Mauriceng98

The default `JWTBearerGrant.get audiences()` function returns an empty list, which leads `JWTBearerGrant.verify claims()` to only check for the existence of an `aud` claim without verifying if it matches the current authorization server. This allows an attacker with a legitimate assertion for a different service to present it to a server that shares the same signing key and uses the default grant, enabling the acquisition of an access token across a trust boundary.

The undici WebSocket client enforces `maxPayloadSize` on a per-frame basis but fails to enforce the cumulative size of fragmented uncompressed messages. A malicious WebSocket server can stream numerous small fragments that individually pass validation but collectively exceed the configured limit. This leads to unbounded memory growth in the client process, resulting in memory exhaustion and a denial of service. This issue affects applications using the `new WebSocket(...)` client that connect to compromised or attacker-controlled endpoints.