Skip to content

v5.0.2

Latest
Latest

Choose a tag to compare

View all tags
@kibertoad kibertoad released this 28 Oct 01:09
· 1 commit to main since this release
v5.0.2
ae09ee8
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Patch Changes

  • 0becf97: Fix an infinite loop in removeDotSegments on paths containing U+2028, U+2029 or \r (CVE-2026-93690). It was reachable directly and through normalize() and resolve() with { iri: true }. Also stop parse() dropping everything after a raw U+2028 or U+2029 in a fragment or a URN NSS.
Assets 2
Loading