deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-wf42-42fg-fg84
Package: @nestjs/platform-fastify (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-670: Always-Incorrect Control Flow Implementation
Vulnerable versions: <= 11.1.15
Patched in: 11.1.16

Summary: Nest Fastify HEAD Request Middleware Bypass

Details:
### Impact

In a NestJS application using `@nestjs/platform-fastify`, GET middleware can be bypassed because Fastify automatically redirects HEAD requests to the corresponding GET handlers (if they exist).

As a result:

- Middleware will be completely skipped.
- The HTTP response won't include a body (since the response is truncated when redirecting a HEAD request to a GET handler).
- The actual handler will still be executed.

### Patches

Fixed in `@nestjs/platform-fastify@11.1.16`
GitHub Security Advisory: GHSA-827p-g5x5-h86c
Package: parse-server (NPM)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-248: Uncaught Exception
Vulnerable versions: < 8.6.43
Patched in: 8.6.43

Summary: Parse Server LiveQuery subscription with invalid regular expression crashes server

Details:
### Impact

A remote attacker can crash the Parse Server by subscribing to a LiveQuery with an invalid regular expression pattern. The server process terminates when the invalid pattern reaches the regex engine during subscription matching, causing denial of service for all connected clients.

### Patches

The fix validates regular expression patterns at subscription time, rejecting invalid patterns before they are stored. Additionally, a defense-in-depth try-catch prevents any subscription matching error from crashing the server process.

### Workarounds

Disable LiveQuery if it is not needed.
GitHub Security Advisory: GHSA-827p-g5x5-h86c
Package: parse-server (NPM)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-248: Uncaught Exception
Vulnerable versions: >= 9.0.0, < 9.6.0-alpha.19
Patched in: 9.6.0-alpha.19

Summary: Parse Server LiveQuery subscription with invalid regular expression crashes server

Details:
### Impact

A remote attacker can crash the Parse Server by subscribing to a LiveQuery with an invalid regular expression pattern. The server process terminates when the invalid pattern reaches the regex engine during subscription matching, causing denial of service for all connected clients.

### Patches

The fix validates regular expression patterns at subscription time, rejecting invalid patterns before they are stored. Additionally, a defense-in-depth try-catch prevents any subscription matching error from crashing the server process.

### Workarounds

Disable LiveQuery if it is not needed.
GitHub Security Advisory: GHSA-5v7g-9h8f-8pgg
Package: parse-server (NPM)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes
Vulnerable versions: < 8.6.42
Patched in: 8.6.42

Summary: Parse Server session creation endpoint allows overwriting server-generated session fields

Details:
### Impact

An authenticated user can overwrite server-generated session fields (`sessionToken`, `expiresAt`, `createdWith`) when creating a session object via `POST /classes/_Session`. This allows bypassing the server's session expiration policy by setting an arbitrary far-future expiration date. It also allows setting a predictable session token value.

### Patches

The session creation endpoint now filters out server-generated fields from user-supplied data, preventing them from being overwritten.

### Workarounds

Add a `beforeSave` trigger on the `_Session` class to validate and reject or strip any user-supplied values for `sessionToken`, `expiresAt`, and `createdWith`.
GitHub Security Advisory: GHSA-5v7g-9h8f-8pgg
Package: parse-server (NPM)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes
Vulnerable versions: >= 9.0.0, < 9.6.0-alpha.17
Patched in: 9.6.0-alpha.17

Summary: Parse Server session creation endpoint allows overwriting server-generated session fields

Details:
### Impact

An authenticated user can overwrite server-generated session fields (`sessionToken`, `expiresAt`, `createdWith`) when creating a session object via `POST /classes/_Session`. This allows bypassing the server's session expiration policy by setting an arbitrary far-future expiration date. It also allows setting a predictable session token value.

### Patches

The session creation endpoint now filters out server-generated fields from user-supplied data, preventing them from being overwritten.

