CVE Vulnerability Catalog

Axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON, the helper behind the public axios.formToJSON() / named formToJSON API and the default request transform used when FormData is sent with an application/json content type.

Axios versions starting with 0.28.0 contain uncontrolled recursion in formDataToJSON, which is exposed as axios.formToJSON() and used internally when axios serialises FormData with Content-Type: application/json. If an application passes attacker-controlled FormData field names, it can lead to stack exhaustion.

Node-tar (npm tar) contains an uncontrolled recursion stack-exhaustion DoS in the internal mapHas helper used by filesFilter. Calling tar.t(...) or tar.x(...) with a non-empty member-selection list installs a filter that closes over the recursive mapHas.

Path traversal vulnerability in serve-static on Windows via encoded backslash (%5C) in the request path. On Windows hosts, an encoded backslash (%5C) decodes to \, which the Windows path treats as a directory separator.

Axios is vulnerable to read-side prototype-pollution gadgets when Object.prototype has already been polluted by another vulnerability or dependency. The most broadly reachable issue is in the bodyless method aliases: axios.get(), axios.delete(), axios.head(), and axios.options().

Axios can consume inherited properties from nested request option objects when the JavaScript process already has a polluted Object.prototype. The top-level merged config is protected with a null prototype, but nested plain objects such as auth and paramsSerializer are cloned into objects with a prototype.

An out-of-bounds read was found in the NC-SI OEM response handler of libslirp. A truncated NC-SI OEM Ethernet frame causes ncsi_rsp_handler_oem() to read up to 4 bytes beyond the supplied packet length and reflect the value into the response sent to the guest, resulting in guest-observable disclosure.

Vulnerability in the iscsi-initiator-utils package involves out-of-bounds write and information disclosure via unvalidated IPv6 payload length. Crafted ICMPv6 Echo requests can cause the iscsiuio daemon to trust an inflated ipv6_plen larger than the actual received payload.

A TSIG packet with name compression can crash DNS. Incorrect size calculations when a TSIG record contains compressed names lead to a large out-of-bounds write, causing a server crash.

A low-privilege authenticated Samba AD user can modify internal LDB special DNs via LDAP access, enabling a domain takeover.

The iscsi-initiator-utils package version 6.2.1.11-0.git4b3e853.el10 has a stack buffer overflow vulnerability in idbm_recinfo_config. A malicious iSCSI target can inject an extra configuration line into a persisted node record via a crafted SendTargets TargetName, later causing a stack buffer overflow.