Zyy0530

An authorization flaw exists in the `createComment` mutation. This allows unauthenticated users to bypass post status checks and add comments to non-public posts, including those that are draft, private, trashed, or password-protected. This can lead to the enumeration of post IDs, the leaking of hidden titles through moderator notifications, and the ability to backdate comments or mark them as pingbacks.

Forge, a native JavaScript implementation of Transport Layer Security, handles received TLS records recursively when using the `forge.tls.createConnection()` function and the `process()` function for TLS record processing. This behavior consumes one JavaScript stack frame per record within a single input chunk. A remote peer can trigger a denial of service by sending thousands of small records simultaneously, which exhausts the call stack and leads to an uncaught exception.

The chunked media upload RPC validates that a chunk index is in range but fails to reject already stored indices or replace previous objects. An authenticated user can repeatedly upload the same valid index, leading to the allocation of multiple temporary objects for each successful request. This process increases the stored bytes beyond the declared logical size of the upload session. The system only detects the inconsistent chunk count after the allocation has occurred.

Nx creates Unix domain sockets for its daemon and isolated plugin workers in shared temporary locations without restricting permissions to the owner. On shared build servers, developer hosts, or multi-user containers, an unprivileged local account can discover and connect to these sockets because the transport lacks authentication and relies solely on filesystem containment. A caller can send a `PROCESS IN BACKGROUND` request containing a module path to invoke its default export, enabling remote code execution as the account running Nx. Additionally, other handlers may expose task hashes, project graphs, and workspace file contents.

A resource exhaustion issue exists in the Planka migrator, which fails to enforce aggregate memory budgets during migration jobs. Authenticated attackers can trigger this by submitting migration requests that point to servers under their control. These servers can advertise a large number of size-compliant attachments, leading to the exhaustion of worker memory and resulting in a denial of service for all users.

A resource exhaustion issue exists in the '/task-filter' endpoint. The system accepts deeply nested filter expressions without enforcing recursion depth limits. Authenticated attackers can provide thousands of nested parentheses via the `filter` query parameter to exhaust system memory, leading to the termination of the API process.

A resource exhaustion issue exists where the system fails to limit parsed row cardinality. Authenticated attackers can upload multipart CSV files containing millions of small records to the 'POST /api/v2/migration/csv/migrate' endpoint, leading to process memory exhaustion and termination of the API service.

The undici WebSocket client enforces `maxPayloadSize` on a per-frame basis but fails to enforce the cumulative size of fragmented uncompressed messages. A malicious WebSocket server can stream numerous small fragments that individually pass validation but collectively exceed the configured limit. This leads to unbounded memory growth in the client process, resulting in memory exhaustion and a denial of service. This issue affects applications using the `new WebSocket(...)` client that connect to compromised or attacker-controlled endpoints.