### Workarounds

Add a `beforeSave` trigger on the `_Session` class to validate and reject or strip any user-supplied values for `sessionToken`, `expiresAt`, and `createdWith`.
GitHub Security Advisory: GHSA-9ccr-fpp6-78qf
Package: parse-server (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Vulnerable versions: < 8.6.44
Patched in: 8.6.44

Summary: Parse Server vulnerable to schema poisoning via prototype pollution in deep copy

Details:
### Impact

An attacker can bypass the default request keyword denylist protection and the class-level permission for adding fields by sending a crafted request that exploits prototype pollution in the deep copy mechanism. This allows injecting fields into class schemas that have field addition locked down, and can cause permanent schema type conflicts that cannot be resolved even with the master key.

### Patches

The vulnerable third-party deep copy library has been replaced with a built-in deep clone mechanism that handles prototype properties safely, allowing the existing denylist check to correctly detect and reject the prohibited keyword.

### Workarounds

None.

### Vulnerability Independence

This vulnerability is not caused by or dependent on a vulnerability in a third-party dependency.

The third-party `deepcopy` library that was replaced in the fix has no known CVE or security advisory regarding this. The library functions as designed. It is not vulnerable.

The vulnerability is in parse-server's own request processing logic. Parse-server's security-critical keyword denylist check runs after the deep copy step in the request pipeline. The deep copy step strips `__proto__` properties as a normal part of its cloning behavior, which means the denylist check never sees the prohibited key. This allows an attacker to bypass both the denylist protection and class-level permissions for adding fields, resulting in schema poisoning.

The root cause is parse-server's reliance on a cloning mechanism that alters the shape of the data before the security check can inspect it. This is a logic flaw in parse-server's security pipeline, not a vulnerability in a dependency. Replacing the cloning mechanism was the fix for parse-server's own bug.
GitHub Security Advisory: GHSA-9ccr-fpp6-78qf
Package: parse-server (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Vulnerable versions: >= 9.0.0, < 9.6.0-alpha.20
Patched in: 9.6.0-alpha.20

Summary: Parse Server vulnerable to schema poisoning via prototype pollution in deep copy

Details:
### Impact

An attacker can bypass the default request keyword denylist protection and the class-level permission for adding fields by sending a crafted request that exploits prototype pollution in the deep copy mechanism. This allows injecting fields into class schemas that have field addition locked down, and can cause permanent schema type conflicts that cannot be resolved even with the master key.

### Patches

The vulnerable third-party deep copy library has been replaced with a built-in deep clone mechanism that handles prototype properties safely, allowing the existing denylist check to correctly detect and reject the prohibited keyword.

### Workarounds

None.

### Vulnerability Independence

This vulnerability is not caused by or dependent on a vulnerability in a third-party dependency.

The third-party `deepcopy` library that was replaced in the fix has no known CVE or security advisory regarding this. The library functions as designed. It is not vulnerable.

The vulnerability is in parse-server's own request processing logic. Parse-server's security-critical keyword denylist check runs after the deep copy step in the request pipeline. The deep copy step strips `__proto__` properties as a normal part of its cloning behavior, which means the denylist check never sees the prohibited key. This allows an attacker to bypass both the denylist protection and class-level permissions for adding fields, resulting in schema poisoning.

The root cause is parse-server's reliance on a cloning mechanism that alters the shape of the data before the security check can inspect it. This is a logic flaw in parse-server's security pipeline, not a vulnerability in a dependency. Replacing the cloning mechanism was the fix for parse-server's own bug.
GitHub Security Advisory: GHSA-4263-jgmp-7pf4
Package: parse-server (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Vulnerable versions: < 8.6.47
Patched in: 8.6.47

Summary: Parse Server's Cloud function dispatch crashes server via prototype chain traversal

Details:
### Impact

Remote clients can crash the Parse Server process by calling a cloud function endpoint with a crafted function name that traverses the JavaScript prototype chain of a registered cloud function handler, causing a stack overflow.

### Patches

The fix restricts property lookups during cloud function name resolution to own properties only, preventing prototype chain traversal from stored function handlers.

