Snyk Security Database

itsa-react-focuscontainer is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship.

marocolor is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship.

io.vertx:vertx-core is a tool-kit for building reactive applications on the JVM.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the WebSocket extension setup of HttpServerConnectionHandler and Http1ClientConnection, which construct the deflate-frame and permessage-deflate handshakers without a maximum allocation for the decompressor, so the configured frame and message size limits bound only the compressed bytes on the wire. An attacker can exhaust memory on the peer by sending a small compressed frame or message that expands to an arbitrarily larger payload during decompression. This requires compression to have been negotiated on the connection, and it applies in both roles, to a server accepting connections and to a client connecting to a server under the attacker's control.