fix(deps): vuln minor upgrades — 15 packages (minor: 4 · patch: 11)

[gh-worker-campaigns-3e9aa4]

Summary: Critical-severity security update — 15 packages upgraded (MINOR changes included)

Manifests changed:

• . (yarn)

---

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

---

Updates

Package	From	To	Type	Dep Type	Vulnerabilities Fixed
pbkdf2	3.1.1	3.1.6	patch	Transitive	4 CRITICAL
handlebars	4.7.7	4.7.9	patch	Transitive	2 CRITICAL, 8 HIGH, 3 MEDIUM, 1 LOW
loader-utils	2.0.0	2.0.4	patch	Transitive	2 CRITICAL, 4 HIGH
form-data	4.0.0	4.0.6	patch	Transitive	2 CRITICAL, 1 HIGH
cipher-base	1.0.4	1.0.7	patch	Transitive	2 CRITICAL
sha.js	2.4.11	2.4.12	patch	Transitive	2 CRITICAL
elliptic	6.6.0	6.6.1	patch	Transitive	1 CRITICAL, 1 LOW
shell-quote	1.8.1	1.8.4	patch	Transitive	1 CRITICAL
node-forge	1.3.0	1.4.0	minor	Transitive	12 HIGH, 2 MEDIUM
minimatch	9.0.3	9.0.9	patch	Transitive	6 HIGH
flatted	3.2.4	3.4.2	minor	Transitive	4 HIGH
validator	13.7.0	13.15.35	minor	Transitive	2 HIGH, 2 MEDIUM
yaml	2.2.1	2.9.0	minor	Transitive	2 HIGH, 2 MEDIUM
picomatch	2.3.0	2.3.2	patch	Transitive	2 HIGH, 2 MEDIUM
dompurify	2.5.6	2.5.9	patch	Transitive	17 MEDIUM, 2 LOW

---

Security Details

🚨 Critical & High Severity (57 fixed)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
cipher-base	CVE-2025-9287	CRITICAL	-	1.0.4	-	-
cipher-base	GHSA-cpq7-6gpm-g9rc	CRITICAL	cipher-base is missing type checks, leading to hash rewind and passing on crafted data	1.0.4	1.0.5	-
elliptic	GHSA-vjh7-7g9h-fjfh	CRITICAL	Elliptic's private key extraction in ECDSA upon signing a malformed input (e.g. a string)	6.6.0	6.6.1	-
form-data	CVE-2025-7783	CRITICAL	-	4.0.0	-	-
form-data	GHSA-fjxv-7rqg-78g4	CRITICAL	form-data uses unsafe random function in form-data for choosing boundary	4.0.0	2.5.4	-
handlebars	CVE-2026-33937	CRITICAL	Handlebars.js has JavaScript Injection via AST Type Confusion	4.7.7	-	-
handlebars	GHSA-2w6w-674q-4c4q	CRITICAL	Handlebars.js has JavaScript Injection via AST Type Confusion	4.7.7	4.7.9	-
loader-utils	GHSA-76p3-8jx3-jpfq	CRITICAL	Prototype pollution in webpack loader-utils	2.0.0	2.0.3	-
loader-utils	CVE-2022-37601	CRITICAL	-	2.0.0	-	-
pbkdf2	GHSA-h7cp-r72f-jxh6	CRITICAL	pbkdf2 returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos	3.1.1	3.1.3	-
pbkdf2	CVE-2025-6545	CRITICAL	-	3.1.1	-	-
pbkdf2	GHSA-v62p-rq8g-8h59	CRITICAL	pbkdf2 silently disregards Uint8Array input, returning static keys	3.1.1	3.1.3	-
pbkdf2	CVE-2025-6547	CRITICAL	-	3.1.1	-	-
sha.js	CVE-2025-9288	CRITICAL	-	2.4.11	-	-
sha.js	GHSA-95m3-7q98-8xr5	CRITICAL	sha.js is missing type checks leading to hash rewind and passing on crafted data	2.4.11	2.4.12	-
shell-quote	GHSA-w7jw-789q-3m8p	CRITICAL	shell-quote quote() does not escape newlines in object .op values	1.8.1	1.8.4	-
flatted	CVE-2026-33228	HIGH	flatted: Prototype Pollution via parse()	3.2.4	-	-
flatted	GHSA-25h7-pfq9-p65f	HIGH	flatted vulnerable to unbounded recursion DoS in parse() revive phase	3.2.4	3.4.0	-
flatted	CVE-2026-32141	HIGH	flatted: Unbounded recursion DoS in parse() revive phase	3.2.4	-	-
flatted	GHSA-rf6f-7fwh-wjgh	HIGH	Prototype Pollution via parse() in NodeJS flatted	3.2.4	3.4.2	-
form-data	GHSA-hmw2-7cc7-3qxx	HIGH	form-data: CRLF injection in form-data via unescaped multipart field names and filenames	4.0.0	2.5.6	-
handlebars	CVE-2026-33939	HIGH	Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation	4.7.7	-	-
handlebars	GHSA-xjpj-3mr7-gcpf	HIGH	Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options	4.7.7	4.7.9	-
handlebars	CVE-2026-33940	HIGH	Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial	4.7.7	-	-
handlebars	GHSA-xhpv-hc6g-r9c6	HIGH	Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial	4.7.7	4.7.9	-
handlebars	CVE-2026-33941	HIGH	Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options	4.7.7	-	-
handlebars	GHSA-9cx6-37pm-9jff	HIGH	Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation	4.7.7	4.7.9	-
handlebars	CVE-2026-33938	HIGH	Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block	4.7.7	-	-
handlebars	GHSA-3mfm-83xf-c92r	HIGH	Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block	4.7.7	4.7.9	-
loader-utils	CVE-2022-37603	HIGH	-	2.0.0	-	-
loader-utils	CVE-2022-37599	HIGH	-	2.0.0	-	-
loader-utils	GHSA-3rfm-jhwj-7488	HIGH	loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS) via url variable	2.0.0	1.4.2	-
loader-utils	GHSA-hhq3-ff78-jv3g	HIGH	loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS)	2.0.0	1.4.2	-
minimatch	GHSA-7r86-cg39-jmmj	HIGH	minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments	9.0.3	10.2.3	-
minimatch	CVE-2026-26996	HIGH	minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern	9.0.3	-	-
minimatch	CVE-2026-27903	HIGH	minimatch has a ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments	9.0.3	-	-
minimatch	GHSA-3ppc-4f35-3m26	HIGH	minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern	9.0.3	10.2.1	-
minimatch	CVE-2026-27904	HIGH	minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions	9.0.3	-	-
minimatch	GHSA-23c5-xmqv-rm74	HIGH	minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions	9.0.3	10.2.3	-
node-forge	CVE-2026-33894	HIGH	Forge has signature forgery in RSA-PKCS due to ASN.1 extra field	1.3.0	-	-
node-forge	GHSA-5m6q-g25r-mvwx	HIGH	Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input	1.3.0	1.4.0	-
node-forge	GHSA-5gfm-wpxj-wjgq	HIGH	node-forge has an Interpretation Conflict vulnerability via its ASN.1 Validator Desynchronization	1.3.0	1.3.2	-
node-forge	CVE-2025-12816	HIGH	-	1.3.0	-	-
node-forge	GHSA-554w-wpv2-vw27	HIGH	node-forge has ASN.1 Unbounded Recursion	1.3.0	1.3.2	-
node-forge	CVE-2025-66031	HIGH	node-forge ASN.1 Unbounded Recursion	1.3.0	-	-
node-forge	CVE-2026-33895	HIGH	Forge has signature forgery in Ed25519 due to missing S > L check	1.3.0	-	-
node-forge	GHSA-q67f-28xg-22rw	HIGH	Forge has signature forgery in Ed25519 due to missing S > L check	1.3.0	1.4.0	-
node-forge	CVE-2026-33896	HIGH	Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)	1.3.0	-	-
node-forge	GHSA-2328-f5f3-gj25	HIGH	Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)	1.3.0	1.4.0	-
node-forge	CVE-2026-33891	HIGH	Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input	1.3.0	-	-
node-forge	GHSA-ppp5-5v6c-4jwp	HIGH	Forge has signature forgery in RSA-PKCS due to ASN.1 extra field	1.3.0	1.4.0	-
picomatch	GHSA-c2c7-rcm5-vvqj	HIGH	Picomatch has a ReDoS vulnerability via extglob quantifiers	2.3.0	4.0.4	-
picomatch	CVE-2026-33671	HIGH	Picomatch has a ReDoS vulnerability via extglob quantifiers	2.3.0	-	-
validator	GHSA-vghf-hv5q-vc2g	HIGH	Validator is Vulnerable to Incomplete Filtering of One or More Instances of Special Elements	13.7.0	13.15.22	-
validator	CVE-2025-12758	HIGH	-	13.7.0	-	-
yaml	CVE-2023-2251	HIGH	Uncaught Exception in eemeli/yaml	2.2.1	-	-
yaml	GHSA-f9xv-q969-pqx4	HIGH	Uncaught Exception in yaml	2.2.1	2.2.2	-

ℹ️ Other Vulnerabilities (32)

---

Review Checklist

Standard review:

• Review changes for compatibility with your code
• Check for breaking changes in release notes
• Run tests locally or wait for CI
• Approve and merge this PR

