Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

brianc/node-postgres

              master @ c9e5761
            

Fixes

CVEs

CRITICAL

Peak severity

100.0%

Coverage

Highlights

Code Injection: 1 prior fix. Scrutinize any change in this area.

lib/result.js: most-fixed (1 issue). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Code Injection: Field names are interpolated into a dynamically generated Function body; without escaping, a malicious column name can inject arbitrary JavaScript code executed at parse time.

Prototype Pollution: Row objects use a normal prototype; a column name like '__proto__' can pollute Object.prototype, leading to property injection across the application.