CWE-248 Uncaught Exception

CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin

Qwik: Crashing any Qwik Server via Resource thenable

kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path

kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing items

MariaDB Connector/Node.js: Uncaught exception crashes the client during ed25519 authentication with zero-configuration TLS

music-metadata: uncatchable process crash parsing a crafted `.dsf` (residual of GHSA-v6c2-xwv6-8xf7)

Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks

RabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumers

vLLM: Structured-output request errors escape the request boundary and terminate the shared EngineCore — engine-fatal denial of service (3 sites)

vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of service

vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host process

Duplicate Advisory: vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host process

vm2: Host-returned Promise rejection can bypass vm2's unhandled-rejection hardening and terminate the host process

Duplicate Advisory: vm2: Host-returned Promise rejection can bypass vm2's unhandled-rejection hardening and terminate the host process

devalue: stringifyAsync can cause an unhandled rejection despite a caught returned promise

fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses

Astro: Malformed port in the Host header can crash the Node adapter

PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)

Nest: Remote process termination via a deeply nested microservice message pattern

Socket.IO: Engine.IO Protocol Revision Mismatch DoS

adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process (DoS)

undici vulnerable to Denial of Service via unrequested WebSocket subprotocol

undici vulnerable to response truncation via oversized chunked responses in the dump interceptor

undici vulnerable to Denial of Service via WebSocketStream unclean close

undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression