anuraghazra/github-readme-stats

axios 1.13.2

11 advisories. Fixed in 1.16.0.

How it can be abusedThis app uses axios to talk to the GitHub API using a secret personal access token. Several of these flaws let an attacker pollute internal settings so that requests get redirected or hijacked and the token or response data can be stolen, or they can crash the service by feeding crafted values through the request path. Anyone hosting this service publicly, including the maintainers whose GitHub tokens are attached to every outbound call, would be affected.

• highGHSA-35jp-ww65-95whaxios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
• highGHSA-3g43-6gmg-66jwaxios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
• highGHSA-43fc-jf86-j433Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig
• highGHSA-6chq-wfr3-2hj9Axios: Header Injection via Prototype Pollution
• highGHSA-777c-7fjr-54vfAllocation of Resources Without Limits or Throttling in Axios
• highGHSA-hfxv-24rg-xrqfAxios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection
• highGHSA-j5f8-grm9-p9fcAxios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection
• highGHSA-p92q-9vqr-4j8vAxios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter
• highGHSA-pf86-5x62-jrwfAxios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking
• highGHSA-pmwg-cvhr-8vh7Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0
• highGHSA-q8qp-cvcw-x6jjAxios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking

brace-expansion 1.1.11

3 advisories. Fixed in 5.0.7.

How it can be abusedAn attacker could send a crafted string with many empty curly-brace groups to whatever part of the app expands patterns, causing the server to burn CPU and memory until it crashes or hangs, taking down card generation for everyone. In this project the vulnerable library only arrives through dev tooling like ESLint and never touches user input at runtime, so real visitors are not affected.

• highGHSA-3jxr-9vmj-r5cpbrace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups
• highGHSA-mh99-v99m-4gvgbrace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash
• highGHSA-rgw5-rvv9-x895brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

flatted 3.3.1

2 advisories. Fixed in 3.4.0.

How it can be abusedThis library serializes and deserializes cached API responses, so an attacker who can get hostile strings into GitHub or WakaTime data (for example via their own gist or repo names) could plant crafted values that, when read back from the cache and unpacked, crash the card-generating functions or tamper with object behavior. Anyone hosting the service would see broken or hanging stat cards until the poisoned cache entries expire.

• highGHSA-25h7-pfq9-p65fflatted vulnerable to unbounded recursion DoS in parse() revive phase
• highGHSA-rf6f-7fwh-wjghPrototype Pollution via parse() in NodeJS flatted

form-data 4.0.4

1 advisory. Fixed in 2.5.6.

How it can be abusedThis bug lets an attacker inject extra parts or headers into outgoing multipart file uploads when field names or filenames come from untrusted input, potentially leaking credentials to a server the attacker controls. In this project form-data is only a transitive dependency of the HTTP client and the code never builds multipart uploads from user input, so real-world abuse here would require an unlikely setup.

• highGHSA-hmw2-7cc7-3qxxform-data: CRLF injection in form-data via unescaped multipart field names and filenames

js-yaml 3.14.1

2 advisories. Fixed in 3.15.0.

How it can be abusedAn attacker could send a specially crafted YAML document that makes the parser burn huge amounts of CPU, slowing or freezing the server. In this project though, js-yaml only reads the repo's own built-in theme files, never anything from incoming requests, so there is no realistic way for an outsider to reach it.

• highGHSA-52cp-r559-cp3mjs-yaml: YAML merge-key chains can force quadratic CPU consumption
• highGHSA-5p4m-2wfm-xmqjJS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported

minimatch 9.0.5

3 advisories. Fixed in 10.2.3.

How it can be abusedAn attacker who can feed their own text into a glob-matching call could send a specially shaped pattern that makes the server's CPU spin for a long time, slowing or freezing responses for everyone. In this project, minimatch is only used indirectly (mainly by test tooling) and never runs on user-supplied query parameters, so real users are not meaningfully exposed.

• highGHSA-23c5-xmqv-rm74minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions
• highGHSA-3ppc-4f35-3m26minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern
• highGHSA-7r86-cg39-jmmjminimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments

path-to-regexp 8.3.0

1 advisory. Fixed in 8.4.0.

How it can be abusedAn attacker could send a specially crafted URL with repeated optional segments that makes the URL matching code hang, freezing the process until it restarts. Here that only affects developers running the app locally with Express, since production runs on Vercel serverless functions where this library is not used.

• highGHSA-j3q9-mxjg-w52fpath-to-regexp vulnerable to Denial of Service via sequential optional groups

picomatch 4.0.3

1 advisory. Fixed in 4.0.4.

How it can be abusedAn attacker could send a crafted pattern string that makes the matching code hang and burn CPU, but this project only uses picomatch indirectly for file matching during development and testing, not on user input in the live API. So the people affected would be developers running local builds, not users of the deployed stat cards.

• highGHSA-c2c7-rcm5-vvqjPicomatch has a ReDoS vulnerability via extglob quantifiers

undici 5.29.0

3 advisories. Fixed in 6.24.0.

How it can be abusedAn attacker could crash or exhaust memory of a server by sending it malicious WebSocket traffic, but this project only uses undici's HTTP fetching to call the GitHub API and never opens WebSocket connections, so there is no exposed path for that attack.

• highGHSA-v9p9-hfj2-hcw8Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation
• highGHSA-vrm6-8vpv-qv8qUndici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression
• highGHSA-vxpw-j846-p89qundici WebSocket client vulnerable to denial of service via fragment count bypass

ws 8.18.3

1 advisory. Fixed in 5.2.5.

How it can be abusedAn attacker could send many tiny pieces of data over a WebSocket connection to make the server hold them all in memory until it runs out and crashes. In this project, however, the app only serves regular HTTP requests to generate SVG cards, so there is no public WebSocket endpoint for anyone to attack.

• highGHSA-96hv-2xvq-fx4pws: Memory exhaustion DoS from tiny fragments and data chunks