Issues

• [MEDIUM] stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS)

  dependabot-security-findingneeds-triagepriority/p0
  cdk8s-team/cdk8s-validation-plugin-example#1863 · Filter by author cdk8s-automation opened on Sep 6, 2026

• [MEDIUM] JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases

  dependabot-security-findingneeds-triagepriority/p0
  cdk8s-team/cdk8s-validation-plugin-example#1763 · Filter by author cdk8s-automation opened on Jun 19, 2026

• [MEDIUM] uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided

  dependabot-security-findingneeds-triagepriority/p0
  cdk8s-team/cdk8s-validation-plugin-example#1682 · Filter by author cdk8s-automation opened on Apr 26, 2026

• [MEDIUM] js-yaml has prototype pollution in merge (<<)

  dependabot-security-findingneeds-triagepriority/p0
  cdk8s-team/cdk8s-validation-plugin-example#1490 · Filter by author cdk8s-automation opened on Nov 17, 2025