### Workarounds

There is no known workaround.
GitHub Security Advisory: GHSA-4263-jgmp-7pf4
Package: parse-server (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Vulnerable versions: >= 9.0.0, < 9.6.0-alpha.24
Patched in: 9.6.0-alpha.24

Summary: Parse Server's Cloud function dispatch crashes server via prototype chain traversal

Details:
### Impact

Remote clients can crash the Parse Server process by calling a cloud function endpoint with a crafted function name that traverses the JavaScript prototype chain of a registered cloud function handler, causing a stack overflow.

### Patches

The fix restricts property lookups during cloud function name resolution to own properties only, preventing prototype chain traversal from stored function handlers.

### Workarounds

There is no known workaround.
GitHub Security Advisory: GHSA-r3xq-68wh-gwvh
Package: parse-server (NPM)
Severity: LOW (CVSS 0.0)
CWE: CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
Vulnerable versions: < 8.6.48
Patched in: 8.6.48

Summary: Parse Server has a password reset token single-use bypass via concurrent requests

Details:
### Impact

The password reset mechanism does not enforce single-use guarantees for reset tokens. When a user requests a password reset, the generated token can be consumed by multiple concurrent requests within a short time window. An attacker who has intercepted a password reset token can race the legitimate user's password reset request, causing both requests to succeed. This may result in the legitimate user believing their password was changed successfully while the attacker's password takes effect instead.

All Parse Server deployments that use the password reset feature are affected.

### Patches

The password reset token is now atomically validated and consumed as part of the password update operation. The database query that updates the password includes the reset token as a condition, ensuring that only one concurrent request can successfully consume the token. Subsequent requests using the same token will fail because the token has already been cleared.

### Workarounds

There is no known workaround other than upgrading.
GitHub Security Advisory: GHSA-r3xq-68wh-gwvh
Package: parse-server (NPM)
Severity: LOW (CVSS 0.0)
CWE: CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
Vulnerable versions: >= 9.0.0, < 9.6.0-alpha.28
Patched in: 9.6.0-alpha.28

Summary: Parse Server has a password reset token single-use bypass via concurrent requests

Details:
### Impact

The password reset mechanism does not enforce single-use guarantees for reset tokens. When a user requests a password reset, the generated token can be consumed by multiple concurrent requests within a short time window. An attacker who has intercepted a password reset token can race the legitimate user's password reset request, causing both requests to succeed. This may result in the legitimate user believing their password was changed successfully while the attacker's password takes effect instead.

All Parse Server deployments that use the password reset feature are affected.

### Patches

The password reset token is now atomically validated and consumed as part of the password update operation. The database query that updates the password includes the reset token as a condition, ensuring that only one concurrent request can successfully consume the token. Subsequent requests using the same token will fail because the token has already been cleared.

### Workarounds

There is no known workaround other than upgrading.
GitHub Security Advisory: GHSA-9xp9-j92r-p88v
Package: parse-server (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-674: Uncontrolled Recursion
Vulnerable versions: < 8.6.45
Patched in: 8.6.45

Summary: Parse Server crash via deeply nested query condition operators

Details:
### Impact

An unauthenticated attacker can crash the Parse Server process by sending a single request with deeply nested query condition operators. This terminates the server and denies service to all connected clients.

### Patches

A depth limit for query condition operator nesting has been added via the `requestComplexity.queryDepth` server option. The option is disabled by default to avoid a breaking change. To mitigate, upgrade and set the option to a value appropriate for your app.

### Workarounds

None.
GitHub Security Advisory: GHSA-9xp9-j92r-p88v
Package: parse-server (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-674: Uncontrolled Recursion
Vulnerable versions: >= 9.0.0, < 9.6.0-alpha.21
Patched in: 9.6.0-alpha.21

Summary: Parse Server crash via deeply nested query condition operators

Details:
### Impact

An unauthenticated attacker can crash the Parse Server process by sending a single request with deeply nested query condition operators. This terminates the server and denies service to all connected clients.

### Patches

A depth limit for query condition operator nesting has been added via the `requestComplexity.queryDepth` server option. The option is disabled by default to avoid a breaking change. To mitigate, upgrade and set the option to a value appropriate for your app.

