273 lines
20 KiB
Markdown
273 lines
20 KiB
Markdown
# Advisory Intelligence — Kordant
|
|
|
|
> **Generated**: 2026-05-28
|
|
> **Phase**: L1 (Intel) — Advisory collection & dependency intelligence
|
|
> **Target**: Kordant monorepo — SolidStart + tRPC + Drizzle ORM + native mobile apps
|
|
|
|
---
|
|
|
|
## Repository Identity
|
|
|
|
| Field | Value |
|
|
|-------|-------|
|
|
| **Project** | Kordant |
|
|
| **Type** | Full-stack monorepo (SolidStart web, iOS, Android, browser extension) |
|
|
| **Git remote** | `git@git.freno.me:Mike/Kordant.git` (self-hosted GitLab/Gitea — **not GitHub**) |
|
|
| **Resolved identity** | `Mike/Kordant` (via git remote) |
|
|
| **Git history available** | `true` (local repo at `/Users/mike/Code/Kordant`) |
|
|
| **Current commit** | `26d9f8b` — "clear references" |
|
|
| **Primary language** | TypeScript/JavaScript (SolidJS frontend, Node.js backend) |
|
|
| **Secondary** | Swift (iOS), Kotlin/Jetpack Compose (Android) |
|
|
| **Framework** | SolidStart 2.0.0-alpha.2, tRPC 10.45.4, Drizzle ORM 0.45.2 |
|
|
| **Database** | Turso/libSQL (SQLite) |
|
|
| **Queue** | BullMQ + ioredis (Redis 7) |
|
|
|
|
---
|
|
|
|
## Recent Advisories (last 24 months)
|
|
|
|
### Advisory Inventory (filtered to ≥12 months old, within last 24 months)
|
|
|
|
Only advisories published between **May 2024 and May 2026** are listed below. Older advisories are noted separately.
|
|
|
|
| # | ID | CVE | Severity | CVSS | Published | Affected Package | Version in Repo | Summary | CWE |
|
|
|---|-----|-----|----------|------|-----------|-----------------|-----------------|---------|-----|
|
|
| 1 | GHSA-58qx-3vcg-4xpx | CVE-2026-45736 | **MEDIUM** | 5.3 | 2026-05-18 | ws | 8.21.0 | Uninitialized memory disclosure | CWE-125 (out-of-bounds read) |
|
|
| 2 | GHSA-gpj5-g38j-94v9 | CVE-2026-39356 | **HIGH** | 7.5 | 2026-04-08 | drizzle-orm | 0.45.2 | SQL injection via improperly escaped SQL identifiers | CWE-89 (SQL Injection) |
|
|
| 3 | GHSA-4w7w-66w2-5vf9 | CVE-2026-39365 | **HIGH** | 7.1 | 2026-04-06 | vite | 6.4.2 / 7.3.3 | Path traversal in optimized deps `.map` handling | CWE-22 (Path Traversal) |
|
|
| 4 | GHSA-v2wj-q39q-566r | CVE-2026-39364 | **HIGH** | — | 2026-04-06 | vite | 6.4.2 / 7.3.3 | `server.fs.deny` bypassed with queries | CWE-22 (Path Traversal) |
|
|
| 5 | GHSA-p9ff-h696-f583 | CVE-2026-39363 | **HIGH** | — | 2026-04-06 | vite | 6.4.2 / 7.3.3 | Arbitrary file read via dev server WebSocket | CWE-22 (Path Traversal) |
|
|
| 6 | GHSA-43p4-m455-4f4j | CVE-2025-68130 | **HIGH** | — | 2025-12-16 | @trpc/server | 10.45.4 | Prototype pollution in `experimental_nextAppDirCaller` | CWE-1321 (Prototype Pollution) |
|
|
| 7 | GHSA-vqpr-j7v3-hqw9 | CVE-2025-66020 | **HIGH** | — | 2025-11-26 | valibot | 0.29.0 | ReDoS in `EMOJI_REGEX` | CWE-1333 (ReDoS) |
|
|
| 8 | GHSA-93m4-6634-74q7 | CVE-2025-62522 | **MEDIUM** | — | 2025-10-20 | vite | 6.4.2 / 7.3.3 | `server.fs.deny` bypass via backslash on Windows | CWE-22 (Path Traversal) |
|
|
| 9 | GHSA-g4jq-h2w9-997c | CVE-2025-58751 | **MEDIUM** | 5.3 | 2025-09-09 | vite | 6.4.2 / 7.3.3 | Middleware may serve files with names matching public directory | CWE-538 (File/Dir Info Exposure) |
|
|
| 10 | GHSA-jqfw-vq24-v9c3 | CVE-2025-58752 | **MEDIUM** | — | 2025-09-09 | vite | 6.4.2 / 7.3.3 | `server.fs` settings not applied to HTML files | CWE-200 (Info Exposure) |
|
|
| 11 | GHSA-859w-5945-r5v3 | CVE-2025-46565 | **MEDIUM** | 5.3 | 2025-04-30 | vite | 6.4.2 / 7.3.3 | `server.fs.deny` bypassed with `/.` paths | CWE-22 (Path Traversal) |
|
|
| 12 | GHSA-pj3v-9cm8-gvj8 | CVE-2025-43855 | **HIGH** | — | 2025-04-24 | @trpc/server | 10.45.4 | WebSocket DoS vulnerability | CWE-400 (Resource Exhaustion) |
|
|
| 13 | GHSA-356w-63v5-8wf4 | CVE-2025-32395 | **MEDIUM** | 5.3 | 2025-04-11 | vite | 6.4.2 / 7.3.3 | `server.fs.deny` bypass with invalid `request-target` | CWE-22 (Path Traversal) |
|
|
| 14 | GHSA-xcj6-pq6g-qj4x | CVE-2025-31486 | **MEDIUM** | 5.3 | 2025-04-04 | vite | 6.4.2 / 7.3.3 | `server.fs.deny` bypass with `.svg` or relative paths | CWE-22 (Path Traversal) |
|
|
| 15 | GHSA-4r4m-qw57-chr8 | CVE-2025-31125 | **HIGH** | 7.5 | 2025-03-31 | vite | 6.4.2 / 7.3.3 | `server.fs.deny` bypass for `inline`/`raw` with `?import` | CWE-22 (Path Traversal) |
|
|
| 16 | GHSA-x574-m823-4x7w | CVE-2025-30208 | **MEDIUM** | 5.3 | 2025-03-25 | vite | 6.4.2 / 7.3.3 | `server.fs.deny` bypass using `?raw??` | CWE-22 (Path Traversal) |
|
|
| 17 | GHSA-3qxh-p7jc-5xh6 | CVE-2025-27109 | **HIGH** | — | 2025-02-25 | solid-js | 1.9.13 | XSS: HTML not escaped in JSX fragments | CWE-79 (XSS) |
|
|
| 18 | GHSA-vg6x-rcgg-rjx6 | CVE-2025-24010 | **MEDIUM** | 5.3 | 2025-01-21 | vite | 6.4.2 / 7.3.3 | External sites can send requests to dev server and read responses | CWE-918 (SSRF) |
|
|
| 19 | GHSA-3h5v-q93c-6h6q | CVE-2024-37890 | **HIGH** | 7.5 | 2024-06-17 | ws | 8.21.0 | DoS when handling requests with many HTTP headers | CWE-770 (Resource Exhaustion) |
|
|
| 20 | GHSA-8jhw-289h-jh2g | CVE-2024-31207 | **MEDIUM** | — | 2024-04-03 | vite | 6.4.2 / 7.3.3 | `server.fs.deny` did not deny directory-pattern requests | CWE-22 (Path Traversal) |
|
|
| 21 | GHSA-64vr-g452-qvp3 | CVE-2024-45812 | **MEDIUM** | 5.3 | 2024-09-17 | vite | 6.4.2 / 7.3.3 | DOM Clobbering gadget in bundled scripts → XSS | CWE-79 (XSS) |
|
|
| 22 | GHSA-9cwx-2883-4wfx | CVE-2024-45811 | **MEDIUM** | 5.3 | 2024-09-17 | vite | 6.4.2 / 7.3.3 | `server.fs.deny` bypass with `?import&raw` | CWE-22 (Path Traversal) |
|
|
| 23 | GHSA-hhhv-q57g-882q | CVE-2024-28176 | **MEDIUM** | 5.3 | 2024-03-07 | jose | 5.10.0 | Resource exhaustion via crafted JWE with compressed plaintext | CWE-770 (Resource Exhaustion) |
|
|
| 24 | GHSA-c24v-8rfc-w8vw | CVE-2024-23331 | **HIGH** | 7.5 | 2024-01-19 | vite | 6.4.2 / 7.3.3 | `server.fs.deny` bypass on case-insensitive filesystems | CWE-22 (Path Traversal) |
|
|
|
|
### Older advisories (≥24 months, retained for pattern analysis)
|
|
|
|
| # | ID | CVE | Severity | Published | Package | Summary |
|
|
|---|-----|-----|----------|-----------|---------|---------|
|
|
| A | GHSA-5888-ffcr-r425 | CVE-2022-23631 | **CRITICAL** | 2022-02-09 | superjson | Prototype pollution → RCE (v2.x affected; repo uses 2.2.6) |
|
|
| B | GHSA-jv3g-j58f-9mq9 | CVE-2022-36083 | HIGH | 2022-09-16 | jose | Resource exhaustion via crafted JWE (pre-v4.9.2) |
|
|
| C | GHSA-58f5-hfqc-jgch | CVE-2021-29443 | HIGH | 2021-04-19 | jose | Padding oracle attack via timing discrepancy |
|
|
| D | GHSA-6fc8-4gx4-v693 | CVE-2021-32640 | MEDIUM | 2021-05-28 | ws | ReDoS in `Sec-Websocket-Protocol` header |
|
|
| E | GHSA-353f-5xf4-qw67 | CVE-2023-34092 | HIGH | 2023-06-06 | vite | `server.fs.deny` bypass using double forward-slash |
|
|
| F | GHSA-92r3-m2mg-pj97 | CVE-2023-49293 | MEDIUM | 2023-12-05 | vite | XSS in `server.transformIndexHtml` via URL payload |
|
|
| G | GHSA-mv48-hcvh-8jj8 | CVE-2022-35204 | MEDIUM | 2022-08-19 | vite | Directory traversal via crafted URL |
|
|
|
|
---
|
|
|
|
### Severity Distribution
|
|
|
|
| Severity | Count (last 24mo) | Count (all-time) |
|
|
|----------|-------------------|------------------|
|
|
| CRITICAL | 0 | 1 (superjson CVE-2022-23631) |
|
|
| HIGH | 12 | 15 |
|
|
| MEDIUM | 11 | 13 |
|
|
| LOW | 0 | 0 |
|
|
| **Total** | **23** | **29** |
|
|
|
|
### Historical Coverage Metadata
|
|
|
|
- **Tier reached**: Tier 1 (24 months) + Tier 2 expansion (all-time for pattern coverage)
|
|
- **Total advisories collected**: 29 (23 within 24 months, 6 older)
|
|
- **Severity distribution**: CRITICAL: 1, HIGH: 15, MEDIUM: 13, LOW: 0
|
|
- **Repository identity**: `Mike/Kordant` (resolved via **git remote** → `git.freno.me:Mike/Kordant.git`)
|
|
- **Git history available**: `true`
|
|
- **Coverage gaps**:
|
|
- **Source 2 (GitHub Security Advisories)**: Skipped — repo is self-hosted on `git.freno.me`, not on GitHub. No `gh api` queries possible.
|
|
- **Source 1 (git log CVE references)**: Partially available — local git history present but no CVE/GHSA IDs found in commit messages or changelogs (security fixes referenced by internal ticket IDs like FRE-4572, FRE-4807, etc.)
|
|
- **Source 5 (web search)**: Not executed — OSV + NVD provided sufficient coverage
|
|
|
|
---
|
|
|
|
## Dependency Intelligence
|
|
|
|
### Key Dependencies & Risk Assessment
|
|
|
|
| Package | Version | Ecosystem | Risk Level | Reason |
|
|
|---------|---------|-----------|------------|--------|
|
|
| **vite** | 6.4.2 / 7.3.3 | npm | 🔴 CRITICAL | 14+ vulnerabilities in 24 months; persistent `server.fs.deny` bypass lineage. Dev server is exposed (port 3000). |
|
|
| **@trpc/server** | 10.45.4 | npm | 🟠 HIGH | Prototype pollution (CVE-2025-68130) + WebSocket DoS (CVE-2025-43855). Both CVSSv4 HIGH. |
|
|
| **drizzle-orm** | 0.45.2 | npm | 🔴 CRITICAL | SQL injection via unescaped identifiers (CVE-2026-39356, CVSS 7.5). Direct DB access layer. |
|
|
| **solid-js** | 1.9.13 | npm | 🟠 HIGH | XSS in JSX fragments (CVE-2025-27109, CVSS HIGH). Core rendering framework. |
|
|
| **valibot** | 0.29.0 | npm | 🟠 HIGH | ReDoS in EMOJI_REGEX (CVE-2025-66020, CVSS HIGH). Used for input validation. |
|
|
| **ws** | 8.21.0 | npm | 🟠 HIGH | Uninitialized memory disclosure (CVE-2026-45736) + DoS via HTTP headers (CVE-2024-37890). WebSocket transport. |
|
|
| **jose** | 5.10.0 | npm | 🟡 MEDIUM | Resource exhaustion via JWE (CVE-2024-28176, CVSS 5.3). JWT/crypto library. |
|
|
| **superjson** | 2.2.6 | npm | 🟠 HIGH | Prototype pollution → RCE (CVE-2022-23631, CVSS 10.0). Used in browser extension for tRPC serialization. |
|
|
| **puppeteer** | 25.0.4 | npm | 🟢 LOW | Old UAF (CVE-2019-5786) — patched in modern versions. Used for report generation. |
|
|
|
|
### High-Risk Patterns
|
|
|
|
1. **Vite `server.fs.deny` — The Recurring Bypass**
|
|
- 8+ distinct CVEs (CVE-2023-34092, CVE-2024-23331, CVE-2024-31207, CVE-2024-45811/45812, CVE-2025-30208, CVE-2025-31125, CVE-2025-31486, CVE-2025-32395, CVE-2025-46565, CVE-2025-58751/58752, CVE-2025-62522, CVE-2026-39363/39364/39365)
|
|
- **All** relate to `server.fs.deny` being bypassed via different techniques: queries, backslashes, `.svg`, `.map`, `/.`, `?import`, `?raw??`, case-insensitive filesystems, double-slash, invalid request-targets, HTML files, WebSocket
|
|
- This is a **structural design flaw** in Vite's path resolution — patches are band-aids on a fundamentally broken security model
|
|
- **Impact**: If the dev server is ever exposed (even internally), an attacker can read any file in the project including `.env`, `docker-compose.yml`, source code, database credentials
|
|
|
|
2. **tRPC + superjson — Prototype Pollution Chain**
|
|
- superjson CVE-2022-23631 (CRITICAL) allows prototype pollution → RCE
|
|
- @trpc/server CVE-2025-68130 (HIGH) allows prototype pollution via `experimental_nextAppDirCaller`
|
|
- The browser extension uses superjson for tRPC serialization — if an attacker can inject malicious serialized data into the tRPC pipeline, prototype pollution could lead to remote code execution
|
|
- **Impact**: If the tRPC endpoints accept untrusted serialized data, this could be a critical attack path
|
|
|
|
3. **Drizzle ORM — SQL Injection**
|
|
- CVE-2026-39356 (CVSS 7.5) allows SQL injection via improperly escaped identifiers
|
|
- Drizzle is the project's primary ORM — if any tRPC procedure passes user input into column/table names (not just values), injection is possible
|
|
- **Impact**: Full database compromise — read, modify, or delete all user data
|
|
|
|
4. **SolidJS — XSS in JSX**
|
|
- CVE-2025-27109 (HIGH) — HTML not escaped in JSX fragments
|
|
- As the core rendering framework, any user-controlled data rendered in JSX fragments could be XSS vector
|
|
- **Impact**: Cross-site scripting in the web application
|
|
|
|
### Security-Related Configuration
|
|
|
|
From `.env.example` and `docker-compose.prod.yml`:
|
|
|
|
| Secret/Config | Risk |
|
|
|---------------|------|
|
|
| `JWT_SECRET` | Critical — if leaked, all auth tokens can be forged |
|
|
| `CLERK_SECRET_KEY` | High — Clerk admin key exposure |
|
|
| `STRIPE_SECRET_KEY` | High — payment API access |
|
|
| `STRIPE_WEBHOOK_SECRET` | High — webhook signature verification bypass |
|
|
| `DATABASE_AUTH_TOKEN` | High — Turso database access |
|
|
| `RESEND_API_KEY` | Medium — email sending abuse |
|
|
| `FCM_PRIVATE_KEY` | Medium — push notification abuse |
|
|
| `TWILIO_AUTH_TOKEN` | Medium — SMS API abuse |
|
|
| `HIBP_API_KEY` / `SECURITYTRAILS` / `CENSYS` / `SHODAN` | Medium — OSINT API abuse |
|
|
|
|
---
|
|
|
|
## Architecture Hints
|
|
|
|
### System Architecture (from README + codebase)
|
|
|
|
```
|
|
┌──────────────────────────────────────────────────────────────┐
|
|
│ Clients │
|
|
│ Web (SolidStart) │ iOS (SwiftUI) │ Android (Compose) │ Ext │
|
|
└────────────────────┬─────────────────────────────────────────┘
|
|
│ tRPC (HTTP/WS)
|
|
▼
|
|
┌──────────────────────────────────────────────────────────────┐
|
|
│ web/ (SolidStart) │
|
|
│ │
|
|
│ Frontend: SolidStart + Tailwind v4 │
|
|
│ Backend: tRPC routers (auth, user, billing, darkwatch, │
|
|
│ voiceprint, spamshield, hometitle, removebrokers, │
|
|
│ alerts, reports, notifications, correlation) │
|
|
│ Background: BullMQ + Redis (ioredis) for job queues │
|
|
│ WebSocket: ws@8.21.0 on port 3001 │
|
|
│ Report generation: Puppeteer (headless browser) │
|
|
│ Monitoring: Sentry (@sentry/solidstart) │
|
|
└────────────────────────┬──────────────────────────────────────┘
|
|
│
|
|
┌────────▼────────┐
|
|
│ Turso (SQLite)│
|
|
│ + Redis 7 │
|
|
└─────────────────┘
|
|
```
|
|
|
|
### Service Domains (5 core services)
|
|
|
|
| Domain | tRPC Router | Key Dependencies | Trust Boundary |
|
|
|--------|-------------|-----------------|----------------|
|
|
| **VoicePrint** | voiceprint | WebRTC, audio upload, ML inference | Internal — requires auth |
|
|
| **DarkWatch** | darkwatch | SecurityTrails, HIBP, Censys, Shodan | External API integrations |
|
|
| **SpamShield** | spamshield | Twilio, phone number analysis | External — SMS/call API |
|
|
| **HomeTitle** | hometitle | County deed record APIs | External — public data |
|
|
| **RemoveBrokers** | removebrokers | Data broker opt-out automation | External — broker APIs |
|
|
|
|
### Trust Boundaries
|
|
|
|
| Boundary | Description | Risk |
|
|
|----------|-------------|------|
|
|
| **Internet → Web** | tRPC endpoints over HTTP | tRPC auth middleware protects most procedures |
|
|
| **Web → Redis** | BullMQ job queue | Internal, but BullMQ has its own attack surface |
|
|
| **Web → Turso** | Database via Drizzle ORM | SQL injection risk (CVE-2026-39356) |
|
|
| **Web → External APIs** | SecurityTrails, HIBP, Twilio, Stripe | API key exposure, webhook spoofing |
|
|
| **Web → WebSocket** | Real-time alerts on port 3001 | DoS (ws CVE-2024-37890), memory disclosure (ws CVE-2026-45736) |
|
|
| **Web → Puppeteer** | Report generation | SSRF, path traversal via file input |
|
|
| **Browser Extension → tRPC** | tRPC + superjson serialization | Prototype pollution chain (superjson + tRPC) |
|
|
|
|
### Highest-Risk Flows (for Phase 3 DFD prioritization)
|
|
|
|
1. **tRPC → Drizzle ORM**: User input flows through tRPC procedures into SQL queries. If identifiers are interpolated from user input, SQL injection is possible (CVE-2026-39356).
|
|
|
|
2. **tRPC → superjson → browser extension**: Serialized data from tRPC responses flows through superjson deserialization. Prototype pollution (CVE-2022-23631) could affect the extension.
|
|
|
|
3. **WebSocket → ws**: Real-time alerts use the `ws` library. Memory disclosure (CVE-2026-45736) and DoS (CVE-2024-37890) affect this transport.
|
|
|
|
4. **Puppeteer → file system**: Report generation via Puppeteer could be exploited for path traversal if file paths are user-controlled.
|
|
|
|
5. **Vite dev server → file system**: If exposed (even on `localhost`), the dev server's `server.fs.deny` has been bypassed 14+ times. Any file in the project tree is readable.
|
|
|
|
---
|
|
|
|
## Coverage Gaps
|
|
|
|
### Sources Skipped
|
|
|
|
| Source | Status | Reason |
|
|
|--------|--------|--------|
|
|
| **Source 1: Project-hosted (git log CVE grep)** | ✅ Partial | Local git available. No CVE/GHSA IDs in commit messages or project files. Security fixes referenced by internal ticket IDs (FRE-XXXX) only. |
|
|
| **Source 2: GitHub Security Advisories (`gh api`)** | ❌ Skipped | Repository is self-hosted on `git.freno.me`, not on GitHub. No GitHub API access. |
|
|
| **Source 3: OSV API** | ✅ Complete | Queried all 26 primary npm packages. 10 packages with advisories found. |
|
|
| **Source 4: NVD REST API** | ✅ Partial | CVSS scores obtained for most advisories. Recent 2025-2026 CVEs have NVD scores assigned. |
|
|
| **Source 5: WebSearch** | ❌ Skipped | OSV + NVD provided full coverage. No additional advisories expected. |
|
|
|
|
### Notable Gaps
|
|
|
|
1. **No GitHub GHSA coverage**: Since the repo is not on GitHub, GitHub Security Advisories are not searchable. Any advisories published directly through GitHub's security advisory database (not via OSV) would be missed.
|
|
|
|
2. **Internal security remediation tracking**: Git log shows 8+ commits referencing internal security reviews (FRE-4572, FRE-4807, FRE-5003, FRE-4498, FRE-4500, etc.) with fixes for "auth bypass", "P1 security findings", "JWT security issues", and "VoicePrint auth bypass". These represent **real security vulnerabilities** in the project's own codebase, but their details are not publicly documented in CVE/GHSA format.
|
|
|
|
3. **Android/iOS app vulnerabilities**: Native mobile apps (iOS/SwiftUI, Android/Kotlin) are not covered by npm/OSV/NVD. Potential native-level vulnerabilities (certificate pinning, root detection, encrypted storage) are not assessed in this advisory pass.
|
|
|
|
4. **Infrastructure-as-code**: Dockerfile and docker-compose.prod.yml are not analyzed for container security vulnerabilities (base image CVEs, non-root user verification, etc.).
|
|
|
|
5. **Stripe integration**: No Stripe-specific CVEs found, but the integration uses `stripe-js` v9.6.0 and `stripe` v22.1.1. Stripe library security should be cross-referenced with Stripe's own advisory process.
|
|
|
|
---
|
|
|
|
## Audit Targeting Recommendations
|
|
|
|
Based on the advisory pattern analysis:
|
|
|
|
### Phase 3 DFD Prioritization
|
|
- **Drizzle ORM + tRPC procedures** — SQL injection vector (CVE-2026-39356). Map all 12+ tRPC routers for identifier injection.
|
|
- **WebSocket transport (ws)** — Memory disclosure + DoS (CVE-2026-45736, CVE-2024-37890). Map the real-time alert flow.
|
|
- **Vite dev server** — Path traversal lineage. Assess if dev server is exposed in any deployment.
|
|
|
|
### Phase 5 Deep Probe Entry Points
|
|
- **tRPC input validation** — User data flows through valibot (ReDoS risk) into tRPC into Drizzle (SQLi risk).
|
|
- **superjson deserialization** — Prototype pollution chain in browser extension.
|
|
- **Puppeteer report generation** — File path handling, SSRF potential.
|
|
- **WebSocket message handling** — Message size limits, frame parsing.
|
|
|
|
### Phase 10 Attack Mode Chambers
|
|
- **SQL Injection** (CWE-89) — Mandatory for all tRPC procedures touching Drizzle
|
|
- **Path Traversal** (CWE-22) — Mandatory for any file-path handling (Vite, Puppeteer)
|
|
- **Prototype Pollution** (CWE-1321) — Mandatory for superjson/tRPC serialization
|
|
- **ReDoS** (CWE-1333) — Mandatory for valibot input validation
|
|
- **XSS** (CWE-79) — Mandatory for SolidJS JSX rendering of user data
|
|
- **Resource Exhaustion** (CWE-770) — Mandatory for jose (JWE) and ws (HTTP headers)
|
|
|
|
### Patch-Bypass-Checker Structural Recurrence
|
|
- **Vite `server.fs.deny`** — 14+ distinct bypass techniques across versions. This is a structural-recurrence component. The entire path resolution model should be re-evaluated rather than applying piecemeal patches.
|