{"matches":[{"vulnerability":{"id":"GHSA-c4j6-fc7j-m34r","dataSource":"https://github.com/advisories/GHSA-c4j6-fc7j-m34r","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/vercel/next.js/security/advisories/GHSA-c4j6-fc7j-m34r","https://github.com/vercel/next.js/releases/tag/v15.5.16","https://github.com/vercel/next.js/releases/tag/v16.2.5","https://nvd.nist.gov/vuln/detail/CVE-2026-44578"],"description":"Next.js vulnerable to server-side request forgery in applications using WebSocket upgrades","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","metrics":{"baseScore":8.6,"exploitabilityScore":3.9,"impactScore":4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44578","epss":0.35539,"percentile":0.98454,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44578","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-44578","cwe":"CWE-918","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["16.2.5"],"state":"fixed","available":[{"version":"16.2.5","date":"2026-05-11","kind":"first-observed"}]},"advisories":[],"risk":28.608894999999997},"relatedVulnerabilities":[{"id":"CVE-2026-44578","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44578","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/vercel/next.js/security/advisories/GHSA-c4j6-fc7j-m34r","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:37272","https://access.redhat.com/errata/RHSA-2026:40974","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/security/cve/CVE-2026-44578","https://bugzilla.redhat.com/show_bug.cgi?id=2477187","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44578.json"],"description":"Next.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests. An attacker can cause the server to proxy requests to arbitrary internal or external destinations, which may expose internal services or cloud metadata endpoints. Vercel-hosted deployments are not affected. This vulnerability is fixed in 15.5.16 and 16.2.5.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","metrics":{"baseScore":8.6,"exploitabilityScore":3.9,"impactScore":4},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","metrics":{"baseScore":8.6,"exploitabilityScore":3.9,"impactScore":4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44578","epss":0.35539,"percentile":0.98454,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44578","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-44578","cwe":"CWE-918","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"next","version":"16.1.7"}},"found":{"vulnerabilityID":"GHSA-c4j6-fc7j-m34r","versionConstraint":">=16.0.0,<16.2.5 (semantic)"},"fix":{"suggestedVersion":"16.2.5"}}],"artifact":{"id":"pkg:npm/next@16.1.7?package-id=662de087d22e519d","name":"next","version":"16.1.7","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vercel:next.js:16.1.7:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/next@16.1.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-pjwm-pj3p-43mv","dataSource":"https://github.com/advisories/GHSA-pjwm-pj3p-43mv","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-pjwm-pj3p-43mv","https://nvd.nist.gov/vuln/detail/CVE-2025-62718","https://nvd.nist.gov/vuln/detail/CVE-2026-44492","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44492.json","https://bugzilla.redhat.com/show_bug.cgi?id=2487938","https://access.redhat.com/security/cve/CVE-2026-44492","https://access.redhat.com/errata/RHSA-2026:36108","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:33183","https://access.redhat.com/errata/RHSA-2026:33173","https://access.redhat.com/errata/RHSA-2026:33163","https://access.redhat.com/errata/RHSA-2026:33160","https://access.redhat.com/errata/RHSA-2026:33155","https://access.redhat.com/errata/RHSA-2026:33005","https://access.redhat.com/errata/RHSA-2026:30651","https://access.redhat.com/errata/RHSA-2026:30650","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:29082","https://access.redhat.com/errata/RHSA-2026:28964","https://access.redhat.com/errata/RHSA-2026:27063","https://access.redhat.com/errata/RHSA-2026:27044","https://access.redhat.com/errata/RHSA-2026:26234","https://access.redhat.com/errata/RHSA-2026:20938","https://access.redhat.com/errata/RHSA-2026:20889","https://access.redhat.com/errata/RHSA-2026:36883","https://access.redhat.com/errata/RHSA-2026:36882","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:36754","https://access.redhat.com/errata/RHSA-2026:34766","https://access.redhat.com/errata/RHSA-2026:36611","https://access.redhat.com/errata/RHSA-2026:40119","https://access.redhat.com/errata/RHSA-2026:40138","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:41055","https://access.redhat.com/errata/RHSA-2026:41064"],"description":"axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","metrics":{"baseScore":8.6,"exploitabilityScore":3.9,"impactScore":4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44492","epss":0.1228,"percentile":0.96184,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44492","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-44492","cwe":"CWE-289","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["1.16.0"],"state":"fixed","available":[{"version":"1.16.0","date":"2026-05-29","kind":"first-observed"}]},"advisories":[],"risk":9.8854},"relatedVulnerabilities":[{"id":"CVE-2026-44492","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44492","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-pjwm-pj3p-43mv","https://access.redhat.com/errata/RHSA-2026:20889","https://access.redhat.com/errata/RHSA-2026:20938","https://access.redhat.com/errata/RHSA-2026:27044","https://access.redhat.com/errata/RHSA-2026:27063","https://access.redhat.com/errata/RHSA-2026:28964","https://access.redhat.com/errata/RHSA-2026:29082","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:30650","https://access.redhat.com/errata/RHSA-2026:30651","https://access.redhat.com/errata/RHSA-2026:33005","https://access.redhat.com/errata/RHSA-2026:33155","https://access.redhat.com/errata/RHSA-2026:33160","https://access.redhat.com/errata/RHSA-2026:33163","https://access.redhat.com/errata/RHSA-2026:33173","https://access.redhat.com/errata/RHSA-2026:33183","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:34766","https://access.redhat.com/errata/RHSA-2026:36108","https://access.redhat.com/errata/RHSA-2026:36611","https://access.redhat.com/errata/RHSA-2026:36754","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:36882","https://access.redhat.com/errata/RHSA-2026:36883","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41055","https://access.redhat.com/errata/RHSA-2026:41064","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:42078","https://access.redhat.com/errata/RHSA-2026:42085","https://access.redhat.com/errata/RHSA-2026:42142","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:46885","https://access.redhat.com/errata/RHSA-2026:46903","https://access.redhat.com/errata/RHSA-2026:50300","https://access.redhat.com/errata/RHSA-2026:54188","https://access.redhat.com/errata/RHSA-2026:57191","https://access.redhat.com/errata/RHSA-2026:59833","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-44492","https://bugzilla.redhat.com/show_bug.cgi?id=2487938","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44492.json"],"description":"Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios does not normalise IPv4-mapped IPv6 addresses. When NO_PROXY lists an IPv4 address such as 127.0.0.1 or 169.254.169.254, a request URL using the IPv4-mapped IPv6 form (::ffff:7f00:1, ::ffff:a9fe:a9fe) still routes through the configured proxy. Node.js resolves these addresses to the underlying IPv4 host, so the request reaches the internal service via the proxy rather than being blocked. This vulnerability is fixed in 0.32.0 and 1.16.0.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","metrics":{"baseScore":8.6,"exploitabilityScore":3.9,"impactScore":4},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","metrics":{"baseScore":8.6,"exploitabilityScore":3.9,"impactScore":4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44492","epss":0.1228,"percentile":0.96184,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44492","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-44492","cwe":"CWE-289","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.15.0"}},"found":{"vulnerabilityID":"GHSA-pjwm-pj3p-43mv","versionConstraint":">=1.15.0,<1.16.0 (semantic)"},"fix":{"suggestedVersion":"1.16.0"}}],"artifact":{"id":"pkg:npm/axios@1.15.0?package-id=520b8e92ffff8054","name":"axios","version":"1.15.0","type":"npm","locations":[{"path":"/sink/oidc-server/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.15.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.15.0","upstreams":[]}},{"vulnerability":{"id":"GO-2026-4887","dataSource":"https://github.com/moby/moby/security/advisories/GHSA-x744-4wpc-v9h2","namespace":"govulndb:language:go","severity":"High","urls":["https://github.com/moby/moby/commit/e89edb19ad7de0407a5d31e3111cb01aa10b5a38","https://docs.docker.com/engine/extend/plugins_authorization","https://github.com/moby/moby/security/advisories/GHSA-v23v-6jw2-98fq"],"description":"Moby has AuthZ plugin bypass when provided oversized request bodies in github.com/docker/docker","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34040","epss":0.0927,"percentile":0.9536,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-34040","cwe":"CWE-288","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":[],"state":""},"advisories":[],"risk":7.091550000000001},"relatedVulnerabilities":[{"id":"CVE-2026-34040","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34040","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/moby/moby/releases/tag/docker-v29.3.1","https://github.com/moby/moby/security/advisories/GHSA-x744-4wpc-v9h2"],"description":"Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to bypass authorization plugins (AuthZ). This issue has been patched in version 29.3.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.1,"impactScore":6.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34040","epss":0.0927,"percentile":0.9536,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-34040","cwe":"CWE-288","source":"security-advisories@github.com","type":"Secondary"}]},{"id":"GHSA-x744-4wpc-v9h2","dataSource":"https://github.com/advisories/GHSA-x744-4wpc-v9h2","namespace":"github:language:go","severity":"High","urls":["https://github.com/moby/moby/security/advisories/GHSA-v23v-6jw2-98fq","https://github.com/moby/moby/security/advisories/GHSA-x744-4wpc-v9h2","https://github.com/moby/moby/commit/e89edb19ad7de0407a5d31e3111cb01aa10b5a38","https://docs.docker.com/engine/extend/plugins_authorization","https://nvd.nist.gov/vuln/detail/CVE-2026-34040","https://github.com/moby/moby/releases/tag/docker-v29.3.1"],"description":"Moby has AuthZ plugin bypass when provided oversized request bodies","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.1,"impactScore":6.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34040","epss":0.0927,"percentile":0.9536,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-34040","cwe":"CWE-288","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"github.com/docker/docker","version":"v28.5.2+incompatible"}},"found":{"vulnerabilityID":"GO-2026-4887","versionConstraint":"none (unknown)"}}],"artifact":{"id":"pkg:golang/github.com/docker/docker@v28.5.2%2Bincompatible?package-id=b3f436952f7c2a0e","name":"github.com/docker/docker","version":"v28.5.2+incompatible","type":"go-module","locations":[{"path":"/backend-go/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:docker:docker:v28.5.2\\+incompatible:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/docker/docker@v28.5.2%2Bincompatible","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:DBX0Y0zAjZbSrm1uzOkdr1onVghKaftjlSWt4AFexzM="}}},{"vulnerability":{"id":"GHSA-hfxv-24rg-xrqf","dataSource":"https://github.com/advisories/GHSA-hfxv-24rg-xrqf","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-hfxv-24rg-xrqf","https://github.com/axios/axios/releases/tag/v0.32.0","https://github.com/axios/axios/releases/tag/v1.16.0"],"description":"Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44496","epss":0.05405,"percentile":0.92685,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44496","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-44496","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-44496","cwe":"CWE-1333","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["1.16.0"],"state":"fixed","available":[{"version":"1.16.0","date":"2026-06-04","kind":"first-observed"}]},"advisories":[],"risk":4.053750000000001},"relatedVulnerabilities":[{"id":"CVE-2026-44496","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44496","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-hfxv-24rg-xrqf","https://access.redhat.com/errata/RHSA-2026:20889","https://access.redhat.com/errata/RHSA-2026:20938","https://access.redhat.com/errata/RHSA-2026:27044","https://access.redhat.com/errata/RHSA-2026:27063","https://access.redhat.com/errata/RHSA-2026:28571","https://access.redhat.com/errata/RHSA-2026:28964","https://access.redhat.com/errata/RHSA-2026:29082","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:30076","https://access.redhat.com/errata/RHSA-2026:30650","https://access.redhat.com/errata/RHSA-2026:30651","https://access.redhat.com/errata/RHSA-2026:33155","https://access.redhat.com/errata/RHSA-2026:33160","https://access.redhat.com/errata/RHSA-2026:33163","https://access.redhat.com/errata/RHSA-2026:33173","https://access.redhat.com/errata/RHSA-2026:33183","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:33683","https://access.redhat.com/errata/RHSA-2026:34766","https://access.redhat.com/errata/RHSA-2026:36611","https://access.redhat.com/errata/RHSA-2026:36754","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:36882","https://access.redhat.com/errata/RHSA-2026:36883","https://access.redhat.com/errata/RHSA-2026:41055","https://access.redhat.com/errata/RHSA-2026:41064","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:42078","https://access.redhat.com/errata/RHSA-2026:42085","https://access.redhat.com/errata/RHSA-2026:42142","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:46885","https://access.redhat.com/errata/RHSA-2026:46903","https://access.redhat.com/errata/RHSA-2026:50300","https://access.redhat.com/errata/RHSA-2026:56789","https://access.redhat.com/errata/RHSA-2026:57191","https://access.redhat.com/errata/RHSA-2026:59360","https://access.redhat.com/errata/RHSA-2026:59833","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-44496","https://bugzilla.redhat.com/show_bug.cgi?id=2487943","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44496.json"],"description":"Axios is a promise based HTTP client for the browser and Node.js. Axios versions before 0.32.0 on the 0.x line and before 1.16.0 on the 1.x line build a regular expression from the configured XSRF cookie name without escaping regex metacharacters. In standard browser environments, an attacker who can influence the cookie name passed to axios can cause expensive regex backtracking while axios reads document.cookie. The practical impact is client-side availability degradation, such as freezing the affected browser tab while axios prepares a request. The issue does not affect ordinary Node.js HTTP adapter usage, React Native, or web workers, where axios does not read document.cookie. This vulnerability is fixed in 0.32.0 and 1.16.0.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44496","epss":0.05405,"percentile":0.92685,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44496","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-44496","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-44496","cwe":"CWE-1333","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.15.0"}},"found":{"vulnerabilityID":"GHSA-hfxv-24rg-xrqf","versionConstraint":">=1.0.0,<1.16.0 (semantic)"},"fix":{"suggestedVersion":"1.16.0"}}],"artifact":{"id":"pkg:npm/axios@1.15.0?package-id=520b8e92ffff8054","name":"axios","version":"1.15.0","type":"npm","locations":[{"path":"/sink/oidc-server/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.15.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.15.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-p293-qw3h-jr36","dataSource":"https://github.com/advisories/GHSA-p293-qw3h-jr36","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/vercel/next.js/security/advisories/GHSA-p293-qw3h-jr36","https://nvd.nist.gov/vuln/detail/CVE-2026-75604","https://github.com/vercel/next.js/commit/968b9fcb26bdeb8e0a861a9df05361474666d51b","https://github.com/vercel/next.js/commit/b0f3460a92b955d3ca41fccff9a525a2b910fbf3","https://github.com/vercel/next.js/releases/tag/v15.5.24","https://github.com/vercel/next.js/releases/tag/v16.3.3"],"description":"Next.js: Unauthenticated Remote Code Execution on windows-hosted servers","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9,"exploitabilityScore":2.3,"impactScore":6.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-75604","epss":0.02105,"percentile":0.81742,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-75604","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["16.3.3"],"state":"fixed","available":[{"version":"16.3.3","date":"2026-09-09","kind":"first-observed"}]},"advisories":[],"risk":1.8945},"relatedVulnerabilities":[{"id":"CVE-2026-75604","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75604","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/vercel/next.js/commit/968b9fcb26bdeb8e0a861a9df05361474666d51b","https://github.com/vercel/next.js/commit/b0f3460a92b955d3ca41fccff9a525a2b910fbf3","https://github.com/vercel/next.js/releases/tag/v15.5.24","https://github.com/vercel/next.js/releases/tag/v16.3.3","https://github.com/vercel/next.js/security/advisories/GHSA-p293-qw3h-jr36"],"description":"Next.js is a React framework for building full-stack web applications. From 13.4.0 until 15.5.24 and 16.3.3, Next.js applications using Pages Router or App Router without Cache Components on Windows-hosted servers do not consistently escape backslashes in route segments before constructing incremental-cache paths. In packages/next/src/shared/lib/router/utils/escape-path-delimiters.ts and packages/next/src/server/lib/incremental-cache/file-system-cache.ts, a remote request can supply encoded Windows path separators that traverse outside the intended cache root and expose private build data, including the server-reference-manifest encryption key. Disclosure of that key can enable remote code execution in the affected application. This issue is fixed in versions 15.5.24 and 16.3.3.