Issues

• [MEDIUM] sprintf-js vulnerable to denial of service through unbounded precision specifiers

  dependabot-security-findingneeds-triagepriority/p0
  cdk8s-team/cdk8s-plus#8290 · Filter by author cdk8s-automation opened on Oct 9, 2026

• [MEDIUM] stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS)

  dependabot-security-findingneeds-triagepriority/p0
  cdk8s-team/cdk8s-plus#8118 · Filter by author cdk8s-automation opened on Sep 6, 2026

• [HIGH] brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash

  dependabot-security-findingneeds-triagepriority/p0
  cdk8s-team/cdk8s-plus#7871 · Filter by author cdk8s-automation opened on Jul 28, 2026

• [MEDIUM] JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases

  dependabot-security-findingneeds-triagepriority/p0
  cdk8s-team/cdk8s-plus#7641 · Filter by author cdk8s-automation opened on Jun 19, 2026

• [MEDIUM] uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided

  dependabot-security-findingneeds-triagepriority/p0
  cdk8s-team/cdk8s-plus#7334 · Filter by author cdk8s-automation opened on Apr 26, 2026

• [MEDIUM] Lodash has Prototype Pollution Vulnerability in _.unset and _.omit functions

  dependabot-security-findingneeds-triagepriority/p0
  cdk8s-team/cdk8s-plus#7206 · Filter by author cdk8s-automation opened on Apr 2, 2026

• [LOW] @tootallnate/once vulnerable to Incorrect Control Flow Scoping

  dependabot-security-findingneeds-triagepriority/p0
  cdk8s-team/cdk8s-plus#7066 · Filter by author cdk8s-automation opened on Mar 7, 2026

• Fixed resource request and limit units

  cdk8s-team/cdk8s-plus#6836 · Filter by author unattended-user opened on Jan 21, 2026
  1

• [MEDIUM] js-yaml has prototype pollution in merge (<<)

  dependabot-security-findingneeds-triagepriority/p0
  cdk8s-team/cdk8s-plus#6519 · Filter by author cdk8s-automation opened on Nov 17, 2025