Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
A satori escaping bug made the Node.js ImageResponse in next/og an RCE path. Only routes that put attacker-controlled values into SVG are reachable. Fixed in 16.3.6.
Next.js fixed image optimization SSRF, two SSG/ISR cache poisoning bugs, a Draft Mode leak and more on 30 Sept. Each one needs a specific config to be reachable.
Four Jackson CVEs landed on 22 Sept with fixes in 2.18.11, 2.21.7 and 2.22.3. Three need niche features. One reaches any app that coerces strings to numbers.
undici fixed nine issues on 14 and 15 Oct, two of them reachable through plain fetch(). Node.js has security releases due 21 Oct. Here is what to patch and where.
Axios published 12 advisories on 16 Sept, all fixed in 1.20.0. Six need prior prototype pollution, two need HTTP/2. Here is how to tell which apply to you.
Two Critical Handlebars.js advisories need untrusted input passed to compile() or allowProtoMethodsByDefault. Apps that only compile their own template files aren't reachable.
Django's 6 Oct security release fixes four CVEs. A header parsing DoS reaches almost every site; formset, GeoDjango and i18n issues need specific features.
OpenSSH 10.6 shipped on 6 Oct with fixes for sftp path handling, compression side channels, GSSAPI state and more. Most depend on options you can check in a minute.
urllib3 2.8.0 fixed three advisories on 15 Sept. The proxy TLS bug needs specific HTTPS proxy options. The streaming bugs sit closer to everyday requests code.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
