.4.0
node-forge	CVE-2026-33896	HIGH	Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)	1.3.1	-
node-forge	GHSA-q67f-28xg-22rw	HIGH	Forge has signature forgery in Ed25519 due to missing S > L check	1.3.1	1.4.0
node-forge	GHSA-q67f-28xg-22rw	HIGH	Forge has signature forgery in Ed25519 due to missing S > L check	1.3.1	1.4.0
node-forge	CVE-2025-66031	HIGH	node-forge ASN.1 Unbounded Recursion	1.3.1	-
node-forge	CVE-2026-33891	HIGH	Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input	1.3.1	-
node-forge	GHSA-5m6q-g25r-mvwx	HIGH	Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input	1.3.1	1.4.0
node-forge	GHSA-554w-wpv2-vw27	HIGH	node-forge has ASN.1 Unbounded Recursion	1.3.1	1.3.2
node-forge	CVE-2026-33895	HIGH	Forge has signature forgery in Ed25519 due to missing S > L check	1.3.1	-
node-forge	CVE-2026-33896	HIGH	Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)	1.3.1	-
node-forge	GHSA-ppp5-5v6c-4jwp	HIGH	Forge has signature forgery in RSA-PKCS due to ASN.1 extra field	1.3.1	1.4.0
node-forge	CVE-2026-33894	HIGH	Forge has signature forgery in RSA-PKCS due to ASN.1 extra field	1.3.1	-
node-forge	GHSA-5gfm-wpxj-wjgq	HIGH	node-forge has an Interpretation Conflict vulnerability via its ASN.1 Validator Desynchronization	1.3.1	1.3.2
node-forge	CVE-2025-12816	HIGH	-	1.3.1	-
node-forge	GHSA-2328-f5f3-gj25	HIGH	Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)	1.3.1	1.4.0
undici	CVE-2026-1528	HIGH	-	6.2.1	-
undici	GHSA-vrm6-8vpv-qv8q	HIGH	Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression	6.2.1	6.24.0
undici	GHSA-f269-vfmq-vjvj	HIGH	Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client	6.2.1	6.24.0
undici	CVE-2026-2229	HIGH	-	6.2.1	-
undici	GHSA-v9p9-hfj2-hcw8	HIGH	Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation	6.2.1	6.24.0
undici	CVE-2026-1526	HIGH	-	6.2.1	-
vite	GHSA-c24v-8rfc-w8vw	HIGH	Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem	5.0.11	2.9.17
vite	GHSA-fx2h-pf6j-xcff	HIGH	vite: `server.fs.deny` bypass on Windows alternate paths	5.0.11	8.0.16
vite	CVE-2024-23331	HIGH	Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem	5.0.11	-
vite	GHSA-c27g-q93r-2cwf	HIGH	launch-editor vulnerable to command injection via the crafted request on Windows	5.0.11	5.4.9
vite	CVE-2025-31125	high	This package is related to CVE CVE-2025-31125 which was detected by cisa.gov as actively being exploited in the wild	5.0.11	-

