Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
browserify/resolve
main @ 261538f
2
Fixes
0
CVEs
MEDIUM
Peak severity
100.0%
Coverage
Highlights
Prototype Pollution: 2 prior fixes. Scrutinize any change in this area.
lib/async.js: most-fixed (2 issues). Treat as high-risk during review.
0 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Prototype Pollution: Direct access to core[x] on an object with a prototype chain allows inherited properties to be treated as valid core modules, enabling prototype pollution to alter resolution behavior.
Prototype Pollution: The synchronous resolution path mirrors the async path's unsafe property access, making it equally vulnerable to inherited-property false positives.
Prototype Pollution: The core-module check relies on the same core[x] access pattern, meaning a polluted Object.prototype could cause non-core modules to be misidentified as core.