{"matches":[{"vulnerability":{"id":"GHSA-7wch-p9px-956x","dataSource":"https://github.com/advisories/GHSA-7wch-p9px-956x","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/digitalbazaar/forge/security/advisories/GHSA-7wch-p9px-956x","https://nvd.nist.gov/vuln/detail/CVE-2026-118779","https://github.com/digitalbazaar/forge/commit/412345db583cd28a9d23636d0d93e9f751b935f3","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1"],"description":"Forge: Regular expression denial of service in PEM decoding (pem.decode)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118779","epss":0.00556,"percentile":0.46406,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118779","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-118779","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.4.1"],"state":"fixed","available":[{"version":"1.4.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.41700000000000004},"relatedVulnerabilities":[{"id":"CVE-2026-118779","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118779","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/digitalbazaar/forge/commit/412345db583cd28a9d23636d0d93e9f751b935f3","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","https://github.com/digitalbazaar/forge/security/advisories/GHSA-7wch-p9px-956x"],"description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used pem.decode(), lib/pem.js, missing END line to process the relevant input or security decision. node-forge used polynomial-time regular expressions in pem.decode(), including when searching for a matching END line and parsing encapsulated headers. An unauthenticated attacker able to supply PEM input to any high-level parser could consume excessive CPU with a long malformed message and cause denial of service. This issue is fixed in version 1.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118779","epss":0.00556,"percentile":0.46406,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118779","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-118779","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"node-forge","version":"1.4.0"}},"found":{"vulnerabilityID":"GHSA-7wch-p9px-956x","versionConstraint":"<=1.4.0 (semantic)"},"fix":{"suggestedVersion":"1.4.1"}}],"artifact":{"id":"pkg:npm/node-forge@1.4.0?package-id=c1e5f20287afef44","name":"node-forge","version":"1.4.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause OR GPL-2.0"],"cpes":["cpe:2.3:a:digitalbazaar:forge:1.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/node-forge@1.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-hqq3-7jhf-c5jx","dataSource":"https://github.com/advisories/GHSA-hqq3-7jhf-c5jx","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/digitalbazaar/forge/security/advisories/GHSA-hqq3-7jhf-c5jx","https://nvd.nist.gov/vuln/detail/CVE-2026-119187","https://github.com/digitalbazaar/forge/commit/817e2ce0d0f6d8a25bc9c2670615c38a9ffdc51c","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1"],"description":"Forge: Denial of service in TLS record processing via call stack exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119187","epss":0.00415,"percentile":0.35807,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119187","cwe":"CWE-674","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["1.4.1"],"state":"fixed","available":[{"version":"1.4.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.31124999999999997},"relatedVulnerabilities":[{"id":"CVE-2026-119187","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119187","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/digitalbazaar/forge/commit/817e2ce0d0f6d8a25bc9c2670615c38a9ffdc51c","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","https://github.com/digitalbazaar/forge/security/advisories/GHSA-hqq3-7jhf-c5jx"],"description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection(), TLS record processing, process() to process the relevant input or security decision. node-forge processed received TLS records recursively, consuming one JavaScript stack frame per record in a single input chunk. A remote peer could send thousands of small records together and exhaust the call stack, causing an uncaught exception and denial of service. This issue is fixed in version 1.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119187","epss":0.00415,"percentile":0.35807,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119187","cwe":"CWE-674","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"node-forge","version":"1.4.0"}},"found":{"vulnerabilityID":"GHSA-hqq3-7jhf-c5jx","versionConstraint":"<=1.4.0 (semantic)"},"fix":{"suggestedVersion":"1.4.1"}}],"artifact":{"id":"pkg:npm/node-forge@1.4.0?package-id=c1e5f20287afef44","name":"node-forge","version":"1.4.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause OR GPL-2.0"],"cpes":["cpe:2.3:a:digitalbazaar:forge:1.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/node-forge@1.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-8hrf-8g6f-7xwp","dataSource":"https://github.com/advisories/GHSA-8hrf-8g6f-7xwp","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/digitalbazaar/forge/security/advisories/GHSA-8hrf-8g6f-7xwp","https://nvd.nist.gov/vuln/detail/CVE-2026-119188","https://github.com/digitalbazaar/forge/commit/700d977d39f9f8f896c55b0763eebb940a2c087e","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1"],"description":"Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119188","epss":0.00411,"percentile":0.35424,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119188","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-119188","cwe":"CWE-476","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.4.1"],"state":"fixed","available":[{"version":"1.4.