{"matches":[{"vulnerability":{"id":"GHSA-45c3-73f7-pv4m","dataSource":"https://github.com/advisories/GHSA-45c3-73f7-pv4m","namespace":"github:language:python","severity":"High","urls":["https://github.com/rthalley/dnspython/security/advisories/GHSA-45c3-73f7-pv4m","https://nvd.nist.gov/vuln/detail/CVE-2026-114605","https://github.com/rthalley/dnspython/commit/b485e460c266540a1a09ca6d8d1d7b685b1d3023","https://github.com/rthalley/dnspython/releases/tag/v2.9.0"],"description":"dnspython dns.name.from_wire_parser() excessive CPU use","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-114605","epss":0.00466,"percentile":0.40323,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-114605","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.9.0"],"state":"fixed","available":[{"version":"2.9.0","date":"2026-10-27","kind":"first-observed"}]},"advisories":[],"risk":0.3495},"relatedVulnerabilities":[{"id":"CVE-2026-114605","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114605","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/rthalley/dnspython/commit/b485e460c266540a1a09ca6d8d1d7b685b1d3023","https://github.com/rthalley/dnspython/releases/tag/v2.9.0","https://github.com/rthalley/dnspython/security/advisories/GHSA-45c3-73f7-pv4m"],"description":"dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.from_wire_parser follows attacker-controlled DNS compression pointer chains without a hop limit. A malicious DNS wire-format message can force excessive pointer traversal during name decompression, causing high CPU use, application degradation, or denial of service in applications that process untrusted DNS messages. This issue is fixed in version 2.9.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-114605","epss":0.00466,"percentile":0.40323,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-114605","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"dnspython","version":"2.8.0"}},"found":{"vulnerabilityID":"GHSA-45c3-73f7-pv4m","versionConstraint":"<2.9.0 (python)"},"fix":{"suggestedVersion":"2.9.0"}}],"artifact":{"id":"pkg:pypi/dnspython@2.8.0?package-id=cccc24be988cb62c","name":"dnspython","version":"2.8.0","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-dnspython:python-dnspython:2.8.0:*:*:*:*:*:*:*","cpe:2.3:a:python-dnspython:python_dnspython:2.8.0:*:*:*:*:*:*:*","cpe:2.3:a:python_dnspython:python-dnspython:2.8.0:*:*:*:*:*:*:*","cpe:2.3:a:python_dnspython:python_dnspython:2.8.0:*:*:*:*:*:*:*","cpe:2.3:a:dnspython:python-dnspython:2.8.0:*:*:*:*:*:*:*","cpe:2.3:a:dnspython:python_dnspython:2.8.0:*:*:*:*:*:*:*","cpe:2.3:a:python-dnspython:dnspython:2.8.0:*:*:*:*:*:*:*","cpe:2.3:a:python_dnspython:dnspython:2.8.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-dnspython:2.8.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_dnspython:2.8.0:*:*:*:*:*:*:*","cpe:2.3:a:dnspython:dnspython:2.8.0:*:*:*:*:*:*:*","cpe:2.3:a:python:dnspython:2.8.0:*:*:*:*:*:*:*"],"purl":"pkg:pypi/dnspython@2.8.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-27r3-jxmh-p828","dataSource":"https://github.com/advisories/GHSA-27r3-jxmh-p828","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/expressjs/body-parser/security/advisories/GHSA-27r3-jxmh-p828","https://nvd.nist.gov/vuln/detail/CVE-2026-111181","https://github.com/expressjs/body-parser/commit/1260c3845f54502a05a87594f09a334786bb34d7","https://github.com/expressjs/body-parser/commit/f7075eae3a84c3473ab4bf0a777da28db208e916","https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/body-parser/releases/tag/1.20.9","https://github.com/expressjs/body-parser/releases/tag/v2.4.0"],"description":"body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111181","epss":0.00388,"percentile":0.32923,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111181","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["2.4.0"],"state":"fixed","available":[{"version":"2.4.0","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.29100000000000004},"relatedVulnerabilities":[{"id":"CVE-2026-111181","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111181","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/body-parser/security/advisories/GHSA-27r3-jxmh-p828"],"description":"body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding such as gzip, body-parser pipes it into a decompression stream and, after reading the body, leaves that stream with no error listener. A payload of one valid compressed frame followed by trailing bytes decodes and the application responds normally, but the trailing bytes then reach the already-finished decoder, which emits an error that is re-thrown as an uncaught exception and terminates the process. No matching route is required because body parsing runs before routing, so any endpoint that parses a body is affected. The issue is fixed in body-parser 2.4.0 and 1.20.9, and users should upgrade to one of those versions or later. As a workaround, disable request-body inflation (set the body-parser inflate option to false) so encoded requests are rejected before any decompression stream is created.