CVEs affecting projects tracked on Release Alert, from NVD & OSV.
JerryScript through 2.3.0 has a (function({a=arguments}){const arguments}) buffer over-read.