### Workarounds

None.
GitHub Security Advisory: GHSA-wfv2-pwc8-crg5
Package: jspdf (NPM)
Severity: CRITICAL (CVSS 9.6)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 4.2.0
Patched in: 4.2.1

Summary: jsPDF has HTML Injection in New Window paths

Details:
### Impact

User control of the `options` argument of the `output` function allows attackers to inject arbitrary HTML (such as scripts) into the browser context the created PDF is opened in. The affected overloads and options are:

* `"pdfobjectnewwindow"`: the `pdfObjectUrl` option and the entire options object, which is JSON-serialized and included verbatim in the generated HTML-string.
* `"pdfjsnewwindow"`: the `pdfJsUrl` and `filename` options
* `"dataurlnewwindow"`: the `filename` option

The vulnerability can be exploited in the following scenario: the attacker provides values for the output options, for example via a web interface. These values are then passed unsanitized (automatically or semi-automatically) to the attack victim. The victim creates and opens a PDF with the attack vector using one of the vulnerable method overloads inside their browser. The attacker can thus inject scripts that run in the victims browser context and can extract or modify secrets from this context.

Example attack vector:

```js
import { jsPDF } from 'jspdf';
const doc = new jsPDF();

const payload =  'x\"></iframe><script>window.__n=1</script><iframe src="';

doc.output('pdfjsnewwindow', {
  filename: payload,
  pdfJsUrl: 'viewer.html'
});
```

### Patches
The vulnerability has been fixed in jspdf@4.2.1.

### Workarounds
Sanitize user input before passing it to the output method.
GitHub Security Advisory: GHSA-7x6v-j9x4-qf24
Package: jspdf (NPM)
Severity: HIGH (CVSS 8.1)
CWE: CWE-116: Improper Encoding or Escaping of Output
Vulnerable versions: <= 4.2.0
Patched in: 4.2.1

Summary: jsPDF has a PDF Object Injection via FreeText color

Details:
### Impact

User control of arguments of the `createAnnotation` method allows users to inject arbitrary PDF objects, such as JavaScript actions.

If given the possibility to pass unsanitized input to the following method, a user can inject arbitrary PDF objects, such as JavaScript actions, which might trigger when the PDF is opened or interacted with..

* `createAnnotation`: `color` parameter

Example attack vector:

```js
import { jsPDF } from 'jspdf'

const doc = new jsPDF();

const payload = '000000) /AA <</E <</S /Launch /F (calc.exe)>>>> (';

doc.createAnnotation({
  type: 'freetext',
  bounds: { x: 10, y: 10, w: 120, h: 20 },
  contents: 'hello',
  color: payload
});

doc.save('test.pdf');
```

### Patches

The vulnerability has been fixed in jsPDF@4.2.1.

### Workarounds
Sanitize user input before passing it to the vulnerable API members.
GitHub Security Advisory: GHSA-8hq9-phh3-p2wp
Package: elysia (NPM)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Vulnerable versions: < 1.4.27
Patched in: 1.4.27

Summary: Elysia Cookie Value Prototype Pollution

Details:
### Impact
Elysia cookie can be overridden by prototype pollution , eg. `__proto__`

Sending cookie with the follows name can override cookie value:
```bash
__proto__=%7B%22injected%22%3A%22polluted%22%7D
```

### Patches
Patched by 1.4.27

### Workarounds
1. Use t.Cookie validation to enforce validation value
2. Prevent iterable over cookie if possible
GitHub Security Advisory: GHSA-ggv3-7p47-pfv8
Package: next (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Vulnerable versions: >= 9.5.0, < 15.5.13
Patched in: 15.5.13

Summary: Next.js: HTTP request smuggling in rewrites

Details:
## Summary
When Next.js rewrites proxy traffic to an external backend, a crafted `DELETE`/`OPTIONS` request using `Transfer-Encoding: chunked` could trigger request boundary disagreement between the proxy and backend. This could allow request smuggling through rewritten routes.

## Impact
An attacker could smuggle a second request to unintended backend routes (for example, internal/admin endpoints), bypassing assumptions that only the configured rewrite destination/path is reachable. This does not impact applications hosted on providers that handle rewrites at the CDN level, such as Vercel. 

