Repository Issue Activity (beta)

#906 Dependency Dashboard

#1628 Large octet-stream request bodies are force-parsed into REQUEST_BODY/ARGS and transformed → memory blow-up (SecRequestBodyNoFilesLimit not enforced; forced URLENCODED vs RAW)

#1681 Transformation cache misses on map-backed collections

#1611 Coraza no longer 'best effort' parses JSON messages larger than configured SecRequestBodyLimit

#1714 Implement RESPONSE_XML support

#1710 Fuzz tests #1331 failed

#1566 docs: investigate RESPONSE_CONTENT_LENGTH variable

#1103 Native prometheus metrics

#1700 SecRuleUpdateTargetByTag silently does nothing: targets are added to a loop copy

#1696 URLENCODED_ERROR is never set for the condition it documents; the decoder cannot detect it

#1575 Add code blocks to documentation

#1686 Concurrent audit log writer: transaction ID is unsanitized in the audit record file path

#1104 Unsupported "accuracy" Action in SecRule Configuration

#1685 REQUEST_BODY is not populated when a body processor ran (XML/JSON), diverging from libmodsecurity v3

#1687 15 MULTIPART_* variables are declared but never populated, so rules referencing them silently never match

#1670 normalise path and normalise path win too transformations return changed true for some cases even if the path not touched

#1653 jsDecode doesn't decode ES2015+ \u{...} extended Unicode escapes

#1675 `msg`/`logdata` macros are expanded on every rule evaluation, emitting spurious "key not found in collection" warnings

#1654 cssDecode writes a single raw byte for non-ASCII hex escapes instead of the codepoint's UTF-8 encoding

#1656 normalisePathWin doesn't strip Windows' trailing dots/spaces or ADS suffixes

#1651 base64DecodeExt truncates output at base64url '-'/'_', letting attacker-controlled tokens evade rules past that point

#1655 compressWhitespace corrupts valid UTF-8 for common accented Latin-1-supplement characters

#1674 cookieParser misinterepretaion of unicode cookie values

#1666 Replace Comment transformation have some loopholes

#1671 URI Decode uni discards high bits, leading to loopholes