漏洞公告

Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`

UAParser.js: Unbounded `Sec-CH-UA-Model` parsing can trigger ReDoS in `withClientHints()`

protobufjs-cli: Code injection in pbjs static output from crafted JSON descriptor names

protobufjs: Memory amplification from preserved unknown fields in binary decode

DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later `RETURN_TRUSTED_TYPE` output

Vulnerable OpenSSL included in cryptography wheels

Microsoft Security Advisory CVE-2026-45591 – ASP.NET Core Denial of Service Vulnerability

aiohttp: Incomplete websocket frame payloads bypass memory limits

aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections

aiohttp: Payload Response Resources Are Not Closed After Mid-Body Disconnect

aiohttp: HTTP/1 Pipelined Requests Queue Without Limit

aiohttp: Unread Compressed Request Bodies Bypass client_max_size During Cleanup

aiohttp: C HTTP Parser Bypasses max_line_size for Fragmented Lines

aiohttp: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges

aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence

aiohttp: CRLF injection in multipart headers

React Router: Potential CSRF via PUT/PATCH/DELETE document requests

Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE

DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside <template> content when using DOM output modes

DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content

DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objects

DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR`

DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks