juliangarnier/anime

brace-expansion 2.0.2

3 advisories. Fixed in 5.0.7.

How it can be abusedThis package is only pulled in indirectly by developer tools (like test runners or bundlers) that match file paths with glob patterns. An attacker who can get a crafted file path or pattern into your build or test step could make those tools hang or crash from memory exhaustion, but the published anime.js library itself never runs this code, so end users of the library are not affected.

• highGHSA-3jxr-9vmj-r5cpbrace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups
• highGHSA-mh99-v99m-4gvgbrace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash
• highGHSA-rgw5-rvv9-x895brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

engine.io 6.6.4

1 advisory. Fixed in 6.6.7.

How it can be abusedAn attacker could flood the long-polling HTTP transport of an Engine.IO server with many open connections, exhausting memory or sockets and knocking the server offline. Only projects that actually run a Socket.IO/Engine.IO server are affected, which this browser-side animation library does not.

• highGHSA-r635-g3xr-vw7xSocket.IO: Engine.IO Polling Transport Connection Exhaustion

immutable 3.8.2

3 advisories. Fixed in 4.3.9.

How it can be abusedImmutable.js is not part of Anime.js's shipped code, which is explicitly zero-dependency, so an attacker cannot reach these flaws through the library itself. At most it could appear in developer tooling or tests, where crashes or slowdowns would only affect developers locally, not end users.

• highGHSA-v56q-mh7h-f735Immutable.js `List` 32-bit trie overflow → unrecoverable DoS
• highGHSA-wf6x-7x77-mvgwImmutable is vulnerable to Prototype Pollution
• highGHSA-xvcm-6775-5m9rImmutable: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set

js-yaml 4.1.0

2 advisories. Fixed in 3.15.0.

How it can be abusedAn attacker who can feed a malicious YAML file into the build or test pipeline could craft deeply chained merge keys or ordered-map tags that make the YAML parser burn huge amounts of CPU, freezing or slowing the machine running it. Only developers or CI systems parsing untrusted YAML with this package are affected; end users of the animation library are not.

• highGHSA-52cp-r559-cp3mjs-yaml: YAML merge-key chains can force quadratic CPU consumption
• highGHSA-5p4m-2wfm-xmqjJS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported

lodash 4.17.21

1 advisory. Fixed in 4.18.0.

How it can be abusedThe flaw lives in lodash's template function, which can run arbitrary code if an attacker controls the text fed into it, so only projects that both depend on lodash and pass untrusted input into templates are exposed. Anime.js is a zero-dependency animation library and does not use lodash at all, so its users are not affected.

• highGHSA-r5fr-rjxr-66jclodash vulnerable to Code Injection via `_.template` imports key names

minimatch 5.1.6

3 advisories. Fixed in 10.2.3.

How it can be abusedAn attacker would need to get a maliciously crafted file path or pattern into the build or test process, where minimatch's pattern matching could hang the CPU for minutes or hours, freezing builds or CI. Since Anime.js ships to browsers and never uses minimatch at runtime, only developers and CI pipelines are affected, not end users.

• highGHSA-23c5-xmqv-rm74minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions
• highGHSA-3ppc-4f35-3m26minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern
• highGHSA-7r86-cg39-jmmjminimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments

picomatch 2.3.1

1 advisory. Fixed in 4.0.4.

How it can be abusedAn attacker could send a specially crafted file name or path pattern that makes the matching library hang the CPU for a long time. In this project picomatch is only used by development and build tools like bundlers and test runners, so it could slow down or freeze a developer's machine during a build or install, but end users of anime.js are not affected.

• highGHSA-c2c7-rcm5-vvqjPicomatch has a ReDoS vulnerability via extglob quantifiers

rollup 4.46.2

1 advisory. Fixed in 2.80.0.

How it can be abusedAn attacker who can get malicious code or a plugin into your build process could trick Rollup into writing files outside the project folder, such as overwriting config files or injecting scripts that run later. This mainly affects developers running builds on untrusted code; since this repo only bundles its own trusted source files, everyday users of the published animation library are not directly exposed.

• highGHSA-mw96-cpmx-2vgcRollup 4 has Arbitrary File Write via Path Traversal

serialize-javascript 6.0.2

1 advisory. Fixed in 7.0.3.

How it can be abusedThe vulnerable library turns JavaScript values into text that can be safely turned back into code later, and the flaw lets crafted Date or RegExp objects smuggle in code that then runs when deserialized. Anime.js has no dependencies and does not use serialize-javascript, so no attacker path exists here; only projects that actually serialize untrusted data with it are affected.

• highGHSA-5c6j-r48x-rmvqSerialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()

socket.io-parser 4.2.4

2 advisories. Fixed in 4.2.7.

How it can be abusedAn attacker could crash any server using Socket.IO by sending packets with huge numbers of binary attachments, which the parser loads into memory all at once until the server runs out. This project does not use socket.io-parser anywhere, so no one deploying Anime.js is affected.

• highGHSA-2m8v-j782-fhvrSocket.IO: Zero-attachment Memory Exhaustion
• highGHSA-677m-j7p3-52f9socket.io allows an unbounded number of binary attachments

ws 8.17.1

1 advisory. Fixed in 5.2.5.

How it can be abusedAn attacker who can connect to a WebSocket server using this vulnerable version can send many tiny message fragments that the server keeps in memory, slowly eating RAM until it crashes. In this repo ws is only pulled in by development tools like the test server and live-reload browser server, so real users of the animation library are not affected; at most a developer running tests locally could crash their own machine.

• highGHSA-96hv-2xvq-fx4pws: Memory exhaustion DoS from tiny fragments and data chunks