agentMemory

Security check static checks

40 out of 100

Reads what is published about the server: package advisories, licence, secrets in the documented setup and tool permissions. Nothing is installed or run, so this is not a security assessment. Checked 24 Oct 2026 by edna-skill-static-v1 main@0409b7b7bb6f. What it checks

• Critical proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet (affects proxy-addr 2.0.7, pinned in package-lock.json).
• High brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups (affects brace-expansion 1.1.12, pinned in package-lock.json).
• High brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion (affects brace-expansion 1.1.12, pinned in package-lock.json).
• High brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash (affects brace-expansion 1.1.12, pinned in package-lock.json).
• High brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion (affects brace-expansion 1.1.12, pinned in package-lock.json).
• High brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation (affects brace-expansion 1.1.12, pinned in package-lock.json).
• High fast-uri vulnerable to host confusion via failed IDN canonicalization (affects fast-uri 2.4.0, pinned in package-lock.json).
• High fast-uri vulnerable to host confusion via backslash authority introducer (affects fast-uri 2.4.0, pinned in package-lock.json).
• High fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization (affects fast-uri 2.4.0, pinned in package-lock.json).
• High fast-uri vulnerable to host confusion via percent-encoded scheme normalization (affects fast-uri 2.4.0, pinned in package-lock.json).
• High fast-uri vulnerable to path traversal via percent-encoded dot segments (affects fast-uri 2.4.0, pinned in package-lock.json).
• High fast-uri vulnerable to authority injection via an unvalidated port in serialize (affects fast-uri 2.4.0, pinned in package-lock.json).
• High fast-uri vulnerable to host confusion via literal backslash authority delimiter (affects fast-uri 2.4.0, pinned in package-lock.json).
• High fast-uri vulnerable to host confusion via percent-encoded authority delimiters (affects fast-uri 2.4.0, pinned in package-lock.json).
• High fast-uri vulnerable to host confusion via failed IDN canonicalization (affects fast-uri 3.1.0, pinned in package-lock.json).
• High fast-uri vulnerable to host confusion via backslash authority introducer (affects fast-uri 3.1.0, pinned in package-lock.json).
• High fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization (affects fast-uri 3.1.0, pinned in package-lock.json).
• High fast-uri vulnerable to host confusion via percent-encoded scheme normalization (affects fast-uri 3.1.0, pinned in package-lock.json).
• High fast-uri vulnerable to path traversal via percent-encoded dot segments (affects fast-uri 3.1.0, pinned in package-lock.json).
• High fast-uri vulnerable to authority injection via an unvalidated port in serialize (affects fast-uri 3.1.0, pinned in package-lock.json).
• High fast-uri vulnerable to host confusion via literal backslash authority delimiter (affects fast-uri 3.1.0, pinned in package-lock.json).
• High fast-uri vulnerable to host confusion via percent-encoded authority delimiters (affects fast-uri 3.1.0, pinned in package-lock.json).
• High fastify vulnerable to request body replacement via an async validation result collision (affects fastify 4.29.1, pinned in package-lock.json).
• High fastify vulnerable to header validation bypass via incomplete schema case normalization (affects fastify 4.29.1, pinned in package-lock.json).
• High fastify vulnerable to request validation bypass via skipped boolean false schemas (affects fastify 4.29.1, pinned in package-lock.json).
• High Fastify's Content-Type header tab character allows body validation bypass (affects fastify 4.29.1, pinned in package-lock.json).
• High fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers (affects fastify 4.29.1, pinned in package-lock.json).
• High find-my-way: DDoS with HTTP2 (affects find-my-way 8.2.2, pinned in package-lock.json).
• High form-data: CRLF injection in form-data via unescaped multipart field names and filenames (affects form-data 4.0.5, pinned in package-lock.json).
• High LinkifyIt#match scan loop has quadratic algorithmic complexity (affects linkify-it 3.0.3, pinned in package-lock.json).
• High linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text (affects linkify-it 3.0.3, pinned in package-lock.json).
• High markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes (affects markdown-it 12.3.2, pinned in package-lock.json).
• High minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions (affects minimatch 3.1.2, pinned in package-lock.json).
• High minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern (affects minimatch 3.1.2, pinned in package-lock.json).
• High minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments (affects minimatch 3.1.2, pinned in package-lock.json).
• High tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape (affects tmp 0.2.5, pinned in package-lock.json).
• High Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack (affects underscore 1.13.7, pinned in package-lock.json).
• High undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives (affects undici 7.16.0, pinned in package-lock.json).
• High Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client (affects undici 7.16.0, pinned in package-lock.json).
• High undici vulnerable to Denial of Service via unrequested WebSocket subprotocol (affects undici 7.16.0, pinned in package-lock.json).
• High Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation (affects undici 7.16.0, pinned in package-lock.json).
• High Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression (affects undici 7.16.0, pinned in package-lock.json).
• High undici WebSocket client vulnerable to denial of service via fragment count bypass (affects undici 7.16.0, pinned in package-lock.json).
