Akiilex

protobufjs allows certain schema option paths to traverse inherited object properties during option application. A crafted protobuf schema or JSON descriptor can cause option handling to write to properties on global JavaScript constructors, corrupting built-in process-wide functionality. This can lead to a persistent denial of service for the lifetime of the affected process. The issue affects applications that parse or load protobuf schemas or descriptors from untrusted sources using reflection APIs such as `parse()`, `Root.load()`, `Root.loadSync()`, or `Root.fromJSON()`. Applications using bundled or trusted schemas to decode untrusted payloads are not directly affected.

When a RequestAuthentication resource is created with a `jwksUri` pointing to an internal service, istiod performs an unauthenticated HTTP GET request to that URL without filtering localhost or link-local IP addresses. This behavior can lead to the distribution of sensitive data to Envoy proxies through the xDS configuration.