ℹ️ Other Vulnerabilities (126)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In
axios	GHSA-62hf-57xw-28j9	MODERATE	Axios: unbounded recursion in toFormData causes DoS via deeply nested request data	1.6.1	1.15.1
axios	GHSA-3p68-rc4w-qgx5	MODERATE	Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF	1.6.1	1.15.0
axios	GHSA-898c-q2cr-xwhg	MODERATE	axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions	1.6.1	1.16.0
axios	GHSA-vf2m-468p-8v99	MODERATE	Axios: HTTP adapter streamed responses bypass maxContentLength	1.6.1	1.15.1
axios	GHSA-w9j2-pvgh-6h63	MODERATE	Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy	1.6.1	1.15.1
axios	GHSA-3w6x-2g7m-8v23	MODERATE	Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`	1.6.1	1.15.2
axios	GHSA-m7pr-hjqh-92cm	MODERATE	Axios: no_proxy bypass via IP alias allows SSRF	1.6.1	1.15.1
axios	GHSA-xx6v-rp6x-q39c	MODERATE	Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion	1.6.1	1.15.1
axios	GHSA-fvcv-3m26-pcqx	MODERATE	Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain	1.6.1	1.15.0
axios	GHSA-445q-vr5w-6q77	MODERATE	Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream	1.6.1	1.15.1
axios	GHSA-5c9x-8gcm-mpgx	MODERATE	Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0	1.6.1	1.15.1
axios	GHSA-898c-q2cr-xwhg	MODERATE	axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions	1.6.1	1.16.0
axios	GHSA-62hf-57xw-28j9	MODERATE	Axios: unbounded recursion in toFormData causes DoS via deeply nested request data	1.6.1	1.15.1
axios	GHSA-w9j2-pvgh-6h63	MODERATE	Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy	1.6.1	1.15.1
axios	GHSA-m7pr-hjqh-92cm	MODERATE	Axios: no_proxy bypass via IP alias allows SSRF	1.6.1	1.15.1
axios	GHSA-3p68-rc4w-qgx5	MODERATE	Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF	1.6.1	1.15.0
axios	GHSA-445q-vr5w-6q77	MODERATE	Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream	1.6.1	1.15.1
axios	GHSA-vf2m-468p-8v99	MODERATE	Axios: HTTP adapter streamed responses bypass maxContentLength	1.6.1	1.15.1
axios	GHSA-5c9x-8gcm-mpgx	MODERATE	Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0	1.6.1	1.15.1
axios	GHSA-3w6x-2g7m-8v23	MODERATE	Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`	1.6.1	1.15.2
axios	GHSA-fvcv-3m26-pcqx	MODERATE	Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain	1.6.1	1.15.0
axios	GHSA-xx6v-rp6x-q39c	MODERATE	Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion	1.6.1	1.15.1
axios	GHSA-m7pr-hjqh-92cm	MODERATE	Axios: no_proxy bypass via IP alias allows SSRF	1.6.1	1.15.1
axios	GHSA-3p68-rc4w-qgx5	MODERATE	Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF	1.6.1	1.15.0
axios	GHSA-5c9x-8gcm-mpgx	MODERATE	Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0	1.6.1	1.15.1
axios	GHSA-898c-q2cr-xwhg	MODERATE	axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions	1.6.1	1.16.0
axios	GHSA-445q-vr5w-6q77	MODERATE	Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream	1.6.1	1.15.1
axios	GHSA-xx6v-rp6x-q39c	MODERATE	Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion	1.6.1	1.15.1
axios	GHSA-fvcv-3m26-pcqx	MODERATE	Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain	1.6.1	1.15.0
axios	GHSA-vf2m-468p-8v99	MODERATE	Axios: HTTP adapter streamed responses bypass maxContentLength	1.6.1	1.15.1
axios	GHSA-w9j2-pvgh-6h63	MODERATE	Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy	1.6.1	1.15.1
axios	GHSA-3w6x-2g7m-8v23	MODERATE	Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`	1.6.1	1.15.2
axios	GHSA-62hf-57xw-28j9	MODERATE	Axios: unbounded recursion in toFormData causes DoS via deeply nested request data	1.6.1	1.15.1
axios	GHSA-m7pr-hjqh-92cm	MODERATE	Axios: no_proxy bypass via IP alias allows SSRF	1.6.1	1.15.1
axios	GHSA-fvcv-3m26-pcqx	MODERATE	Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain	1.6.1	1.15.0
axios	GHSA-62hf-57xw-28j9	MODERATE	Axios: unbounded recursion in toFormData causes DoS via deeply nested request data	1.6.1	1.15.1
axios	GHSA-xx6v-rp6x-q39c	MODERATE	Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion	1.6.1	1.15.1
axios	GHSA-445q-vr5w-6q77	MODERATE	Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream	1.6.1	1.15.1
axios	GHSA-3w6x-2g7m-8v23	MODERATE	Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`	1.6.1	1.15.2
axios	GHSA-w9j2-pvgh-6h63	MODERATE	Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy	1.6.1	1.15.1
axios	GHSA-vf2m-468p-8v99	MODERATE	Axios: HTTP adapter streamed responses bypass maxContentLength	1.6.1	1.15.1
axios	GHSA-3p68-rc4w-qgx5	MODERATE	Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF	1.6.1	1.15.0
axios	GHSA-5c9x-8gcm-mpgx	MODERATE	Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0	1.6.1	1.15.1
axios	GHSA-898c-q2cr-xwhg	MODERATE	axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions	1.6.1	1.16.0
axios	GHSA-xx6v-rp6x-q39c	MODERATE	Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion	1.6.1	1.15.1
axios	GHSA-898c-q2cr-xwhg	MODERATE	axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions	1.6.1	1.16.0
axios	GHSA-fvcv-3m26-pcqx	MODERATE	Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain	1.6.1	1.15.0
axios	GHSA-62hf-57xw-28j9	MODERATE	Axios: unbounded recursion in toFormData causes DoS via deeply nested request data	1.6.1	1.15.1
axios	GHSA-m7pr-hjqh-92cm	MODERATE	Axios: no_proxy bypass via IP alias allows SSRF	1.6.1	1.15.1
axios	GHSA-3w6x-2g7m-8v23	MODERATE	Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`	1.6.1	1.15.2
axios	GHSA-w9j2-pvgh-6h63	MODERATE	Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy	1.6.1	1.15.1
axios	GHSA-vf2m-468p-8v99	MODERATE	Axios: HTTP adapter streamed responses bypass maxContentLength	1.6.1	1.15.1
axios	GHSA-445q-vr5w-6q77	MODERATE	Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream	1.6.1	1.15.1
axios	GHSA-5c9x-8gcm-mpgx	MODERATE	Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0	1.6.1	1.15.1
axios	GHSA-3p68-rc4w-qgx5	MODERATE	Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF	1.6.1	1.15.0
node-forge	CVE-2025-66030	MODERATE	node-forge ASN.1 OID Integer Truncation	1.3.1	-
node-forge	GHSA-65ch-62r8-g69g	MODERATE	node-forge is vulnerable to ASN.1 OID Integer Truncation	1.3.1	1.3.2
node-forge	CVE-2025-66030	MODERATE	node-forge ASN.1 OID Integer Truncation	1.3.1	-
node-forge	GHSA-65ch-62r8-g69g	MODERATE	node-forge is vulnerable to ASN.1 OID Integer Truncation	1.3.1	1.3.2
node-forge	CVE-2025-66030	MODERATE	node-forge ASN.1 OID Integer Truncation	1.3.1	-
node-forge	GHSA-65ch-62r8-g69g	MODERATE	node-forge is vulnerable to ASN.1 OID Integer Truncation	1.3.1	1.3.2
node-forge	GHSA-65ch-62r8-g69g	MODERATE	node-forge is vulnerable to ASN.1 OID Integer Truncation	1.3.1	1.3.2
node-forge	CVE-2025-66030	MODERATE	node-forge ASN.1 OID Integer Truncation	1.3.1	-
node-forge	CVE-2025-66030	MODERATE	node-forge ASN.1 OID Integer Truncation	1.3.1	-
node-forge	GHSA-65ch-62r8-g69g	MODERATE	node-forge is vulnerable to ASN.1 OID Integer Truncation	1.3.1	1.3.2
undici	GHSA-9f24-jqhm-jfcw	MODERATE	fetch(url) leads to a memory leak in undici	6.2.1	6.6.1
undici	GHSA-c76h-2ccp-4975	MODERATE	Use of Insufficiently Random Values in undici	6.2.1	5.28.5
undici	GHSA-2mjp-6q6p-2qxm	MODERATE	Undici has an HTTP Request/Response Smuggling issue	6.2.1	6.24.0
undici	GHSA-g9mf-h72j-4rw9	MODERATE	Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion	6.2.1	7.18.2
undici	CVE-2026-22036	MODERATE	Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion	6.2.1	-
undici	CVE-2025-22150	MODERATE	Undici Uses Insufficiently Random Values	6.2.1	-
undici	CVE-2024-24750	MODERATE	Backpressure request ignored in fetch() in Undici	6.2.1	-
undici	CVE-2026-1525	MODERATE	-	6.2.1	-
undici	GHSA-4992-7rv2-5pvq	MODERATE	Undici has CRLF Injection in undici via `upgrade` option	6.2.1	6.24.0
undici	CVE-2026-1527	MODERATE	-	6.2.1	-
url-parse	CVE-2022-0639	MODERATE	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.4.3	-
url-parse	CVE-2022-0691	MODERATE	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.4.3	-
url-parse	GHSA-hh27-ffr2-f2jc	MODERATE	Open redirect in url-parse	1.4.3	1.5.2
url-parse	GHSA-rqff-837h-mm52	MODERATE	Authorization bypass in url-parse	1.4.3	1.5.6
url-parse	CVE-2021-3664	MODERATE	-	1.4.3	-
url-parse	GHSA-8v38-pw62-9cw2	MODERATE	url-parse Incorrectly parses URLs that include an '@'	1.4.3	1.5.7
url-parse	CVE-2022-0512	MODERATE	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.4.3	-
url-parse	CVE-2020-8124	MODERATE	-	1.4.3	-
url-parse	GHSA-jf5r-8hm2-f872	MODERATE	url-parse incorrectly parses hostname / protocol due to unstripped leading control characters.	1.4.3	1.5.9
url-parse	CVE-2021-27515	MODERATE	-	1.4.3	-
url-parse	GHSA-46c4-8wrp-j99v	MODERATE	Improper Validation and Sanitization in url-parse	1.4.3	1.4.5
url-parse	GHSA-9m6j-fcg5-2442	MODERATE	Path traversal in url-parse	1.4.3	1.5.0
vite	GHSA-356w-63v5-8wf4	MODERATE	Vite has an `server.fs.deny` bypass with an invalid `request-target`	5.0.11	6.2.6
vite	GHSA-v6wh-96g9-6wx3	MODERATE	launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows	5.0.11	8.0.16
vite	CVE-2025-32395	MODERATE	Vite has an `server.fs.deny` bypass with an invalid `request-target`	5.0.11	-
vite	GHSA-93m4-6634-74q7	MODERATE	vite allows server.fs.deny bypass via backslash on Windows	5.0.11	7.1.11
vite	CVE-2025-62522	MODERATE	vite allows server.fs.deny bypass via backslash on Windows	5.0.11	-
vite	GHSA-859w-5945-r5v3	MODERATE	Vite's server.fs.deny bypassed with /. for files under project root	5.0.11	6.3.4
vite	CVE-2025-24010	MODERATE	Vite allows any websites to send any requests to the development server and read the response	5.0.11	-
vite	GHSA-64vr-g452-qvp3	MODERATE	Vite DOM Clobbering gadget found in vite bundled scripts that leads to XSS	5.0.11	5.4.6
vite	CVE-2024-45812	MODERATE	DOM Clobbering gadget found in vite bundled scripts that leads to XSS in Vite	5.0.11	-
vite	CVE-2025-31125	MODERATE	Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query	5.0.11	-
vite	GHSA-vg6x-rcgg-rjx6	MODERATE	Websites were able to send any requests to the development server and read the response in vite	5.0.11	6.0.9
vite	CVE-2024-45811	MODERATE	server.fs.deny bypassed when using ?import&raw in vite	5.0.11	-
vite	CVE-2024-31207	MODERATE	Vite's `server.fs.deny` did not deny requests for patterns with directories	5.0.11	-
vite	GHSA-9cwx-2883-4wfx	MODERATE	Vite's `server.fs.deny` is bypassed when using `?import&raw`	5.0.11	5.4.6
vite	GHSA-4r4m-qw57-chr8	MODERATE	Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query	5.0.11	6.2.4
vite	CVE-2025-46565	MODERATE	Vite's server.fs.deny bypassed with /. for files under project root	5.0.11	-
vite	GHSA-4w7w-66w2-5vf9	MODERATE	Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling	5.0.11	8.0.5
vite	GHSA-8jhw-289h-jh2g	MODERATE	Vite's `server.fs.deny` did not deny requests for patterns with directories.	5.0.11	2.9.18
vite	CVE-2025-31486	MODERATE	Vite allows server.fs.deny to be bypassed with .svg or relative paths	5.0.11	-
vite	GHSA-x574-m823-4x7w	MODERATE	Vite bypasses server.fs.deny when using ?raw??	5.0.11	6.2.3
vite	CVE-2025-30208	MODERATE	Vite bypasses server.fs.deny when using `?raw??`	5.0.11	-
vite	GHSA-xcj6-pq6g-qj4x	MODERATE	Vite allows server.fs.deny to be bypassed with .svg or relative paths	5.0.11	6.2.5
axios	GHSA-xhjh-pmcv-23jw	LOW	Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams	1.6.1	1.15.1
axios	GHSA-xhjh-pmcv-23jw	LOW	Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams	1.6.1	1.15.1
axios	GHSA-xhjh-pmcv-23jw	LOW	Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams	1.6.1	1.15.1
axios	GHSA-xhjh-pmcv-23jw	LOW	Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams	1.6.1	1.15.1
axios	GHSA-xhjh-pmcv-23jw	LOW	Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams	1.6.1	1.15.1
undici	GHSA-9qxr-qj54-h672	LOW	Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect	6.2.1	5.28.4
undici	CVE-2024-30261	LOW	Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect	6.2.1	-
undici	GHSA-m4v8-wqvr-p9f7	LOW	Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline	6.2.1	5.28.4
undici	CVE-2024-30260	LOW	Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline	6.2.1	-
undici	GHSA-cxrh-j4jr-qwg3	LOW	undici Denial of Service attack via bad certificate data	6.2.1	5.29.0
undici	CVE-2025-47279	LOW	undici Denial of Service attack via bad certificate data	6.2.1	-
undici	GHSA-3787-6prv-h9w3	LOW	Undici proxy-authorization header not cleared on cross-origin redirect in fetch	6.2.1	5.28.3
undici	CVE-2024-24758	LOW	Proxy-Authorization header not cleared on cross-origin redirect in fetch in Undici	6.2.1	-
vite	CVE-2025-58751	LOW	Vite middleware may serve files starting with the same name with the public directory	5.0.11	-
vite	GHSA-jqfw-vq24-v9c3	LOW	Vite's `server.fs` settings were not applied to HTML files	5.0.11	7.1.5
vite	GHSA-g4jq-h2w9-997c	LOW	Vite middleware may serve files starting with the same name with the public directory	5.0.11	7.1.5
vite	CVE-2025-58752	LOW	Vite's `server.fs` settings were not applied to HTML files	5.0.11	-

