waydeshi

jackson-databind: unbounded numeric parse in Duration and XMLGregorianCalendar deserialization allows CPU denial of service

jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path

qs.stringify throws TypeError on objects with a non-callable constructor.isBuffer property