Poppo25

A heap-based buffer overflow occurs in the `unc decoder mixed interleave::processTile()` function. This issue is triggered when a HEIF file is processed with chroma components of unequal bit depths, such as 16-bit Cb and 8-bit Cr. This allows an attacker to perform out-of-bounds writes past the Cr plane, which could lead to arbitrary code execution within image-processing pipelines.

esm.sh is a content delivery network (CDN) for web development. A server-side request forgery (SSRF) issue (CWE-918) exists in the `/http(s)` fetch route. The service attempts to prevent requests to localhost or internal targets, but the validation relies on hostname string checks, which can be circumvented using DNS alias domains. This allows an external party to make the esm.sh server fetch internal localhost services.