The policy
- Cards target the newest release of each framework and a supported runtime on the day they are verified, and pin every dependency to an exact version with a lockfile or a fully pinned requirements file.
- A release younger than seven days is taken only when it is a security release; each card records the publish dates of what it pins and the result of a dependency audit.
- A card is verified by running its tests against the vulnerable code, the fix and the wrong fix. The date and toolchain of that run are on the card, and the fixed code is never shown without them.
- The fixes themselves do not depend on the newest release: the same code is correct on every supported line listed below, unless the card says otherwise in its pitfalls. Versions below the minimum secure version of a line are missing published security fixes.
- The Node.js cards declare
^22.23.2 || ^24.18.1 || >=26.5.1inengines: the supported long-term support lines at their latest security releases.
Versions by stack
| Stack | Cards run on | Supported framework lines | Supported runtimes |
|---|---|---|---|
| Node.js and Express27 cards | Express 5.3.0; Node.js 26.11.1 |
|
|
| Python and Flask29 cards | Flask 3.1.3; CPython 3.14.8 |
|
|
| Java and Spring Boot27 cards | Spring Boot 4.1.1; OpenJDK 21.0.12.1 |
|
|
| C# and ASP.NET Core26 cards | ASP.NET Core 10; .NET 10.0.12; .NET 10 |
|
|
| TypeScript and Next.js12 cards | Next.js 16.4.0; Node.js 26.11.1 |
|
|
| Python and FastAPI13 cards | FastAPI 0.142.2; CPython 3.14.8 |
|
|
| Python and Django13 cards | Django 6.1.2; CPython 3.14.8 |
|
|
| Go and net/http15 cards | Go standard library 1.27.2; Go 1.27.2 |
|
|
| Ruby on Rails13 cards | Ruby on Rails 8.1.4; Ruby 4.0.7 |
|
|
| PHP and Laravel13 cards | Laravel 13.34.0; PHP 8.5.11 |
|
|
Minimum secure versions
| Stack | Package and version | Why |
|---|---|---|
| Node.js and Express | express 5.3.0 | Requires proxy-addr 2.0.8 (CVE-2026-90711, IP spoofing), qs 6.16.0 (CVE-2026-82417, CVE-2026-82562 and CVE-2026-2391, denial of service) and body-parser 2.3.0 (CVE-2026-12590); npm ls qs should show only 6.16.0. Advisory |
| Node.js and Express | express 4.22.3 | Requires qs 6.16.0 and path-to-regexp 0.1.13 (CVE-2026-4867). Refresh the lockfile until proxy-addr is 2.0.8 (CVE-2026-90711) and body-parser 1.20.8: 1.20.6 still pulls a vulnerable qs 6.15.3. Advisory |
| Node.js and Express | node 22.23.2, 24.18.1 or 26.5.1 | The 29 July 2026 security releases, the latest on 11 October 2026: an HTTP/2 use-after-free (CVE-2026-56848), a Permission Model bypass (CVE-2026-58043), HTTP/2 memory exhaustion in 22.x and 24.x (CVE-2026-56846) and eight lower-severity CVEs. Advisory |
| Python and Flask | flask 3.1.3 | CVE-2026-27205: the session did not add Vary: Cookie when accessed in some ways, so a cache could serve one user's page to another. Advisory |
| Python and Flask | werkzeug 3.1.9 | CVE-2026-102598, the latest of several safe_join() fixes for Windows device names (3.1.4 to 3.1.9). Advisory |
| Python and Flask | jinja2 3.1.6 | CVE-2025-27516: sandbox breakout through the attr filter. Advisory |
| Python and Flask | CPython 3.15.0, 3.14.8, 3.13.16, 3.12.15 or 3.11.17 | Six CVEs fixed on 30 September and 1 October 2026, such as an ssl use-after-free (CVE-2026-19445), a tarfile filter bypass (CVE-2026-19672) and unbounded zipfile decompression (CVE-2026-15310); 3.11 to 3.13 also fix two more tarfile CVEs, and the fix for one of them, CVE-2026-87910, was in no 3.14 release on 11 October 2026. Advisory |
| Java and Spring Boot | org.apache.tomcat.embed:tomcat-embed-core 11.0.26 | Fixes four Important CVEs (15 September 2026), among them CVE-2026-86350 (HTTP/2 request header mix-up, 11.0.22 to 11.0.25) and CVE-2026-76183 (WebSocket security-constraint bypass). Spring Boot 4.1.1 and 4.0.8 still manage 11.0.24, so set tomcat.version to 11.0.26, as the cards do. Advisory |