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.30825},"relatedVulnerabilities":[{"id":"CVE-2026-119188","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119188","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/digitalbazaar/forge/commit/700d977d39f9f8f896c55b0763eebb940a2c087e","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","https://github.com/digitalbazaar/forge/security/advisories/GHSA-8hrf-8g6f-7xwp"],"description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection(), fragmented handshake message, interleaved record to process the relevant input or security decision. node-forge continued processing after a TLS record of another content type interrupted a fragmented handshake message. A remote peer could trigger an uncaught TypeError in process(), causing the connection or hosting process to fail. This issue is fixed in version 1.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119188","epss":0.00411,"percentile":0.35424,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119188","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-119188","cwe":"CWE-476","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"node-forge","version":"1.4.0"}},"found":{"vulnerabilityID":"GHSA-8hrf-8g6f-7xwp","versionConstraint":"<=1.4.0 (semantic)"},"fix":{"suggestedVersion":"1.4.1"}}],"artifact":{"id":"pkg:npm/node-forge@1.4.0?package-id=c1e5f20287afef44","name":"node-forge","version":"1.4.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause OR GPL-2.0"],"cpes":["cpe:2.3:a:digitalbazaar:forge:1.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/node-forge@1.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-3g3m-2fjr-6pw4","dataSource":"https://github.com/advisories/GHSA-3g3m-2fjr-6pw4","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/node-glob/security/advisories/GHSA-3g3m-2fjr-6pw4","https://nvd.nist.gov/vuln/detail/CVE-2026-118773","https://github.com/isaacs/node-glob/commit/4682e8c9babee1b385202ede36389634e12076d7","https://github.com/isaacs/node-glob/releases/tag/v14.0.2"],"description":"Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118773","epss":0.0035,"percentile":0.28709,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118773","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["14.0.2"],"state":"fixed","available":[{"version":"14.0.2","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.19774999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-118773","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118773","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-glob/commit/4682e8c9babee1b385202ede36389634e12076d7","https://github.com/isaacs/node-glob/releases/tag/v14.0.2","https://github.com/isaacs/node-glob/security/advisories/GHSA-3g3m-2fjr-6pw4"],"description":"Glob matches files using patterns the shell uses. From 9.0.0 until 14.0.2, abort branches in src/walker.ts, including GlobUtil.walkCB(), GlobUtil.walkCB2(), GlobUtil.walkCBSync(), and GlobUtil.walkCB2Sync(), invoke the callbacks without returning. After AbortSignal or AbortSignal.timeout() rejects or emits an error, execution can continue into processor.processPatterns(), readdirCB(), and recursive traversal. The issue affects glob() and globStream() when applications expose attacker-influenced patterns or directory trees and rely on cancellation as a traversal budget. Repeated timed-out requests can stack background filesystem operations and CPU work, degrading worker throughput or service availability; no confidentiality or integrity impact was observed. This issue is fixed in 14.0.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118773","epss":0.0035,"percentile":0.28709,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118773","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"glob","version":"13.0.0"}},"found":{"vulnerabilityID":"GHSA-3g3m-2fjr-6pw4","versionConstraint":">=9.0.0,<=14.0.1 (semantic)"},"fix":{"suggestedVersion":"14.0.2"}}],"artifact":{"id":"pkg:npm/glob@13.0.0?package-id=44cac8685033b227","name":"glob","version":"13.0.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BlueOak-1.0.0"],"cpes":["cpe:2.3:a:isaacs:glob:13.0.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/glob@13.0.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-86w9-cpqp-85rv","dataSource":"https://github.com/advisories/GHSA-86w9-cpqp-85rv","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-85393","https://github.com/digitalbazaar/forge/issues/1149","https://github.com/advisories/GHSA-ppp5-5v6c-4jwp","https://github.com/digitalbazaar/forge/blob/v1.4.0/lib/asn1.js","https://github.com/digitalbazaar/forge/blob/v1.4.0/lib/rsa.js","https://www.vulncheck.com/advisories/node-forge-through-1.4.0-rsa-pkcs-1-1.5-signature-forgery-via-nested-digestalgorithm-padding","https://github.com/digitalbazaar/forge/pull/1152"],"description":"node-forge RSA PKCS#1 v1.5 signature verification accepts extra nested DigestAlgorithm elements","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-85393","epss":0.00248,"percentile":0.16158,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-85393","cwe":"CWE-347","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.19344},"relatedVulnerabilities":[{"id":"CVE-2026-85393","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85393","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/advisories/GHSA-ppp5-5v6c-4jwp","https://github.com/digitalbazaar/forge","https://github.com/digitalbazaar/forge/blob/v1.4.0/lib/asn1.js","https://github.com/digitalbazaar/forge/blob/v1.4.0/lib/rsa.js","https://github.com/digitalbazaar/forge/issues/1149","https://www.vulncheck.com/advisories/node-forge-through-1.4.0-rsa-pkcs-1-1.5-signature-forgery-via-nested-digestalgorithm-padding"],"description":"node-forge through 1.4.0 fails to validate element count in nested DigestAlgorithm sequences during RSA PKCS#1 v1.5 signature verification. Attackers can embed garbage bytes inside the DigestAlgorithm sequence to forge valid signatures for arbitrary messages using low-exponent RSA keys. This is an incomplete fix for CVE-2026-33894.