UlisesGascon

proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

multer vulnerable to Denial of Service via orphaned disk writes on aborted uploads

multiparty vulnerable to Denial of Service via unbounded part-header accumulation

morgan vulnerable to Log Injection via unescaped double quote in quoted log fields

compression vulnerable to Denial of Service via memory leak on premature response close

hbs vulnerable to Denial of Service via unhandled exception in async helper output escaping

fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization

fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets

moment vulnerable to Path Traversal via crafted non-string locale name

fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers