Issues

• [MEDIUM] stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS)

  dependabot-security-findingneeds-triagepriority/p0
  cdk8s-team/cdk8s-core#4081 · Filter by author cdk8s-automation opened on Sep 6, 2026

• [MEDIUM] JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases

  dependabot-security-findingneeds-triagepriority/p0
  cdk8s-team/cdk8s-core#3947 · Filter by author cdk8s-automation opened on Jun 19, 2026

• [MEDIUM] uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided

  dependabot-security-findingneeds-triagepriority/p0
  cdk8s-team/cdk8s-core#3849 · Filter by author cdk8s-automation opened on Apr 26, 2026

• [MEDIUM] Lodash has Prototype Pollution Vulnerability in _.unset and _.omit functions

  dependabot-security-findingneeds-triagepriority/p0
  cdk8s-team/cdk8s-core#3820 · Filter by author cdk8s-automation opened on Apr 2, 2026

• [MEDIUM] js-yaml has prototype pollution in merge (<<)

  dependabot-security-findingneeds-triagepriority/p0
  cdk8s-team/cdk8s-core#3602 · Filter by author cdk8s-automation opened on Nov 17, 2025