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-85393","epss":0.00248,"percentile":0.16158,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-85393","cwe":"CWE-347","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"node-forge","version":"1.4.0"}},"found":{"vulnerabilityID":"GHSA-86w9-cpqp-85rv","versionConstraint":"<=1.4.0 (semantic)"}}],"artifact":{"id":"pkg:npm/node-forge@1.4.0?package-id=c1e5f20287afef44","name":"node-forge","version":"1.4.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause OR GPL-2.0"],"cpes":["cpe:2.3:a:digitalbazaar:forge:1.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/node-forge@1.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-5x38-2vff-x55p","dataSource":"https://github.com/advisories/GHSA-5x38-2vff-x55p","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/digitalbazaar/forge/security/advisories/GHSA-5x38-2vff-x55p","https://nvd.nist.gov/vuln/detail/CVE-2026-119190","https://github.com/digitalbazaar/forge/commit/58c06bc251856b409c30ecb35a93f5f6c9bbc84a","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1"],"description":"Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119190","epss":0.00246,"percentile":0.15897,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119190","cwe":"CWE-295","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-119190","cwe":"CWE-436","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.4.1"],"state":"fixed","available":[{"version":"1.4.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.18327000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-119190","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119190","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/digitalbazaar/forge/commit/58c06bc251856b409c30ecb35a93f5f6c9bbc84a","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","https://github.com/digitalbazaar/forge/security/advisories/GHSA-5x38-2vff-x55p"],"description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge parsed deprecated extension OIDs 2.5.29.10 and 2.5.29.13 as basicConstraints, and pki.verifyCertificateChain() used the first extension with that name. Exploitation requires a CA trusted by the application to issue a certificate carrying an attacker-supplied deprecated-OID extension, commonly because the CA copies extensions from a certificate signing request. By placing a permissive deprecated extension before the genuine 2.5.29.19 basicConstraints extension, the certificate holder could have the certificate accepted as a CA and issue certificates for arbitrary names, enabling server or client impersonation. If the issuing CA adds a keyUsage extension without keyCertSign, node-forge rejects the chain. This issue is fixed in version 1.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119190","epss":0.00246,"percentile":0.15897,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119190","cwe":"CWE-295","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-119190","cwe":"CWE-436","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"node-forge","version":"1.4.0"}},"found":{"vulnerabilityID":"GHSA-5x38-2vff-x55p","versionConstraint":"<=1.4.0 (semantic)"},"fix":{"suggestedVersion":"1.4.1"}}],"artifact":{"id":"pkg:npm/node-forge@1.4.0?package-id=c1e5f20287afef44","name":"node-forge","version":"1.4.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause OR GPL-2.0"],"cpes":["cpe:2.3:a:digitalbazaar:forge:1.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/node-forge@1.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-rxp7-6hxx-x8q5","dataSource":"https://github.com/advisories/GHSA-rxp7-6hxx-x8q5","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rxp7-6hxx-x8q5","https://nvd.nist.gov/vuln/detail/CVE-2026-111997","https://github.com/beaugunderson/ip-address/commit/ec80fcd5d7b97defecfd39717d782a9f9f8b89dd","https://github.com/beaugunderson/ip-address/releases/tag/v10.7.4"],"description":"ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111997","epss":0.00315,"percentile":0.24412,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111997","cwe":"CWE-1333","source":"cve@mitre.org","type":"Secondary"}],"fix":{"versions":["10.7.4"],"state":"fixed","available":[{"version":"10.7.4","date":"2026-10-22","kind":"first-observed"}]},"advisories":[],"risk":0.177975},"relatedVulnerabilities":[{"id":"CVE-2026-111997","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111997","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rxp7-6hxx-x8q5"],"description":"ip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall) via many % characters in input reaching a function call that uses the Address6 constructor.","cvss":[{"source":"cve@mitre.org","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111997","epss":0.00315,"percentile":0.24412,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111997","cwe":"CWE-1333","source":"cve@mitre.org","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"ip-address","version":"10.7.3"}},"found":{"vulnerabilityID":"GHSA-rxp7-6hxx-x8q5","versionConstraint":"<=10.7.3 (semantic)"},"fix":{"suggestedVersion":"10.7.4"}}],"artifact":{"id":"pkg:npm/ip-address@10.7.3?package-id=dd9249c9f21b5144","name":"ip-address","version":"10.7.3","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:beaugunderson:ip-address:10.7.3:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/ip-address@10.7.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-g3hv-75wg-m249","dataSource":"https://github.com/advisories/GHSA-g3hv-75wg-m249","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249","https://nvd.nist.gov/vuln/detail/CVE-2026-118764","https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1"],"description":"minimatch has potential denial of service via globparts amplification","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["11.0.1"],"state":"fixed","available":[{"version":"11.0.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.173145},"relatedVulnerabilities":[{"id":"CVE-2026-118764","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118764","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1","https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"10.2.5"}},"found":{"vulnerabilityID":"GHSA-g3hv-75wg-m249","versionConstraint":"<11.0.1 (semantic)"},"fix":{"suggestedVersion":"11.0.1"}}],"artifact":{"id":"pkg:npm/minimatch@10.2.5?package-id=35a06022798aa111","name":"minimatch","version":"10.2.5","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BlueOak-1.0.0"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:10.2.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@10.2.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-6wvx-3r32-xmcg","dataSource":"https://github.com/advisories/GHSA-6wvx-3r32-xmcg","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/digitalbazaar/forge/security/advisories/GHSA-6wvx-3r32-xmcg","https://nvd.nist.gov/vuln/detail/CVE-2026-118777","https://github.com/digitalbazaar/forge/commit/797c3f816a22748a96fceebb34eb3a6716853991","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1"],"description":"Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118777","epss":0.00255,"percentile":0.17162,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118777","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.4.1"],"state":"fixed","available":[{"version":"1.4.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.12494999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-118777","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118777","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/digitalbazaar/forge/commit/797c3f816a22748a96fceebb34eb3a6716853991","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","https://github.com/digitalbazaar/forge/security/advisories/GHSA-6wvx-3r32-xmcg"],"description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the forge.http client stored cookie names and paths from Set-Cookie response headers in ordinary JavaScript objects. A malicious server could use the cookie name __proto__ so that the attacker-controlled cookie path was written as a property on Object.prototype, or use inherited names such as constructor to modify Object. An empty cookie value could use the removal path to delete an inherited Object.prototype property. Applications using forge.http directly or through forge.xhr are affected; applications that do not use forge.http are unaffected. This issue is fixed in version 1.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118777","epss":0.00255,"percentile":0.17162,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118777","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"node-forge","version":"1.4.0"}},"found":{"vulnerabilityID":"GHSA-6wvx-3r32-xmcg","versionConstraint":"<=1.4.0 (semantic)"},"fix":{"suggestedVersion":"1.4.1"}}],"artifact":{"id":"pkg:npm/node-forge@1.4.0?package-id=c1e5f20287afef44","name":"node-forge","version":"1.4.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause OR GPL-2.0"],"cpes":["cpe:2.3:a:digitalbazaar:forge:1.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/node-forge@1.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-5cwg-6vw7-rj6p","dataSource":"https://github.com/advisories/GHSA-5cwg-6vw7-rj6p","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/digitalbazaar/forge/security/advisories/GHSA-5cwg-6vw7-rj6p","https://nvd.nist.gov/vuln/detail/CVE-2026-119186","https://github.com/digitalbazaar/forge/commit/236845d96c71207259f91638d0138bba8e2fd624","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1"],"description":"Forge: AES-GCM authentication bypass via unvalidated tagLength option","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119186","epss":0.00206,"percentile":0.10693,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119186","cwe":"CWE-354","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-119186","cwe":"CWE-1284","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.4.1"],"state":"fixed","available":[{"version":"1.4.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.11227000000000001},"relatedVulnerabilities":[{"id":"CVE-2026-119186","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119186","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/digitalbazaar/forge/commit/236845d96c71207259f91638d0138bba8e2fd624","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","https://github.com/digitalbazaar/forge/security/advisories/GHSA-5cwg-6vw7-rj6p"],"description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge did not validate the AES-GCM tagLength option passed to start() during decryption through forge.cipher.createDecipher(). When an application derived tagLength from received data or used an unset or zero-like configuration value, a value that converted to zero together with an empty or missing authentication tag caused the calculated and supplied tags to compare as empty, so decipher.finish() accepted unauthenticated ciphertext. Applications that omit tagLength to use the 128-bit default or pass a fixed valid tag length are unaffected. This issue is fixed in version 1.