Notaflightrisk

Authenticated users can cause uncontrolled resource consumption by requesting avatars in numerous distinct sizes. By uploading a noisy avatar and requesting it at every size up to 1024, an attacker can cache approximately one gigabyte of data per account without eviction. This leads to the API process being OOM-killed, which occurs when the operating system terminates a process because the system has run out of available memory.

When `escapeParameter` is enabled and translations are rendered as HTML via `v-html`, the `sanitizeTranslatedHtml()` function fails to properly handle the `srcdoc` attribute of `<iframe>` elements. While the sanitizer escapes markup and neutralizes event handlers, browsers decode these character references when parsing the `srcdoc` value as a same-origin nested HTML document. This allows attacker-controlled parameters or translation content placed within `srcdoc` to execute arbitrary scripts in the application's origin, leading to DOM-based Cross-Site Scripting (XSS). This issue can be triggered if untrusted values are passed as parameters into `srcdoc`, if translation messages contain untrusted HTML, or if untrusted named values are used in conjunction with a list.

A denial of service issue exists where attackers can exhaust CPU resources through quadratic-time parsing within the `Snapshot::from bytes()` function. By committing a crafted .mailmap file containing descending-ordered entries, an attacker can force repeated front inserts, which blocks workers executing log, blame, or shortlog operations for several minutes.

Seroval allows for the stringification of JavaScript values, including complex structures. The `deserializeTypedArray` function within `fromJSON` and `fromCrossJSON` trusts a deserialized source value as an ArrayBuffer without bounding the serialized element count. An attacker can provide a small untrusted JSON object containing a large length value, which forces the TypedArray constructor to synchronously allocate a massive number of elements. This process can exhaust CPU or memory resources and starve the event loop, leading to a denial of service. The offset check fails to reject the crafted source because `source.byteLength` is undefined. While DataView encounters a similar unchecked cast, it throws an error instead of allocating memory.

The JSONC parser at stream-json/jsonc/parser.js and verifier at stream-json/jsonc/verifier.js restart comment-terminator scanning from the opening slash when a block or line comment spans an input chunk, while retaining the accumulated comment buffer. This behavior can lead to quadratic CPU work and stall the Node.js event loop if a large valid comment is delivered across many small chunks. This issue specifically affects the JSONC parser and does not impact the plain JSON parser. The attack vector is considered local as JSONC input typically consists of locally owned or user-controlled configuration.

The `Client.list()` function is susceptible to a Denial of Service (DoS) when interacting with a malicious or compromised FTP server. The issue occurs during the parsing of Unix-style directory listings where the `RE LINE` expression in `src/parseListUnix.ts` performs inefficient backtracking across adjacent variable-length owner and group fields. This happens when a long Unix-style line contains a valid prefix but fails to satisfy subsequent size and date fields. Because `parseList()` applies the selected parser to every line, a crafted response can cause quadratic CPU consumption, blocking the Node.js event loop and freezing the process. Listings based on MLSD are not affected.

This URI parser for Node.js decodes percent escapes in a hostname during parsing and subsequently decodes the parsed hostname a second time during authority recomposition. This double decoding allows nested percent-encoded input to be transformed into a different network destination, such as a loopback hostname or address, which violates RFC 3986 section 2.4. Applications that normalize or resolve untrusted HTTP-family URIs before outbound routing, redirect validation, or host-policy checks may be susceptible to server-side request forgery (SSRF) and host-policy bypass.