Ethankim88

A Denial of Service (DoS) issue exists in the `request.form()` function when processing `application/x-www-form-urlencoded` requests. While limits for `max fields` and `max part size` are enforced for `multipart/form-data`, they are ignored for url-encoded bodies. This allows an unauthenticated attacker to cause resource exhaustion through two methods: sending a large number of fields (e.g., 1,000,000 fields), which blocks the worker's event loop and consumes CPU, or sending a single very large field, which forces unbounded memory allocation.

Processing a malicious PSD file can lead to memory corruption, potentially resulting in a crash or arbitrary code execution. This occurs because bounds checks for tile extents in PSD image decoding and encoding used types susceptible to integer overflow. A PSD image with specifically crafted tile dimensions could cause values to wrap around, bypassing the checks and triggering an out-of-bounds write in the `src/decode.c` and `src/encode.c` files.

Name of the Vulnerable Software and Affected Versions Drizzle versions prior to 0.45.2 and 1.0.0-beta.20 Description Drizzle ORM does not properly escape quoted SQL identifiers in its `escapeName()` implementations. This can allow an attacker to terminate the quoted identifier and inject SQL when applications pass attacker-controlled input to APIs that construct SQL identifiers or aliases, such as `sql.identifier()` and `.as()`. Recommendations Update to version 0.45.2 or 1.0.0-beta.20.

Kysely, a type-safe TypeScript SQL query builder, has a SQL injection issue in JSON path compilation for MySQL and SQLite dialects. The `visitJSONPathLeg()` function directly appends user-controlled values from `.key()` and `.at()` into single-quoted JSON path string literals without escaping single quotes. This allows an attacker to break out of the JSON path string context and inject arbitrary SQL. This behavior differs from `sanitizeIdentifier()`, which correctly handles delimiters for identifiers. The issue arises because both identifiers and JSON path keys are non-parameterizable SQL constructs requiring manual escaping, but only identifiers are protected. PostgreSQL is not affected as it uses a different approach to JSON path construction that includes proper string literal sanitization. A proof-of-concept demonstrates the ability to exfiltrate data, such as an administrator password, from a SQLite database using a crafted JSON key name. This issue can be exploited in applications that dynamically select JSON fields, such as search APIs or admin panels.

Sequelize, a Node.js ORM tool, contains a SQL injection flaw due to unescaped cast type handling within JSON/JSONB where clause processing. The ` traverseJSON()` function splits JSON path keys using '::' to determine a cast type, which is then directly incorporated into SQL queries using `CAST(... AS <type>)`. An attacker controlling JSON object keys can inject arbitrary SQL code, potentially leading to data exfiltration from any table. The vulnerable component is the ` traverseJSON()` function.

A flaw exists in Multer, a node.js middleware used for processing `multipart/form-data`. This issue can be exploited to initiate a Denial of Service (DoS) attack by submitting specially crafted requests, which may lead to resource exhaustion.

A flawed regular expression is generated when three or more parameters are present within a single segment, separated by characters other than a period (`.`). For example, `/:a-:b-:c` or `/:a-:b-:c-:d`. The backtrack protection introduced in `path-to-regexp@0.1.12` only addresses ambiguity for two parameters. With three or more parameters, the generated lookahead does not prevent single separator characters from causing capture groups to overlap, leading to catastrophic backtracking. Custom regular expression patterns defined in route definitions, such as `/:a-:b([^-/]+)-:c([^-/]+)`, are not affected as they override the default capture group.