chainguard/redisinsight

Vulnerabilities (57)

• CVE-2026-2391Feb 12, 2026
  affected < 3.0.3-r1fixed 3.0.3-r1

  ### Summary The `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to cause denial-of-service via memory exhaustion. This is a bypass of the array limit enforcement, similar to the bracket notation bypass

• CVE-2026-25639HigFeb 9, 2026
  affected < 3.0.2-r2fixed 3.0.2-r2

  Axios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can trigger this by providi

• CVE-2026-24842Jan 28, 2026
  affected < 3.0.2-r2fixed 3.0.2-r2

  node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that b

• CVE-2026-24001Jan 22, 2026
  affected < 3.0.2-r1fixed 3.0.2-r1

  jsdiff is a JavaScript text differencing implementation. Prior to versions 8.0.3, 5.2.2, 4.0.4, and 3.5.1, attempting to parse a patch whose filename headers contain the line break characters `\r`, `\u2028`, or `\u2029` can cause the `parsePatch` method to enter an infinite loop.

• CVE-2025-13465MedJan 21, 2026
  affected < 3.0.2-r1fixed 3.0.2-r1

  Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwritin

• CVE-2026-23950Jan 20, 2026
  affected < 3.0.2-r1fixed 3.0.2-r1

  node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3. This is due to an incomplete handling of Unicode path collisions in the `path-reservations` system. On case-insensitive or normalization-insensitive filesystems (such as macOS AP

• CVE-2026-23745Jan 16, 2026
  affected < 3.0.2-r1fixed 3.0.2-r1

  node-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default secure behavior). This allows malicious archives to bypass the extraction root restriction, leading t

• CVE-2025-15284Dec 29, 2025
  affected < 3.0.0-r1fixed 3.0.0-r1

  Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1. Summary The arrayLimit option in qs did not enforce limits for bracket notation (a[]=1&a[]=2), only for indexed notation (a[0]=1). This is a consistency bug; arrayLim

• CVE-2025-65945Dec 4, 2025
  affected < 3.0.0-r0fixed 3.0.0-r0

  auth0/node-jws is a JSON Web Signature implementation for Node.js. In versions 3.2.2 and earlier and version 4.0.0, auth0/node-jws has an improper signature verification vulnerability when using the HS256 algorithm under specific conditions. Applications are affected when they us

• CVE-2025-12758Nov 27, 2025
  affected < 3.0.0-r0fixed 3.0.0-r0

  Versions of the package validator before 13.15.22 are vulnerable to Incomplete Filtering of One or More Instances of Special Elements in the isLength() function that does not take into account Unicode variation selectors (\uFE0F, \uFE0E) appearing in a sequence which lead to impr

• CVE-2025-13466MedNov 24, 2025
  affected < 2.70.1-r5fixed 2.70.1-r5

  body-parser 2.2.0 is vulnerable to denial of service due to inefficient handling of URL-encoded bodies with very large numbers of parameters. An attacker can send payloads containing thousands of parameters within the default 100KB request size limit, causing elevated CPU and mem

• CVE-2025-64756Nov 17, 2025
  affected < 0fixed 0

  Glob matches files using patterns the shell uses. Starting in version 10.2.0 and prior to versions 10.5.0 and 11.1.0, the glob CLI contains a command injection vulnerability in its -c/--cmd option that allows arbitrary command execution when processing files with malicious names.

• CVE-2025-64718Nov 13, 2025
  affected < 2.70.1-r4fixed 2.70.1-r4

  js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (`__proto__`). All users who parse untrusted yaml documents may be impacted. T

• CVE-2025-60542MedOct 29, 2025
  affected < 2.70.1-r3fixed 2.70.1-r3

  SQL Injection vulnerability in TypeORM before 0.3.26 via crafted request to repository.save or repository.update due to the sqlstring call using stringifyObjects default to false.

• CVE-2025-56200Sep 30, 2025
  affected < 3.0.0-r0fixed 3.0.0-r0

  A URL validation bypass vulnerability exists in validator.js through version 13.15.15. The isURL() function uses '://' as a delimiter to parse protocols, while browsers use ':' as the delimiter. This parsing difference allows attackers to bypass protocol and domain validation by

• CVE-2025-59343HigSep 24, 2025
  affected < 2.70.1-r2fixed 2.70.1-r2

  tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.1.1, 2.1.3, and 1.16.5 are vulnerable to symlink validation bypass if the destination directory is predictable with a specific tarball. This issue has been patched in version 3.1.1, 2.1.4, and 1.16.6. A worka

• CVE-2025-58754Sep 12, 2025
  affected < 2.70.1-r1fixed 2.70.1-r1

  Axios is a promise based HTTP client for the browser and Node.js. When Axios starting in version 0.28.0 and prior to versions 0.30.2 and 1.12.0 runs on Node.js and is given a URL with the `data:` scheme, it does not perform HTTP. Instead, its Node http adapter decodes the entire