• Medium ajv has ReDoS when using `$data` option (affects ajv 8.17.1, pinned in package-lock.json).
• Medium brace-expansion: Zero-step sequence causes process hang and memory exhaustion (affects brace-expansion 1.1.12, pinned in package-lock.json).
• Medium brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service (affects brace-expansion 1.1.12, pinned in package-lock.json).
• Medium fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets (affects fast-uri 2.4.0, pinned in package-lock.json).
• Medium fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding (affects fast-uri 2.4.0, pinned in package-lock.json).
• Medium fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets (affects fast-uri 3.1.0, pinned in package-lock.json).
• Medium fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding (affects fast-uri 3.1.0, pinned in package-lock.json).
• Medium fastify: request.protocol and request.host Spoofable via X-Forwarded-Proto/Host from Untrusted Connections (affects fastify 4.29.1, pinned in package-lock.json).
• Medium fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses (affects fastify 4.29.1, pinned in package-lock.json).
• Medium fastify vulnerable to schema validation bypass via root primitive coercion mismatch (affects fastify 4.29.1, pinned in package-lock.json).
• Medium markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds (affects markdown-it 12.3.2, pinned in package-lock.json).
• Medium markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations (affects markdown-it 12.3.2, pinned in package-lock.json).
• Medium qs: Denial of Service via Attacker Controlled isBuffer (affects qs 6.14.0, pinned in package-lock.json).
• Medium qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion (affects qs 6.14.0, pinned in package-lock.json).
• Medium qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set (affects qs 6.14.0, pinned in package-lock.json).
• Medium undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches (affects undici 7.16.0, pinned in package-lock.json).
• Medium Undici has an HTTP Request/Response Smuggling issue (affects undici 7.16.0, pinned in package-lock.json).
• Medium undici vulnerable to Denial of Service via unbounded decompression of compressed responses (affects undici 7.16.0, pinned in package-lock.json).
• Medium Undici has CRLF Injection in undici via `upgrade` option (affects undici 7.16.0, pinned in package-lock.json).
• Medium undici vulnerable to Denial of Service via unbounded memory in the EventSource parser (affects undici 7.16.0, pinned in package-lock.json).
• Medium undici vulnerable to downstream response desynchronization via retry interceptor (affects undici 7.16.0, pinned in package-lock.json).
• Medium undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens (affects undici 7.16.0, pinned in package-lock.json).
• Medium Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion (affects undici 7.16.0, pinned in package-lock.json).
• Medium undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives (affects undici 7.16.0, pinned in package-lock.json).
• Medium undici vulnerable to CRLF Injection via blob-like body 'type' property (affects undici 7.16.0, pinned in package-lock.json).
• Medium undici vulnerable to HTTP header injection via Set-Cookie percent-decoding (affects undici 7.16.0, pinned in package-lock.json).
• Medium undici vulnerable to Denial of Service via orphaned RetryHandler response body (affects undici 7.16.0, pinned in package-lock.json).
• Medium undici vulnerable to cross-user information disclosure via shared cache whitespace bypass (affects undici 7.16.0, pinned in package-lock.json).
• Medium undici vulnerable to Denial of Service via WebSocketStream unclean close (affects undici 7.16.0, pinned in package-lock.json).
• Medium undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields (affects undici 7.16.0, pinned in package-lock.json).
• Medium uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided (affects uuid 13.0.0, pinned in package-lock.json).
• Medium uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided (affects uuid 8.3.2, pinned in package-lock.json).
• Low fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references (affects fast-uri 2.4.0, pinned in package-lock.json).
• Low fast-uri vulnerable to improper path equivalence in relative reference normalization (affects fast-uri 2.4.0, pinned in package-lock.json).
• Low fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references (affects fast-uri 3.1.0, pinned in package-lock.json).
• Low fast-uri vulnerable to improper path equivalence in relative reference normalization (affects fast-uri 3.1.0, pinned in package-lock.json).
• Low Fastify Vulnerable to DoS via Unbounded Memory Allocation in sendWebStream (affects fastify 4.29.1, pinned in package-lock.json).
• Low markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled (affects markdown-it 12.3.2, pinned in package-lock.json).
• Low qs's arrayLimit bypass in comma parsing allows denial of service (affects qs 6.14.0, pinned in package-lock.json).
• Low undici vulnerable to response truncation via oversized chunked responses in the dump interceptor (affects undici 7.16.0, pinned in package-lock.json).
• Low undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse (affects undici 7.16.0, pinned in package-lock.json).
• Low undici vulnerable to caching and replay of unsafe HTTP method responses (affects undici 7.16.0, pinned in package-lock.json).
• Low undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching (affects undici 7.16.0, pinned in package-lock.json).
• Low undici vulnerable to downstream response splitting via retry interceptor (affects undici 7.16.0, pinned in package-lock.json).
• Note 1 of 294 packages are not pinned to one version, so only the malicious packages list was checked for them, not version advisories.