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9,"exploitabilityScore":2.3,"impactScore":6.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-75604","epss":0.02105,"percentile":0.81742,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-75604","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"next","version":"16.1.7"}},"found":{"vulnerabilityID":"GHSA-p293-qw3h-jr36","versionConstraint":">=16.0.0,<16.3.3 (semantic)"},"fix":{"suggestedVersion":"16.3.3"}}],"artifact":{"id":"pkg:npm/next@16.1.7?package-id=662de087d22e519d","name":"next","version":"16.1.7","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vercel:next.js:16.1.7:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/next@16.1.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-267c-6grr-h53f","dataSource":"https://github.com/advisories/GHSA-267c-6grr-h53f","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f","https://github.com/vercel/next.js/releases/tag/v15.5.16","https://github.com/vercel/next.js/releases/tag/v16.2.5","https://nvd.nist.gov/vuln/detail/CVE-2026-44575"],"description":"Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44575","epss":0.01594,"percentile":0.75718,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44575","cwe":"CWE-288","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-44575","cwe":"CWE-551","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["16.2.5"],"state":"fixed","available":[{"version":"16.2.5","date":"2026-05-11","kind":"first-observed"}]},"advisories":[],"risk":1.1955},"relatedVulnerabilities":[{"id":"CVE-2026-44575","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44575","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:37272","https://access.redhat.com/errata/RHSA-2026:40974","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/security/cve/CVE-2026-44575","https://bugzilla.redhat.com/show_bug.cgi?id=2477188","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44575.json"],"description":"Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.16 and 16.2.5, App Router applications that rely on middleware or proxy-based checks for authorization can allow unauthorized access through transport-specific route variants used for segment prefetching. In affected configurations, specially crafted .rsc and segment-prefetch URLs can resolve to the same page without being matched by the intended middleware rule, which can allow protected content to be reached without the expected authorization check. This vulnerability is fixed in 15.5.16 and 16.2.5.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44575","epss":0.01594,"percentile":0.75718,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44575","cwe":"CWE-288","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-44575","cwe":"CWE-551","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"next","version":"16.1.7"}},"found":{"vulnerabilityID":"GHSA-267c-6grr-h53f","versionConstraint":">=16.0.0,<16.2.5 (semantic)"},"fix":{"suggestedVersion":"16.2.5"}}],"artifact":{"id":"pkg:npm/next@16.1.7?package-id=662de087d22e519d","name":"next","version":"16.1.7","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vercel:next.js:16.1.7:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/next@16.1.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-96hv-2xvq-fx4p","dataSource":"https://github.com/advisories/GHSA-96hv-2xvq-fx4p","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/websockets/ws/security/advisories/GHSA-96hv-2xvq-fx4p","https://github.com/websockets/ws/commit/86d3e8a5fb0246ed373860c5fbb0de88824a27f7","https://github.com/websockets/ws/commit/b5372ac67bb97a773727b8e9f5035a8123556d53","https://github.com/websockets/ws/commit/bca91adf15677e47dbe4f959653452727be28b94","https://github.com/websockets/ws/commit/fd36cd864fcdf62a08273a99e19a7d975401fee8","https://nvd.nist.gov/vuln/detail/CVE-2026-48779","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48779.json","https://bugzilla.redhat.com/show_bug.cgi?id=2489661","https://access.redhat.com/security/cve/CVE-2026-48779","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:33183","https://access.redhat.com/errata/RHSA-2026:33173","https://access.redhat.com/errata/RHSA-2026:33163","https://access.redhat.com/errata/RHSA-2026:33160","https://access.redhat.com/errata/RHSA-2026:33155","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:36754","https://access.redhat.com/errata/RHSA-2026:37272","https://access.redhat.com/errata/RHSA-2026:27171","https://access.redhat.com/errata/RHSA-2026:26638"],"description":"ws: Memory exhaustion DoS from tiny fragments and data chunks","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-48779","epss":0.01426,"percentile":0.72944,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-48779","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-48779","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-48779","cwe":"CWE-1050","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["8.21.0"],"state":"fixed","available":[{"version":"8.21.0","date":"2026-06-15","kind":"first-observed"}]},"advisories":[],"risk":1.0695},"relatedVulnerabilities":[{"id":"CVE-2026-48779","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48779","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/websockets/ws/commit/86d3e8a5fb0246ed373860c5fbb0de88824a27f7","https://github.com/websockets/ws/commit/b5372ac67bb97a773727b8e9f5035a8123556d53","https://github.com/websockets/ws/commit/bca91adf15677e47dbe4f959653452727be28b94","https://github.com/websockets/ws/commit/fd36cd864fcdf62a08273a99e19a7d975401fee8","https://github.com/websockets/ws/security/advisories/GHSA-96hv-2xvq-fx4p","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:33155","https://access.redhat.com/errata/RHSA-2026:33160","https://access.redhat.com/errata/RHSA-2026:33163","https://access.redhat.com/errata/RHSA-2026:33173","https://access.redhat.com/errata/RHSA-2026:33183","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:36754","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37272","https://access.redhat.com/errata/RHSA-2026:40984","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41941","https://access.redhat.com/errata/RHSA-2026:41944","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:56366","https://access.redhat.com/errata/RHSA-2026:56431","https://access.redhat.com/errata/RHSA-2026:57013","https://access.redhat.com/errata/RHSA-2026:57590","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-48779","https://bugzilla.redhat.com/show_bug.cgi?id=2489661","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48779.json"],"description":"ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer can send a high volume of exceptionally small fragments and data chunks, with modest network traffic, to force the remote peer into allocating and holding structural wrappers that consume far more memory than the default documented message-size limit, leading to process termination due to OOM. This issue has been fixed in versions 5.2.5, 6.2.4, 7.5.11, and 8.21.0.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-48779","epss":0.01426,"percentile":0.72944,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-48779","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-48779","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-48779","cwe":"CWE-1050","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"ws","version":"8.20.0"}},"found":{"vulnerabilityID":"GHSA-96hv-2xvq-fx4p","versionConstraint":">=8.0.0,<8.21.0 (semantic)"},"fix":{"suggestedVersion":"8.21.0"}}],"artifact":{"id":"pkg:npm/ws@8.20.0?package-id=3efe55bdcc2b3e36","name":"ws","version":"8.20.0","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:ws_project:ws:8.20.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/ws@8.20.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-587h-7wmj-h5pm","dataSource":"https://github.com/advisories/GHSA-587h-7wmj-h5pm","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/vitejs/launch-editor/security/advisories/GHSA-587h-7wmj-h5pm","https://nvd.nist.gov/vuln/detail/CVE-2026-112942","https://github.com/vitejs/launch-editor/commit/f13cd835d4b8e860b1d4d080ad8a490cc2463679","https://github.com/vitejs/launch-editor/releases/tag/v2.14.2"],"description":"launch-editor: `fs.existsSync()` existence check can be bypassed on Windows","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":7.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112942","epss":0.01344,"percentile":0.71405,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112942","cwe":"CWE-77","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.3.7"],"state":"fixed","available":[{"version":"7.3.7","date":"2026-10-21","kind":"first-observed"}]},"advisories":[],"risk":1.008},"relatedVulnerabilities":[{"id":"CVE-2026-112942","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112942","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/vitejs/launch-editor/commit/f13cd835d4b8e860b1d4d080ad8a490cc2463679","https://github.com/vitejs/launch-editor/releases/tag/v2.14.2","https://github.com/vitejs/launch-editor/security/advisories/GHSA-587h-7wmj-h5pm"],"description":"launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor-middleware processes an attacker-controlled Windows file argument where the file argument ends in a parent-directory component plus a line-and-column suffix: the path is resolved while the suffix is still present, and launch-editor removes the suffix before its existsSync check, leaving the existing parent directory for existsSync and allowing the attacker-controlled file argument to pass filename existence validation without requiring the malicious filename to exist. The bypass can lead to OS command injection when combined with the separately described Windows percent-expansion flaw. This issue is fixed in version 2.14.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112942","epss":0.01344,"percentile":0.71405,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112942","cwe":"CWE-77","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"vite","version":"7.3.2"}},"found":{"vulnerabilityID":"GHSA-587h-7wmj-h5pm","versionConstraint":">=7.0.0,<=7.3.6 (semantic)"},"fix":{"suggestedVersion":"7.3.7"}}],"artifact":{"id":"pkg:npm/vite@7.3.2?package-id=5c0ce5d7d525ae42","name":"vite","version":"7.3.2","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vitejs:vite:7.3.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/vite@7.3.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-587h-7wmj-h5pm","dataSource":"https://github.com/advisories/GHSA-587h-7wmj-h5pm","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/vitejs/launch-editor/security/advisories/GHSA-587h-7wmj-h5pm","https://nvd.nist.gov/vuln/detail/CVE-2026-112942","https://github.com/vitejs/launch-editor/commit/f13cd835d4b8e860b1d4d080ad8a490cc2463679","https://github.com/vitejs/launch-editor/releases/tag/v2.14.2"],"description":"launch-editor: `fs.existsSync()` existence check can be bypassed on Windows","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":7.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112942","epss":0.01344,"percentile":0.71405,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112942","cwe":"CWE-77","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.3.7"],"state":"fixed","available":[{"version":"7.3.7","date":"2026-10-21","kind":"first-observed"}]},"advisories":[],"risk":1.008},"relatedVulnerabilities":[{"id":"CVE-2026-112942","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112942","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/vitejs/launch-editor/commit/f13cd835d4b8e860b1d4d080ad8a490cc2463679","https://github.com/vitejs/launch-editor/releases/tag/v2.14.2","https://github.com/vitejs/launch-editor/security/advisories/GHSA-587h-7wmj-h5pm"],"description":"launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor-middleware processes an attacker-controlled Windows file argument where the file argument ends in a parent-directory component plus a line-and-column suffix: the path is resolved while the suffix is still present, and launch-editor removes the suffix before its existsSync check, leaving the existing parent directory for existsSync and allowing the attacker-controlled file argument to pass filename existence validation without requiring the malicious filename to exist. The bypass can lead to OS command injection when combined with the separately described Windows percent-expansion flaw. This issue is fixed in version 2.14.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112942","epss":0.01344,"percentile":0.71405,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112942","cwe":"CWE-77","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"vite","version":"7.3.6"}},"found":{"vulnerabilityID":"GHSA-587h-7wmj-h5pm","versionConstraint":">=7.0.0,<=7.3.6 (semantic)"},"fix":{"suggestedVersion":"7.3.7"}}],"artifact":{"id":"pkg:npm/vite@7.3.6?package-id=dcc7b510dec05363","name":"vite","version":"7.3.6","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vitejs:vite:7.3.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/vite@7.3.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-587h-7wmj-h5pm","dataSource":"https://github.com/advisories/GHSA-587h-7wmj-h5pm","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/vitejs/launch-editor/security/advisories/GHSA-587h-7wmj-h5pm","https://nvd.nist.gov/vuln/detail/CVE-2026-112942","https://github.com/vitejs/launch-editor/commit/f13cd835d4b8e860b1d4d080ad8a490cc2463679","https://github.com/vitejs/launch-editor/releases/tag/v2.14.2"],"description":"launch-editor: `fs.existsSync()` existence check can be bypassed on Windows","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":7.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112942","epss":0.01344,"percentile":0.71405,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112942","cwe":"CWE-77","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["8.2.4"],"state":"fixed","available":[{"version":"8.2.4","date":"2026-10-21","kind":"first-observed"}]},"advisories":[],"risk":1.008},"relatedVulnerabilities":[{"id":"CVE-2026-112942","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112942","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/vitejs/launch-editor/commit/f13cd835d4b8e860b1d4d080ad8a490cc2463679","https://github.com/vitejs/launch-editor/releases/tag/v2.14.2","https://github.com/vitejs/launch-editor/security/advisories/GHSA-587h-7wmj-h5pm"],"description":"launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor-middleware processes an attacker-controlled Windows file argument where the file argument ends in a parent-directory component plus a line-and-column suffix: the path is resolved while the suffix is still present, and launch-editor removes the suffix before its existsSync check, leaving the existing parent directory for existsSync and allowing the attacker-controlled file argument to pass filename existence validation without requiring the malicious filename to exist. The bypass can lead to OS command injection when combined with the separately described Windows percent-expansion flaw. This issue is fixed in version 2.14.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112942","epss":0.01344,"percentile":0.71405,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112942","cwe":"CWE-77","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"vite","version":"8.2.2"}},"found":{"vulnerabilityID":"GHSA-587h-7wmj-h5pm","versionConstraint":">=8.2.0,<=8.2.3 (semantic)"},"fix":{"suggestedVersion":"8.2.4"}}],"artifact":{"id":"pkg:npm/vite@8.2.2?package-id=ae073bacc7b8ee83","name":"vite","version":"8.2.2","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vitejs:vite:8.2.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/vite@8.2.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-35jp-ww65-95wh","dataSource":"https://github.com/advisories/GHSA-35jp-ww65-95wh","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-35jp-ww65-95wh","https://github.com/advisories/GHSA-fvcv-3m26-pcqx","https://nvd.nist.gov/vuln/detail/CVE-2026-44494"],"description":"axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.7,"exploitabilityScore":2.3,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44494","epss":0.01057,"percentile":0.64472,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44494","cwe":"CWE-441","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-44494","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-44494","cwe":"CWE-915","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["1.16.0"],"state":"fixed","available":[{"version":"1.16.0","date":"2026-05-29","kind":"first-observed"}]},"advisories":[],"risk":0.8561699999999999},"relatedVulnerabilities":[{"id":"CVE-2026-44494","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44494","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-35jp-ww65-95wh","https://access.redhat.com/errata/RHSA-2026:20889","https://access.redhat.com/errata/RHSA-2026:20938","https://access.redhat.com/errata/RHSA-2026:27044","https://access.redhat.com/errata/RHSA-2026:28964","https://access.redhat.com/errata/RHSA-2026:29082","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:29800","https://access.redhat.com/errata/RHSA-2026:29864","https://access.redhat.com/errata/RHSA-2026:30650","https://access.redhat.com/errata/RHSA-2026:30651","https://access.redhat.com/errata/RHSA-2026:33005","https://access.redhat.com/errata/RHSA-2026:33155","https://access.redhat.com/errata/RHSA-2026:33160","https://access.redhat.com/errata/RHSA-2026:33163","https://access.redhat.com/errata/RHSA-2026:33173","https://access.redhat.com/errata/RHSA-2026:33183","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:34525","https://access.redhat.com/errata/RHSA-2026:34527","https://access.redhat.com/errata/RHSA-2026:34530","https://access.redhat.com/errata/RHSA-2026:34794","https://access.redhat.com/errata/RHSA-2026:36108","https://access.redhat.com/errata/RHSA-2026:36611","https://access.redhat.com/errata/RHSA-2026:36754","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:36882","https://access.redhat.com/errata/RHSA-2026:36883","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:40792","https://access.redhat.com/errata/RHSA-2026:40795","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41055","https://access.redhat.com/errata/RHSA-2026:41064","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:42078","https://access.redhat.com/errata/RHSA-2026:42085","https://access.redhat.com/errata/RHSA-2026:42142","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:46885","https://access.redhat.com/errata/RHSA-2026:46903","https://access.redhat.com/errata/RHSA-2026:50300","https://access.redhat.com/errata/RHSA-2026:54188","https://access.redhat.com/errata/RHSA-2026:57191","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-44494","https://bugzilla.redhat.com/show_bug.cgi?id=2487942","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44494.json"],"description":"Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.16.0, the Axios library is vulnerable to a Prototype Pollution \"Gadget\" attack that allows any Object.prototype pollution in the application's dependency tree to be escalated into a full Man-in-the-Middle (MITM) attack — intercepting, reading, and modifying all HTTP traffic including authentication credentials. The HTTP adapter at lib/adapters/http.js:670 reads config.proxy via standard property access, which traverses the prototype chain. Because proxy is not present in Axios defaults, the merged config object has no own proxy property, making it trivially injectable via prototype pollution. Once injected, setProxy() routes all HTTP requests through the attacker's proxy server. This vulnerability is fixed in 1.16.0.