| Java and Spring Boot | org.springframework:spring-webmvc 7.0.9 | Seven Spring Framework CVEs of 20 August 2026, such as XSS through EscapedErrors (CVE-2026-59281) and SpEL denial of service (CVE-2026-47886); Spring Boot 4.1.1 and 4.0.8 manage it. Advisory |
| Java and Spring Boot | org.springframework.boot:spring-boot 4.0.7 (4.0.x) or 4.1.0 | CVE-2026-40976 (Actuator endpoints with no authorization rule) and, from 4.0.7, CVE-2026-41001 and CVE-2026-40992; 4.1.0 shipped with all of them fixed. Advisory |
| Java and Spring Boot | org.springframework.security 7.0.7 or 7.1.1 | CVE-2026-47841 (WebAuthn user-verification bypass), CVE-2026-41707 (DPoP proof replay), CVE-2026-47877 (consent-page XSS) and CVE-2026-47842, 20 August 2026; Spring Boot 4.0.8 and 4.1.1 manage it. Advisory |
| Java and Spring Boot | JDK 25.0.4.1, 21.0.12.1 or 17.0.20.1 | The 18 August 2026 OpenJDK advisory (CVE-2026-70906, CVE-2026-61308, CVE-2026-70907, CVE-2026-60589) covers 25.0.4, 21.0.12, 17.0.20 and earlier; Temurin ships jdk-25.0.4.1+1 and so on. The next quarterly update was set for 20 October 2026. Advisory |
| C# and ASP.NET Core | .NET runtime and Microsoft.AspNetCore.App 10.0.12, 9.0.20 or 8.0.31 | The 8 September 2026 servicing releases, the latest on 11 October 2026: an ASP.NET Core denial of service under IIS out-of-process hosting (CVE-2026-69304) and three .NET and Visual Studio CVEs (CVE-2026-69439, CVE-2026-69522, CVE-2026-71328). Advisory |
| C# and ASP.NET Core | .NET SDK 10.0.112 or 10.0.401, 9.0.121 or 9.0.318, or 8.0.131 or 8.0.425 | These SDKs carry the patched runtimes and the dotnet watch fixes for CVE-2026-58649 and, on Linux, CVE-2026-69806. Advisory |
| TypeScript and Next.js | next 16.3.8 | Seven advisories fixed on 30 September 2026, such as SSRF in Image Optimization (CVE-2026-94483) and cache poisoning (CVE-2026-94484, CVE-2026-94543); earlier 2026 releases fixed proxy (middleware) bypasses and remote code execution. Advisory |
| TypeScript and Next.js | next 15.5.27 | CVE-2026-94484, CVE-2026-94543 and CVE-2026-94485 for 15.x, whose support ends on 2026-10-21; after that, only 16.x gets fixes. Advisory |
| TypeScript and Next.js | node 22.23.2, 24.18.1 or 26.5.1 | The 29 July 2026 security releases, the latest on 11 October 2026: an HTTP/2 use-after-free (CVE-2026-56848), a Permission Model bypass (CVE-2026-58043), HTTP/2 memory exhaustion in 22.x and 24.x (CVE-2026-56846) and eight lower-severity CVEs. Advisory |
| Python and FastAPI | starlette 1.3.1 | CVE-2026-54283 (form size limits ignored for URL-encoded bodies), CVE-2026-48818 (SSRF and NTLM credential theft through UNC paths in StaticFiles on Windows), CVE-2026-48710 and others. Advisory |
| Python and FastAPI | python-multipart 0.0.31 | CVE-2026-53539 (quadratic-time parsing, fixed in 0.0.30), CVE-2026-53540 and earlier denial-of-service fixes; FastAPI does not require a fixed version. Advisory |
| Python and FastAPI | CPython 3.15.0, 3.14.8, 3.13.16, 3.12.15 or 3.11.17 | Six CVEs fixed on 30 September and 1 October 2026, such as an ssl use-after-free (CVE-2026-19445), a tarfile filter bypass (CVE-2026-19672) and unbounded zipfile decompression (CVE-2026-15310); 3.11 to 3.13 also fix two more tarfile CVEs, and the fix for one of them, CVE-2026-87910, was in no 3.14 release on 11 October 2026. Advisory |
| Python and Django | django 6.1.2, 6.0.9 or 5.2.18 | The 6 October 2026 security releases: CVE-2026-84429 (quadratic header parsing), CVE-2026-77050 (language-code denial of service), CVE-2026-87890 (request forgery through spatial lookup bytes) and CVE-2026-87975 (privilege abuse in model formsets with editable primary keys). Advisory |
| Python and Django | CPython 3.15.0, 3.14.8, 3.13.16 or 3.12.15 | Six CVEs fixed on 30 September and 1 October 2026, such as an ssl use-after-free (CVE-2026-19445), a tarfile filter bypass (CVE-2026-19672) and unbounded zipfile decompression (CVE-2026-15310); 3.11 to 3.13 also fix two more tarfile CVEs, and the fix for one of them, CVE-2026-87910, was in no 3.14 release on 11 October 2026. Advisory |
| Go and net/http | Go 1.27 1.27.2 | 15 advisories, among them html/template escaping (GO-2026-6599, GO-2026-6600), HTTP/1 desynchronization after CONNECT (GO-2026-6605, GO-2026-6613), unbounded Range headers (GO-2026-6609) and five HTTP/2 issues (GO-2026-6603 and others). Advisory |
| Go and net/http | Go 1.26 1.26.9 | The same 15 fixes; in 1.26 the HTTP/2 ones land in net/http's bundled copy of HTTP/2. Advisory |
| Go and net/http | golang.org/x/net 0.60.0 | The five HTTP/2 fixes above (GO-2026-6603 and others), for programs that import golang.org/x/net/http2 directly. Advisory |
| Go and net/http | github.com/golang-jwt/jwt/v5 5.2.2 | Excessive memory allocation while parsing a token's header (GO-2025-3553, CVE-2025-30204). Advisory |
| Ruby on Rails | rails 8.1.3.1 or 8.0.5.1 (7.2.3.2 on the unsupported 7.2 line) | CVE-2026-66066 (critical): with libvips image variants and untrusted uploads, Active Storage can be made to read any file, secret_key_base included. Also run libvips 8.13 or later, and rotate secrets if exposed. Advisory |
| Ruby on Rails | rails 8.1.2.1, 8.0.4.1 or 7.2.3.1 | Ten advisories of 23 March 2026, including XSS in Action View tag helpers and SafeBuffer#% (CVE-2026-33168, CVE-2026-33170) and path traversal in Active Storage's DiskService (CVE-2026-33195). Advisory |
| Ruby on Rails | ruby 4.0.7, 3.4.11, or 3.3.12 with the resolv gem 0.3.2 | resolv CVE-2026-80212 and CVE-2026-80213 (27 August 2026): 4.0.7 and 3.4.11 bundle the fixed resolv 0.7.2; 3.3.12 still bundles 0.3.1, so update that gem. Advisory |
| PHP and Laravel | laravel/framework 13.30.0 or 12.69.0 | GHSA-jh5r-qr3c-85q8 (CVE-2026-102279, 2026-09-10): XSS on the debug error page when APP_DEBUG is true. These releases also contain the earlier 2026 fixes for CVE-2026-48019 and CVE-2026-48041. Advisory |
| PHP and Laravel | php 8.5.11, 8.4.26, 8.3.35 or 8.2.34 | The 24 September 2026 releases fix eleven CVEs in every supported branch, among them CVE-2026-91769 (TLS hostname verification falling back to the CN) and CVE-2026-91766 (credentials leaked on stream wrapper redirects). Advisory |
Every card's versions
Node.js and Express (27 cards)
| Card | Framework | Runtime |
|---|---|---|
| Cross-site request forgery (CSRF) | Express 5.3.0 | Node.js 26.11.1 |
| Missing object-level authorization (IDOR and BOLA) | Express 5.3.0 | Node.js 26.11.1 (node:sqlite needs 22.13.0 or later without a flag) |
| Open redirect | Express 5.3.0 | Node.js 26.11.1 |
| Path traversal | Express 5.3.0 | Node.js 26.11.1 |
| Server-side request forgery (SSRF) | Express 5.3.0 | Node.js 26.11.1 |
| CORS misconfiguration on credentialed APIs | Express 5.3.0 | Node.js 26.11.1 |
| Insecure randomness for security tokens | Express 5.3.0 | Node.js 26.11.1 |
| Weak password hashing | Express 5.3.0 | Node.js 26.11.1 |
| Code injection | Express 5.3.0 | Node.js 26.11.1 (node:vm built in) |
| Cross-site scripting (XSS) | Express 5.3.0 with EJS 6.0.1 templates | Node.js 26.11.1 |
| CSV formula injection | Express 5.3.0 | Node.js 26.11.1 |
| NoSQL operator injection | Express 5.3.0 with the MongoDB Node.js driver 7.7.0 | Node.js 26.11.1 |
| OS command and argument injection | Express 5.3.0 | Node.js 26.11.1 (node:child_process is built in) |
| Server-side template injection | Express 5.3.0 | Node.js 26.11.1 |
| SQL injection | Express 5.3.0 | Node.js 26.11.1 (node:sqlite needs 22.13.0 or later without a flag) |
| Clickjacking | Express 5.3.0 | Node.js 26.11.1 |
| Regular-expression denial of service (ReDoS) | Express 5.3.0 | Node.js 26.11.1 |
| Unbounded resource consumption | Express 5.3.0 | Node.js 26.11.1 |
| Unrestricted file upload | Express 5.3.0 | Node.js 26.11.1 |
| Hard-coded secrets | Express 5.3.0 | Node.js 26.11.1 |
| Improper TLS certificate validation | Express 5.3.0 | Node.js 26.11.1 |
| JWT validation in APIs (bearer tokens) | Express 5.3.0 | Node.js 26.11.1 |
| Missing authentication for a critical function | Express 5.3.0 | Node.js 26.11.1 (node:sqlite needs 22.13.0 or later without a flag) |
| Session fixation and session cookies | Express 5.3.0 | Node.js 26.11.1 |
| Insecure deserialization | Express 5.3.0 | Node.js 26.11.1 |
| Mass assignment (over-posting) | Express 5.3.0 | Node.js 26.11.1 |
| CRLF injection in logs and response headers | Express 5.3.0 | Node.js 26.11.1 |
Python and Flask (29 cards)
| Card | Framework | Runtime |
|---|---|---|
| Cross-site request forgery (CSRF) | Flask 3.1.3 | CPython 3.14.8 |
| Missing object-level authorization (IDOR and BOLA) | Flask 3.1.3 | CPython 3.14.8 |
| Open redirect | Flask 3.1.3 | CPython 3.14.8 |
| Path traversal | Flask 3.1.3 | CPython 3.14.8 |
| Server-side request forgery (SSRF) | Flask 3.1.3 | CPython 3.14.8 |
| CORS misconfiguration on credentialed APIs | Flask 3.1.3 | CPython 3.14.8 |
| XML external entity (XXE) processing | Flask 3.1.3 | CPython 3.14.8 (libexpat 2.8.5) |
| Insecure randomness for security tokens | Flask 3.1.3 | CPython 3.14.8 |
| Weak password hashing | Flask 3.1.3 | CPython 3.14.8 |
| Code injection | Flask 3.1.3 | CPython 3.14.8 |
| Cross-site scripting (XSS) | Flask 3.1.3 with Jinja2 templates | CPython 3.14.8 |
| CSV formula injection | Flask 3.1.3 | CPython 3.14.8 |
| LDAP filter injection | Flask 3.1.3 | CPython 3.14.8 |
| NoSQL operator injection | Flask 3.1.3 with PyMongo 4.18.2 (tests: mongomock 4.3.0) | CPython 3.14.8 |
| OS command and argument injection | Flask 3.1.3 | CPython 3.14.8 (subprocess is in the standard library) |
| Server-side template injection | Flask 3.1.3 (Jinja2 3.1.6) | CPython 3.14.8 |
| SQL injection | Flask 3.1.3 | CPython 3.14.8 |
| XPath injection | Flask 3.1.3 | CPython 3.14.8 |
| Clickjacking | Flask 3.1.3 | CPython 3.14.8 |
| Regular-expression denial of service (ReDoS) | Flask 3.1.3 | CPython 3.14.8 |
| Unrestricted file upload | Flask 3.1.3 | CPython 3.14.8 |
| Hard-coded secrets | Flask 3.1.3 | CPython 3.14.8 |
| Improper TLS certificate validation | Flask 3.1.3 | CPython 3.14.8 |
| JWT validation in APIs (bearer tokens) | Flask 3.1.3 | CPython 3.14.8 |
| Missing authentication for a critical function | Flask 3.1.3 | CPython 3.14.8 |
| Session fixation and session cookies | Flask 3.1.3 with Flask-Session 0.8.0 (server-side sessions) | CPython 3.14.8 |
| Insecure deserialization | Flask 3.1.3 | CPython 3.14.8 |
| Mass assignment (over-posting) | Flask 3.1.3 | CPython 3.14.8 |
| CRLF injection in logs and response headers | Flask 3.1.3 | CPython 3.14.8 |
Java and Spring Boot (27 cards)
| Card | Framework | Runtime |
|---|---|---|
| Cross-site request forgery (CSRF) | Spring Boot 4.1.1 (Spring Security 7.1.1, Spring Framework 7.0.9, Spring MVC) | OpenJDK 21.0.12.1 (Homebrew), Maven 3.9.16 |
| Missing object-level authorization (IDOR and BOLA) | Spring Boot 4.1.1 (Spring Framework 7.0.9, Spring Security 7.1.1, Spring MVC) | OpenJDK 21.0.12.1 (Homebrew), Maven 3.9.16 |
| Open redirect | Spring Boot 4.1.1 (Spring Framework 7.0.9, Spring MVC) | OpenJDK 21.0.12.1 (Homebrew), Maven 3.9.16 |
| Path traversal | Spring Boot 4.1.1 (Spring Framework 7.0.9, Spring MVC) | OpenJDK 21.0.12.1 (Homebrew), Maven 3.9.16 |
| Server-side request forgery (SSRF) | Spring Boot 4.1.1 (Spring Framework 7.0.9, Spring MVC) | OpenJDK 21.0.12.1 (Homebrew), Maven 3.9.16 |
| CORS misconfiguration on credentialed APIs | Spring Boot 4.1.1 (Spring Framework 7.0.9, Spring MVC) | OpenJDK 21.0.12.1 (Homebrew), Maven 3.9.16 |
| XML external entity (XXE) processing | Spring Boot 4.1.1 (Spring Framework 7, Spring MVC) | OpenJDK 21.0.12.1 (Homebrew), Maven 3.9.16 |
| Insecure randomness for security tokens | Spring Boot 4.1.1 (Spring Framework 7, Spring MVC) | OpenJDK 21.0.12.1 (Homebrew), Maven 3.9.16 |
| Weak password hashing | Spring Boot 4.1.1 (Spring Framework 7.0.9, Spring MVC) with Spring Security Crypto 7.1.1 | OpenJDK 21.0.12.1 (Homebrew), Maven 3.9.16 |
| Code injection | Spring Boot 4.1.1 (Spring Framework 7.0.9, SpEL / spring-expression) | OpenJDK 21.0.12.1 (Homebrew), Maven 3.9.16 |
| Cross-site scripting (XSS) | Spring Boot 4.1.1 (Spring MVC) with Thymeleaf 3.1.5 | OpenJDK 21.0.12.1 (Homebrew), Maven 3.9.16 |