---

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
dompurify	GHSA-hpcv-96wg-7vj8	MODERATE	DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound instanceof checks	2.5.6	3.4.6	-
dompurify	GHSA-v2wj-7wpq-c8vv	MODERATE	DOMPurify contains a Cross-site Scripting vulnerability	2.5.6	3.3.2	-
dompurify	GHSA-39q2-94rc-95cp	MODERATE	DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation	2.5.6	3.4.0	-
dompurify	CVE-2026-0540	MODERATE	-	2.5.6	-	-
dompurify	GHSA-h7mw-gpvr-xq4m	MODERATE	DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)	2.5.6	3.4.0	-
dompurify	GHSA-rp9w-3fw7-7cwq	MODERATE	DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside .content	2.5.6	3.4.7	-	dompurify	GHSA-76mc-f452-cxcm	MODERATE	DOMPurify: Hook mutation of data.allowedTags / data.allowedAttributes permanently pollutes DEFAULT_ALLOWED_TAGS / DEFAULT_ALLOWED_ATTR	2.5.6	3.4.7	-	dompurify	CVE-2025-26791	MODERATE	-	2.5.6	-	-	dompurify	GHSA-r47g-fvhr-h676	MODERATE	DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM	2.5.6	3.4.6	-	dompurify	GHSA-vhxf-7vqr-mrjg	MODERATE	DOMPurify allows Cross-site Scripting (XSS)	2.5.6	3.2.4	-	dompurify	CVE-2025-15599	MODERATE	-	2.5.6	-	-	dompurify	GHSA-v8jm-5vwx-cfxm	MODERATE	DOMPurify contains a Cross-site Scripting vulnerability	2.5.6	3.2.7	-	dompurify	GHSA-cjmm-f4jc-qw8r	MODERATE	DOMPurify ADD_ATTR predicate skips URI validation	2.5.6	3.3.2	-	dompurify	GHSA-h8r8-wccr-v5f2	MODERATE	DOMPurify is vulnerable to mutation-XSS via Re-Contextualization	2.5.6	3.3.2	-	dompurify	GHSA-cmwh-pvxp-8882	MODERATE	DOMPurify: Permanent ALLOWED_ATTR pollution via setConfig() bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)	2.5.6	3.4.11	-	dompurify	GHSA-crv5-9vww-q3g8	MODERATE	DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode	2.5.6	3.4.0	-	dompurify	GHSA-cj63-jhhr-wcxv	MODERATE	DOMPurify USE_PROFILES prototype pollution allows event handlers	2.5.6	3.3.2	-	handlebars	CVE-2026-33916	MODERATE	Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection	4.7.7	-	-	handlebars	GHSA-2qvq-rjwj-gvw9	MODERATE	Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection	4.7.7	4.7.9	-	handlebars	GHSA-7rx3-28cr-v5wh	MODERATE	Handlebars.js has a Prototype Method Access Control Gap via Missing lookupSetter Blocklist Entry	4.7.7	4.7.9	-	node-forge	GHSA-65ch-62r8-g69g	MODERATE	node-forge is vulnerable to ASN.1 OID Integer Truncation	1.3.0	1.3.2	-	node-forge	CVE-2025-66030	MODERATE	node-forge ASN.1 OID Integer Truncation	1.3.0	-	-	picomatch	CVE-2026-33672	MODERATE	Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching	2.3.0	-	-	picomatch	GHSA-3v7f-55p6-f55p	MODERATE	Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching	2.3.0	4.0.4	-	validator	CVE-2025-56200	MODERATE	-	13.7.0	-	-	validator	GHSA-9965-vmph-33xx	MODERATE	validator.js has a URL validation bypass vulnerability in its isURL function	13.7.0	13.15.20	-	yaml	CVE-2026-33532	MODERATE	yaml is vulnerable to Stack Overflow via deeply nested YAML collections	2.2.1	-	-	yaml	GHSA-48c2-rrv3-qjmp	MODERATE	yaml is vulnerable to Stack Overflow via deeply nested YAML collections	2.2.1	2.8.3	-	dompurify	GHSA-vxr8-fq34-vvx9	LOW	DOMPurify: Trusted Types policy survives clearConfig() and can poison later RETURN_TRUSTED_TYPE output	2.5.6	3.4.9	-	dompurify	GHSA-x4vx-rjvf-j5p4	LOW	DOMPurify: IN_PLACE mode trusts attacker-controlled nodeName on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objects	2.5.6	-	-	elliptic	GHSA-848j-6mx2-7j84	LOW	Elliptic Uses a Cryptographic Primitive with a Risky Implementation	6.6.0	-	-	handlebars	GHSA-442j-39wm-28r2	LOW	Handlebars.js has a Property Access Validation Bypass in container.lookup	4.7.7	4.7.9	-