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111181","epss":0.00388,"percentile":0.32923,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111181","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"body-parser","version":"2.3.0"}},"found":{"vulnerabilityID":"GHSA-27r3-jxmh-p828","versionConstraint":">=2.0.0,<2.4.0 (semantic)"},"fix":{"suggestedVersion":"2.4.0"}}],"artifact":{"id":"pkg:npm/body-parser@2.3.0?package-id=ca309967e0c601c9","name":"body-parser","version":"2.3.0","type":"npm","locations":[{"path":"/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:openjsf:body-parser:2.3.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/body-parser@2.3.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-vxq7-64xx-v4gw","dataSource":"https://github.com/advisories/GHSA-vxq7-64xx-v4gw","namespace":"github:language:python","severity":"High","urls":["https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw","https://nvd.nist.gov/vuln/detail/CVE-2026-97689","https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed","https://github.com/urllib3/urllib3/releases/tag/2.8.0"],"description":"urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","metrics":{"baseScore":8.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-97689","epss":0.00335,"percentile":0.26859,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-97689","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.8.0"],"state":"fixed","available":[{"version":"2.8.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.27470000000000006},"relatedVulnerabilities":[{"id":"CVE-2026-97689","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97689","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed","https://github.com/urllib3/urllib3/releases/tag/2.8.0","https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw"],"description":"urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a length bound. The trigger is that a malicious server returns Transfer-Encoding: chunked followed by a very long run of bytes without a newline. The attack mechanism is that a malicious HTTP server sends a very long unterminated chunk-size line. The impact is that unbounded memory allocation can exhaust the client process. This issue is fixed in version 2.8.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-97689","epss":0.00335,"percentile":0.26859,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-97689","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"urllib3","version":"2.7.0"}},"found":{"vulnerabilityID":"GHSA-vxq7-64xx-v4gw","versionConstraint":">=1.10.3,<2.8.0 (python)"},"fix":{"suggestedVersion":"2.8.0"}}],"artifact":{"id":"pkg:pypi/urllib3@2.7.0?package-id=f15e232a431c0539","name":"urllib3","version":"2.7.0","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python:urllib3:2.7.0:*:*:*:*:*:*:*"],"purl":"pkg:pypi/urllib3@2.7.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-6pq8-jhm2-2vcw","dataSource":"https://github.com/advisories/GHSA-6pq8-jhm2-2vcw","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw","https://nvd.nist.gov/vuln/detail/CVE-2026-110816","https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727","https://github.com/ljharb/qs/releases/tag/v6.16.1"],"description":"qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110816","epss":0.00368,"percentile":0.30715,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110816","cwe":"CWE-248","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-110816","cwe":"CWE-704","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}],"fix":{"versions":["6.16.1"],"state":"fixed","available":[{"version":"6.16.1","date":"2026-10-27","kind":"first-observed"}]},"advisories":[],"risk":0.19872},"relatedVulnerabilities":[{"id":"CVE-2026-110816","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110816","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727","https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw"],"description":"### Summary\n\n\n\n`qs.stringify` with `arrayFormat: 'comma'` throws `TypeError: Cannot convert object to primitive value` when an array element cannot be coerced to a string, such as an object with an own non-callable `toString` (`{ \"toString\": \"x\" }`) or a null-prototype object. The comma format joins array elements with `Array.prototype.join` and, under `encodeValuesOnly`, first passes each element through `String()` in `utils.encode`; neither guards against an element whose string coercion fails.\n\n\n\n### Details\n\n\n\nIn `lib/stringify.js`, the comma branch collapses the array with `obj.join(',')`. For an element whose own `toString` is not callable, `ToPrimitive` skips it, falls through to `Object.prototype.valueOf` (which returns the object itself), and throws. Under `encodeValuesOnly: true`, the same element first reaches `String(str)` in `utils.encode` (`lib/utils.js`) and throws there. Nested arrays (`{ \"a\": [[{ \"toString\": \"x\" }]] }`) throw the same way, through `Array.prototype.toString`. The `indices`, `brackets`, and `repeat` formats walk into object elements instead of coercing them, and are not affected.\n\n\n\nSuch elements can come from untrusted input. `JSON.parse` produces `{ \"a\": [{ \"toString\": \"x\" }] }` with no qs option involved. `qs.parse(\"a[0][toString]=x\", { allowPrototypes: true })` keeps the `toString` key, and `qs.parse(\"a[][b]=c\", { plainObjects: true })` produces a null-prototype element; the default parse options drop `toString` and produce ordinary objects, which do not throw. Express 4's default `query parser`, Express 5's `extended` query parser, and body-parser's `urlencoded({ extended: true })` all call `qs.parse` with `allowPrototypes: true`.