| CSV formula injection | Spring Boot 4.1.1 (spring-boot-starter-webmvc) | OpenJDK 21.0.12.1 (Homebrew), Maven 3.9.16 |
| LDAP filter injection | Spring Boot 4.1.1 (Spring Framework 7.0.9, Spring MVC, Spring LDAP 4.1.1) | OpenJDK 21.0.12.1 (Homebrew), Maven 3.9.16 |
| OS command and argument injection | Spring Boot 4.1.1 (Spring Framework 7.0.9, Spring MVC) | OpenJDK 21.0.12.1 (Homebrew), Maven 3.9.16 |
| Server-side template injection | Spring Boot 4.1.1 (Spring Framework 7.0.9, SpEL / spring-expression) | OpenJDK 21.0.12.1 (Homebrew), Maven 3.9.16 |
| SQL injection | Spring Boot 4.1.1 (Spring Framework 7.0.9, Spring MVC) | OpenJDK 21.0.12.1 (Homebrew), Maven 3.9.16 |
| XPath injection | Spring Boot 4.1.1 (javax.xml.xpath) | OpenJDK 21.0.12.1 (Homebrew), Maven 3.9.16 |
| Regular-expression denial of service (ReDoS) | Spring Boot 4.1.1 (Spring Framework 7.0.9, Spring MVC) | OpenJDK 21.0.12.1 (Homebrew), Maven 3.9.16 |
| Unrestricted file upload | Spring Boot 4.1.1 (Spring Framework 7.0.9, Spring MVC on Tomcat 11.0.26) | OpenJDK 21.0.12.1 (Homebrew), Maven 3.9.16 |
| Hard-coded secrets | Spring Boot 4.1.1 (Spring Framework 7.0.9, Spring MVC, RestClient) | OpenJDK 21.0.12.1 (Homebrew), Maven 3.9.16 |
| Improper TLS certificate validation | Spring Boot 4.1.1 (Spring Framework 7.0.9, Spring MVC, RestClient) | OpenJDK 21.0.12.1 (Homebrew), Maven 3.9.16 |
| JWT validation in APIs (bearer tokens) | Spring Boot 4.1.1 (Spring Security 7.1.1 OAuth2 resource server, Spring Framework 7.0.9, Spring MVC) | OpenJDK 21.0.12.1 (Homebrew), Maven 3.9.16 |
| Missing authentication for a critical function | Spring Boot 4.1.1 (spring-boot-starter-webmvc, OncePerRequestFilter) | OpenJDK 21.0.12.1 (Homebrew), Maven 3.9.16 |
| Session fixation and session cookies | Spring Boot 4.1.1 (Spring Security 7.1.1, Spring Framework 7.0.9, Spring MVC, embedded Tomcat 11.0.26) | OpenJDK 21.0.12.1 (Homebrew), Maven 3.9.16 |
| Insecure deserialization | Spring Boot 4.1.1 (Spring Framework 7, Spring MVC) | OpenJDK 21.0.12.1 (Homebrew), Maven 3.9.16 |
| Mass assignment (over-posting) | Spring Boot 4.1.1 (Spring Framework 7.0.9, Spring MVC, Jackson 3) | OpenJDK 21.0.12.1 (Homebrew), Maven 3.9.16 |
| CRLF injection in logs and response headers | Spring Boot 4.1.1 (Spring Framework 7.0.9, Spring MVC on Tomcat 11.0.26, Logback) | OpenJDK 21.0.12.1 (Homebrew), Maven 3.9.16 |
C# and ASP.NET Core (26 cards)
| Card | Framework | Runtime |
|---|---|---|
| Cross-site request forgery (CSRF) | ASP.NET Core 10 minimal API with cookie authentication and antiforgery | .NET 10.0.12 (SDK 10.0.112, ASP.NET Core runtime 10.0.12) |
| Missing object-level authorization (IDOR and BOLA) | ASP.NET Core 10 minimal API | .NET 10.0.12 (SDK 10.0.112) |
| Open redirect | ASP.NET Core 10 MVC controllers with cookie authentication and antiforgery | .NET 10.0.12 (SDK 10.0.112, ASP.NET Core runtime 10.0.12) |
| Path traversal | ASP.NET Core 10 minimal API | .NET 10.0.12 (SDK 10.0.112) |
| Server-side request forgery (SSRF) | ASP.NET Core 10 minimal API | .NET 10.0.12 (SDK 10.0.112) |
| CORS misconfiguration on credentialed APIs | ASP.NET Core 10 minimal API with the CORS middleware | .NET 10.0.12 (SDK 10.0.112, ASP.NET Core runtime 10.0.12) |
| XML external entity (XXE) processing | ASP.NET Core 10 minimal API | .NET 10.0.12 (SDK 10.0.112) |
| Insecure randomness for security tokens | ASP.NET Core 10 minimal API | .NET 10.0.12 (SDK 10.0.112) |
| Weak password hashing | ASP.NET Core 10 minimal API with ASP.NET Core Identity's PasswordHasher<TUser> | .NET 10.0.12 (SDK 10.0.112) |
| Code injection | ASP.NET Core 10 (minimal API) | ASP.NET Core 10 minimal API on .NET 10.0.12 |
| Cross-site scripting (XSS) | ASP.NET Core 10 MVC with Razor views | .NET 10.0.12 (SDK 10.0.112) |
| CSV formula injection | ASP.NET Core 10 (minimal API) | ASP.NET Core 10 minimal API on .NET 10.0.12 |
| OS command and argument injection | ASP.NET Core 10 minimal API | .NET 10.0.12 (SDK 10.0.112) |
| Server-side template injection | ASP.NET Core 10 minimal API | .NET 10.0.12 (SDK 10.0.112) |
| SQL injection | ASP.NET Core 10 minimal API | .NET 10.0.12 (SDK 10.0.112) |
| XPath injection | ASP.NET Core 10 (minimal API); System.Xml.XPath | ASP.NET Core 10 minimal API on .NET 10.0.12 |
| Regular-expression denial of service (ReDoS) | ASP.NET Core 10 minimal API | .NET 10.0.12 (SDK 10.0.112) |
| Unbounded resource consumption | ASP.NET Core 10 (minimal API); Microsoft.AspNetCore.RateLimiting | ASP.NET Core 10 minimal API on .NET 10.0.12 |
| Unrestricted file upload | ASP.NET Core 10 minimal API | .NET 10.0.12 (SDK 10.0.112) |
| Hard-coded secrets | ASP.NET Core 10 minimal API with the options pattern and IHttpClientFactory | .NET 10.0.12 (SDK 10.0.112, ASP.NET Core runtime 10.0.12) |
| Improper TLS certificate validation | ASP.NET Core 10 minimal API with IHttpClientFactory | .NET 10.0.12 (SDK 10.0.112) |
| JWT validation in APIs (bearer tokens) | ASP.NET Core 10 minimal API with JWT bearer authentication | .NET 10.0.12 (SDK 10.0.112, ASP.NET Core runtime 10.0.12) |
| Missing authentication for a critical function | ASP.NET Core 10 minimal API (authentication handler + RequireAuthorization) | .NET 10 (SDK 10.0.112, runtime 10.0.12) |
| Session fixation and session cookies | ASP.NET Core 10 minimal API with cookie authentication (fixed) or session state (vulnerable and wrong) | .NET 10.0.12 (SDK 10.0.112, ASP.NET Core runtime 10.0.12) |
| Insecure deserialization | ASP.NET Core 10 minimal API | .NET 10.0.12 (SDK 10.0.112) |
| Mass assignment (over-posting) | ASP.NET Core 10 minimal API (System.Text.Json) | .NET 10.0.12 (SDK 10.0.112) |
TypeScript and Next.js (12 cards)
| Card | Framework | Runtime |
|---|---|---|
| Missing object-level authorization (IDOR and BOLA) | Next.js 16.4.0 (App Router route handlers) | Node.js 26.11.1 (node:sqlite needs 22.13.0 or later without a flag; route handlers use the default Node.js runtime) |
| Open redirect | Next.js 16.4.0 (App Router server action with redirect() from next/navigation) | Node.js 26.11.1 |
| Path traversal | Next.js 16.4.0 (App Router route handlers) | Node.js 26.11.1 (route handlers use the default Node.js runtime, which node:fs needs) |
| Server-side request forgery (SSRF) | Next.js 16.4.0 (App Router route handlers) | Node.js 26.11.1 (route handlers use the default Node.js runtime; node:http, node:net and node:dns are not available on the Edge runtime) |
| Cross-site scripting (XSS) | Next.js 16.4.0 (App Router server component) with React 19.3.0 | Node.js 26.11.1 |
| OS command and argument injection | Next.js 16.4.0 (App Router route handlers) | Node.js 26.11.1 (route handlers use the default Node.js runtime; node:child_process is not available on the Edge runtime) |
| SQL injection | Next.js 16.4.0 (App Router route handlers) | Node.js 26.11.1 (node:sqlite needs 22.13.0 or later without a flag; route handlers use the default Node.js runtime) |
| Clickjacking | Next.js 16.4.0 (middleware) | Node.js 26.11.1 (middleware runs on the Node.js runtime) |
| Unrestricted file upload | Next.js 16.4.0 (App Router route handlers) | Node.js 26.11.1 (route handlers use the default Node.js runtime) |
| JWT validation in APIs (bearer tokens) | Next.js 16.4.0 (App Router route handlers) | Node.js 26.11.1 (the route handler uses the default Node.js runtime; jose also runs on the Edge runtime) |
| Missing authentication for a critical function | Next.js 16.4.0 (App Router route handlers) | Node.js 26.11.1 (node:sqlite needs 22.13.0 or later; route handlers use the default Node.js runtime) |
| Mass assignment (over-posting) | Next.js 16.4.0 (App Router route handler and server action) | Node.js 26.11.1 |
Python and FastAPI (13 cards)
| Card | Framework | Runtime |
|---|---|---|
| Missing object-level authorization (IDOR and BOLA) | FastAPI 0.142.2 (Starlette 1.7.0, Pydantic 2.13.5) with SQLAlchemy 2.0.54 | CPython 3.14.8 |
| Open redirect | FastAPI 0.142.2 (Starlette 1.7.0) | CPython 3.14.8 |
