Findings

lodash.template() compiles untrusted input into executable JavaScript when the caller doesn't pre-sanitize template data.

An oversized authentication banner can exhaust worker memory before authentication completes.

Under specific ACL configurations, a queued command inside a transaction can bypass command permission checks.

A malformed QUIC packet can trigger an out-of-bounds read in the HTTP/3 module, potentially disclosing worker process memory.

Affects Windows batch-file execution only. Our node:20-alpine containers run on Linux, so the risk is accepted without further action.

Reviewed against our deployment: we do not use libpq client-side error parsing in the affected code path, and the server is not exposed to untrusted clients.

Crafted input to lodash.merge can pollute Object.prototype, potentially enabling denial of service or property injection downstream.

A stack buffer overflow in the Lua bit library bundled with Redis can be exploited from a Lua script to achieve remote code execution.

A signal handler race condition in sshd allows unauthenticated remote code execution as root on glibc-based Linux systems.

A crafted admission review request can inject arbitrary paths into the nginx template, leading to remote code execution in the ingress controller pod.