\n\n\n\n#### PoC\n\n\n\n```js\n\n\n\nvar qs = require(\"qs\");\n\n\n\nqs.stringify(JSON.parse(\"{\\\"a\\\":[{\\\"toString\\\":\\\"x\\\"}]}\"), { arrayFormat: \"comma\" });\n\n\n\nqs.stringify(qs.parse(\"a[0][toString]=x\", { allowPrototypes: true }), { arrayFormat: \"comma\" });\n\n\n\nqs.stringify(qs.parse(\"a[][b]=c\", { plainObjects: true }), { arrayFormat: \"comma\", encodeValuesOnly: true });\n\n\n\n// TypeError: Cannot convert object to primitive value\n\n\n\n```\n\n\n\n#### Fix\n\n\n\nApplied in a952e75 on `main` and released as v6.16.1: an element whose string coercion would fail is coerced to its primitive `valueOf`, if any, or else to `Object.prototype.toString`, so it renders as `[object Object]`, the same as any other object element already does under the comma format. Nested arrays are walked the way `join` walks them. Every input that did not previously throw serializes exactly as before, and a `toString` or `valueOf` that itself throws still propagates.\n\n\n\n### Affected versions\n\n\n\n`>=6.7.0 <6.16.1`, fixed in v6.16.1.\n\n\n\nThe `join` path was introduced with the comma format in b84acba and first shipped in v6.7.0; v6.6.x and earlier ignore `arrayFormat: 'comma'` and are not affected. The `encodeValuesOnly` `String()` site was introduced in 4c4b23d (v6.11.1); before that, the same input throws at `join`. Every release from v6.7.0 through v6.16.0 is affected.\n\n\n\n### Impact\n\n\n\nAn unauthenticated request can make any code path that re-serializes attacker-influenced data with `qs.stringify` and `arrayFormat: 'comma'` (for example, rebuilding a query string from `req.query` for a redirect or an upstream request, or serializing a parsed JSON body) throw synchronously. In a typical Node.js HTTP framework the throw is caught by the framework error boundary and the affected request returns a 500; the process survives and other requests are unaffected. Where the call runs outside an error boundary, such as an `async` Express 4 handler (where the throw becomes an unhandled promise rejection) or a bare `http` request handler, the process exits, so the impact in that case depends on the application error handling rather than on qs. The default `arrayFormat` (`indices`) is not affected.","cvss":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110816","epss":0.00368,"percentile":0.30715,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110816","cwe":"CWE-248","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-110816","cwe":"CWE-704","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"qs","version":"6.16.0"}},"found":{"vulnerabilityID":"GHSA-6pq8-jhm2-2vcw","versionConstraint":">=6.7.0,<=6.16.0 (semantic)"},"fix":{"suggestedVersion":"6.16.1"}}],"artifact":{"id":"pkg:npm/qs@6.16.0?package-id=2fa6a2c672f0b459","name":"qs","version":"6.16.0","type":"npm","locations":[{"path":"/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:qs_project:qs:6.16.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/qs@6.16.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-3g3m-2fjr-6pw4","dataSource":"https://github.com/advisories/GHSA-3g3m-2fjr-6pw4","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/node-glob/security/advisories/GHSA-3g3m-2fjr-6pw4","https://nvd.nist.gov/vuln/detail/CVE-2026-118773","https://github.com/isaacs/node-glob/commit/4682e8c9babee1b385202ede36389634e12076d7","https://github.com/isaacs/node-glob/releases/tag/v14.0.2"],"description":"Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118773","epss":0.0035,"percentile":0.28709,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118773","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["14.0.2"],"state":"fixed","available":[{"version":"14.0.2","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.19774999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-118773","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118773","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-glob/commit/4682e8c9babee1b385202ede36389634e12076d7","https://github.com/isaacs/node-glob/releases/tag/v14.0.2","https://github.com/isaacs/node-glob/security/advisories/GHSA-3g3m-2fjr-6pw4"],"description":"Glob matches files using patterns the shell uses. From 9.0.0 until 14.0.2, abort branches in src/walker.ts, including GlobUtil.walkCB(), GlobUtil.walkCB2(), GlobUtil.walkCBSync(), and GlobUtil.walkCB2Sync(), invoke the callbacks without returning. After AbortSignal or AbortSignal.timeout() rejects or emits an error, execution can continue into processor.processPatterns(), readdirCB(), and recursive traversal. The issue affects glob() and globStream() when applications expose attacker-influenced patterns or directory trees and rely on cancellation as a traversal budget. Repeated timed-out requests can stack background filesystem operations and CPU work, degrading worker throughput or service availability; no confidentiality or integrity impact was observed. This issue is fixed in 14.0.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118773","epss":0.0035,"percentile":0.28709,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118773","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"glob","version":"13.0.6"}},"found":{"vulnerabilityID":"GHSA-3g3m-2fjr-6pw4","versionConstraint":">=9.0.0,<=14.0.1 (semantic)"},"fix":{"suggestedVersion":"14.0.2"}}],"artifact":{"id":"pkg:npm/glob@13.0.6?package-id=425c28c98c6e82a4","name":"glob","version":"13.0.6","type":"npm","locations":[{"path":"/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:isaacs:glob:13.0.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/glob@13.0.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-gh4c-6fx4-qh6g","dataSource":"https://github.com/advisories/GHSA-gh4c-6fx4-qh6g","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g","https://nvd.nist.gov/vuln/detail/CVE-2026-97688","https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f","https://github.com/urllib3/urllib3/releases/tag/2.8.0"],"description":"urllib3: Chunked Deflate streaming can enter an infinite loop","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-97688","epss":0.00292,"percentile":0.21778,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-97688","cwe":"CWE-835","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["2.8.0"],"state":"fixed","available":[{"version":"2.8.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.17373999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-97688","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97688","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f","https://github.com/urllib3/urllib3/releases/tag/2.8.0","https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g"],"description":"urllib3 is an HTTP client library for Python. From 2.6.2 until 2.8.0, HTTPResponse.stream and HTTPResponse.read_chunked can enter an infinite loop because the Deflate decoder retains trailing bytes as unconsumed input after reaching end-of-stream and repeatedly decodes them without progress. The issue occurs when an untrusted server sends a chunked Deflate response whose decoded body exceeds a positive finite chunk size and whose encoded body has trailing bytes, specifically a response with Transfer-Encoding: chunked and Content-Encoding: deflate, content decoding enabled, and the positive finite amt=N streaming chunk size. The attack mechanism is that a malicious server returns a compressed chunked response with trailing bytes after the Deflate stream. The impact is excessive CPU usage and a request that does not complete, and network read timeouts do not interrupt the loop because no further socket read occurs. This issue is fixed in version 2.8.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-97688","epss":0.00292,"percentile":0.21778,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-97688","cwe":"CWE-835","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"urllib3","version":"2.7.0"}},"found":{"vulnerabilityID":"GHSA-gh4c-6fx4-qh6g","versionConstraint":">=2.6.2,<2.8.0 (python)"},"fix":{"suggestedVersion":"2.8.0"}}],"artifact":{"id":"pkg:pypi/urllib3@2.7.0?package-id=f15e232a431c0539","name":"urllib3","version":"2.7.0","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python:urllib3:2.7.0:*:*:*:*:*:*:*"],"purl":"pkg:pypi/urllib3@2.7.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-g3hv-75wg-m249","dataSource":"https://github.com/advisories/GHSA-g3hv-75wg-m249","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249","https://nvd.nist.gov/vuln/detail/CVE-2026-118764","https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1"],"description":"minimatch has potential denial of service via globparts amplification","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["11.0.1"],"state":"fixed","available":[{"version":"11.0.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.173145},"relatedVulnerabilities":[{"id":"CVE-2026-118764","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118764","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1","https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"10.2.6"}},"found":{"vulnerabilityID":"GHSA-g3hv-75wg-m249","versionConstraint":"<11.0.1 (semantic)"},"fix":{"suggestedVersion":"11.0.1"}}],"artifact":{"id":"pkg:npm/minimatch@10.2.6?package-id=414f79b9205a8947","name":"minimatch","version":"10.2.6","type":"npm","locations":[{"path":"/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:10.2.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@10.2.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-8988-9cw3-xx77","dataSource":"https://github.com/advisories/GHSA-8988-9cw3-xx77","namespace":"github:language:python","severity":"High","urls":["https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77","https://nvd.nist.gov/vuln/detail/CVE-2026-97687","https://github.com/urllib3/urllib3/pull/5093","https://github.com/urllib3/urllib3/commit/07408cec79d1856d81bb42c74a904a24fdb9e465","https://github.com/urllib3/urllib3/commit/b6447295fff7b38fdffc67e0df9712d60cef3cc3","https://github.com/urllib3/urllib3/releases/tag/2.8.0"],"description":"urllib3: HTTPS proxy TLS configuration may be ignored or overridden","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":7.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-97687","epss":0.00206,"percentile":0.10662,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-97687","cwe":"CWE-295","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-97687","cwe":"CWE-440","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.8.0"],"state":"fixed","available":[{"version":"2.8.