Issues

[HIGH] follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects

cdk8s-team/cdk8s-redis#2494 · opened

on Nov 3, 2026

[MEDIUM] minimatch has potential denial of service via globparts amplification

cdk8s-team/cdk8s-redis#2493 · opened

on Nov 3, 2026

[LOW] deepmerge mergeObject() allows prototype poisoning of returned objects

cdk8s-team/cdk8s-redis#2486 · opened

on Oct 31, 2026

[HIGH] follow-redirects sensitiveHeaders regex escaping can expose credential headers

cdk8s-team/cdk8s-redis#2470 · opened

on Oct 23, 2026

[HIGH] follow-redirects array-form headers bypass cross-origin credential stripping

cdk8s-team/cdk8s-redis#2469 · opened

on Oct 23, 2026

[MEDIUM] sprintf-js vulnerable to denial of service through unbounded precision specifiers

cdk8s-team/cdk8s-redis#2442 · opened

on Oct 9, 2026

[MEDIUM] stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS)

cdk8s-team/cdk8s-redis#2394 · opened

on Sep 6, 2026

[MEDIUM] JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases

cdk8s-team/cdk8s-redis#2272 · opened

on Jun 19, 2026

[MEDIUM] uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided

cdk8s-team/cdk8s-redis#2173 · opened

on Apr 26, 2026

[MEDIUM] follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets

cdk8s-team/cdk8s-redis#2156 · opened

on Apr 17, 2026

[MEDIUM] Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions

cdk8s-team/cdk8s-redis#2141 · opened

on Apr 2, 2026

[LOW] @tootallnate/once vulnerable to Incorrect Control Flow Scoping

cdk8s-team/cdk8s-redis#2094 · opened

on Mar 7, 2026

[MEDIUM] js-yaml has prototype pollution in merge (<<)

cdk8s-team/cdk8s-redis#1931 · opened

on Nov 17, 2025

Navigation Menu

Repository navigation