Skip to content
OpenAdvisories

Package · Wolfi

langfuse-3-worker

249 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

246 results · Feed

  • High 7.6
    CVE-2025-66414

    DNS Rebinding Protection Disabled by Default in Model Context Protocol TypeScript SDK for Servers Running on Localhost

    MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Prior to 1.24.0, The Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based M…

    Model Context Protocol typescript-sdk langfuse-3-worker langfuse-3 Wolfi npm
  • Medium 6.9
    CVE-2025-66400

    mdast-util-to-hast unsanitized class attribute

    mdast-util-to-hast is an mdast utility to transform to hast. From 13.0.0 to before 13.2.1, multiple (unprefixed) classnames could be added in markdown source by using character references. This could make rendered user supplied markdown code elements appear l…

    syntax-tree mdast-util-to-hast langfuse-3-worker langfuse-3 Wolfi npm
  • Medium 6.0
    CVE-2025-62522 Scanner template

    vite allows server.fs.deny bypass via backslash on Windows

    Vite is a frontend tooling framework for JavaScript. In versions from 2.9.18 to before 3.0.0, 3.2.9 to before 4.0.0, 4.5.3 to before 5.0.0, 5.2.6 to before 5.4.21, 6.0.0 to before 6.4.1, 7.0.0 to before 7.0.8, and 7.1.0 to before 7.1.11, files denied by serve…

    vitejs vite langfuse-3-worker renovate Wolfi npm
  • Low 2.3
    CVE-2025-58752

    Vite's `server.fs` settings were not applied to HTML files

    Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, any HTML files on the machine were served regardless of the `server.fs` settings. Only apps that explicitly expose the Vite dev server to the network (usin…

    vitejs vite langfuse-3-worker vitess-23 Wolfi npm
  • Low 2.3
    CVE-2025-58751 Scanner template

    Vite middleware may serve files starting with the same name with the public directory

    Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, files starting with the same name with the public directory were served bypassing the `server.fs` settings. Only apps that explicitly expose the Vite dev s…

    vitejs vite langfuse-3-worker vitess-23 Wolfi npm
  • Low 3.1
    CVE-2025-5889

    juliangruber brace-expansion index.js expand redos

    A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient regular expression complexity…

    juliangruber brace-expansion langfuse-3-worker renovate Debian Ubuntu Azure Linux Alpine Wolfi npm