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.7,"exploitabilityScore":2.3,"impactScore":5.8},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.7,"exploitabilityScore":2.3,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44494","epss":0.01057,"percentile":0.64472,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44494","cwe":"CWE-441","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-44494","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-44494","cwe":"CWE-915","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.15.0"}},"found":{"vulnerabilityID":"GHSA-35jp-ww65-95wh","versionConstraint":">=1.0.0,<1.16.0 (semantic)"},"fix":{"suggestedVersion":"1.16.0"}}],"artifact":{"id":"pkg:npm/axios@1.15.0?package-id=520b8e92ffff8054","name":"axios","version":"1.15.0","type":"npm","locations":[{"path":"/sink/oidc-server/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.15.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.15.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-5xrq-8626-4rwp","dataSource":"https://github.com/advisories/GHSA-5xrq-8626-4rwp","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/vitest-dev/vitest/security/advisories/GHSA-5xrq-8626-4rwp","https://github.com/vitest-dev/vitest/blob/eb1abf08573032a532015b999ad3501c5e89e3bb/packages/browser/src/node/commands/fs.ts#L10-L11","https://github.com/vitest-dev/vitest/blob/eb1abf08573032a532015b999ad3501c5e89e3bb/packages/browser/src/node/plugin.ts#L194-L196","https://github.com/vitest-dev/vitest/blob/eb1abf08573032a532015b999ad3501c5e89e3bb/packages/browser/src/node/rpc.ts#L115-L121","https://github.com/vitest-dev/vitest/blob/eb1abf08573032a532015b999ad3501c5e89e3bb/packages/ui/node/index.ts#L77","https://github.com/vitest-dev/vitest/blob/eb1abf08573032a532015b999ad3501c5e89e3bb/packages/vitest/src/api/setup.ts#L103-L105","https://github.com/vitest-dev/vitest/blob/eb1abf08573032a532015b999ad3501c5e89e3bb/packages/vitest/src/api/setup.ts#L119-L121","https://nvd.nist.gov/vuln/detail/CVE-2026-47429","https://github.com/vitest-dev/vitest/pull/10445","https://github.com/vitest-dev/vitest/pull/9350","https://github.com/vitest-dev/vitest/commit/20e00ef7808de6d330c5e2fda530f686e08f1c8d","https://github.com/vitest-dev/vitest/commit/af88b1f5d82844a4761ea9a977156c98e2b14ca8","https://github.com/vitest-dev/vitest/releases/tag/v3.2.5","https://github.com/vitest-dev/vitest/releases/tag/v4.1.0"],"description":"When Vitest UI server is listening, arbitrary file can be read and executed","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-47429","epss":0.00876,"percentile":0.5901,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-47429","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.2.6"],"state":"fixed","available":[{"version":"3.2.6","date":"2026-06-08","kind":"first-observed"}]},"advisories":[],"risk":0.8234400000000001},"relatedVulnerabilities":[{"id":"CVE-2026-47429","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47429","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/vitest-dev/vitest/commit/20e00ef7808de6d330c5e2fda530f686e08f1c8d","https://github.com/vitest-dev/vitest/commit/af88b1f5d82844a4761ea9a977156c98e2b14ca8","https://github.com/vitest-dev/vitest/pull/10445","https://github.com/vitest-dev/vitest/pull/9350","https://github.com/vitest-dev/vitest/releases/tag/v3.2.5","https://github.com/vitest-dev/vitest/releases/tag/v4.1.0","https://github.com/vitest-dev/vitest/security/advisories/GHSA-5xrq-8626-4rwp"],"description":"Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /__vitest_attachment__, allowing \\\\?\\\\..\\\\ path traversal to read files outside the project; exposed API write and rerun features such as saveTestFile and rerun could also allow arbitrary script execution. This issue is fixed in versions 3.2.5 and 4.1.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-47429","epss":0.00876,"percentile":0.5901,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-47429","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"vitest","version":"3.2.4"}},"found":{"vulnerabilityID":"GHSA-5xrq-8626-4rwp","versionConstraint":"<3.2.6 (semantic)"},"fix":{"suggestedVersion":"3.2.6"}}],"artifact":{"id":"pkg:npm/vitest@3.2.4?package-id=dd5686aba11d6a74","name":"vitest","version":"3.2.4","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vitest.dev:vitest:3.2.4:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/vitest@3.2.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-m99w-x7hq-7vfj","dataSource":"https://github.com/advisories/GHSA-m99w-x7hq-7vfj","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj","https://github.com/vercel/next.js/pull/96013","https://github.com/vercel/next.js/commit/019628571641dec57aaf349ba0c360e3964e6f12","https://github.com/vercel/next.js/releases/tag/v15.5.21","https://github.com/vercel/next.js/releases/tag/v16.2.11"],"description":"Next.js: Denial of Service in App Router using Server Actions","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-64641","epss":0.00856,"percentile":0.58389,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-64641","cwe":"CWE-834","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["16.2.11"],"state":"fixed","available":[{"version":"16.2.11","date":"2026-07-23","kind":"first-observed"}]},"advisories":[],"risk":0.6719599999999999},"relatedVulnerabilities":[{"id":"CVE-2026-64641","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64641","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/vercel/next.js/commit/019628571641dec57aaf349ba0c360e3964e6f12","https://github.com/vercel/next.js/pull/96013","https://github.com/vercel/next.js/releases/tag/v15.5.21","https://github.com/vercel/next.js/releases/tag/v16.2.11","https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj"],"description":"Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process. This issue has been fixed in versions 15.5.21 and 16.2.11.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-64641","epss":0.00856,"percentile":0.58389,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-64641","cwe":"CWE-834","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"next","version":"16.1.7"}},"found":{"vulnerabilityID":"GHSA-m99w-x7hq-7vfj","versionConstraint":">=16.0.0,<16.2.11 (semantic)"},"fix":{"suggestedVersion":"16.2.11"}}],"artifact":{"id":"pkg:npm/next@16.1.7?package-id=662de087d22e519d","name":"next","version":"16.1.7","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vercel:next.js:16.1.7:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/next@16.1.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-pf86-5x62-jrwf","dataSource":"https://github.com/advisories/GHSA-pf86-5x62-jrwf","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-pf86-5x62-jrwf","https://nvd.nist.gov/vuln/detail/CVE-2026-42033"],"description":"Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42033","epss":0.00867,"percentile":0.58737,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42033","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-42033","cwe":"CWE-915","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["1.15.1"],"state":"fixed","available":[{"version":"1.15.1","date":"2026-05-05","kind":"first-observed"}]},"advisories":[],"risk":0.645915},"relatedVulnerabilities":[{"id":"CVE-2026-42033","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42033","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-pf86-5x62-jrwf","https://access.redhat.com/errata/RHSA-2026:14937","https://access.redhat.com/errata/RHSA-2026:16476","https://access.redhat.com/errata/RHSA-2026:16532","https://access.redhat.com/errata/RHSA-2026:16534","https://access.redhat.com/errata/RHSA-2026:16535","https://access.redhat.com/errata/RHSA-2026:16542","https://access.redhat.com/errata/RHSA-2026:16874","https://access.redhat.com/errata/RHSA-2026:17468","https://access.redhat.com/errata/RHSA-2026:17474","https://access.redhat.com/errata/RHSA-2026:17657","https://access.redhat.com/errata/RHSA-2026:17699","https://access.redhat.com/errata/RHSA-2026:19109","https://access.redhat.com/errata/RHSA-2026:19375","https://access.redhat.com/errata/RHSA-2026:20889","https://access.redhat.com/errata/RHSA-2026:20938","https://access.redhat.com/errata/RHSA-2026:21017","https://access.redhat.com/errata/RHSA-2026:21338","https://access.redhat.com/errata/RHSA-2026:21772","https://access.redhat.com/errata/RHSA-2026:22465","https://access.redhat.com/errata/RHSA-2026:22619","https://access.redhat.com/errata/RHSA-2026:22629","https://access.redhat.com/errata/RHSA-2026:22840","https://access.redhat.com/errata/RHSA-2026:23361","https://access.redhat.com/errata/RHSA-2026:24536","https://access.redhat.com/errata/RHSA-2026:24539","https://access.redhat.com/errata/RHSA-2026:24853","https://access.redhat.com/errata/RHSA-2026:24977","https://access.redhat.com/errata/RHSA-2026:25041","https://access.redhat.com/errata/RHSA-2026:25089","https://access.redhat.com/errata/RHSA-2026:25271","https://access.redhat.com/errata/RHSA-2026:25273","https://access.redhat.com/errata/RHSA-2026:26214","https://access.redhat.com/errata/RHSA-2026:26225","https://access.redhat.com/errata/RHSA-2026:26232","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:36882","https://access.redhat.com/errata/RHSA-2026:48670","https://access.redhat.com/security/cve/CVE-2026-42033","https://bugzilla.redhat.com/show_bug.cgi?id=2461607","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42033.json"],"description":"Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when Object.prototype has been polluted by any co-dependency with keys that axios reads without a hasOwnProperty guard, an attacker can (a) silently intercept and modify every JSON response before the application sees it, or (b) fully hijack the underlying HTTP transport, gaining access to request credentials, headers, and body. The precondition is prototype pollution from a separate source in the same process. This vulnerability is fixed in 1.15.1 and 0.31.1.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42033","epss":0.00867,"percentile":0.58737,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42033","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-42033","cwe":"CWE-915","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.15.0"}},"found":{"vulnerabilityID":"GHSA-pf86-5x62-jrwf","versionConstraint":">=1.0.0,<1.15.1 (semantic)"},"fix":{"suggestedVersion":"1.15.1"}}],"artifact":{"id":"pkg:npm/axios@1.15.0?package-id=520b8e92ffff8054","name":"axios","version":"1.15.0","type":"npm","locations":[{"path":"/sink/oidc-server/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.15.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.15.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-3g43-6gmg-66jw","dataSource":"https://github.com/advisories/GHSA-3g43-6gmg-66jw","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-3g43-6gmg-66jw","https://nvd.nist.gov/vuln/detail/CVE-2026-44495"],"description":"axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L","metrics":{"baseScore":7,"exploitabilityScore":2.3,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44495","epss":0.00854,"percentile":0.58327,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44495","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-44495","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-44495","cwe":"CWE-915","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["1.15.2"],"state":"fixed","available":[{"version":"1.15.2","date":"2026-05-29","kind":"first-observed"}]},"advisories":[],"risk":0.61915},"relatedVulnerabilities":[{"id":"CVE-2026-44495","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44495","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-3g43-6gmg-66jw","https://access.redhat.com/errata/RHSA-2026:20889","https://access.redhat.com/errata/RHSA-2026:20938","https://access.redhat.com/errata/RHSA-2026:27044","https://access.redhat.com/errata/RHSA-2026:27063","https://access.redhat.com/errata/RHSA-2026:27944","https://access.redhat.com/errata/RHSA-2026:28964","https://access.redhat.com/errata/RHSA-2026:29082","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:30650","https://access.redhat.com/errata/RHSA-2026:30651","https://access.redhat.com/errata/RHSA-2026:33155","https://access.redhat.com/errata/RHSA-2026:33160","https://access.redhat.com/errata/RHSA-2026:33163","https://access.redhat.com/errata/RHSA-2026:33173","https://access.redhat.com/errata/RHSA-2026:33183","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:34160","https://access.redhat.com/errata/RHSA-2026:34374","https://access.redhat.com/errata/RHSA-2026:36108","https://access.redhat.com/errata/RHSA-2026:36611","https://access.redhat.com/errata/RHSA-2026:36754","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:36882","https://access.redhat.com/errata/RHSA-2026:36883","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:40768","https://access.redhat.com/errata/RHSA-2026:40792","https://access.redhat.com/errata/RHSA-2026:40795","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41055","https://access.redhat.com/errata/RHSA-2026:41064","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:42078","https://access.redhat.com/errata/RHSA-2026:42142","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:46885","https://access.redhat.com/errata/RHSA-2026:46903","https://access.redhat.com/errata/RHSA-2026:50300","https://access.redhat.com/errata/RHSA-2026:53840","https://access.redhat.com/errata/RHSA-2026:54188","https://access.redhat.com/errata/RHSA-2026:54555","https://access.redhat.com/errata/RHSA-2026:57191","https://access.redhat.com/errata/RHSA-2026:59833","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-44495","https://bugzilla.redhat.com/show_bug.cgi?id=2487937","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44495.json"],"description":"Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in request config processing. If another vulnerability in the same JavaScript process has already polluted Object.prototype.transformResponse, affected Axios versions may treat that inherited value as request configuration or as an option validator. Axios does not itself create the prototype pollution. Exploitability requires a separate prototype-pollution vulnerability or equivalent attacker control over Object.prototype before Axios creates a request. This vulnerability is fixed in 0.31.1 and 1.15.2.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H","metrics":{"baseScore":7.7,"exploitabilityScore":2.3,"impactScore":5.5},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L","metrics":{"baseScore":7,"exploitabilityScore":2.3,"impactScore":4.8},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L","metrics":{"baseScore":7,"exploitabilityScore":2.3,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44495","epss":0.00854,"percentile":0.58327,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44495","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-44495","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-44495","cwe":"CWE-915","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.15.0"}},"found":{"vulnerabilityID":"GHSA-3g43-6gmg-66jw","versionConstraint":">=1.0.0,<1.15.2 (semantic)"},"fix":{"suggestedVersion":"1.15.2"}}],"artifact":{"id":"pkg:npm/axios@1.15.0?package-id=520b8e92ffff8054","name":"axios","version":"1.15.0","type":"npm","locations":[{"path":"/sink/oidc-server/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.15.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.15.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-36qx-fr4f-26g5","dataSource":"https://github.com/advisories/GHSA-36qx-fr4f-26g5","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/vercel/next.js/security/advisories/GHSA-36qx-fr4f-26g5","https://github.com/vercel/next.js/releases/tag/v15.5.16","https://github.com/vercel/next.js/releases/tag/v16.2.5","https://nvd.nist.gov/vuln/detail/CVE-2026-44573"],"description":"Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44573","epss":0.00796,"percentile":0.56483,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44573","cwe":"CWE-863","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-44573","cwe":"CWE-551","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["16.2.5"],"state":"fixed","available":[{"version":"16.2.5","date":"2026-05-11","kind":"first-observed"}]},"advisories":[],"risk":0.597},"relatedVulnerabilities":[{"id":"CVE-2026-44573","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44573","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/vercel/next.js/security/advisories/GHSA-36qx-fr4f-26g5","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:37272","https://access.redhat.com/errata/RHSA-2026:40974","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/security/cve/CVE-2026-44573","https://bugzilla.redhat.com/show_bug.cgi?id=2477199","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44573.json"],"description":"Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, Applications using the Pages Router with i18n configured and middleware/proxy-based authorization can allow unauthorized access to protected page data through locale-less /_next/data/<buildId>/<page>.json requests. In affected configurations, middleware does not run for the unprefixed data route, allowing an attacker to retrieve SSR JSON for protected pages without passing the intended authorization checks. This vulnerability is fixed in 15.5.16 and 16.2.5.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44573","epss":0.00796,"percentile":0.56483,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44573","cwe":"CWE-863","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-44573","cwe":"CWE-551","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"next","version":"16.1.7"}},"found":{"vulnerabilityID":"GHSA-36qx-fr4f-26g5","versionConstraint":">=16.0.0,<16.2.5 (semantic)"},"fix":{"suggestedVersion":"16.2.5"}}],"artifact":{"id":"pkg:npm/next@16.1.7?package-id=662de087d22e519d","name":"next","version":"16.1.7","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vercel:next.js:16.1.7:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/next@16.1.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-q8qp-cvcw-x6jj","dataSource":"https://github.com/advisories/GHSA-q8qp-cvcw-x6jj","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-q8qp-cvcw-x6jj","https://nvd.nist.gov/vuln/detail/CVE-2026-42264","https://github.com/axios/axios/pull/10779","https://github.com/axios/axios/commit/47915144662f2733e6c051bdcb895a8c8f0586aa","https://github.com/axios/axios/releases/tag/v1.15.2"],"description":"Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42264","epss":0.00797,"percentile":0.56505,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42264","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-42264","cwe":"CWE-915","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["1.15.2"],"state":"fixed","available":[{"version":"1.15.2","date":"2026-05-05","kind":"first-observed"}]},"advisories":[],"risk":0.593765},"relatedVulnerabilities":[{"id":"CVE-2026-42264","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42264","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/axios/axios/commit/47915144662f2733e6c051bdcb895a8c8f0586aa","https://github.com/axios/axios/pull/10779","https://github.com/axios/axios/releases/tag/v1.15.2","https://github.com/axios/axios/security/advisories/GHSA-q8qp-cvcw-x6jj","https://access.redhat.com/errata/RHSA-2026:20889","https://access.redhat.com/errata/RHSA-2026:20938","https://access.redhat.com/errata/RHSA-2026:33173","https://access.redhat.com/errata/RHSA-2026:36207","https://access.redhat.com/errata/RHSA-2026:37287","https://access.redhat.com/errata/RHSA-2026:37288","https://access.redhat.com/errata/RHSA-2026:37297","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:42142","https://access.redhat.com/errata/RHSA-2026:50300","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-42264","https://bugzilla.redhat.com/show_bug.cgi?id=2467927","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42264.json"],"description":"Axios is a promise based HTTP client for the browser and Node.js. From version 1.0.0 to before version 1.15.2, fFive config properties (auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser) in the HTTP adapter are read via direct property access without hasOwnProperty guards, making them exploitable as prototype pollution gadgets. When Object.prototype is polluted by another dependency in the same process, axios silently picks up these polluted values on every outbound HTTP request. This issue has been patched in version 1.15.2.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42264","epss":0.00797,"percentile":0.56505,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42264","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-42264","cwe":"CWE-915","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.15.0"}},"found":{"vulnerabilityID":"GHSA-q8qp-cvcw-x6jj","versionConstraint":">=1.0.0,<1.15.2 (semantic)"},"fix":{"suggestedVersion":"1.15.2"}}],"artifact":{"id":"pkg:npm/axios@1.15.0?package-id=520b8e92ffff8054","name":"axios","version":"1.15.0","type":"npm","locations":[{"path":"/sink/oidc-server/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.15.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.15.0","upstreams":[]}},{"vulnerability":{"id":"GO-2026-6612","dataSource":"https://go.dev/cl/847187","namespace":"govulndb:language:go","severity":"Critical","urls":["https://go.dev/cl/847310","https://go.dev/issue/81743","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"],"description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78663","epss":0.00622,"percentile":0.49817,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78663","cwe":"CWE-675","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.60.0"],"state":"fixed","available":[{"version":"0.60.0","date":"2026-10-08","kind":"release"}]},"advisories":[],"risk":0.56291},"relatedVulnerabilities":[{"id":"CVE-2026-78663","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78663","namespace":"nvd:cpe","severity":"Critical","urls":["https://go.dev/cl/847187","https://go.dev/cl/847310","https://go.dev/issue/81743","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://pkg.go.dev/vuln/GO-2026-6612"],"description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78663","epss":0.00622,"percentile":0.49817,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78663","cwe":"CWE-675","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.56.0"}},"found":{"vulnerabilityID":"GO-2026-6612","versionConstraint":"<0.60.0 (go)"},"fix":{"suggestedVersion":"0.60.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.56.0?package-id=ab49808757d6d4dc","name":"golang.org/x/net","version":"v0.56.0","type":"go-module","locations":[{"path":"/backend-go/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.56.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.56.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.56.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o="}}},{"vulnerability":{"id":"GHSA-mg66-mrh9-m8jx","dataSource":"https://github.com/advisories/GHSA-mg66-mrh9-m8jx","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/vercel/next.js/security/advisories/GHSA-mg66-mrh9-m8jx","https://github.com/vercel/next.js/releases/tag/v15.5.16","https://github.com/vercel/next.js/releases/tag/v16.2.5","https://nvd.nist.gov/vuln/detail/CVE-2026-44579"],"description":"Next.js vulnerable to Denial of Service via connection exhaustion in applications using Cache Components","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44579","epss":0.00746,"percentile":0.54823,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44579","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-44579","cwe":"CWE-833","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["16.2.5"],"state":"fixed","available":[{"version":"16.2.5","date":"2026-05-11","kind":"first-observed"}]},"advisories":[],"risk":0.5594999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-44579","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44579","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/vercel/next.js/security/advisories/GHSA-mg66-mrh9-m8jx","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:37272","https://access.redhat.com/errata/RHSA-2026:40974","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/security/cve/CVE-2026-44579","https://bugzilla.redhat.com/show_bug.cgi?id=2477193","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44579.json"],"description":"Next.js is a React framework for building full-stack web applications. From  to before 15.5.16 and 16.2.5, applications using Partial Prerendering through the Cache Components feature can be vulnerable to connection exhaustion through crafted POST requests to a server action. In affected configurations, a malicious request can trigger a request-body handling deadlock that leaves connections open for an extended period, consuming file descriptors and server capacity until legitimate users are denied service. This vulnerability is fixed in 15.5.16 and 16.2.5.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44579","epss":0.00746,"percentile":0.54823,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44579","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-44579","cwe":"CWE-833","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"next","version":"16.1.7"}},"found":{"vulnerabilityID":"GHSA-mg66-mrh9-m8jx","versionConstraint":">=16.0.0,<16.2.5 (semantic)"},"fix":{"suggestedVersion":"16.2.5"}}],"artifact":{"id":"pkg:npm/next@16.1.7?package-id=662de087d22e519d","name":"next","version":"16.1.7","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vercel:next.js:16.1.7:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/next@16.1.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-p92q-9vqr-4j8v","dataSource":"https://github.com/advisories/GHSA-p92q-9vqr-4j8v","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-p92q-9vqr-4j8v","https://github.com/axios/axios/releases/tag/v0.32.0","https://github.com/axios/axios/releases/tag/v1.16.0","https://nvd.nist.gov/vuln/detail/CVE-2026-44487"],"description":"Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44487","epss":0.00689,"percentile":0.52756,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44487","cwe":"CWE-201","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-44487","cwe":"CWE-201","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["1.16.0"],"state":"fixed","available":[{"version":"1.16.0","date":"2026-06-04","kind":"first-observed"}]},"advisories":[],"risk":0.540865},"relatedVulnerabilities":[{"id":"CVE-2026-44487","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44487","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-p92q-9vqr-4j8v","https://access.redhat.com/errata/RHSA-2026:20889","https://access.redhat.com/errata/RHSA-2026:20938","https://access.redhat.com/errata/RHSA-2026:27044","https://access.redhat.com/errata/RHSA-2026:27063","https://access.redhat.com/errata/RHSA-2026:28964","https://access.redhat.com/errata/RHSA-2026:29082","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:29864","https://access.redhat.com/errata/RHSA-2026:30650","https://access.redhat.com/errata/RHSA-2026:30651","https://access.redhat.com/errata/RHSA-2026:33155","https://access.redhat.com/errata/RHSA-2026:33160","https://access.redhat.com/errata/RHSA-2026:33163","https://access.redhat.com/errata/RHSA-2026:33173","https://access.redhat.com/errata/RHSA-2026:33183","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:34374","https://access.redhat.com/errata/RHSA-2026:34525","https://access.redhat.com/errata/RHSA-2026:34527","https://access.redhat.com/errata/RHSA-2026:34530","https://access.redhat.com/errata/RHSA-2026:36611","https://access.redhat.com/errata/RHSA-2026:36754","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:36882","https://access.redhat.com/errata/RHSA-2026:36883","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:40768","https://access.redhat.com/errata/RHSA-2026:40792","https://access.redhat.com/errata/RHSA-2026:40795","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41055","https://access.redhat.com/errata/RHSA-2026:41064","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:42078","https://access.redhat.com/errata/RHSA-2026:42085","https://access.redhat.com/errata/RHSA-2026:42142","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:46885","https://access.redhat.com/errata/RHSA-2026:46903","https://access.redhat.com/errata/RHSA-2026:50300","https://access.redhat.com/errata/RHSA-2026:54188","https://access.redhat.com/errata/RHSA-2026:54206","https://access.redhat.com/errata/RHSA-2026:57191","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-44487","https://bugzilla.redhat.com/show_bug.cgi?id=2487948","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44487.json"],"description":"Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’s Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected origin during specific proxy-to-direct redirect flows. This affects Node.js usage, where an initial HTTP request is sent through an authenticated HTTP proxy, redirects are followed, and the redirected URL is no longer proxied. Under affected redirect shapes, the final origin can receive the proxy credential that was intended only for the outbound proxy. This vulnerability is fixed in 0.32.0 and 1.16.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44487","epss":0.00689,"percentile":0.52756,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44487","cwe":"CWE-201","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-44487","cwe":"CWE-201","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.15.0"}},"found":{"vulnerabilityID":"GHSA-p92q-9vqr-4j8v","versionConstraint":">=1.0.0,<1.16.0 (semantic)"},"fix":{"suggestedVersion":"1.16.0"}}],"artifact":{"id":"pkg:npm/axios@1.15.0?package-id=520b8e92ffff8054","name":"axios","version":"1.15.0","type":"npm","locations":[{"path":"/sink/oidc-server/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.15.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.15.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-mf9v-mfxr-j63j","dataSource":"https://github.com/advisories/GHSA-mf9v-mfxr-j63j","namespace":"github:language:python","severity":"High","urls":["https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j","https://nvd.nist.gov/vuln/detail/CVE-2026-44432","https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2026-142.yaml"],"description":"urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","metrics":{"baseScore":8.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44432","epss":0.0068,"percentile":0.52404,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44432","cwe":"CWE-409","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-44432","cwe":"CWE-409","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["2.7.0"],"state":"fixed","available":[{"version":"2.7.0","date":"2026-05-11","kind":"first-observed"}]},"advisories":[],"risk":0.5337999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-44432","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44432","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j","https://access.redhat.com/errata/RHSA-2026:15862","https://access.redhat.com/errata/RHSA-2026:20338","https://access.redhat.com/errata/RHSA-2026:22934","https://access.redhat.com/errata/RHSA-2026:24000","https://access.redhat.com/errata/RHSA-2026:24009","https://access.redhat.com/errata/RHSA-2026:24014","https://access.redhat.com/errata/RHSA-2026:24069","https://access.redhat.com/errata/RHSA-2026:24374","https://access.redhat.com/errata/RHSA-2026:24476","https://access.redhat.com/errata/RHSA-2026:24483","https://access.redhat.com/errata/RHSA-2026:24540","https://access.redhat.com/errata/RHSA-2026:24541","https://access.redhat.com/errata/RHSA-2026:24542","https://access.redhat.com/errata/RHSA-2026:24544","https://access.redhat.com/errata/RHSA-2026:25039","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25928","https://access.redhat.com/errata/RHSA-2026:26212","https://access.redhat.com/errata/RHSA-2026:26304","https://access.redhat.com/errata/RHSA-2026:27929","https://access.redhat.com/errata/RHSA-2026:28000","https://access.redhat.com/errata/RHSA-2026:28157","https://access.redhat.com/errata/RHSA-2026:28158","https://access.redhat.com/errata/RHSA-2026:28159","https://access.redhat.com/errata/RHSA-2026:28571","https://access.redhat.com/errata/RHSA-2026:30076","https://access.redhat.com/errata/RHSA-2026:30078","https://access.redhat.com/errata/RHSA-2026:30087","https://access.redhat.com/errata/RHSA-2026:30088","https://access.redhat.com/errata/RHSA-2026:30089","https://access.redhat.com/errata/RHSA-2026:32992","https://access.redhat.com/errata/RHSA-2026:33313","https://access.redhat.com/errata/RHSA-2026:33683","https://access.redhat.com/errata/RHSA-2026:34160","https://access.redhat.com/errata/RHSA-2026:34374","https://access.redhat.com/errata/RHSA-2026:34526","https://access.redhat.com/errata/RHSA-2026:34531","https://access.redhat.com/errata/RHSA-2026:34533","https://access.redhat.com/errata/RHSA-2026:34607","https://access.redhat.com/errata/RHSA-2026:36350","https://access.redhat.com/errata/RHSA-2026:37275","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:42078","https://access.redhat.com/errata/RHSA-2026:42079","https://access.redhat.com/errata/RHSA-2026:42132","https://access.redhat.com/errata/RHSA-2026:42144","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:43038","https://access.redhat.com/errata/RHSA-2026:44481","https://access.redhat.com/errata/RHSA-2026:51206","https://access.redhat.com/errata/RHSA-2026:56347","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:59409","https://access.redhat.com/errata/RHSA-2026:60362","https://access.redhat.com/errata/RHSA-2026:60371","https://access.redhat.com/errata/RHSA-2026:7625","https://access.redhat.com/errata/RHSA-2026:7634","https://access.redhat.com/security/cve/CVE-2026-44432","https://bugzilla.redhat.com/show_bug.cgi?id=2477154","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44432.json"],"description":"urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1) during the second HTTPResponse.read(amt=N) call when the response was decompressed using the official Brotli library or (2) when HTTPResponse.drain_conn() was called after the response had been read and decompressed partially (compression algorithm did not matter here). These issues could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This could result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data) on the client side. This vulnerability is fixed in 2.7.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44432","epss":0.0068,"percentile":0.52404,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44432","cwe":"CWE-409","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-44432","cwe":"CWE-409","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"urllib3","version":"2.6.3"}},"found":{"vulnerabilityID":"GHSA-mf9v-mfxr-j63j","versionConstraint":">=2.6.0,<2.7.0 (python)"},"fix":{"suggestedVersion":"2.7.0"}}],"artifact":{"id":"pkg:pypi/urllib3@2.6.3?package-id=0526caf26f90afee","name":"urllib3","version":"2.6.3","type":"python","locations":[{"path":"/backend/bdd/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python:urllib3:2.6.3:*:*:*:*:*:*:*"],"purl":"pkg:pypi/urllib3@2.6.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-pmwg-cvhr-8vh7","dataSource":"https://github.com/advisories/GHSA-pmwg-cvhr-8vh7","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-pmwg-cvhr-8vh7","https://nvd.nist.gov/vuln/detail/CVE-2026-42043"],"description":"Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":7.2,"exploitabilityScore":3.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42043","epss":0.00711,"percentile":0.53586,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42043","cwe":"CWE-183","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-42043","cwe":"CWE-441","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-42043","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-42043","cwe":"CWE-918","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["1.15.1"],"state":"fixed","available":[{"version":"1.15.1","date":"2026-05-05","kind":"first-observed"}]},"advisories":[],"risk":0.522585},"relatedVulnerabilities":[{"id":"CVE-2026-42043","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42043","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/axios/axios/security/advisories/GHSA-pmwg-cvhr-8vh7","https://access.redhat.com/errata/RHSA-2026:14937","https://access.redhat.com/errata/RHSA-2026:16476","https://access.redhat.com/errata/RHSA-2026:16532","https://access.redhat.com/errata/RHSA-2026:16534","https://access.redhat.com/errata/RHSA-2026:16535","https://access.redhat.com/errata/RHSA-2026:16542","https://access.redhat.com/errata/RHSA-2026:16874","https://access.redhat.com/errata/RHSA-2026:17468","https://access.redhat.com/errata/RHSA-2026:17474","https://access.redhat.com/errata/RHSA-2026:17657","https://access.redhat.com/errata/RHSA-2026:17699","https://access.redhat.com/errata/RHSA-2026:19109","https://access.redhat.com/errata/RHSA-2026:19375","https://access.redhat.com/errata/RHSA-2026:20889","https://access.redhat.com/errata/RHSA-2026:20938","https://access.redhat.com/errata/RHSA-2026:21017","https://access.redhat.com/errata/RHSA-2026:21338","https://access.redhat.com/errata/RHSA-2026:21772","https://access.redhat.com/errata/RHSA-2026:22465","https://access.redhat.com/errata/RHSA-2026:22619","https://access.redhat.com/errata/RHSA-2026:22629","https://access.redhat.com/errata/RHSA-2026:22840","https://access.redhat.com/errata/RHSA-2026:23361","https://access.redhat.com/errata/RHSA-2026:24536","https://access.redhat.com/errata/RHSA-2026:24539","https://access.redhat.com/errata/RHSA-2026:24853","https://access.redhat.com/errata/RHSA-2026:24977","https://access.redhat.com/errata/RHSA-2026:25041","https://access.redhat.com/errata/RHSA-2026:25089","https://access.redhat.com/errata/RHSA-2026:25271","https://access.redhat.com/errata/RHSA-2026:25273","https://access.redhat.com/errata/RHSA-2026:26214","https://access.redhat.com/errata/RHSA-2026:26225","https://access.redhat.com/errata/RHSA-2026:26232","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:36882","https://access.redhat.com/errata/RHSA-2026:48670","https://access.redhat.com/security/cve/CVE-2026-42043","https://bugzilla.redhat.com/show_bug.cgi?id=2461626","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42043.json"],"description":"Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, an attacker who can influence the target URL of an Axios request can use any address in the 127.0.0.0/8 range (other than 127.0.0.1) to completely bypass the NO_PROXY protection. This vulnerability is due to an incomplete for CVE-2025-62718, This vulnerability is fixed in 1.15.1 and 0.31.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","metrics":{"baseScore":10,"exploitabilityScore":3.9,"impactScore":5.8},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":7.2,"exploitabilityScore":3.9,"impactScore":2.8},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":7.2,"exploitabilityScore":3.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42043","epss":0.00711,"percentile":0.53586,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42043","cwe":"CWE-183","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-42043","cwe":"CWE-441","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-42043","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-42043","cwe":"CWE-918","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.15.0"}},"found":{"vulnerabilityID":"GHSA-pmwg-cvhr-8vh7","versionConstraint":">=1.0.0,<1.15.1 (semantic)"},"fix":{"suggestedVersion":"1.15.1"}}],"artifact":{"id":"pkg:npm/axios@1.15.0?package-id=520b8e92ffff8054","name":"axios","version":"1.15.0","type":"npm","locations":[{"path":"/sink/oidc-server/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.15.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.15.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-hmw2-7cc7-3qxx","dataSource":"https://github.com/advisories/GHSA-hmw2-7cc7-3qxx","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/form-data/form-data/security/advisories/GHSA-hmw2-7cc7-3qxx","https://nvd.nist.gov/vuln/detail/CVE-2026-12143","https://github.com/form-data/form-data/commit/64190db548c0179e37206858e39f27cf513e9435","https://github.com/form-data/form-data/commit/be3f3cf553978bac15a5182f1f3c3d2d38ccf229","https://github.com/form-data/form-data/commit/c7133499c2ee1b80c678e411244f4442bf902045","https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart-form-data","https://www.npmjs.com/package/form-data"],"description":"form-data: CRLF injection in form-data via unescaped multipart field names and filenames","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-12143","epss":0.00669,"percentile":0.51971,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-12143","cwe":"CWE-93","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-12143","cwe":"CWE-93","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["4.0.6"],"state":"fixed","available":[{"version":"4.0.6","date":"2026-06-15","kind":"first-observed"}]},"advisories":[],"risk":0.5218200000000001},"relatedVulnerabilities":[{"id":"CVE-2026-12143","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12143","namespace":"nvd:cpe","severity":"High","urls":["https://cwe.mitre.org/data/definitions/93.html","https://github.com/form-data/form-data/commit/64190db548c0179e37206858e39f27cf513e9435","https://github.com/form-data/form-data/commit/be3f3cf553978bac15a5182f1f3c3d2d38ccf229","https://github.com/form-data/form-data/commit/c7133499c2ee1b80c678e411244f4442bf902045","https://github.com/form-data/form-data/security/advisories/GHSA-hmw2-7cc7-3qxx","https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart-form-data","https://www.npmjs.com/package/form-data","https://access.redhat.com/errata/RHSA-2026:33155","https://access.redhat.com/errata/RHSA-2026:33160","https://access.redhat.com/errata/RHSA-2026:33163","https://access.redhat.com/errata/RHSA-2026:33173","https://access.redhat.com/errata/RHSA-2026:33183","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:36319","https://access.redhat.com/errata/RHSA-2026:36625","https://access.redhat.com/errata/RHSA-2026:36754","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41929","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:44263","https://access.redhat.com/errata/RHSA-2026:44267","https://access.redhat.com/errata/RHSA-2026:48124","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:48693","https://access.redhat.com/errata/RHSA-2026:50300","https://access.redhat.com/errata/RHSA-2026:54770","https://access.redhat.com/errata/RHSA-2026:56338","https://access.redhat.com/errata/RHSA-2026:56366","https://access.redhat.com/errata/RHSA-2026:56431","https://access.redhat.com/errata/RHSA-2026:57013","https://access.redhat.com/errata/RHSA-2026:57545","https://access.redhat.com/errata/RHSA-2026:57590","https://access.redhat.com/errata/RHSA-2026:57801","https://access.redhat.com/errata/RHSA-2026:59136","https://access.redhat.com/errata/RHSA-2026:59153","https://access.redhat.com/errata/RHSA-2026:59155","https://access.redhat.com/errata/RHSA-2026:59556","https://access.redhat.com/errata/RHSA-2026:59557","https://access.redhat.com/errata/RHSA-2026:59558","https://access.redhat.com/errata/RHSA-2026:59559","https://access.redhat.com/errata/RHSA-2026:59579","https://access.redhat.com/errata/RHSA-2026:60387","https://access.redhat.com/errata/RHSA-2026:60388","https://access.redhat.com/errata/RHSA-2026:60389","https://access.redhat.com/errata/RHSA-2026:60390","https://access.redhat.com/errata/RHSA-2026:60391","https://access.redhat.com/errata/RHSA-2026:60446","https://access.redhat.com/errata/RHSA-2026:60477","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:63047","https://access.redhat.com/errata/RHSA-2026:63355","https://access.redhat.com/errata/RHSA-2026:63373","https://access.redhat.com/errata/RHSA-2026:66003","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-12143","https://bugzilla.redhat.com/show_bug.cgi?id=2488480","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12143.json"],"description":"form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Disposition` header without escaping carriage return (CR), line feed (LF), or double-quote (\") characters. An application that passes attacker-controlled data as a field name or filename (for example, an API gateway that turns JSON object keys into multipart field names) allows the attacker to terminate the header line and inject additional headers, or to smuggle entire additional multipart parts, into the request the application forwards to a backend. This can let the attacker add or override form fields (e.g. set `is_admin=true`) seen by the downstream parser. This is an instance of CWE-93 (CRLF injection). The fix escapes CR, LF, and `\"` as `%0D`, `%0A`, and `%22` in field names and filenames, matching the serialization browsers use per the WHATWG HTML multipart/form-data encoding algorithm. Exploitation requires the consuming application to use untrusted input as a field name or filename; applications that use only fixed/trusted field names are not affected. Fixed in 2.5.6, 3.0.5, and 4.0.6.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-12143","epss":0.00669,"percentile":0.51971,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-12143","cwe":"CWE-93","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-12143","cwe":"CWE-93","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"form-data","version":"4.0.5"}},"found":{"vulnerabilityID":"GHSA-hmw2-7cc7-3qxx","versionConstraint":">=4.0.0,<4.0.6 (semantic)"},"fix":{"suggestedVersion":"4.0.6"}}],"artifact":{"id":"pkg:npm/form-data@4.0.5?package-id=ccb384eda685076d","name":"form-data","version":"4.0.5","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:form-data:form-data:4.0.5:*:*:*:*:*:*:*","cpe:2.3:a:form-data:form_data:4.0.5:*:*:*:*:*:*:*","cpe:2.3:a:form_data:form-data:4.0.5:*:*:*:*:*:*:*","cpe:2.3:a:form_data:form_data:4.0.5:*:*:*:*:*:*:*","cpe:2.3:a:form:form-data:4.0.5:*:*:*:*:*:*:*","cpe:2.3:a:form:form_data:4.0.5:*:*:*:*:*:*:*"],"purl":"pkg:npm/form-data@4.0.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-hmw2-7cc7-3qxx","dataSource":"https://github.com/advisories/GHSA-hmw2-7cc7-3qxx","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/form-data/form-data/security/advisories/GHSA-hmw2-7cc7-3qxx","https://nvd.nist.gov/vuln/detail/CVE-2026-12143","https://github.com/form-data/form-data/commit/64190db548c0179e37206858e39f27cf513e9435","https://github.com/form-data/form-data/commit/be3f3cf553978bac15a5182f1f3c3d2d38ccf229","https://github.com/form-data/form-data/commit/c7133499c2ee1b80c678e411244f4442bf902045","https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart-form-data","https://www.npmjs.com/package/form-data"],"description":"form-data: CRLF injection in form-data via unescaped multipart field names and filenames","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-12143","epss":0.00669,"percentile":0.51971,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-12143","cwe":"CWE-93","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-12143","cwe":"CWE-93","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["4.0.6"],"state":"fixed","available":[{"version":"4.0.6","date":"2026-06-15","kind":"first-observed"}]},"advisories":[],"risk":0.5218200000000001},"relatedVulnerabilities":[{"id":"CVE-2026-12143","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12143","namespace":"nvd:cpe","severity":"High","urls":["https://cwe.mitre.org/data/definitions/93.html","https://github.com/form-data/form-data/commit/64190db548c0179e37206858e39f27cf513e9435","https://github.com/form-data/form-data/commit/be3f3cf553978bac15a5182f1f3c3d2d38ccf229","https://github.com/form-data/form-data/commit/c7133499c2ee1b80c678e411244f4442bf902045","https://github.com/form-data/form-data/security/advisories/GHSA-hmw2-7cc7-3qxx","https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart-form-data","https://www.npmjs.com/package/form-data","https://access.redhat.com/errata/RHSA-2026:33155","https://access.redhat.com/errata/RHSA-2026:33160","https://access.redhat.com/errata/RHSA-2026:33163","https://access.redhat.com/errata/RHSA-2026:33173","https://access.redhat.com/errata/RHSA-2026:33183","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:36319","https://access.redhat.com/errata/RHSA-2026:36625","https://access.redhat.com/errata/RHSA-2026:36754","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41929","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:44263","https://access.redhat.com/errata/RHSA-2026:44267","https://access.redhat.com/errata/RHSA-2026:48124","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:48693","https://access.redhat.com/errata/RHSA-2026:50300","https://access.redhat.com/errata/RHSA-2026:54770","https://access.redhat.com/errata/RHSA-2026:56338","https://access.redhat.com/errata/RHSA-2026:56366","https://access.redhat.com/errata/RHSA-2026:56431","https://access.redhat.com/errata/RHSA-2026:57013","https://access.redhat.com/errata/RHSA-2026:57545","https://access.redhat.com/errata/RHSA-2026:57590","https://access.redhat.com/errata/RHSA-2026:57801","https://access.redhat.com/errata/RHSA-2026:59136","https://access.redhat.com/errata/RHSA-2026:59153","https://access.redhat.com/errata/RHSA-2026:59155","https://access.redhat.com/errata/RHSA-2026:59556","https://access.redhat.com/errata/RHSA-2026:59557","https://access.redhat.com/errata/RHSA-2026:59558","https://access.redhat.com/errata/RHSA-2026:59559","https://access.redhat.com/errata/RHSA-2026:59579","https://access.redhat.com/errata/RHSA-2026:60387","https://access.redhat.com/errata/RHSA-2026:60388","https://access.redhat.com/errata/RHSA-2026:60389","https://access.redhat.com/errata/RHSA-2026:60390","https://access.redhat.com/errata/RHSA-2026:60391","https://access.redhat.com/errata/RHSA-2026:60446","https://access.redhat.com/errata/RHSA-2026:60477","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:63047","https://access.redhat.com/errata/RHSA-2026:63355","https://access.redhat.com/errata/RHSA-2026:63373","https://access.redhat.com/errata/RHSA-2026:66003","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-12143","https://bugzilla.redhat.com/show_bug.cgi?id=2488480","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12143.json"],"description":"form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Disposition` header without escaping carriage return (CR), line feed (LF), or double-quote (\") characters. An application that passes attacker-controlled data as a field name or filename (for example, an API gateway that turns JSON object keys into multipart field names) allows the attacker to terminate the header line and inject additional headers, or to smuggle entire additional multipart parts, into the request the application forwards to a backend. This can let the attacker add or override form fields (e.g. set `is_admin=true`) seen by the downstream parser. This is an instance of CWE-93 (CRLF injection). The fix escapes CR, LF, and `\"` as `%0D`, `%0A`, and `%22` in field names and filenames, matching the serialization browsers use per the WHATWG HTML multipart/form-data encoding algorithm. Exploitation requires the consuming application to use untrusted input as a field name or filename; applications that use only fixed/trusted field names are not affected. Fixed in 2.5.6, 3.0.5, and 4.0.6.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-12143","epss":0.00669,"percentile":0.51971,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-12143","cwe":"CWE-93","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-12143","cwe":"CWE-93","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"form-data","version":"4.0.5"}},"found":{"vulnerabilityID":"GHSA-hmw2-7cc7-3qxx","versionConstraint":">=4.0.0,<4.0.6 (semantic)"},"fix":{"suggestedVersion":"4.0.6"}}],"artifact":{"id":"pkg:npm/form-data@4.0.5?package-id=a2c17cd144b1a249","name":"form-data","version":"4.0.5","type":"npm","locations":[{"path":"/sink/oidc-server/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:form-data:form-data:4.0.5:*:*:*:*:*:*:*","cpe:2.3:a:form-data:form_data:4.0.5:*:*:*:*:*:*:*","cpe:2.3:a:form_data:form-data:4.0.5:*:*:*:*:*:*:*","cpe:2.3:a:form_data:form_data:4.0.5:*:*:*:*:*:*:*","cpe:2.3:a:form:form-data:4.0.5:*:*:*:*:*:*:*","cpe:2.3:a:form:form_data:4.0.5:*:*:*:*:*:*:*"],"purl":"pkg:npm/form-data@4.0.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-2v4p-qf9q-27wj","dataSource":"https://github.com/advisories/GHSA-2v4p-qf9q-27wj","namespace":"github:language:go","severity":"High","urls":["https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj","https://github.com/grpc/grpc-go/issues/9354","https://github.com/grpc/grpc-go/pull/9365","https://github.com/grpc/grpc-go/pull/9366","https://github.com/grpc/grpc-go/pull/9367","https://github.com/grpc/grpc-go/commit/3822494d8ea03b992c089fd2a195f041762fffb7","https://github.com/grpc/grpc-go/commit/8668b69c167df908b6b3666dcbf40992b9e932a4","https://github.com/grpc/grpc-go/commit/93e31b48545e2a8aaeb6e06b47fb249f94e6297f","https://github.com/grpc/grpc-go/releases/tag/v1.82.2","https://github.com/grpc/grpc-go/releases/tag/v1.83.2","https://nvd.nist.gov/vuln/detail/CVE-2026-84445"],"description":"gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84445","epss":0.00641,"percentile":0.50726,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84445","cwe":"CWE-129","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-84445","cwe":"CWE-248","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["1.83.2"],"state":"fixed","available":[{"version":"1.83.2","date":"2026-09-09","kind":"first-observed"}]},"advisories":[],"risk":0.51921},"relatedVulnerabilities":[{"id":"CVE-2026-84445","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84445","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/grpc/grpc-go/commit/3822494d8ea03b992c089fd2a195f041762fffb7","https://github.com/grpc/grpc-go/commit/8668b69c167df908b6b3666dcbf40992b9e932a4","https://github.com/grpc/grpc-go/commit/93e31b48545e2a8aaeb6e06b47fb249f94e6297f","https://github.com/grpc/grpc-go/issues/9354","https://github.com/grpc/grpc-go/pull/9365","https://github.com/grpc/grpc-go/pull/9366","https://github.com/grpc/grpc-go/pull/9367","https://github.com/grpc/grpc-go/releases/tag/v1.82.2","https://github.com/grpc/grpc-go/releases/tag/v1.83.2","https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj"],"description":"gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow internal/transport/http2_server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in internal/xds/server/routing.go assumes that an authority value exists and indexes the empty slice. A remote client that can complete transport connection establishment can trigger an index-out-of-bounds panic that is not recovered by the per-RPC goroutine and terminates the entire server process. In insecure or ordinary TLS deployments the request can be unauthenticated, while strict mTLS or ALTS deployments require valid transport credentials before the malformed RPC can reach the interceptor. This issue is fixed in versions 1.82.2 and 1.83.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84445","epss":0.00641,"percentile":0.50726,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84445","cwe":"CWE-129","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-84445","cwe":"CWE-248","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"google.golang.org/grpc","version":"v1.83.1"}},"found":{"vulnerabilityID":"GHSA-2v4p-qf9q-27wj","versionConstraint":">=1.83.0,<1.83.2 (go)"},"fix":{"suggestedVersion":"1.83.2"}}],"artifact":{"id":"pkg:golang/google.golang.org/grpc@v1.83.1?package-id=b2976780e6ed0f45","name":"google.golang.org/grpc","version":"v1.83.1","type":"go-module","locations":[{"path":"/backend-go/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:google:grpc:v1.83.1:*:*:*:*:*:*:*"],"purl":"pkg:golang/google.golang.org/grpc@v1.83.1","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:HIO0+BEtBP6soyqvqC8sNUjZ7bTs+0hFQuFF+RAy++Y="}}},{"vulnerability":{"id":"GHSA-4c8g-83qw-93j6","dataSource":"https://github.com/advisories/GHSA-4c8g-83qw-93j6","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6","https://nvd.nist.gov/vuln/detail/CVE-2026-13676","https://github.com/fastify/fast-uri/pull/188","https://github.com/fastify/fast-uri/commit/2a6d357a18a68e6d812824379fd3388a1ae50d05","https://github.com/fastify/fast-uri/commit/21ea1f9d70495c931f55dff893a8fa38f4f2e6bd","https://github.com/fastify/fast-uri/commit/01db48010f594b98f7b323be18b393791c66ed1d","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-13676.json","https://github.com/fastify/fast-uri/releases/tag/v4.0.1","https://github.com/fastify/fast-uri/releases/tag/v3.1.3","https://github.com/fastify/fast-uri/releases/tag/v2.4.2","https://cna.openjsf.org/security-advisories.html","https://bugzilla.redhat.com/show_bug.cgi?id=2494197","https://access.redhat.com/security/cve/CVE-2026-13676","https://access.redhat.com/errata/RHSA-2026:41929","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:37628","https://access.redhat.com/errata/RHSA-2026:37585","https://access.redhat.com/errata/RHSA-2026:37186","https://access.redhat.com/errata/RHSA-2026:43038","https://access.redhat.com/errata/RHSA-2026:42815","https://access.redhat.com/errata/RHSA-2026:40765","https://access.redhat.com/errata/RHSA-2026:44239","https://access.redhat.com/errata/RHSA-2026:44268","https://access.redhat.com/errata/RHSA-2026:48126","https://access.redhat.com/errata/RHSA-2026:48124","https://access.redhat.com/errata/RHSA-2026:49642","https://access.redhat.com/errata/RHSA-2026:50479","https://access.redhat.com/errata/RHSA-2026:50340","https://access.redhat.com/errata/RHSA-2026:47728","https://access.redhat.com/errata/RHSA-2026:51196","https://access.redhat.com/errata/RHSA-2026:51197","https://access.redhat.com/errata/RHSA-2026:51342","https://access.redhat.com/errata/RHSA-2026:51348","https://access.redhat.com/errata/RHSA-2026:51349","https://access.redhat.com/errata/RHSA-2026:50758","https://access.redhat.com/errata/RHSA-2026:54760","https://access.redhat.com/errata/RHSA-2026:56366","https://access.redhat.com/errata/RHSA-2026:56431","https://access.redhat.com/errata/RHSA-2026:57013","https://access.redhat.com/errata/RHSA-2026:57191","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:57590","https://access.redhat.com/errata/RHSA-2026:59593","https://access.redhat.com/errata/RHSA-2026:60386","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61314","https://access.redhat.com/errata/RHSA-2026:63371","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545"],"description":"fast-uri vulnerable to host confusion via failed IDN canonicalization","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-13676","epss":0.00692,"percentile":0.52908,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-13676","cwe":"CWE-436","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-13676","cwe":"CWE-551","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["3.1.3"],"state":"fixed","available":[{"version":"3.1.3","date":"2026-07-22","kind":"first-observed"}]},"advisories":[],"risk":0.519},"relatedVulnerabilities":[{"id":"CVE-2026-13676","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13676","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6","https://access.redhat.com/errata/RHSA-2026:37186","https://access.redhat.com/errata/RHSA-2026:37585","https://access.redhat.com/errata/RHSA-2026:37628","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:40765","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41929","https://access.redhat.com/errata/RHSA-2026:42815","https://access.redhat.com/errata/RHSA-2026:43038","https://access.redhat.com/errata/RHSA-2026:44239","https://access.redhat.com/errata/RHSA-2026:44268","https://access.redhat.com/errata/RHSA-2026:47728","https://access.redhat.com/errata/RHSA-2026:48124","https://access.redhat.com/errata/RHSA-2026:48126","https://access.redhat.com/errata/RHSA-2026:49642","https://access.redhat.com/errata/RHSA-2026:50340","https://access.redhat.com/errata/RHSA-2026:50479","https://access.redhat.com/errata/RHSA-2026:50758","https://access.redhat.com/errata/RHSA-2026:51196","https://access.redhat.com/errata/RHSA-2026:51197","https://access.redhat.com/errata/RHSA-2026:51342","https://access.redhat.com/errata/RHSA-2026:51348","https://access.redhat.com/errata/RHSA-2026:51349","https://access.redhat.com/errata/RHSA-2026:54760","https://access.redhat.com/errata/RHSA-2026:56366","https://access.redhat.com/errata/RHSA-2026:56431","https://access.redhat.com/errata/RHSA-2026:57013","https://access.redhat.com/errata/RHSA-2026:57191","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:57590","https://access.redhat.com/errata/RHSA-2026:59593","https://access.redhat.com/errata/RHSA-2026:60386","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61314","https://access.redhat.com/errata/RHSA-2026:63371","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-13676","https://bugzilla.redhat.com/show_bug.cgi?id=2494197","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-13676.json"],"description":"fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, silently leaving the host in its original Unicode form while normalize() and equal() still return values that differ from a WHATWG-compatible URL parser. Applications that use fast-uri to enforce host-based policy (denylists, loopback filtering, redirect validation, outbound proxy routing) before passing the same URL to Node's URL or fetch can be bypassed when the two implementations resolve the same input to different hosts. Patches: upgrade to fast-uri 3.1.3 for the 3.x line or 4.0.1 for the 4.x line. Workarounds: enforce host policy using the same URL parser used for the actual request, or reject non-ASCII hosts before policy checks.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-13676","epss":0.00692,"percentile":0.52908,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-13676","cwe":"CWE-436","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-13676","cwe":"CWE-551","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"3.1.0"}},"found":{"vulnerabilityID":"GHSA-4c8g-83qw-93j6","versionConstraint":">=3.0.0,<3.1.3 (semantic)"},"fix":{"suggestedVersion":"3.1.3"}}],"artifact":{"id":"pkg:npm/fast-uri@3.1.0?package-id=a87bf2e2258cda95","name":"fast-uri","version":"3.1.0","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:openjsf:fast-uri:3.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@3.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-23hp-3jrh-7fpw","dataSource":"https://github.com/advisories/GHSA-23hp-3jrh-7fpw","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw","https://nvd.nist.gov/vuln/detail/CVE-2026-59873","https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3","https://github.com/isaacs/node-tar/releases/tag/v7.5.19"],"description":"node-tar: Decompression/parse DoS via unlimited input","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","metrics":{"baseScore":9.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59873","epss":0.00582,"percentile":0.47813,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59873","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.5.19"],"state":"fixed","available":[{"version":"7.5.19","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.5048849999999999},"relatedVulnerabilities":[{"id":"CVE-2026-59873","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59873","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3","https://github.com/isaacs/node-tar/releases/tag/v7.5.19","https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw"],"description":"node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as src/extract.ts, allowing a small crafted gzip bomb to exhaust disk space and CPU. This issue is fixed in version 7.5.19.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59873","epss":0.00582,"percentile":0.47813,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59873","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"7.5.13"}},"found":{"vulnerabilityID":"GHSA-23hp-3jrh-7fpw","versionConstraint":"<=7.5.18 (semantic)"},"fix":{"suggestedVersion":"7.5.19"}}],"artifact":{"id":"pkg:npm/tar@7.5.13?package-id=c08fe2f2d0b796ea","name":"tar","version":"7.5.13","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BlueOak-1.0.0"],"cpes":["cpe:2.3:a:tar_project:tar:7.5.13:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:7.5.13:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:7.5.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@7.5.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-83w8-p2f5-377r","dataSource":"https://github.com/advisories/GHSA-83w8-p2f5-377r","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/fastify/fastify-static/security/advisories/GHSA-83w8-p2f5-377r","https://nvd.nist.gov/vuln/detail/CVE-2026-15074","https://github.com/fastify/fastify-static/commit/db4276f846ba56b21f93768cd6636ee5e2fc58b1","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fastify-static/releases/tag/v10.1.1"],"description":"@fastify/static vulnerable to route guard bypass via path traversal","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-15074","epss":0.00672,"percentile":0.52065,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-15074","cwe":"CWE-22","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["10.1.1"],"state":"fixed","available":[{"version":"10.1.1","date":"2026-07-25","kind":"first-observed"}]},"advisories":[],"risk":0.504},"relatedVulnerabilities":[{"id":"CVE-2026-15074","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15074","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fastify-static/security/advisories/GHSA-83w8-p2f5-377r"],"description":"@fastify/static up to and including version 10.1.0 fails to reject dot-dot path segments in request pathnames before the file-resolution stage. This is a bypass of the earlier fix for CVE-2026-6414, which only covered encoded forward slashes. Because the underlying send library normalizes dot segments before applying its own path-traversal guard, an unauthenticated attacker can bypass any route-scoped middleware and read files inside the static root that live under the guarded URL prefix. The bypass does not allow access outside the configured static root by itself, it defeats route-guard filtering only. The issue is patched in @fastify/static 10.1.1.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-15074","epss":0.00672,"percentile":0.52065,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-15074","cwe":"CWE-22","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@fastify/static","version":"9.1.3"}},"found":{"vulnerabilityID":"GHSA-83w8-p2f5-377r","versionConstraint":"<=10.1.0 (semantic)"},"fix":{"suggestedVersion":"10.1.1"}}],"artifact":{"id":"pkg:npm/%40fastify/static@9.1.3?package-id=adbfb80a5767f8c8","name":"@fastify/static","version":"9.1.3","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:\\@fastify\\/static:\\@fastify\\/static:9.1.3:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40fastify/static@9.1.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-777c-7fjr-54vf","dataSource":"https://github.com/advisories/GHSA-777c-7fjr-54vf","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-777c-7fjr-54vf","https://github.com/axios/axios/pull/10795","https://github.com/axios/axios/pull/10796","https://github.com/axios/axios/releases/tag/v1.16.0","https://nvd.nist.gov/vuln/detail/CVE-2026-44488"],"description":"Allocation of Resources Without Limits or Throttling in Axios","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44488","epss":0.00669,"percentile":0.51972,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44488","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-44488","cwe":"CWE-770","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["1.16.0"],"state":"fixed","available":[{"version":"1.16.0","date":"2026-06-04","kind":"first-observed"}]},"advisories":[],"risk":0.5017499999999999},"relatedVulnerabilities":[{"id":"CVE-2026-44488","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44488","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-777c-7fjr-54vf","https://access.redhat.com/errata/RHSA-2026:20889","https://access.redhat.com/errata/RHSA-2026:20938","https://access.redhat.com/errata/RHSA-2026:27044","https://access.redhat.com/errata/RHSA-2026:27063","https://access.redhat.com/errata/RHSA-2026:28964","https://access.redhat.com/errata/RHSA-2026:29082","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:30650","https://access.redhat.com/errata/RHSA-2026:30651","https://access.redhat.com/errata/RHSA-2026:33155","https://access.redhat.com/errata/RHSA-2026:33160","https://access.redhat.com/errata/RHSA-2026:33163","https://access.redhat.com/errata/RHSA-2026:33173","https://access.redhat.com/errata/RHSA-2026:33183","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:34160","https://access.redhat.com/errata/RHSA-2026:34374","https://access.redhat.com/errata/RHSA-2026:34525","https://access.redhat.com/errata/RHSA-2026:34527","https://access.redhat.com/errata/RHSA-2026:34530","https://access.redhat.com/errata/RHSA-2026:36611","https://access.redhat.com/errata/RHSA-2026:36754","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:36882","https://access.redhat.com/errata/RHSA-2026:36883","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:40768","https://access.redhat.com/errata/RHSA-2026:40792","https://access.redhat.com/errata/RHSA-2026:40795","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41055","https://access.redhat.com/errata/RHSA-2026:41064","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:42078","https://access.redhat.com/errata/RHSA-2026:42085","https://access.redhat.com/errata/RHSA-2026:42142","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:46885","https://access.redhat.com/errata/RHSA-2026:46903","https://access.redhat.com/errata/RHSA-2026:50300","https://access.redhat.com/errata/RHSA-2026:54188","https://access.redhat.com/errata/RHSA-2026:54555","https://access.redhat.com/errata/RHSA-2026:57191","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-44488","https://bugzilla.redhat.com/show_bug.cgi?id=2487949","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44488.json"],"description":"Axios is a promise based HTTP client for the browser and Node.js. Axios versions 1.7.0 through 1.15.x did not enforce configured request and response size limits when requests were sent with the fetch adapter. Applications that selected adapter: 'fetch', or ran in environments where axios resolved to the fetch adapter, could receive or send bodies larger than maxContentLength or maxBodyLength despite those limits being explicitly configured. This can cause resource exhaustion in server-side usage when a malicious or compromised server returns an oversized response, when an attacker can supply a large data: URL, or when an application forwards attacker-controlled request bodies through axios while relying on maxBodyLength as a boundary. This vulnerability is fixed in 0.32.0 and 1.16.0.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44488","epss":0.00669,"percentile":0.51972,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44488","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-44488","cwe":"CWE-770","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.15.0"}},"found":{"vulnerabilityID":"GHSA-777c-7fjr-54vf","versionConstraint":">=1.7.0,<1.16.0 (semantic)"},"fix":{"suggestedVersion":"1.16.0"}}],"artifact":{"id":"pkg:npm/axios@1.15.0?package-id=520b8e92ffff8054","name":"axios","version":"1.15.0","type":"npm","locations":[{"path":"/sink/oidc-server/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.15.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.15.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-6gpp-xcg3-4w24","dataSource":"https://github.com/advisories/GHSA-6gpp-xcg3-4w24","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24","https://github.com/vercel/next.js/pull/96014","https://github.com/vercel/next.js/commit/6bf4df14508ad6c0cd46af50c6051ee42f2d9151","https://github.com/vercel/next.js/releases/tag/v16.2.11"],"description":"Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-64642","epss":0.00635,"percentile":0.50444,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-64642","cwe":"CWE-285","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["16.2.11"],"state":"fixed","available":[{"version":"16.2.11","date":"2026-07-23","kind":"first-observed"}]},"advisories":[],"risk":0.50165},"relatedVulnerabilities":[{"id":"CVE-2026-64642","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64642","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/vercel/next.js/commit/6bf4df14508ad6c0cd46af50c6051ee42f2d9151","https://github.com/vercel/next.js/pull/96014","https://github.com/vercel/next.js/releases/tag/v16.2.11","https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24"],"description":"Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales can bypass middleware/proxy based authentication. This issue has been fixed in version 16.2.11.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":3.9,"impactScore":4.3},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-64642","epss":0.00635,"percentile":0.50444,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-64642","cwe":"CWE-285","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"next","version":"16.1.7"}},"found":{"vulnerabilityID":"GHSA-6gpp-xcg3-4w24","versionConstraint":">=16.0.0,<16.2.11 (semantic)"},"fix":{"suggestedVersion":"16.2.11"}}],"artifact":{"id":"pkg:npm/next@16.1.7?package-id=662de087d22e519d","name":"next","version":"16.1.7","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vercel:next.js:16.1.7:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/next@16.1.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-492v-c6pp-mqqv","dataSource":"https://github.com/advisories/GHSA-492v-c6pp-mqqv","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/vercel/next.js/security/advisories/GHSA-492v-c6pp-mqqv","https://github.com/vercel/next.js/releases/tag/v15.5.16","https://github.com/vercel/next.js/releases/tag/v16.2.5","https://nvd.nist.gov/vuln/detail/CVE-2026-44574"],"description":"Next.js has a Middleware / Proxy bypass through dynamic route parameter injection","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"exploitabilityScore":2.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44574","epss":0.00636,"percentile":0.50512,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44574","cwe":"CWE-288","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-44574","cwe":"CWE-551","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["16.2.5"],"state":"fixed","available":[{"version":"16.2.5","date":"2026-05-11","kind":"first-observed"}]},"advisories":[],"risk":0.49608},"relatedVulnerabilities":[{"id":"CVE-2026-44574","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44574","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/vercel/next.js/security/advisories/GHSA-492v-c6pp-mqqv","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:37272","https://access.redhat.com/errata/RHSA-2026:40974","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/security/cve/CVE-2026-44574","https://bugzilla.redhat.com/show_bug.cgi?id=2477207","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44574.json"],"description":"Next.js is a React framework for building full-stack web applications. From 15.4.0 to before 15.5.16 and 16.2.5, applications that rely on middleware to protect dynamic routes can be vulnerable to authorization bypass. In affected deployments, specially crafted query parameters can alter the dynamic route value seen by the page while leaving the visible path unchanged, which can allow protected content to be rendered without passing the expected middleware check. This vulnerability is fixed in 15.5.16 and 16.2.5.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"exploitabilityScore":2.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"exploitabilityScore":2.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44574","epss":0.00636,"percentile":0.50512,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44574","cwe":"CWE-288","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-44574","cwe":"CWE-551","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"next","version":"16.1.7"}},"found":{"vulnerabilityID":"GHSA-492v-c6pp-mqqv","versionConstraint":">=16.0.0,<16.2.5 (semantic)"},"fix":{"suggestedVersion":"16.2.5"}}],"artifact":{"id":"pkg:npm/next@16.1.7?package-id=662de087d22e519d","name":"next","version":"16.1.7","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vercel:next.js:16.1.7:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/next@16.1.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-73wf-gq98-2v4g","dataSource":"https://github.com/advisories/GHSA-73wf-gq98-2v4g","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g","https://nvd.nist.gov/vuln/detail/CVE-2026-73088","https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51","https://github.com/browserslist/browserslist/releases/tag/4.28.7"],"description":"Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73088","epss":0.00658,"percentile":0.51501,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73088","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-73088","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.28.7"],"state":"fixed","available":[{"version":"4.28.7","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.4935},"relatedVulnerabilities":[{"id":"CVE-2026-73088","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-73088","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51","https://github.com/browserslist/browserslist/releases/tag/4.28.7","https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g"],"description":"Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, reached unconditionally through getStat() and loadStat() on every browserslist() call, processes untrusted browserslist-stats.json, opts.stats, and CLI --stats data with an unguarded for...in loop and plain-object bracket access and assignment, allowing inherited Object.prototype keys including __proto__, toString, valueOf, constructor, hasOwnProperty, and isPrototypeOf to cause an uncaught TypeError or modify the prototype of the returned normalized object. This issue is fixed in version 4.28.7.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73088","epss":0.00658,"percentile":0.51501,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73088","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-73088","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"browserslist","version":"4.26.3"}},"found":{"vulnerabilityID":"GHSA-73wf-gq98-2v4g","versionConstraint":"<=4.28.6 (semantic)"},"fix":{"suggestedVersion":"4.28.7"}}],"artifact":{"id":"pkg:npm/browserslist@4.26.3?package-id=130093dde0b17526","name":"browserslist","version":"4.26.3","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:browserslist_project:browserslist:4.26.3:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/browserslist@4.26.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-c83g-rgw3-j3cx","dataSource":"https://github.com/advisories/GHSA-c83g-rgw3-j3cx","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx","https://nvd.nist.gov/vuln/detail/CVE-2026-73089","https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405","https://github.com/browserslist/browserslist/releases/tag/4.28.7"],"description":"Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73089","epss":0.00655,"percentile":0.51388,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73089","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.28.7"],"state":"fixed","available":[{"version":"4.28.7","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.49125},"relatedVulnerabilities":[{"id":"CVE-2026-73089","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-73089","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405","https://github.com/browserslist/browserslist/releases/tag/4.28.7","https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx"],"description":"Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct `(queries, context)` result in cache and every parseQueries() AST in parseCache without a size cap, TTL, or eviction, allowing an attacker who can influence repeated browserslist() query values, including valid since `<year>-<month>-<day>` queries, to bypass the caller-controlled BROWSERSLIST_DISABLE_CACHE mitigation and cause linear memory growth followed by an out-of-memory process crash. This issue is fixed in version 4.28.7.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73089","epss":0.00655,"percentile":0.51388,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73089","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"browserslist","version":"4.26.3"}},"found":{"vulnerabilityID":"GHSA-c83g-rgw3-j3cx","versionConstraint":"<=4.28.6 (semantic)"},"fix":{"suggestedVersion":"4.28.7"}}],"artifact":{"id":"pkg:npm/browserslist@4.26.3?package-id=130093dde0b17526","name":"browserslist","version":"4.26.3","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:browserslist_project:browserslist:4.26.3:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/browserslist@4.26.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-rgw5-rvv9-x895","dataSource":"https://github.com/advisories/GHSA-rgw5-rvv9-x895","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895","https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d","https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac","https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf","https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031","https://nvd.nist.gov/vuln/detail/CVE-2026-69152"],"description":"brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69152","epss":0.00647,"percentile":0.51007,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69152","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69152","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.1.18"],"state":"fixed","available":[{"version":"1.1.18","date":"2026-08-03","kind":"first-observed"}]},"advisories":[],"risk":0.48525},"relatedVulnerabilities":[{"id":"CVE-2026-69152","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-69152","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d","https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac","https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf","https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop. The fix for CVE-2026-14257 is bypassed by the vulnerability. This issue is fixed in versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69152","epss":0.00647,"percentile":0.51007,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69152","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69152","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.14"}},"found":{"vulnerabilityID":"GHSA-rgw5-rvv9-x895","versionConstraint":"<1.1.18 (semantic)"},"fix":{"suggestedVersion":"1.1.18"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.14?package-id=e9bc4db499821f08","name":"brace-expansion","version":"1.1.14","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.14:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.14","upstreams":[]}},{"vulnerability":{"id":"GHSA-rgw5-rvv9-x895","dataSource":"https://github.com/advisories/GHSA-rgw5-rvv9-x895","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895","https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d","https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac","https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf","https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031","https://nvd.nist.gov/vuln/detail/CVE-2026-69152"],"description":"brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69152","epss":0.00647,"percentile":0.51007,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69152","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69152","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.1.18"],"state":"fixed","available":[{"version":"1.1.18","date":"2026-08-03","kind":"first-observed"}]},"advisories":[],"risk":0.48525},"relatedVulnerabilities":[{"id":"CVE-2026-69152","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-69152","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d","https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac","https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf","https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop. The fix for CVE-2026-14257 is bypassed by the vulnerability. This issue is fixed in versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69152","epss":0.00647,"percentile":0.51007,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69152","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69152","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.14"}},"found":{"vulnerabilityID":"GHSA-rgw5-rvv9-x895","versionConstraint":"<1.1.18 (semantic)"},"fix":{"suggestedVersion":"1.1.18"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.14?package-id=fa326f252298de13","name":"brace-expansion","version":"1.1.14","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.14:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.14","upstreams":[]}},{"vulnerability":{"id":"GHSA-rgw5-rvv9-x895","dataSource":"https://github.com/advisories/GHSA-rgw5-rvv9-x895","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895","https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d","https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac","https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf","https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031","https://nvd.nist.gov/vuln/detail/CVE-2026-69152"],"description":"brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69152","epss":0.00647,"percentile":0.51007,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69152","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69152","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.1.4"],"state":"fixed","available":[{"version":"2.1.4","date":"2026-08-03","kind":"first-observed"}]},"advisories":[],"risk":0.48525},"relatedVulnerabilities":[{"id":"CVE-2026-69152","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-69152","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d","https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac","https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf","https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop. The fix for CVE-2026-14257 is bypassed by the vulnerability. This issue is fixed in versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69152","epss":0.00647,"percentile":0.51007,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69152","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69152","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"2.1.0"}},"found":{"vulnerabilityID":"GHSA-rgw5-rvv9-x895","versionConstraint":">=2.0.0,<2.1.4 (semantic)"},"fix":{"suggestedVersion":"2.1.4"}}],"artifact":{"id":"pkg:npm/brace-expansion@2.1.0?package-id=5b11ade77bad45b9","name":"brace-expansion","version":"2.1.0","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:2.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@2.