Aszx87410

**Name of the Vulnerable Software and Affected Versions** pnpm versions prior to 10.34.0 pnpm versions prior to 11.4.0 **Description** pnpm allows a transitive dependency alias within registry package metadata to include path traversal segments. During the installation process, pnpm utilizes this alias as a filesystem path when linking dependency nodes. This allows a registry package to cause `pnpm install --ignore-scripts` to replace project paths with symlinks pointing to dependency package directories controlled by an attacker. **Recommendations** Update pnpm to version 10.34.0 or later. Update pnpm to version 11.4.0 or later.

**Name of the Vulnerable Software and Affected Versions** pnpm versions prior to 10.34.0 pnpm versions prior to 11.4.0 **Description** In non-frozen mode, `pnpm install` may accept new remote package content even after detecting that the downloaded tarball does not match the integrity recorded in `pnpm-lock.yaml`. If a registry serves different metadata and tarball content for a package name and version already locked with an integrity value, pnpm reports an integrity mismatch but then performs a resolution repair. This process accepts the new integrity from the registry, updates the lockfile, installs the new content, and exits successfully, meaning the lockfile integrity check does not act as a hard stop by default. This behavior can be exploited if a registry is compromised or if a registry mirror/proxy serves mutated package content. In such cases, a new environment (such as a new machine or a new team member onboarding) may install a malicious replacement package despite the presence of a lockfile with the original integrity. **Recommendations** Update pnpm to version 10.34.0 or later. Update pnpm to version 11.4.0 or later. As a temporary mitigation, use the `--frozen-lockfile` flag during installation to ensure the process fails if an integrity mismatch is detected.

**Name of the Vulnerable Software and Affected Versions** multiparty versions prior to 4.3.0 **Description** A denial of service issue exists due to regular expression backtracking in the Content-Disposition filename parameter parser. A crafted multipart upload containing a long header value can cause regex matching to take several seconds, which blocks the event loop. This affects any service that accepts multipart uploads using this library. **Recommendations** Upgrade to version 4.3.0 or higher. Limit upload sizes at the proxy or gateway layer to reduce the attack surface.