Snyk Security Database

@astrojs/vercel is a Deploy your site to Vercel

Affected versions of this package are vulnerable to Missing Authorization via the _isr process. An attacker can access protected content by sending unauthenticated GET requests with a crafted x_astro_path query parameter, causing the server to render and return any route, even those protected by edge rules or middleware. This is only exploitable if edge-based access controls or middleware are used to protect routes, and the deployment uses split middleware or path-based rules at the edge.

h2 is a Pure-Python HTTP/2 protocol implementation

Affected versions of this package are vulnerable to HTTP Request Smuggling via the processing of HTTP/2 request headers containing multiple Host headers. An attacker can interfere with downstream HTTP/1.1 applications by crafting requests that result in multiple Host headers being forwarded, potentially enabling request smuggling attacks.

org.webjars.npm:crypto-js is a library of crypto standards.

Affected versions of this package are vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in the WordArray.random function. An attacker can recover security-sensitive values by enumerating the reduced output space of the underlying pseudo-random number generator. This is only exploitable if the application uses the affected function to generate security-sensitive values.