AIKIDO-2026-11087

TL;DR

The hot-shots StatsD client builds metric packets from caller-supplied names, tag keys, and tag values. Before the fix, carriage-return characters were not stripped, so receivers that split lines on \r could accept attacker-influenced injected metrics. Transport sockets also lacked default error listeners, so unhandled socket errors could terminate the Node.js host process, and invalid oversized bufferFlushInterval values could force rapid buffer flush loops that exhaust CPU. Version 15.0.0 sanitizes \r, attaches safe default error handlers, validates flush intervals, and wraps interval flushes to prevent host crashes.