| Path traversal | FastAPI 0.142.2 (Starlette 1.7.0 FileResponse) | CPython 3.14.8 |
| Server-side request forgery (SSRF) | FastAPI 0.142.2 (Starlette 1.7.0, Pydantic 2.13.5) | CPython 3.14.8 |
| Weak password hashing | FastAPI 0.142.2 (Starlette 1.7.0, Pydantic 2.13.5) | CPython 3.14.8 |
| Code injection | FastAPI 0.142.2 (Starlette 1.7.0, Pydantic 2.13.5) | CPython 3.14.8 |
| SQL injection | FastAPI 0.142.2 (Starlette 1.7.0, Pydantic 2.13.5) with SQLAlchemy 2.0.54 | CPython 3.14.8 |
| Unbounded resource consumption | FastAPI 0.142.2 (Starlette 1.7.0, Pydantic 2.13.5) | CPython 3.14.8 |
| Unrestricted file upload | FastAPI 0.142.2 (Starlette 1.7.0, Pydantic 2.13.5) | CPython 3.14.8 |
| JWT validation in APIs (bearer tokens) | FastAPI 0.142.2 (Starlette 1.7.0) with an HTTPBearer dependency | CPython 3.14.8 |
| Missing authentication for a critical function | FastAPI 0.142.2 (Starlette 1.7.0, Pydantic 2.13.5) | CPython 3.14.8 |
| Insecure deserialization | FastAPI 0.142.2 (Starlette 1.7.0, Pydantic 2.13.5) | CPython 3.14.8 |
| Mass assignment (over-posting) | FastAPI 0.142.2 (Starlette 1.7.0, Pydantic 2.13.5) | CPython 3.14.8 |
Python and Django (13 cards)
| Card | Framework | Runtime |
|---|---|---|
| Cross-site request forgery (CSRF) | Django 6.1.2 (CsrfViewMiddleware, sessions and django.contrib.auth) | CPython 3.14.8 |
| Missing object-level authorization (IDOR and BOLA) | Django 6.1.2 (ORM over SQLite, django.contrib.auth sessions) | CPython 3.14.8 |
| Open redirect | Django 6.1.2 (django.contrib.auth sign-in) | CPython 3.14.8 |
| Path traversal | Django 6.1.2 (FileResponse) | CPython 3.14.8 |
| Server-side request forgery (SSRF) | Django 6.1.2 | CPython 3.14.8 |
| Weak password hashing | Django 6.1.2 (django.contrib.auth.hashers) | CPython 3.14.8 |
| Cross-site scripting (XSS) | Django 6.1.2 with Django templates | CPython 3.14.8 |
| CSV formula injection | Django 6.1.2 | CPython 3.14.8 |
| SQL injection | Django 6.1.2 (ORM over SQLite) | CPython 3.14.8 |
| Clickjacking | Django 6.1.2 (XFrameOptionsMiddleware, ContentSecurityPolicyMiddleware) | CPython 3.14.8 |
| Unrestricted file upload | Django 6.1.2 (request.FILES, FileResponse, django.views.static.serve) | CPython 3.14.8 |
| Missing authentication for a critical function | Django 6.1.2 | CPython 3.14.8 |
| Mass assignment (over-posting) | Django 6.1.2 (ModelForm, django.contrib.auth sessions) | CPython 3.14.8 |
Go and net/http (15 cards)
| Card | Framework | Runtime |
|---|---|---|
| Missing object-level authorization (IDOR and BOLA) | Go standard library 1.27.2 (net/http, database/sql) with modernc.org/sqlite 1.60.1 | Go 1.27.2 (golang:1.27.2-trixie, linux/arm64); also passes on Go 1.26.9 |
| Open redirect | Go standard library 1.27.2 (net/http, net/url) | Go 1.27.2 (golang:1.27.2-trixie, linux/arm64); also passes on Go 1.26.9 |
| Path traversal | Go standard library 1.27.2 (net/http, os.Root) | Go 1.27.2 (golang:1.27.2-trixie, linux/arm64); also passes on Go 1.26.9 |
| Server-side request forgery (SSRF) | Go standard library 1.27.2 (net/http client, net/netip) | Go 1.27.2 (golang:1.27.2-trixie, linux/arm64); also passes on Go 1.26.9 |
| Insecure randomness for security tokens | Go standard library 1.27.2 (net/http, crypto/rand) | Go 1.27.2 (golang:1.27.2-trixie, linux/arm64); also passes on Go 1.26.9 |
| Weak password hashing | Go standard library 1.27.2 (net/http, database/sql) with x/crypto 0.57.0 (argon2) | Go 1.27.2 (golang:1.27.2-trixie, linux/arm64); also passes on Go 1.26.9 |
| Cross-site scripting (XSS) | Go standard library 1.27.2 (net/http, html/template) | Go 1.27.2 (golang:1.27.2-trixie, linux/arm64); also passes on Go 1.26.9 |
| OS command and argument injection | Go standard library 1.27.2 (net/http, os/exec) | Go 1.27.2 (golang:1.27.2-trixie, linux/arm64); also passes on Go 1.26.9 |
| SQL injection | Go standard library 1.27.2 (net/http, database/sql) with modernc.org/sqlite 1.60.1 | Go 1.27.2 (golang:1.27.2-trixie, linux/arm64); also passes on Go 1.26.9 |
