Repository navigation

Issues

[LOW] deepmerge mergeObject() allows prototype poisoning of returned objects
cdk8s-team/cdk8s-image#2712 · opened on Oct 31, 2026
[HIGH] follow-redirects sensitiveHeaders regex escaping can expose credential headers
cdk8s-team/cdk8s-image#2696 · opened on Oct 23, 2026
[HIGH] follow-redirects array-form headers bypass cross-origin credential stripping
cdk8s-team/cdk8s-image#2695 · opened on Oct 23, 2026
[MEDIUM] sprintf-js vulnerable to denial of service through unbounded precision specifiers
cdk8s-team/cdk8s-image#2668 · opened on Oct 9, 2026
[MEDIUM] stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS)
cdk8s-team/cdk8s-image#2620 · opened on Sep 6, 2026
[MEDIUM] JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases
cdk8s-team/cdk8s-image#2512 · opened on Jun 19, 2026
[MEDIUM] uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided
cdk8s-team/cdk8s-image#2413 · opened on Apr 26, 2026
[MEDIUM] follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets
cdk8s-team/cdk8s-image#2396 · opened on Apr 17, 2026
[MEDIUM] Lodash has Prototype Pollution Vulnerability in _.unset and _.omit functions
cdk8s-team/cdk8s-image#2381 · opened on Apr 2, 2026
[LOW] @tootallnate/once vulnerable to Incorrect Control Flow Scoping
cdk8s-team/cdk8s-image#2334 · opened on Mar 7, 2026
[MEDIUM] js-yaml has prototype pollution in merge (<<)
cdk8s-team/cdk8s-image#2174 · opened on Nov 17, 2025