A-Tt-Om

**Name of the Vulnerable Software and Affected Versions** Hono versions 4.0.0 through 4.12.26 **Description** The `cx()` function in `hono/css` composes class names from plain strings but marks the result as already escaped without performing HTML-escaping on the input. This allows untrusted `className` values used in a JSX class attribute during server-side rendering to break out of the attribute and inject arbitrary markup. **Recommendations** Update to version 4.12.27.

**Name of the Vulnerable Software and Affected Versions** Echo versions prior to 4.15.3 Echo versions prior to 5.2.0 **Description** A discrepancy exists between the router and the static file handler regarding URL path decoding. The router matches routes using the raw encoded path, preserving `%2F` as-is, whereas the `StaticDirectoryHandler` function unescapes `%2F` to `/` before resolving filesystem paths. This inconsistency allows an attacker to bypass route-level access controls to read static files without authorization. **Recommendations** Update to version 4.15.3 or later. Update to version 5.2.0 or later.

**Name of the Vulnerable Software and Affected Versions** @nestjs/platform-fastify versions prior to 11.1.24 **Description** An authentication bypass exists in the Fastify adapter when middleware is registered through the `MiddlewareConsumer.forRoutes()` API. An unauthenticated client can bypass registered middleware, such as authentication guards, rate limiting, or logging, by appending a trailing slash (`/`) to the request URL. This issue occurs with the default Fastify adapter configuration and specifically affects applications using standard CRUD route shapes, such as 'GET /resource' and 'GET /resource/:id'. **Recommendations** Update to version 11.1.24.