Find, fix and prevent vulnerabilities in your code.

Overview

minimatch is a minimal matching utility.

Affected versions of this package are vulnerable to Asymmetric Resource Consumption (Amplification) in the firstPhasePreProcess method, where the **/.. transform clones a globParts entry and pushes the clone back onto the same array inside a do...while (didSomething) fixpoint loop. An attacker can exhaust CPU and memory by supplying a glob pattern whose **/.. sequences regenerate entries during preprocessing, which secondPhasePreProcess then compares in an O(n^2) pairwise partsMatch pass over the expanded set. Exploitation requires the pattern to be parsed with optimizationLevel set to 2 or higher.

Remediation

Upgrade minimatch to version 11.0.1 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Release

Overview

i18next is an internationalization framework for browser or any other javascript environment (eg. node.js).

Affected versions of this package are vulnerable to Modification of Assumed-Immutable Data (MAID) via the deepExtend function in src/utils.js, which uses the in operator to check for property existence on the target object. Because the in operator traverses the prototype chain, an attacker who can supply a malicious resource bundle containing a property named hasOwnProperty can overwrite Object.prototype.hasOwnProperty, causing process-wide corruption of that built-in and crashing any subsequent code that relies on it.

Note: This is only exploitable when deepExtend is invoked with deep merging enabled, such as through addResourceBundle with the deep parameter set to true.

PoC

import i18next from 'i18next';

await i18next.init({ lng: 'en', resources: { en: { translation: {} } } });

const payload = { hasOwnProperty: { call: 'corrupted' } };
i18next.addResourceBundle('en', 'translation', payload, /* deep */ true, /* overwrite */ true);

// Process-wide corruption:
Object.prototype.hasOwnProperty.call({}, 'test'); // TypeError: ... is not a function

Note: The PoC uses i18next initialised with a default English translation resource and demonstrates process-wide corruption by overwriting Object.prototype.hasOwnProperty via addResourceBundle with deep and overwrite flags set to true.

Remediation

Upgrade i18next to version 26.3.4 or higher.

References

• GitHub Advisory
• github.com
• GitHub Commit

Overview

Affected versions of this package are vulnerable to Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') in the deserializeErrors function during SSR hydration. An attacker can cause unexpected constructor execution on the client, potentially resulting in outbound network traffic, by supplying crafted input that overwrites certain aspects of errors caught by the SSR process.

Note: This is only exploitable if the application is running in Framework Mode or Data Mode and performs manual SSR/hydration with code that allows attacker-controlled input to influence error deserialization.

Remediation

Upgrade react-router to version 7.18.0 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub PR