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119186","epss":0.00206,"percentile":0.10693,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119186","cwe":"CWE-354","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-119186","cwe":"CWE-1284","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"node-forge","version":"1.4.0"}},"found":{"vulnerabilityID":"GHSA-5cwg-6vw7-rj6p","versionConstraint":"<=1.4.0 (semantic)"},"fix":{"suggestedVersion":"1.4.1"}}],"artifact":{"id":"pkg:npm/node-forge@1.4.0?package-id=c1e5f20287afef44","name":"node-forge","version":"1.4.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause OR GPL-2.0"],"cpes":["cpe:2.3:a:digitalbazaar:forge:1.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/node-forge@1.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-525v-9gp9-w22h","dataSource":"https://github.com/advisories/GHSA-525v-9gp9-w22h","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/digitalbazaar/forge/security/advisories/GHSA-525v-9gp9-w22h","https://nvd.nist.gov/vuln/detail/CVE-2026-118778","https://github.com/digitalbazaar/forge/commit/7be9fbd40df2e2f15f29fea2846b1c87d58f6888","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1"],"description":"Forge: TLS client crash when the server sends no certificate","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118778","epss":0.00204,"percentile":0.10367,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118778","cwe":"CWE-476","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["1.4.1"],"state":"fixed","available":[{"version":"1.4.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.11118000000000003},"relatedVulnerabilities":[{"id":"CVE-2026-118778","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118778","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/digitalbazaar/forge/commit/7be9fbd40df2e2f15f29fea2846b1c87d58f6888","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","https://github.com/digitalbazaar/forge/security/advisories/GHSA-525v-9gp9-w22h"],"description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection(), c.session.serverCertificate, RSA key exchange to process the relevant input or security decision. node-forge's TLS client checked the wrong property when deciding whether a server certificate was missing. A malicious TLS server or on-path peer could omit the Certificate message and reach code that dereferenced the absent certificate, causing an uncaught exception and terminating the connection or process. This issue is fixed in version 1.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118778","epss":0.00204,"percentile":0.10367,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118778","cwe":"CWE-476","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"node-forge","version":"1.4.0"}},"found":{"vulnerabilityID":"GHSA-525v-9gp9-w22h","versionConstraint":"<=1.4.0 (semantic)"},"fix":{"suggestedVersion":"1.4.1"}}],"artifact":{"id":"pkg:npm/node-forge@1.4.0?package-id=c1e5f20287afef44","name":"node-forge","version":"1.4.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause OR GPL-2.0"],"cpes":["cpe:2.3:a:digitalbazaar:forge:1.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/node-forge@1.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-4642-5mcj-2rqw","dataSource":"https://github.com/advisories/GHSA-4642-5mcj-2rqw","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/digitalbazaar/forge/security/advisories/GHSA-4642-5mcj-2rqw","https://nvd.nist.gov/vuln/detail/CVE-2026-118775","https://github.com/digitalbazaar/forge/commit/e56a3dde8e4e63bae566bb32546eeaf92f515e1e","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1"],"description":"Forge: ASN.1 OID first arc truncation in asn1.oidToDer","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118775","epss":0.00313,"percentile":0.24276,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118775","cwe":"CWE-190","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.4.1"],"state":"fixed","available":[{"version":"1.4.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.10485499999999999},"relatedVulnerabilities":[{"id":"CVE-2026-118775","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118775","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/digitalbazaar/forge/commit/e56a3dde8e4e63bae566bb32546eeaf92f515e1e","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","https://github.com/digitalbazaar/forge/security/advisories/GHSA-4642-5mcj-2rqw"],"description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, asn1.oidToDer() in lib/asn1.js did not range-check the first two arcs of an OID. An application that accepted an untrusted OID string, checked or authorized that string, and then encoded it with asn1.oidToDer() could emit DER representing a different, trusted OID from the one that was checked. DER parsing is not affected. This issue is fixed in version 1.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118775","epss":0.00313,"percentile":0.24276,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118775","cwe":"CWE-190","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"node-forge","version":"1.4.0"}},"found":{"vulnerabilityID":"GHSA-4642-5mcj-2rqw","versionConstraint":"<=1.4.0 (semantic)"},"fix":{"suggestedVersion":"1.4.1"}}],"artifact":{"id":"pkg:npm/node-forge@1.4.0?package-id=c1e5f20287afef44","name":"node-forge","version":"1.4.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause OR GPL-2.0"],"cpes":["cpe:2.3:a:digitalbazaar:forge:1.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/node-forge@1.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-jc66-7q78-782g","dataSource":"https://github.com/advisories/GHSA-jc66-7q78-782g","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/digitalbazaar/forge/security/advisories/GHSA-jc66-7q78-782g","https://nvd.nist.gov/vuln/detail/CVE-2026-118782","https://github.com/digitalbazaar/forge/commit/d9584aa56824972858366d5187b3d29e46bf3656","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1"],"description":"Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118782","epss":0.00125,"percentile":0.02194,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118782","cwe":"CWE-354","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-118782","cwe":"CWE-1284","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["1.4.1"],"state":"fixed","available":[{"version":"1.4.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.09375},"relatedVulnerabilities":[{"id":"CVE-2026-118782","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118782","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/digitalbazaar/forge/commit/d9584aa56824972858366d5187b3d29e46bf3656","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","https://github.com/digitalbazaar/forge/security/advisories/GHSA-jc66-7q78-782g"],"description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge accepted a PKCS#12 MAC or PKCS#12 password-based encryption iteration count of zero or less. pki.pbe.generatePkcs12Key() then returned a constant key independent of the password and salt, allowing crafted PKCS#12 input processed by forge.pkcs12.pkcs12FromAsn1() to bypass password-based integrity checks. Predictable encryption keys and IVs also affected PKCS#12 PBE using pbeWithSHAAnd3-KeyTripleDES-CBC or pbewithSHAAnd40BitRC2-CBC, including shrouded key bags, encrypted SafeContents, and PKCS#8 ENCRYPTED PRIVATE KEY input processed independently by forge.pki.decryptPrivateKeyInfo(). PBES2/PBKDF2-encrypted content is unaffected. This issue is fixed in version 1.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118782","epss":0.00125,"percentile":0.02194,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118782","cwe":"CWE-354","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-118782","cwe":"CWE-1284","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"node-forge","version":"1.4.0"}},"found":{"vulnerabilityID":"GHSA-jc66-7q78-782g","versionConstraint":"<=1.4.0 (semantic)"},"fix":{"suggestedVersion":"1.4.1"}}],"artifact":{"id":"pkg:npm/node-forge@1.4.0?package-id=c1e5f20287afef44","name":"node-forge","version":"1.4.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause OR GPL-2.0"],"cpes":["cpe:2.3:a:digitalbazaar:forge:1.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/node-forge@1.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-4487-j8r4-4g2f","dataSource":"https://github.com/advisories/GHSA-4487-j8r4-4g2f","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/digitalbazaar/forge/security/advisories/GHSA-4487-j8r4-4g2f","https://nvd.nist.gov/vuln/detail/CVE-2026-118780","https://github.com/digitalbazaar/forge/commit/f6555609bd30f442fbfacd543155928ceccf98d0","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1"],"description":"Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118780","epss":0.00172,"percentile":0.06586,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118780","cwe":"CWE-295","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-118780","cwe":"CWE-471","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["1.4.1"],"state":"fixed","available":[{"version":"1.4.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.05761999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-118780","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118780","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/digitalbazaar/forge/commit/f6555609bd30f442fbfacd543155928ceccf98d0","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","https://github.com/digitalbazaar/forge/security/advisories/GHSA-4487-j8r4-4g2f"],"description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used pki.verifyCertificateChain(), pki.createCaStore(), duplicate subject names to process the relevant input or security decision. node-forge modified the CA store while trying certificates that shared a subject name during pki.verifyCertificateChain(). A failed chain verification could permanently remove trusted CA certificates from the store, causing later valid chains to fail and creating a persistent availability impact for applications that reused the store. This issue is fixed in version 1.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118780","epss":0.00172,"percentile":0.06586,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118780","cwe":"CWE-295","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-118780","cwe":"CWE-471","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"node-forge","version":"1.4.0"}},"found":{"vulnerabilityID":"GHSA-4487-j8r4-4g2f","versionConstraint":"<=1.4.0 (semantic)"},"fix":{"suggestedVersion":"1.4.1"}}],"artifact":{"id":"pkg:npm/node-forge@1.4.0?package-id=c1e5f20287afef44","name":"node-forge","version":"1.4.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause OR GPL-2.0"],"cpes":["cpe:2.3:a:digitalbazaar:forge:1.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/node-forge@1.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-h6cr-wjv9-3cpp","dataSource":"https://github.com/advisories/GHSA-h6cr-wjv9-3cpp","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/digitalbazaar/forge/security/advisories/GHSA-h6cr-wjv9-3cpp","https://nvd.nist.gov/vuln/detail/CVE-2026-118781","https://github.com/digitalbazaar/forge/commit/e96c47b7f006dec66fb7bb1934e7375498b04a72","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1"],"description":"Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"exploitabilityScore":1.5,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118781","epss":0.00119,"percentile":0.01735,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118781","cwe":"CWE-835","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.4.1"],"state":"fixed","available":[{"version":"1.4.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.035105},"relatedVulnerabilities":[{"id":"CVE-2026-118781","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118781","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/digitalbazaar/forge/commit/e96c47b7f006dec66fb7bb1934e7375498b04a72","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","https://github.com/digitalbazaar/forge/security/advisories/GHSA-h6cr-wjv9-3cpp"],"description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used BigInteger.prototype.modInverse(), bnModInverse(), lib/jsbn.js, RSA public exponent e to process the relevant input or security decision. node-forge's bundled jsbn implementation entered an infinite loop when BigInteger.prototype.modInverse() received a negative value or modulus. An attacker who could control the RSA public exponent passed to key generation, or a direct modInverse() operand, could block the Node.js event loop at full CPU. Parsed DER, PEM, JWK, PKCS#12, X.509, and TLS values are unsigned and cannot trigger this issue. This issue is fixed in version 1.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"exploitabilityScore":1.5,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118781","epss":0.00119,"percentile":0.01735,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118781","cwe":"CWE-835","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"node-forge","version":"1.4.0"}},"found":{"vulnerabilityID":"GHSA-h6cr-wjv9-3cpp","versionConstraint":"<=1.4.0 (semantic)"},"fix":{"suggestedVersion":"1.4.1"}}],"artifact":{"id":"pkg:npm/node-forge@1.4.0?package-id=c1e5f20287afef44","name":"node-forge","version":"1.4.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause OR GPL-2.0"],"cpes":["cpe:2.3:a:digitalbazaar:forge:1.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/node-forge@1.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-cxww-7g56-2vh6","dataSource":"https://github.com/advisories/GHSA-cxww-7g56-2vh6","namespace":"github:language:github-action","severity":"High","urls":["https://github.com/actions/download-artifact/security/advisories/GHSA-cxww-7g56-2vh6","https://github.com/advisories/GHSA-6q32-hq47-5qq3","https://snyk.io/research/zip-slip-vulnerability","https://github.com/actions/download-artifact/releases/tag/v4.1.3"],"description":"@actions/download-artifact has an Arbitrary File Write via artifact extraction","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.3,"exploitabilityScore":2.1,"impactScore":5.2},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.6},"vendorMetadata":{}}],"fix":{"versions":["4.1.3"],"state":"fixed","available":[{"version":"4.1.3","date":"2025-09-04","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"stock-matcher","searchedBy":{"language":"","namespace":"github:language:github-action","package":{"name":"actions/download-artifact","version":"v4"}},"found":{"vulnerabilityID":"GHSA-cxww-7g56-2vh6","versionConstraint":">=4.0.0,<4.1.3 (unknown)"},"fix":{"suggestedVersion":"4.1.3"}}],"artifact":{"id":"pkg:github/actions/download-artifact@v4?package-id=ca8785fee8298e4d","name":"actions/download-artifact","version":"v4","type":"github-action","locations":[{"path":"/.github/workflows/build-and-release.yml","accessPath":""}],"language":"","licenses":[],"cpes":["cpe:2.3:a:actions\\/download-artifact:actions\\/download-artifact:v4:*:*:*:*:*:*:*","cpe:2.3:a:actions\\/download-artifact:actions\\/download_artifact:v4:*:*:*:*:*:*:*","cpe:2.3:a:actions\\/download_artifact:actions\\/download-artifact:v4:*:*:*:*:*:*:*","cpe:2.3:a:actions\\/download_artifact:actions\\/download_artifact:v4:*:*:*:*:*:*:*","cpe:2.3:a:actions\\/download:actions\\/download-artifact:v4:*:*:*:*:*:*:*","cpe:2.3:a:actions\\/download:actions\\/download_artifact:v4:*:*:*:*:*:*:*"],"purl":"pkg:github/actions/download-artifact@v4","upstreams":[]}},{"vulnerability":{"id":"GHSA-cxww-7g56-2vh6","dataSource":"https://github.com/advisories/GHSA-cxww-7g56-2vh6","namespace":"github:language:github-action","severity":"High","urls":["https://github.com/actions/download-artifact/security/advisories/GHSA-cxww-7g56-2vh6","https://github.com/advisories/GHSA-6q32-hq47-5qq3","https://snyk.io/research/zip-slip-vulnerability","https://github.com/actions/download-artifact/releases/tag/v4.1.3"],"description":"@actions/download-artifact has an Arbitrary File Write via artifact extraction","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.3,"exploitabilityScore":2.1,"impactScore":5.2},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.6},"vendorMetadata":{}}],"fix":{"versions":["4.1.3"],"state":"fixed","available":[{"version":"4.1.3","date":"2025-09-04","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"stock-matcher","searchedBy":{"language":"","namespace":"github:language:github-action","package":{"name":"actions/download-artifact","version":"v4"}},"found":{"vulnerabilityID":"GHSA-cxww-7g56-2vh6","versionConstraint":">=4.0.0,<4.1.3 (unknown)"},"fix":{"suggestedVersion":"4.1.3"}}],"artifact":{"id":"pkg:github/actions/download-artifact@v4?package-id=05a3bb4bd8ad5ba1","name":"actions/download-artifact","version":"v4","type":"github-action","locations":[{"path":"/.github/workflows/create-artifact.yml","accessPath":""}],"language":"","licenses":[],"cpes":["cpe:2.3:a:actions\\/download-artifact:actions\\/download-artifact:v4:*:*:*:*:*:*:*","cpe:2.3:a:actions\\/download-artifact:actions\\/download_artifact:v4:*:*:*:*:*:*:*","cpe:2.3:a:actions\\/download_artifact:actions\\/download-artifact:v4:*:*:*:*:*:*:*","cpe:2.3:a:actions\\/download_artifact:actions\\/download_artifact:v4:*:*:*:*:*:*:*","cpe:2.3:a:actions\\/download:actions\\/download-artifact:v4:*:*:*:*:*:*:*","cpe:2.3:a:actions\\/download:actions\\/download_artifact:v4:*:*:*:*:*:*:*"],"purl":"pkg:github/actions/download-artifact@v4","upstreams":[]}}],"source":{"type":"file","target":"AikidoSec/safe-chain"},"distro":{"name":"","version":"","idLike":null},"descriptor":{"name":"grype","version":"0.121.0","configuration":{"output":["json"],"file":"./grype.json","pretty":false,"distro":"","add-cpes-if-none":false,"output-template-file":"","check-for-app-update":true,"only-fixed":false,"only-notfixed":false,"ignore-wontfix":"","platform":"","search":{"scope":"squashed","unindexed-archives":false,"indexed-archives":true},"ignore":[{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"kernel-headers","version":"","language":"","type":"rpm","location":"","upstream-name":"kernel"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux(-.*)?-headers-.*","version":"","language":"","type":"deb","location":"","upstream-name":"linux.*"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux-libc-dev","version":"","language":"","type":"deb","location":"","upstream-name":"linux"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux-kbuild-.*","version":"","language":"","type":"deb","location":"","upstream-name":"linux.*"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"}],"exclude":[],"externalSources":{"enable":false,"maven":{"searchUpstreamBySha1":true,"baseUrl":"https://search.maven.org/solrsearch/select","rateLimit":300000000}},"match":{"java":{"using-cpes":false},"jvm":{"using-cpes":true},"dotnet":{"using-cpes":false},"golang":{"using-cpes":false,"always-use-cpe-for-stdlib":false,"allow-main-module-pseudo-version-comparison":false},"javascript":{"using-cpes":false},"python":{"using-cpes":false},"ruby":{"using-cpes":false},"rust":{"using-cpes":false},"hex":{"using-cpes":false},"stock":{"using-cpes":true},"dpkg":{"using-cpes":false,"missing-epoch-strategy":"zero","use-cpes-for-eol":false},"rpm":{"using-cpes":false,"missing-epoch-strategy":"auto","use-cpes-for-eol":false}},"fail-on-severity":"","registry":{"insecure-skip-tls-verify":false,"insecure-use-http":false,"ca-cert":""},"show-suppressed":false,"include-matcher-suppressions":false,"by-cve":false,"SortBy":{"sort-by":"risk"},"name":"","default-image-pull-source":"","from":null,"vex-documents":[],"vex-add":[],"match-upstream-kernel-headers":false,"fix-channel":{"redhat-eus":{"apply":"auto","versions":">= 8.0"},"ubuntu-esm":{"apply":"auto","versions":""}},"timestamp":true,"alerts":{"enable-eol-distro-warnings":true},"db":{"cache-dir":"$HOME/.cache/grype/db","update-url":"https://grype.anchore.io/databases","ca-cert":"","auto-update":true,"validate-by-hash-on-start":true,"validate-age":true,"max-allowed-built-age":432000000000000,"require-update-check":false,"update-available-timeout":30000000000,"update-download-timeout":300000000000,"max-update-check-frequency":7200000000000},"exp":{},"dev":{"db":{"debug":false}}},"db":{"status":{"schemaVersion":"v6.1.10","from":"https://grype.anchore.io/databases/v6/vulnerability-db_v6.1.10_2026-11-01T00:24:34Z_1793514012.tar.zst?checksum=sha256%3Ad0e1af9e6491440e1a671d0a0aafc32c5c7cb5cda787dcec3482799ef298f31c","built":"2026-11-01T06:20:12Z","path":"$HOME/.cache/grype/db/6/vulnerability.db","valid":true},"providers":{"alma":{"captured":"2026-11-01T00:24:39Z","input":"xxh64:d398731e6455b022"},"alpine":{"captured":"2026-11-01T00:24:47Z","input":"xxh64:c40c8985935df81b"},"amazon":{"captured":"2026-11-01T00:24:37Z","input":"xxh64:ee129200b14d5c8a"},"arch":{"captured":"2026-11-01T00:24:47Z","input":"xxh64:14f6c24dd6cd12c8"},"bitnami":{"captured":"2026-11-01T00:24:34Z","input":"xxh64:971619846357ae10"},"chainguard":{"captured":"2026-11-01T00:24:48Z","input":"xxh64:dfbf78c7fc58a603"},"chainguard-libraries":{"captured":"2026-11-01T00:24:50Z","input":"xxh64:db9c34dd1b7bc8d0"},"debian":{"captured":"2026-11-01T00:24:52Z","input":"xxh64:078c82a49c8cb529"},"echo":{"captured":"2026-11-01T00:24:41Z","input":"xxh64:1d0df98736854a48"},"eol":{"captured":"2026-11-01T00:24:59Z","input":"xxh64:0f2164b3e62ba44b"},"epss":{"captured":"2026-11-01T00:25:00Z","input":"xxh64:0d4c3b8d2c2e5188"},"fedora":{"captured":"2026-11-01T00:24:40Z","input":"xxh64:28fe3d1d8ae41f9b"},"github":{"captured":"2026-11-01T00:24:57Z","input":"xxh64:076a86d2dc5c9e83"},"govulndb":{"captured":"2026-11-01T00:24:45Z","input":"xxh64:56e169604e12196e"},"hummingbird":{"captured":"2026-11-01T00:27:26Z","input":"xxh64:e86abd0466410fb6"},"kev":{"captured":"2026-11-01T00:25:06Z","input":"xxh64:cb0f4041bd51c379"},"mariner":{"captured":"2026-11-01T00:24:56Z","input":"xxh64:003337efdc7e1888"},"minimos":{"captured":"2026-11-01T00:24:56Z","input":"xxh64:219c30ffded7a12c"},"nvd":{"captured":"2026-11-01T00:25:41Z","input":"xxh64:75e41eec415fdb0a"},"oracle":{"captured":"2026-11-01T00:24:42Z","input":"xxh64:0546c2dd11a85c07"},"photon":{"captured":"2026-11-01T00:24:37Z","input":"xxh64:8dbfd0c521fd470a"},"rhel":{"captured":"2026-11-01T01:08:40Z","input":"xxh64:57c5e6a7f9f134ff"},"secureos":{"captured":"2026-11-01T00:24:34Z","input":"xxh64:ac7fa7f44e8ed7dd"},"sles":{"captured":"2026-11-01T00:26:56Z","input":"xxh64:025a1565b2cc7cdf"},"ubuntu":{"captured":"2026-11-01T00:25:58Z","input":"xxh64:9ab4d29f0ea6275d"},"wolfi":{"captured":"2026-11-01T00:25:02Z","input":"xxh64:d27b08e998baab8e"}}},"timestamp":"2026-11-02T03:06:26.523865927Z"}}