## Patches
The vulnerability originated in an upstream library vendored by Next.js. It is fixed by updating that dependency’s behavior so `content-length: 0` is added only when both `content-length` and `transfer-encoding` are absent, and `transfer-encoding` is no longer removed in that code path.

## Workarounds
If upgrade is not immediately possible:
- Block chunked `DELETE`/`OPTIONS` requests on rewritten routes at your edge/proxy.
- Enforce authentication/authorization on backend routes per our [security guidance](https://nextjs.org/docs/app/guides/data-security).
GitHub Security Advisory: GHSA-ggv3-7p47-pfv8
Package: next (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Vulnerable versions: >= 16.0.0-beta.0, < 16.1.7
Patched in: 16.1.7

Summary: Next.js: HTTP request smuggling in rewrites

Details:
## Summary
When Next.js rewrites proxy traffic to an external backend, a crafted `DELETE`/`OPTIONS` request using `Transfer-Encoding: chunked` could trigger request boundary disagreement between the proxy and backend. This could allow request smuggling through rewritten routes.

## Impact
An attacker could smuggle a second request to unintended backend routes (for example, internal/admin endpoints), bypassing assumptions that only the configured rewrite destination/path is reachable. This does not impact applications hosted on providers that handle rewrites at the CDN level, such as Vercel. 

## Patches
The vulnerability originated in an upstream library vendored by Next.js. It is fixed by updating that dependency’s behavior so `content-length: 0` is added only when both `content-length` and `transfer-encoding` are absent, and `transfer-encoding` is no longer removed in that code path.

## Workarounds
If upgrade is not immediately possible:
- Block chunked `DELETE`/`OPTIONS` requests on rewritten routes at your edge/proxy.
- Enforce authentication/authorization on backend routes per our [security guidance](https://nextjs.org/docs/app/guides/data-security).
GitHub Security Advisory: GHSA-h27x-g6w4-24gq
Package: next (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 16.0.1, < 16.1.7
Patched in: 16.1.7

Summary: Next.js: Unbounded postponed resume buffering can lead to DoS

Details:
## Summary
A request containing the `next-resume: 1` header (corresponding with a PPR resume request) would buffer request bodies without consistently enforcing `maxPostponedStateSize` in certain setups. The previous mitigation protected minimal-mode deployments, but equivalent non-minimal deployments remained vulnerable to the same unbounded postponed resume-body buffering behavior.

## Impact
In applications using the App Router with Partial Prerendering capability enabled (via `experimental.ppr` or `cacheComponents`), an attacker could send oversized `next-resume` POST payloads that were buffered without consistent size enforcement in non-minimal deployments, causing excessive memory usage and potential denial of service.

## Patches
Fixed by enforcing size limits across all postponed-body buffering paths and erroring when limits are exceeded.  

## Workarounds
If upgrade is not immediately possible:
- Block requests containing the `next-resume` header, as this is never valid to be sent from an untrusted client.
GitHub Security Advisory: GHSA-mq59-m269-xvcx
Package: next (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: >= 16.0.1, < 16.1.7
Patched in: 16.1.7

Summary: Next.js: null origin can bypass Server Actions CSRF checks

Details:
## Summary
`origin: null` was treated as a "missing" origin during Server Action CSRF validation. As a result, requests from opaque contexts (such as sandboxed iframes) could bypass origin verification instead of being validated as cross-origin requests.

## Impact
An attacker could induce a victim browser to submit Server Actions from a sandboxed context, potentially executing state-changing actions with victim credentials (CSRF).

## Patches
Fixed by treating `'null'` as an explicit origin value and enforcing host/origin checks unless `'null'` is explicitly allowlisted in `experimental.serverActions.allowedOrigins`.  

## Workarounds
If upgrade is not immediately possible:
- Add CSRF tokens for sensitive Server Actions.
- Prefer `SameSite=Strict` on sensitive auth cookies.
- Do not allow `'null'` in `serverActions.allowedOrigins` unless intentionally required and additionally protected.