Issues · cdk8s-team/cdk8s-examples

[HIGH] xmldom: Quadratic-memory consumption

cdk8s-team/cdk8s-examples#962 · opened

on Sep 13, 2026

[HIGH] js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

cdk8s-team/cdk8s-examples#963 · opened

on Sep 13, 2026

[MEDIUM] xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content

cdk8s-team/cdk8s-examples#960 · opened

on Sep 13, 2026

[HIGH] xmldom: Quadratic-time attribute deduplication

cdk8s-team/cdk8s-examples#959 · opened

on Sep 13, 2026

[HIGH] xmldom: DocType `name` Injection Bypasses requireWellFormed

cdk8s-team/cdk8s-examples#961 · opened

on Sep 13, 2026

[HIGH] xmldom: Element name injection via createElement() bypasses requireWellFormed

cdk8s-team/cdk8s-examples#956 · opened

on Sep 13, 2026

[HIGH] xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed

cdk8s-team/cdk8s-examples#957 · opened

on Sep 13, 2026

[HIGH] xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser

cdk8s-team/cdk8s-examples#958 · opened

on Sep 13, 2026

[HIGH] xmldom: Processing Instruction Target Injection Bypasses requireWellFormed

cdk8s-team/cdk8s-examples#954 · opened

on Sep 13, 2026

[HIGH] xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge

cdk8s-team/cdk8s-examples#955 · opened

on Sep 13, 2026

[HIGH] fast-uri vulnerable to host confusion via percent-encoded scheme normalization

cdk8s-team/cdk8s-examples#951 · opened

on Sep 6, 2026

[MEDIUM] xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization

cdk8s-team/cdk8s-examples#952 · opened

on Sep 6, 2026

[HIGH] fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization

cdk8s-team/cdk8s-examples#950 · opened

on Sep 6, 2026

[MEDIUM] stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS)

cdk8s-team/cdk8s-examples#949 · opened

on Sep 6, 2026

[HIGH] fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding

cdk8s-team/cdk8s-examples#948 · opened

on Sep 5, 2026

[HIGH] fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references

cdk8s-team/cdk8s-examples#947 · opened

on Sep 5, 2026

[LOW] tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter

cdk8s-team/cdk8s-examples#931 · opened

on Aug 18, 2026

[HIGH] JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported

cdk8s-team/cdk8s-examples#924 · opened

on Aug 9, 2026

[HIGH] fast-uri vulnerable to host confusion via backslash authority introducer

cdk8s-team/cdk8s-examples#921 · opened

on Aug 7, 2026

[LOW] AWS CDK CodeBuild S3 Log Encryption Boolean Inversion

cdk8s-team/cdk8s-examples#909 · opened

on Jul 28, 2026

[LOW] AWS CDK CodeBuild S3 Log Encryption Boolean Inversion

cdk8s-team/cdk8s-examples#910 · opened

on Jul 28, 2026

[LOW] AWS CDK CodeBuild S3 Log Encryption Boolean Inversion

cdk8s-team/cdk8s-examples#907 · opened

on Jul 28, 2026

[LOW] AWS CDK CodeBuild S3 Log Encryption Boolean Inversion

cdk8s-team/cdk8s-examples#908 · opened

on Jul 28, 2026

[LOW] AWS CDK CodeBuild S3 Log Encryption Boolean Inversion

cdk8s-team/cdk8s-examples#906 · opened

on Jul 28, 2026

[HIGH] fast-uri vulnerable to host confusion via failed IDN canonicalization

cdk8s-team/cdk8s-examples#904 · opened

on Jul 26, 2026