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.15553},"relatedVulnerabilities":[{"id":"CVE-2026-97687","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97687","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/urllib3/urllib3/commit/07408cec79d1856d81bb42c74a904a24fdb9e465","https://github.com/urllib3/urllib3/commit/b6447295fff7b38fdffc67e0df9712d60cef3cc3","https://github.com/urllib3/urllib3/pull/5093","https://github.com/urllib3/urllib3/releases/tag/2.8.0","https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77"],"description":"urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mode, use_forwarding_for_https=True, and CERT_NONE configuration paths fail to remain separated because target-server TLS settings are incorrectly applied to the HTTPS proxy connection. The trigger is that an application uses an HTTPS proxy and configures target-server TLS settings that must remain separate from the proxy TLS handshake, including HTTPS forwarding with target-specific identity or credentials. Applying cert_reqs=CERT_NONE can overwrite proxy_ssl_context.verify_mode in place, and the mutation persists so later connections reusing the same context may connect to the HTTPS proxy without certificate verification. The attack mechanism is that an attacker intercepts and impersonates the HTTPS proxy after the effective proxy policy accepts the attacker's certificate. The impact is that the attacker can observe or modify forwarded traffic or receive a target TLS client certificate, while CONNECT tunneling still preserves the separate end-to-end target TLS connection. This issue is fixed in version 2.8.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"exploitabilityScore":2.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-97687","epss":0.00206,"percentile":0.10662,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-97687","cwe":"CWE-295","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-97687","cwe":"CWE-440","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"urllib3","version":"2.7.0"}},"found":{"vulnerabilityID":"GHSA-8988-9cw3-xx77","versionConstraint":">=1.26.0,<2.8.0 (python)"},"fix":{"suggestedVersion":"2.8.0"}}],"artifact":{"id":"pkg:pypi/urllib3@2.7.0?package-id=f15e232a431c0539","name":"urllib3","version":"2.7.0","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python:urllib3:2.7.0:*:*:*:*:*:*:*"],"purl":"pkg:pypi/urllib3@2.7.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-w74x-v6f9-j3xg","dataSource":"https://github.com/advisories/GHSA-w74x-v6f9-j3xg","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-w74x-v6f9-j3xg","https://nvd.nist.gov/vuln/detail/CVE-2026-110306","https://github.com/fastify/fast-uri/commit/39933a1f1422986f14e2d844f552238feb40f5d4","https://github.com/fastify/fast-uri/commit/597f254c86d151568511eeb9a1df761fd12520b3","https://github.com/fastify/fast-uri/commit/e60e716f41d1d73717e2d803d20b68d2c6d20a0f","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v2.4.8","https://github.com/fastify/fast-uri/releases/tag/v3.1.9","https://github.com/fastify/fast-uri/releases/tag/v4.2.3"],"description":"fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110306","epss":0.0025,"percentile":0.16356,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110306","cwe":"CWE-172","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-110306","cwe":"CWE-180","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["3.1.9"],"state":"fixed","available":[{"version":"3.1.9","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.13874999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-110306","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110306","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-w74x-v6f9-j3xg"],"description":"fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, fast-uri percent-decodes the scheme component with the legacy global unescape() function before validating it, so an input whose decoded scheme is a dangerous token is emitted as a live scheme even though RFC 3986 does not allow percent-encoding in a scheme and no other parser accepts it. An application that screens dangerous schemes on the raw input and then stores or renders the normalized or resolved result can turn an inert string into an executable javascript, data, or vbscript URL, producing a stored or reflected cross-site scripting vector, and the equal() comparison treats an encoded and a plain scheme as the same, which can bypass equality-based allowlists. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to one of these versions or later. As a workaround, reject input whose scheme part contains a percent sign, or check the parsed scheme against an allowlist after normalization and use that same parsed result rather than the raw string.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110306","epss":0.0025,"percentile":0.16356,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110306","cwe":"CWE-172","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-110306","cwe":"CWE-180","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"3.1.8"}},"found":{"vulnerabilityID":"GHSA-w74x-v6f9-j3xg","versionConstraint":">=3.0.0,<3.1.9 (semantic)"},"fix":{"suggestedVersion":"3.1.9"}}],"artifact":{"id":"pkg:npm/fast-uri@3.1.8?package-id=71a819f53d6e99a9","name":"fast-uri","version":"3.1.8","type":"npm","locations":[{"path":"/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:openjsf:fast-uri:3.1.8:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@3.1.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-wjr9-j795-jxcr","dataSource":"https://github.com/advisories/GHSA-wjr9-j795-jxcr","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-wjr9-j795-jxcr","https://nvd.nist.gov/vuln/detail/CVE-2026-110180","https://github.com/fastify/fast-uri/commit/58c183d0b168ad87f98773266444ce1f6375803a","https://github.com/fastify/fast-uri/commit/ddfc6a51122dfce0365655f04479fc3adb7f6b3c","https://github.com/fastify/fast-uri/commit/f6d46dfeab025d0c440485f4ae29fa4f14707646","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v2.4.8","https://github.com/fastify/fast-uri/releases/tag/v3.1.9","https://github.com/fastify/fast-uri/releases/tag/v4.2.3"],"description":"fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110180","epss":0.00255,"percentile":0.17126,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110180","cwe":"CWE-20","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-110180","cwe":"CWE-436","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["3.1.9"],"state":"fixed","available":[{"version":"3.1.9","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.12494999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-110180","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110180","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-wjr9-j795-jxcr"],"description":"fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions from 2.4.2 through 2.4.7, from 3.1.3 through 3.1.8, and from 4.0.1 through 4.2.2, for HTTP-family schemes the canonicalizeHost() function passes the parsed host to the WHATWG URL parser and adopts its hostname without checking that the parser consumed the entire input as a host, so the authority can be silently rewritten: data before an at-sign is dropped and tab, carriage-return, and line-feed characters are stripped, with no error reported. An application that enforces host-based policy such as denylists, loopback filtering, redirect validation, or outbound proxy routing on one representation can then see the canonical host diverge from what it checked, allowing traffic to be steered to an unintended destination. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to one of these versions or later. As a workaround, reject an authority that contains more than one at-sign or any tab, carriage-return, or line-feed before calling fast-uri, or treat any non-empty parse error as fatal and compare hosts only from the same parse result.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110180","epss":0.00255,"percentile":0.17126,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110180","cwe":"CWE-20","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-110180","cwe":"CWE-436","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"3.1.8"}},"found":{"vulnerabilityID":"GHSA-wjr9-j795-jxcr","versionConstraint":">=3.1.3,<3.1.9 (semantic)"},"fix":{"suggestedVersion":"3.1.9"}}],"artifact":{"id":"pkg:npm/fast-uri@3.1.8?package-id=71a819f53d6e99a9","name":"fast-uri","version":"3.1.8","type":"npm","locations":[{"path":"/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:openjsf:fast-uri:3.1.8:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@3.1.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-333x-w4r6-6crp","dataSource":"https://github.com/advisories/GHSA-333x-w4r6-6crp","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-333x-w4r6-6crp","https://nvd.nist.gov/vuln/detail/CVE-2026-110725","https://github.com/fastify/fast-uri/commit/39e6493c1356f30a0084171627eb266786e1620e","https://github.com/fastify/fast-uri/commit/a9b8d67353630aab053cd727cf629023dd018d2b","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v2.4.8","https://github.com/fastify/fast-uri/releases/tag/v3.1.9","https://github.com/fastify/fast-uri/releases/tag/v4.2.3"],"description":"fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110725","epss":0.00302,"percentile":0.23001,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110725","cwe":"CWE-41","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-110725","cwe":"CWE-116","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["3.1.9"],"state":"fixed","available":[{"version":"3.1.9","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.10117},"relatedVulnerabilities":[{"id":"CVE-2026-110725","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110725","namespace":"nvd:cpe","severity":"Low","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-333x-w4r6-6crp"],"description":"fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, when serialize(), normalize(), or resolve() are called with the non-default option reference set to suffix on a reference that has no authority, the emitted relative reference can contain a bare colon in its first path segment without escaping it, even though RFC 3986 forbids that because it makes the string reparse as an absolute URI with a scheme. An application that serializes or normalizes a relative reference with the suffix option and then treats the result as a URI can turn inert input into a live javascript, data, or vbscript URL, a cross-site scripting vector, and the equal() comparison can conflate a scheme-bearing reference with a relative one. Exposure is limited to applications using the non-default suffix reference option. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to one of these versions or later. As a workaround, avoid the suffix reference option on untrusted input, or percent-encode a colon in the first path segment of the result before treating it as a URI.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110725","epss":0.00302,"percentile":0.23001,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110725","cwe":"CWE-41","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-110725","cwe":"CWE-116","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"3.1.8"}},"found":{"vulnerabilityID":"GHSA-333x-w4r6-6crp","versionConstraint":">=3.0.0,<3.1.9 (semantic)"},"fix":{"suggestedVersion":"3.1.9"}}],"artifact":{"id":"pkg:npm/fast-uri@3.1.8?package-id=71a819f53d6e99a9","name":"fast-uri","version":"3.1.8","type":"npm","locations":[{"path":"/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:openjsf:fast-uri:3.1.8:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@3.1.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-xhq7-xmqj-769h","dataSource":"https://github.com/advisories/GHSA-xhq7-xmqj-769h","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-xhq7-xmqj-769h","https://nvd.nist.gov/vuln/detail/CVE-2026-110095","https://github.com/fastify/fast-uri/commit/048bbd0a252971be86d6579f0dfc87f8de5b9c47","https://github.com/fastify/fast-uri/commit/52774a5c35df36b0bbe439cd4c12c3dc0e50e3b9","https://github.com/fastify/fast-uri/commit/7c19f8b97ec51f1f20b4e3d9d5820cb8d5176058","https://github.com/fastify/fast-uri/commit/9eb8759a9825c046f57f7f695f1944bc39b88abd","https://github.com/fastify/fast-uri/commit/acc5c5d60c4209571789496e1732468911c7e12a","https://github.com/fastify/fast-uri/commit/b110a3571c37dfcf9d1c72ce2e2e178c78d1a424","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v2.4.8","https://github.com/fastify/fast-uri/releases/tag/v3.1.9","https://github.com/fastify/fast-uri/releases/tag/v4.2.3"],"description":"fast-uri vulnerable to improper path equivalence in relative reference normalization","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110095","epss":0.00289,"percentile":0.21549,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110095","cwe":"CWE-41","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["3.1.9"],"state":"fixed","available":[{"version":"3.1.9","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.096815},"relatedVulnerabilities":[{"id":"CVE-2026-110095","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110095","namespace":"nvd:cpe","severity":"Low","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-xhq7-xmqj-769h"],"description":"fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, the normalize() and serialize() functions apply RFC 3986 dot-segment removal to the path of a relative-path reference, even though that algorithm is defined only for the merged target path during resolution, so a leading parent-directory segment can be dropped and a document-relative reference can become root-relative. An application that normalizes an attacker-supplied or user-supplied relative reference and then resolves it, or uses it as a cache, deduplication, or authorization key, can have the reference escape its intended directory and point at a different resource. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to one of these versions or later. As a workaround, resolve a relative reference against its absolute base first and normalize the absolute result instead of normalizing the reference beforehand.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110095","epss":0.00289,"percentile":0.21549,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110095","cwe":"CWE-41","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"3.1.8"}},"found":{"vulnerabilityID":"GHSA-xhq7-xmqj-769h","versionConstraint":">=3.0.0,<3.1.9 (semantic)"},"fix":{"suggestedVersion":"3.1.9"}}],"artifact":{"id":"pkg:npm/fast-uri@3.1.8?package-id=71a819f53d6e99a9","name":"fast-uri","version":"3.1.8","type":"npm","locations":[{"path":"/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:openjsf:fast-uri:3.1.8:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@3.1.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-6q48-6c7w-9gw2","dataSource":"https://github.com/advisories/GHSA-6q48-6c7w-9gw2","namespace":"github:language:python","severity":"Critical","urls":["https://github.com/certifi/python-certifi/security/advisories/GHSA-6q48-6c7w-9gw2","https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576","https://emudhra.we-have-a-problem.com"],"description":"certifi bundles emSign root CAs with compromised intermediate CA keys","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":9.1},"vendorMetadata":{}}],"fix":{"versions":["2026.10.18"],"state":"fixed","available":[{"version":"2026.10.18","date":"2026-10-26","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"certifi","version":"2026.7.22"}},"found":{"vulnerabilityID":"GHSA-6q48-6c7w-9gw2","versionConstraint":">=2019.03.09,<2026.10.18 (python)"},"fix":{"suggestedVersion":"2026.10.18"}}],"artifact":{"id":"pkg:pypi/certifi@2026.7.22?package-id=94f96c9665535457","name":"certifi","version":"2026.7.22","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:certifi:certifi:2026.7.22:*:*:*:*:python:*:*"],"purl":"pkg:pypi/certifi@2026.7.22","upstreams":[]}}],"source":{"type":"file","target":"CycloneDX/cdxgen"},"distro":{"name":"","version":"","idLike":null},"descriptor":{"name":"grype","version":"0.121.0","configuration":{"output":["json"],"file":"./grype.json","pretty":false,"distro":"","add-cpes-if-none":false,"output-template-file":"","check-for-app-update":true,"only-fixed":false,"only-notfixed":false,"ignore-wontfix":"","platform":"","search":{"scope":"squashed","unindexed-archives":false,"indexed-archives":true},"ignore":[{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"kernel-headers","version":"","language":"","type":"rpm","location":"","upstream-name":"kernel"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux(-.*)?-headers-.*","version":"","language":"","type":"deb","location":"","upstream-name":"linux.*"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux-libc-dev","version":"","language":"","type":"deb","location":"","upstream-name":"linux"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux-kbuild-.*","version":"","language":"","type":"deb","location":"","upstream-name":"linux.*"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"}],"exclude":[],"externalSources":{"enable":false,"maven":{"searchUpstreamBySha1":true,"baseUrl":"https://search.maven.org/solrsearch/select","rateLimit":300000000}},"match":{"java":{"using-cpes":false},"jvm":{"using-cpes":true},"dotnet":{"using-cpes":false},"golang":{"using-cpes":false,"always-use-cpe-for-stdlib":false,"allow-main-module-pseudo-version-comparison":false},"javascript":{"using-cpes":false},"python":{"using-cpes":false},"ruby":{"using-cpes":false},"rust":{"using-cpes":false},"hex":{"using-cpes":false},"stock":{"using-cpes":true},"dpkg":{"using-cpes":false,"missing-epoch-strategy":"zero","use-cpes-for-eol":false},"rpm":{"using-cpes":false,"missing-epoch-strategy":"auto","use-cpes-for-eol":false}},"fail-on-severity":"","registry":{"insecure-skip-tls-verify":false,"insecure-use-http":false,"ca-cert":""},"show-suppressed":false,"include-matcher-suppressions":false,"by-cve":false,"SortBy":{"sort-by":"risk"},"name":"","default-image-pull-source":"","from":null,"vex-documents":[],"vex-add":[],"match-upstream-kernel-headers":false,"fix-channel":{"redhat-eus":{"apply":"auto","versions":">= 8.0"},"ubuntu-esm":{"apply":"auto","versions":""}},"timestamp":true,"alerts":{"enable-eol-distro-warnings":true},"db":{"cache-dir":"$HOME/.cache/grype/db","update-url":"https://grype.anchore.io/databases","ca-cert":"","auto-update":true,"validate-by-hash-on-start":true,"validate-age":true,"max-allowed-built-age":432000000000000,"require-update-check":false,"update-available-timeout":30000000000,"update-download-timeout":300000000000,"max-update-check-frequency":7200000000000},"exp":{},"dev":{"db":{"debug":false}}},"db":{"status":{"schemaVersion":"v6.1.10","from":"https://grype.anchore.io/databases/v6/vulnerability-db_v6.1.10_2026-11-01T00:24:34Z_1793514012.tar.zst?checksum=sha256%3Ad0e1af9e6491440e1a671d0a0aafc32c5c7cb5cda787dcec3482799ef298f31c","built":"2026-11-01T06:20:12Z","path":"$HOME/.cache/grype/db/6/vulnerability.db","valid":true},"providers":{"alma":{"captured":"2026-11-01T00:24:39Z","input":"xxh64:d398731e6455b022"},"alpine":{"captured":"2026-11-01T00:24:47Z","input":"xxh64:c40c8985935df81b"},"amazon":{"captured":"2026-11-01T00:24:37Z","input":"xxh64:ee129200b14d5c8a"},"arch":{"captured":"2026-11-01T00:24:47Z","input":"xxh64:14f6c24dd6cd12c8"},"bitnami":{"captured":"2026-11-01T00:24:34Z","input":"xxh64:971619846357ae10"},"chainguard":{"captured":"2026-11-01T00:24:48Z","input":"xxh64:dfbf78c7fc58a603"},"chainguard-libraries":{"captured":"2026-11-01T00:24:50Z","input":"xxh64:db9c34dd1b7bc8d0"},"debian":{"captured":"2026-11-01T00:24:52Z","input":"xxh64:078c82a49c8cb529"},"echo":{"captured":"2026-11-01T00:24:41Z","input":"xxh64:1d0df98736854a48"},"eol":{"captured":"2026-11-01T00:24:59Z","input":"xxh64:0f2164b3e62ba44b"},"epss":{"captured":"2026-11-01T00:25:00Z","input":"xxh64:0d4c3b8d2c2e5188"},"fedora":{"captured":"2026-11-01T00:24:40Z","input":"xxh64:28fe3d1d8ae41f9b"},"github":{"captured":"2026-11-01T00:24:57Z","input":"xxh64:076a86d2dc5c9e83"},"govulndb":{"captured":"2026-11-01T00:24:45Z","input":"xxh64:56e169604e12196e"},"hummingbird":{"captured":"2026-11-01T00:27:26Z","input":"xxh64:e86abd0466410fb6"},"kev":{"captured":"2026-11-01T00:25:06Z","input":"xxh64:cb0f4041bd51c379"},"mariner":{"captured":"2026-11-01T00:24:56Z","input":"xxh64:003337efdc7e1888"},"minimos":{"captured":"2026-11-01T00:24:56Z","input":"xxh64:219c30ffded7a12c"},"nvd":{"captured":"2026-11-01T00:25:41Z","input":"xxh64:75e41eec415fdb0a"},"oracle":{"captured":"2026-11-01T00:24:42Z","input":"xxh64:0546c2dd11a85c07"},"photon":{"captured":"2026-11-01T00:24:37Z","input":"xxh64:8dbfd0c521fd470a"},"rhel":{"captured":"2026-11-01T01:08:40Z","input":"xxh64:57c5e6a7f9f134ff"},"secureos":{"captured":"2026-11-01T00:24:34Z","input":"xxh64:ac7fa7f44e8ed7dd"},"sles":{"captured":"2026-11-01T00:26:56Z","input":"xxh64:025a1565b2cc7cdf"},"ubuntu":{"captured":"2026-11-01T00:25:58Z","input":"xxh64:9ab4d29f0ea6275d"},"wolfi":{"captured":"2026-11-01T00:25:02Z","input":"xxh64:d27b08e998baab8e"}}},"timestamp":"2026-11-02T03:07:43.914042253Z"}}