| Unbounded resource consumption | Go standard library 1.27.2 (net/http: MaxBytesReader, http.Server timeouts) | Go 1.27.2 (golang:1.27.2-trixie, linux/arm64); also passes on Go 1.26.9 |
| Unrestricted file upload | Go standard library 1.27.2 (net/http multipart, http.MaxBytesReader, crypto/rand) | Go 1.27.2 (golang:1.27.2-trixie, linux/arm64); also passes on Go 1.26.9 |
| Improper TLS certificate validation | Go standard library 1.27.2 (net/http client, crypto/tls, crypto/x509) | Go 1.27.2 (golang:1.27.2-trixie, linux/arm64); also passes on Go 1.26.9 |
| JWT validation in APIs (bearer tokens) | Go standard library 1.27.2 (net/http) with golang-jwt/jwt v5.3.1 | Go 1.27.2 (golang:1.27.2-trixie, linux/arm64); also passes on Go 1.26.9 |
| Missing authentication for a critical function | Go standard library 1.27.2 (net/http, crypto/hmac, crypto/sha256) | Go 1.27.2 (golang:1.27.2-trixie, linux/arm64); also passes on Go 1.26.9 |
| Mass assignment (over-posting) | Go standard library 1.27.2 (net/http, encoding/json) | Go 1.27.2 (golang:1.27.2-trixie, linux/arm64); also passes on Go 1.26.9 |
Ruby on Rails (13 cards)
| Card | Framework | Runtime |
|---|---|---|
| Cross-site request forgery (CSRF) | Ruby on Rails 8.1.4 (protect_from_forgery, cookie sessions) | Ruby 4.0.7 |
| Missing object-level authorization (IDOR and BOLA) | Ruby on Rails 8.1.4 (Active Record scopes over SQLite) | Ruby 4.0.7 |
| Open redirect | Ruby on Rails 8.1.4 (sign-in with has_secure_password, redirect_to and url_from) | Ruby 4.0.7 |
| Path traversal | Ruby on Rails 8.1.4 (API controller, send_file) | Ruby 4.0.7 |
| Server-side request forgery (SSRF) | Ruby on Rails 8.1.4 (API controller) with Net::HTTP (net-http 0.9.1) and IPAddr (ipaddr 1.2.8) | Ruby 4.0.7 |
| Cross-site scripting (XSS) | Ruby on Rails 8.1.4 (ERB views) | Ruby 4.0.7 |
| CSV formula injection | Ruby on Rails 8.1.4 (API controller, CSV.generate, send_data) | Ruby 4.0.7 |
| SQL injection | Ruby on Rails 8.1.4 (Active Record over SQLite) | Ruby 4.0.7 |
| Unrestricted file upload | Ruby on Rails 8.1.4 (API controller, ActionDispatch::Http::UploadedFile, send_file) | Ruby 4.0.7 |
| Missing authentication for a critical function | Ruby on Rails 8.1.4 (API controller, before_action, OpenSSL::HMAC, ActiveSupport::SecurityUtils) | Ruby 4.0.7 |
| Session fixation and session cookies | Ruby on Rails 8.1.4 (ActionDispatch::Session::CacheStore) | Ruby 4.0.7 |
| Insecure deserialization | Ruby on Rails 8.1.4 (API controller) with Marshal, Psych (YAML) and JSON | Ruby 4.0.7 |
| Mass assignment (over-posting) | Ruby on Rails 8.1.4 (strong parameters, Active Record over SQLite) | Ruby 4.0.7 |
PHP and Laravel (13 cards)
| Card | Framework | Runtime |
|---|---|---|
| Cross-site request forgery (CSRF) | Laravel 13.34.0 (sessions on SQLite) | PHP 8.5.11 (CLI) |
| Missing object-level authorization (IDOR and BOLA) | Laravel 13.34.0 (Eloquent over SQLite) | PHP 8.5.11 (CLI) |
| Open redirect | Laravel 13.34.0 (sessions on SQLite) | PHP 8.5.11 (CLI) |
| Path traversal | Laravel 13.34.0 (Storage) | PHP 8.5.11 (CLI) |
| Server-side request forgery (SSRF) | Laravel 13.34.0 with PHP 8.5's Uri\WhatWg\Url, filter_var(FILTER_FLAG_GLOBAL_RANGE) and stream sockets | PHP 8.5.11 (CLI) |
| Weak password hashing | Laravel 13.34.0 (Hash facade) | PHP 8.5.11 (CLI) |
| Cross-site scripting (XSS) | Laravel 13.34.0 (Blade) | PHP 8.5.11 (CLI) |
| SQL injection | Laravel 13.34.0 (query builder over SQLite) | PHP 8.5.11 (CLI) |
| Unrestricted file upload | Laravel 13.34.0 (validation rules mimes, extensions and max; UploadedFile::store; Storage) | PHP 8.5.11 (CLI) |
| Missing authentication for a critical function | Laravel 13.34.0 (route middleware, hash_hmac, hash_equals) | PHP 8.5.11 (CLI) |
| Session fixation and session cookies | Laravel 13.34.0 (sessions on SQLite) | PHP 8.5.11 (CLI) |
| Insecure deserialization | Laravel 13.34.0 with PHP unserialize (allowed_classes) and json_decode | PHP 8.5.11 (CLI) |
| Mass assignment (over-posting) | Laravel 13.34.0 (Eloquent over SQLite) | PHP 8.5.11 (CLI) |