Str1Ckl4Nd

A denial of service issue exists in the `InlineParser.parse link()` function. An attacker can cause quadratic CPU growth by providing crafted Markdown containing thousands of balanced nested brackets that do not form a valid link. This triggers repeated scans by the ` contains nested link` function, leading to CPU exhaustion in applications parsing the input.

Forge, a native JavaScript implementation of Transport Layer Security, handles received TLS records recursively when using the `forge.tls.createConnection()` function and the `process()` function for TLS record processing. This behavior consumes one JavaScript stack frame per record within a single input chunk. A remote peer can trigger a denial of service by sending thousands of small records simultaneously, which exhausts the call stack and leads to an uncaught exception.

In the `client credentials` and Resource Owner Password Credentials token grant handlers, the system can authenticate `request.client` as one confidential client while retaining an attacker-supplied `request.client id` for `validate grant type` and `validate scopes`. This allows a lower-privilege authenticated client to cause grant and scope authorization to use another client's identity if the application validator relies on the `client id` argument, which may result in the issuance of tokens with unauthorized grants or scopes. Validators that authorize exclusively from `request.client` may not be affected.

An information disclosure issue exists in the Dashboard Agent input proxy. The system stores a delegated user-actor token within session input records that are accessible via the browser. An attacker possessing a public session token for a chat can access the records endpoint to retrieve the token from the `payload.metadata.userActorToken` variable and subsequently replay it to perform an environment JWT (JSON Web Token) exchange.

An authorization bypass allows authenticated project members to complete a waitpoint in another member's DEVELOPMENT environment by skipping the per-user environment ownership check. An attacker with knowledge of a victim's waitpoint friendly ID can submit `type=DATETIME` or `type=MANUAL` with `isTimeout` to prematurely mark a pending waitpoint as completed.

Nx creates Unix domain sockets for its daemon and isolated plugin workers in shared temporary locations without restricting permissions to the owner. On shared build servers, developer hosts, or multi-user containers, an unprivileged local account can discover and connect to these sockets because the transport lacks authentication and relies solely on filesystem containment. A caller can send a `PROCESS IN BACKGROUND` request containing a module path to invoke its default export, enabling remote code execution as the account running Nx. Additionally, other handlers may expose task hashes, project graphs, and workspace file contents.

Authenticated users can cause a denial of service during data import because the system fails to limit archive expansion. An attacker can upload highly compressed files that expand to tens of gigabytes in memory and on disk, which exhausts server resources and crashes the instance.

A resource exhaustion issue exists in the '/task-filter' endpoint. The system accepts deeply nested filter expressions without enforcing recursion depth limits. Authenticated attackers can provide thousands of nested parentheses via the `filter` query parameter to exhaust system memory, leading to the termination of the API process.

A resource exhaustion issue exists where the system fails to limit parsed row cardinality. Authenticated attackers can upload multipart CSV files containing millions of small records to the 'POST /api/v2/migration/csv/migrate' endpoint, leading to process memory exhaustion and termination of the API service.

A resource exhaustion issue exists in the Planka migrator, which fails to enforce aggregate memory budgets during migration jobs. Authenticated attackers can trigger this by submitting migration requests that point to servers under their control. These servers can advertise a large number of size-compliant attachments, leading to the exhaustion of worker memory and resulting in a denial of service for all users.

Authenticated users can cause a denial of service by uploading specially crafted images to the avatar and project-background upload endpoints. The software fails to apply pixel decode limits, allowing images with extreme aspect ratios to consume excessive CPU and memory during processing. This can be triggered through repeated or concurrent uploads.

An unauthenticated peer can cause the Node.js process to terminate, resulting in a denial of service. This occurs when the server receives a normal HTTP request with a malformed Host header or a WebSocket upgrade request to the `/ws` endpoint with a malformed Origin header. The malformed values trigger an uncaught exception in the host-validation path, crashing the development server. The impact is limited to the availability of the server, with no risk of code execution or data disclosure.

An issue exists in the `router` proxy-table implementation where host+path selectors use unanchored substring matching on request metadata. When a router key contains a `/`, the `getTargetFromProxyTable()` function concatenates the `Host` header and the request URL into a single string and checks if the configured key is a substring of that combined value. This allows an attacker to bypass routing boundaries by providing a crafted `Host` header that acts as a superstring match for the configured key, potentially routing requests to unintended backends. This affects the `createProxyMiddleware()` function when configured with host+path rules.

The undici WebSocket client enforces `maxPayloadSize` on a per-frame basis but fails to enforce the cumulative size of fragmented uncompressed messages. A malicious WebSocket server can stream numerous small fragments that individually pass validation but collectively exceed the configured limit. This leads to unbounded memory growth in the client process, resulting in memory exhaustion and a denial of service. This issue affects applications using the `new WebSocket(...)` client that connect to compromised or attacker-controlled endpoints.

The HTTP redirect handler `HttpExecutor.prepareRedirectUrlOptions()` only removes credential headers that exactly match the lowercase string "authorization". Consequently, other credential-bearing headers, such as `PRIVATE-TOKEN` or mixed-case `Authorization` headers, are not stripped and may be forwarded to an attacker-controlled cross-origin redirect destination, leading to credential exposure.