Review Checklist

Standard review:

Review changes for compatibility with your code
Check for breaking changes in release notes
Run tests locally or wait for CI
Approve and merge this PR

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System

…/client]

datadog-datadog-prod-us1-2 · 2026-06-16T07:22:27Z

✨ Fix all issues with BitsAI

⚠️ Warnings

🚦 3 Pipeline jobs failed

OpenAPI Generator | Samples up-to-date

Linux tests | Build: JDK 11 (ubuntu-latest)

Windows tests | Build (11)

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.

🔗 Commit SHA: 5888a63 | Docs | Datadog PR Page | Give us feedback!}

ADMS: vuln minor upgrades — 6 packages (minor: 5 · patch: 1) [samples…

5888a63

…/client]

gh-worker-campaigns-3e9aa4 Bot added the campaigner-automated-change label Jun 16, 2026

gh-worker-campaigns-3e9aa4 Bot closed this Jul 19, 2026

gh-worker-campaigns-3e9aa4 Bot deleted the engraver-auto-version-upgrade/minorpatch/npm/client/0-1781594209 branch July 19, 2026 14:54

Navigation Menu

Uh oh!

fix(deps): vuln minor upgrades — 6 packages (minor: 5 · patch: 1) [samples/client] - #54

fix(deps): vuln minor upgrades — 6 packages (minor: 5 · patch: 1) [samples/client]#54
gh-worker-campaigns-3e9aa4[bot] wants to merge 1 commit into
masterfrom
engraver-auto-version-upgrade/minorpatch/npm/client/0-1781594209

gh-worker-campaigns-3e9aa4 Bot commented Jun 16, 2026

Uh oh!

datadog-datadog-prod-us1-2 Bot commented Jun 16, 2026 •

edited by datadog-prod-us1-4 Bot

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

gh-worker-campaigns-3e9aa4 Bot commented Jun 16, 2026

Updates

Security Details

Review Checklist

Uh oh!

datadog-datadog-prod-us1-2 Bot commented Jun 16, 2026 • edited by datadog-prod-us1-4 Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Warnings

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

datadog-datadog-prod-us1-2 Bot commented Jun 16, 2026 •

edited by datadog-prod-us1-4 Bot

Loading