7Thparkk

Forge, a native JavaScript implementation of Transport Layer Security, handles received TLS records recursively when using the `forge.tls.createConnection()` function and the `process()` function for TLS record processing. This behavior consumes one JavaScript stack frame per record within a single input chunk. A remote peer can trigger a denial of service by sending thousands of small records simultaneously, which exhausts the call stack and leads to an uncaught exception.

Nx creates Unix domain sockets for its daemon and isolated plugin workers in shared temporary locations without restricting permissions to the owner. On shared build servers, developer hosts, or multi-user containers, an unprivileged local account can discover and connect to these sockets because the transport lacks authentication and relies solely on filesystem containment. A caller can send a `PROCESS IN BACKGROUND` request containing a module path to invoke its default export, enabling remote code execution as the account running Nx. Additionally, other handlers may expose task hashes, project graphs, and workspace file contents.

Authenticated users can cause a denial of service during data import because the system fails to limit archive expansion. An attacker can upload highly compressed files that expand to tens of gigabytes in memory and on disk, which exhausts server resources and crashes the instance.

A resource exhaustion issue exists where the system fails to limit parsed row cardinality. Authenticated attackers can upload multipart CSV files containing millions of small records to the 'POST /api/v2/migration/csv/migrate' endpoint, leading to process memory exhaustion and termination of the API service.

A resource exhaustion issue exists in the Planka migrator, which fails to enforce aggregate memory budgets during migration jobs. Authenticated attackers can trigger this by submitting migration requests that point to servers under their control. These servers can advertise a large number of size-compliant attachments, leading to the exhaustion of worker memory and resulting in a denial of service for all users.

Authenticated users can cause a denial of service by uploading specially crafted images to the avatar and project-background upload endpoints. The software fails to apply pixel decode limits, allowing images with extreme aspect ratios to consume excessive CPU and memory during processing. This can be triggered through repeated or concurrent uploads.

A resource exhaustion issue exists in the '/task-filter' endpoint. The system accepts deeply nested filter expressions without enforcing recursion depth limits. Authenticated attackers can provide thousands of nested parentheses via the `filter` query parameter to exhaust system memory, leading to the termination of the API process.

A crafted PDF can cause long runtimes and large memory consumption during text extraction. This occurs when the `Font. collect cid character widths()` function in `pypdf/ font.py` expands unusually large CID font /W width ranges or excessive width entries. CID (Character Identifier) fonts are a way of mapping characters to glyphs in PDF files.

An issue exists in the `router` proxy-table implementation where host+path selectors use unanchored substring matching on request metadata. When a router key contains a `/`, the `getTargetFromProxyTable()` function concatenates the `Host` header and the request URL into a single string and checks if the configured key is a substring of that combined value. This allows an attacker to bypass routing boundaries by providing a crafted `Host` header that acts as a superstring match for the configured key, potentially routing requests to unintended backends. This affects the `createProxyMiddleware()` function when configured with host+path rules.

When the `fetch()` function is called, the runtime validates the destination hostname against `--deny-net` rules but fails to re-verify the IP addresses that the hostname resolves to. This allows an attacker-controlled script to use a specially crafted domain name that passes the initial hostname check but resolves to a denied IP address, effectively bypassing network isolation rules. This can lead to unauthorized access to blocked hosts, such as `localhost` or internal services, particularly when running untrusted or third-party code.