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-mh99-v99m-4gvg","dataSource":"https://github.com/advisories/GHSA-mh99-v99m-4gvg","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-mh99-v99m-4gvg","https://nvd.nist.gov/vuln/detail/CVE-2026-14257","https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5","https://github.com/juliangruber/brace-expansion","https://www.npmjs.com/package/brace-expansion","https://github.com/juliangruber/brace-expansion/pull/129","https://github.com/juliangruber/brace-expansion/pull/130","https://github.com/juliangruber/brace-expansion/pull/136","https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d","https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031","https://github.com/juliangruber/brace-expansion/commit/d13ff455a58b0d56704f0111e3c2a0b16ceb06eb"],"description":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-14257","epss":0.00643,"percentile":0.5082,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-14257","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-14257","cwe":"CWE-770","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}],"fix":{"versions":["1.1.17"],"state":"fixed","available":[{"version":"1.1.17","date":"2026-08-01","kind":"first-observed"}]},"advisories":[],"risk":0.48225000000000007},"relatedVulnerabilities":[{"id":"CVE-2026-14257","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-14257","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion","https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5","https://www.npmjs.com/package/brace-expansion"],"description":"brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays.","cvss":[{"source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-14257","epss":0.00643,"percentile":0.5082,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-14257","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-14257","cwe":"CWE-770","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.14"}},"found":{"vulnerabilityID":"GHSA-mh99-v99m-4gvg","versionConstraint":"<1.1.17 (semantic)"},"fix":{"suggestedVersion":"1.1.17"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.14?package-id=e9bc4db499821f08","name":"brace-expansion","version":"1.1.14","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.14:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.14","upstreams":[]}},{"vulnerability":{"id":"GHSA-mh99-v99m-4gvg","dataSource":"https://github.com/advisories/GHSA-mh99-v99m-4gvg","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-mh99-v99m-4gvg","https://nvd.nist.gov/vuln/detail/CVE-2026-14257","https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5","https://github.com/juliangruber/brace-expansion","https://www.npmjs.com/package/brace-expansion","https://github.com/juliangruber/brace-expansion/pull/129","https://github.com/juliangruber/brace-expansion/pull/130","https://github.com/juliangruber/brace-expansion/pull/136","https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d","https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031","https://github.com/juliangruber/brace-expansion/commit/d13ff455a58b0d56704f0111e3c2a0b16ceb06eb"],"description":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-14257","epss":0.00643,"percentile":0.5082,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-14257","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-14257","cwe":"CWE-770","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}],"fix":{"versions":["1.1.17"],"state":"fixed","available":[{"version":"1.1.17","date":"2026-08-01","kind":"first-observed"}]},"advisories":[],"risk":0.48225000000000007},"relatedVulnerabilities":[{"id":"CVE-2026-14257","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-14257","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion","https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5","https://www.npmjs.com/package/brace-expansion"],"description":"brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays.","cvss":[{"source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-14257","epss":0.00643,"percentile":0.5082,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-14257","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-14257","cwe":"CWE-770","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.14"}},"found":{"vulnerabilityID":"GHSA-mh99-v99m-4gvg","versionConstraint":"<1.1.17 (semantic)"},"fix":{"suggestedVersion":"1.1.17"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.14?package-id=fa326f252298de13","name":"brace-expansion","version":"1.1.14","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.14:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.14","upstreams":[]}},{"vulnerability":{"id":"GHSA-mh99-v99m-4gvg","dataSource":"https://github.com/advisories/GHSA-mh99-v99m-4gvg","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-mh99-v99m-4gvg","https://nvd.nist.gov/vuln/detail/CVE-2026-14257","https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5","https://github.com/juliangruber/brace-expansion","https://www.npmjs.com/package/brace-expansion","https://github.com/juliangruber/brace-expansion/pull/129","https://github.com/juliangruber/brace-expansion/pull/130","https://github.com/juliangruber/brace-expansion/pull/136","https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d","https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031","https://github.com/juliangruber/brace-expansion/commit/d13ff455a58b0d56704f0111e3c2a0b16ceb06eb"],"description":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-14257","epss":0.00643,"percentile":0.5082,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-14257","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-14257","cwe":"CWE-770","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}],"fix":{"versions":["2.1.3"],"state":"fixed","available":[{"version":"2.1.3","date":"2026-08-01","kind":"first-observed"}]},"advisories":[],"risk":0.48225000000000007},"relatedVulnerabilities":[{"id":"CVE-2026-14257","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-14257","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion","https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5","https://www.npmjs.com/package/brace-expansion"],"description":"brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays.","cvss":[{"source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-14257","epss":0.00643,"percentile":0.5082,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-14257","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-14257","cwe":"CWE-770","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"2.1.0"}},"found":{"vulnerabilityID":"GHSA-mh99-v99m-4gvg","versionConstraint":">=2.0.0,<2.1.3 (semantic)"},"fix":{"suggestedVersion":"2.1.3"}}],"artifact":{"id":"pkg:npm/brace-expansion@2.1.0?package-id=5b11ade77bad45b9","name":"brace-expansion","version":"2.1.0","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:2.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@2.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-rq7h-c2jc-7f22","dataSource":"https://github.com/advisories/GHSA-rq7h-c2jc-7f22","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/vitejs/vite/security/advisories/GHSA-rq7h-c2jc-7f22","https://nvd.nist.gov/vuln/detail/CVE-2026-112946","https://github.com/vitejs/vite/pull/23656","https://github.com/vitejs/vite/commit/170b92791421bcd484f7325936d989a82d6bd4aa","https://github.com/vitejs/vite/commit/45c0e3392a298626955a0ab93a8e51232daac721","https://github.com/vitejs/vite/commit/c3e06f92e969952466b4e2f5801e85e1e00cd905","https://github.com/vitejs/vite/commit/e570d8d016096b5f8f6f09808376ca6cf73f27d0","https://github.com/vitejs/vite/commit/f0d76c7da13d5e794807b82f0b86c1931a8438e3"],"description":"Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112946","epss":0.00852,"percentile":0.58266,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112946","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-112946","cwe":"CWE-284","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.3.7"],"state":"fixed","available":[{"version":"7.3.7","date":"2026-10-22","kind":"first-observed"}]},"advisories":[],"risk":0.4813799999999999},"relatedVulnerabilities":[{"id":"CVE-2026-112946","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112946","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/vitejs/vite/commit/170b92791421bcd484f7325936d989a82d6bd4aa","https://github.com/vitejs/vite/commit/45c0e3392a298626955a0ab93a8e51232daac721","https://github.com/vitejs/vite/commit/c3e06f92e969952466b4e2f5801e85e1e00cd905","https://github.com/vitejs/vite/commit/e570d8d016096b5f8f6f09808376ca6cf73f27d0","https://github.com/vitejs/vite/commit/f0d76c7da13d5e794807b82f0b86c1931a8438e3","https://github.com/vitejs/vite/pull/23656","https://github.com/vitejs/vite/security/advisories/GHSA-rq7h-c2jc-7f22"],"description":"Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, import analysis can record a root-relative browser URL in safeModulePaths instead of the cleaned resolved module identifier. On a network-accessible, non-Windows development server, an imported project file whose URL matches an absolute host path can authorize a later raw-filesystem request for that host file, provided server.fs.deny does not block it. The request can disclose the matching file outside the project root, but it does not allow arbitrary path traversal because the host path must correspond to a project-relative URL authorized by the application graph. This issue is fixed in versions 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112946","epss":0.00852,"percentile":0.58266,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112946","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-112946","cwe":"CWE-284","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"vite","version":"7.3.2"}},"found":{"vulnerabilityID":"GHSA-rq7h-c2jc-7f22","versionConstraint":">=7.0.0,<=7.3.6 (semantic)"},"fix":{"suggestedVersion":"7.3.7"}}],"artifact":{"id":"pkg:npm/vite@7.3.2?package-id=5c0ce5d7d525ae42","name":"vite","version":"7.3.2","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vitejs:vite:7.3.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/vite@7.3.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-rq7h-c2jc-7f22","dataSource":"https://github.com/advisories/GHSA-rq7h-c2jc-7f22","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/vitejs/vite/security/advisories/GHSA-rq7h-c2jc-7f22","https://nvd.nist.gov/vuln/detail/CVE-2026-112946","https://github.com/vitejs/vite/pull/23656","https://github.com/vitejs/vite/commit/170b92791421bcd484f7325936d989a82d6bd4aa","https://github.com/vitejs/vite/commit/45c0e3392a298626955a0ab93a8e51232daac721","https://github.com/vitejs/vite/commit/c3e06f92e969952466b4e2f5801e85e1e00cd905","https://github.com/vitejs/vite/commit/e570d8d016096b5f8f6f09808376ca6cf73f27d0","https://github.com/vitejs/vite/commit/f0d76c7da13d5e794807b82f0b86c1931a8438e3"],"description":"Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112946","epss":0.00852,"percentile":0.58266,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112946","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-112946","cwe":"CWE-284","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.3.7"],"state":"fixed","available":[{"version":"7.3.7","date":"2026-10-22","kind":"first-observed"}]},"advisories":[],"risk":0.4813799999999999},"relatedVulnerabilities":[{"id":"CVE-2026-112946","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112946","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/vitejs/vite/commit/170b92791421bcd484f7325936d989a82d6bd4aa","https://github.com/vitejs/vite/commit/45c0e3392a298626955a0ab93a8e51232daac721","https://github.com/vitejs/vite/commit/c3e06f92e969952466b4e2f5801e85e1e00cd905","https://github.com/vitejs/vite/commit/e570d8d016096b5f8f6f09808376ca6cf73f27d0","https://github.com/vitejs/vite/commit/f0d76c7da13d5e794807b82f0b86c1931a8438e3","https://github.com/vitejs/vite/pull/23656","https://github.com/vitejs/vite/security/advisories/GHSA-rq7h-c2jc-7f22"],"description":"Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, import analysis can record a root-relative browser URL in safeModulePaths instead of the cleaned resolved module identifier. On a network-accessible, non-Windows development server, an imported project file whose URL matches an absolute host path can authorize a later raw-filesystem request for that host file, provided server.fs.deny does not block it. The request can disclose the matching file outside the project root, but it does not allow arbitrary path traversal because the host path must correspond to a project-relative URL authorized by the application graph. This issue is fixed in versions 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112946","epss":0.00852,"percentile":0.58266,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112946","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-112946","cwe":"CWE-284","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"vite","version":"7.3.6"}},"found":{"vulnerabilityID":"GHSA-rq7h-c2jc-7f22","versionConstraint":">=7.0.0,<=7.3.6 (semantic)"},"fix":{"suggestedVersion":"7.3.7"}}],"artifact":{"id":"pkg:npm/vite@7.3.6?package-id=dcc7b510dec05363","name":"vite","version":"7.3.6","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vitejs:vite:7.3.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/vite@7.3.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-rq7h-c2jc-7f22","dataSource":"https://github.com/advisories/GHSA-rq7h-c2jc-7f22","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/vitejs/vite/security/advisories/GHSA-rq7h-c2jc-7f22","https://nvd.nist.gov/vuln/detail/CVE-2026-112946","https://github.com/vitejs/vite/pull/23656","https://github.com/vitejs/vite/commit/170b92791421bcd484f7325936d989a82d6bd4aa","https://github.com/vitejs/vite/commit/45c0e3392a298626955a0ab93a8e51232daac721","https://github.com/vitejs/vite/commit/c3e06f92e969952466b4e2f5801e85e1e00cd905","https://github.com/vitejs/vite/commit/e570d8d016096b5f8f6f09808376ca6cf73f27d0","https://github.com/vitejs/vite/commit/f0d76c7da13d5e794807b82f0b86c1931a8438e3"],"description":"Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112946","epss":0.00852,"percentile":0.58266,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112946","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-112946","cwe":"CWE-284","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["8.2.4"],"state":"fixed","available":[{"version":"8.2.4","date":"2026-10-22","kind":"first-observed"}]},"advisories":[],"risk":0.4813799999999999},"relatedVulnerabilities":[{"id":"CVE-2026-112946","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112946","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/vitejs/vite/commit/170b92791421bcd484f7325936d989a82d6bd4aa","https://github.com/vitejs/vite/commit/45c0e3392a298626955a0ab93a8e51232daac721","https://github.com/vitejs/vite/commit/c3e06f92e969952466b4e2f5801e85e1e00cd905","https://github.com/vitejs/vite/commit/e570d8d016096b5f8f6f09808376ca6cf73f27d0","https://github.com/vitejs/vite/commit/f0d76c7da13d5e794807b82f0b86c1931a8438e3","https://github.com/vitejs/vite/pull/23656","https://github.com/vitejs/vite/security/advisories/GHSA-rq7h-c2jc-7f22"],"description":"Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, import analysis can record a root-relative browser URL in safeModulePaths instead of the cleaned resolved module identifier. On a network-accessible, non-Windows development server, an imported project file whose URL matches an absolute host path can authorize a later raw-filesystem request for that host file, provided server.fs.deny does not block it. The request can disclose the matching file outside the project root, but it does not allow arbitrary path traversal because the host path must correspond to a project-relative URL authorized by the application graph. This issue is fixed in versions 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112946","epss":0.00852,"percentile":0.58266,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112946","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-112946","cwe":"CWE-284","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"vite","version":"8.2.2"}},"found":{"vulnerabilityID":"GHSA-rq7h-c2jc-7f22","versionConstraint":">=8.2.0,<=8.2.3 (semantic)"},"fix":{"suggestedVersion":"8.2.4"}}],"artifact":{"id":"pkg:npm/vite@8.2.2?package-id=ae073bacc7b8ee83","name":"vite","version":"8.2.2","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vitejs:vite:8.2.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/vite@8.2.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-q3j6-qgpj-74h6","dataSource":"https://github.com/advisories/GHSA-q3j6-qgpj-74h6","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-q3j6-qgpj-74h6","https://nvd.nist.gov/vuln/detail/CVE-2026-6321","https://cna.openjsf.org/security-advisories.html","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6321.json","https://github.com/fastify/fast-uri/releases/tag/v3.1.1","https://github.com/fastify/fast-uri/releases/tag/v2.4.1","https://bugzilla.redhat.com/show_bug.cgi?id=2466582","https://access.redhat.com/security/cve/CVE-2026-6321","https://access.redhat.com/errata/RHSA-2026:42079","https://access.redhat.com/errata/RHSA-2026:42078","https://access.redhat.com/errata/RHSA-2026:37385","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:26420","https://access.redhat.com/errata/RHSA-2026:26416","https://access.redhat.com/errata/RHSA-2026:26234","https://access.redhat.com/errata/RHSA-2026:26214","https://access.redhat.com/errata/RHSA-2026:25123","https://access.redhat.com/errata/RHSA-2026:25089","https://access.redhat.com/errata/RHSA-2026:24977","https://access.redhat.com/errata/RHSA-2026:24866","https://access.redhat.com/errata/RHSA-2026:24766","https://access.redhat.com/errata/RHSA-2026:24473","https://access.redhat.com/errata/RHSA-2026:21338","https://access.redhat.com/errata/RHSA-2026:20338","https://access.redhat.com/errata/RHSA-2026:19238","https://access.redhat.com/errata/RHSA-2026:56431","https://access.redhat.com/errata/RHSA-2026:56366","https://access.redhat.com/errata/RHSA-2026:57013","https://access.redhat.com/errata/RHSA-2026:56928"],"description":"fast-uri vulnerable to path traversal via percent-encoded dot segments","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-6321","epss":0.00634,"percentile":0.50399,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-6321","cwe":"CWE-22","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-6321","cwe":"CWE-22","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["3.1.1"],"state":"fixed","available":[{"version":"3.1.1","date":"2026-05-09","kind":"first-observed"}]},"advisories":[],"risk":0.47550000000000003},"relatedVulnerabilities":[{"id":"CVE-2026-6321","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6321","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-q3j6-qgpj-74h6","https://access.redhat.com/errata/RHSA-2026:19238","https://access.redhat.com/errata/RHSA-2026:20338","https://access.redhat.com/errata/RHSA-2026:21338","https://access.redhat.com/errata/RHSA-2026:24473","https://access.redhat.com/errata/RHSA-2026:24766","https://access.redhat.com/errata/RHSA-2026:24866","https://access.redhat.com/errata/RHSA-2026:24977","https://access.redhat.com/errata/RHSA-2026:25089","https://access.redhat.com/errata/RHSA-2026:25123","https://access.redhat.com/errata/RHSA-2026:26214","https://access.redhat.com/errata/RHSA-2026:26234","https://access.redhat.com/errata/RHSA-2026:26416","https://access.redhat.com/errata/RHSA-2026:26420","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:37385","https://access.redhat.com/errata/RHSA-2026:42078","https://access.redhat.com/errata/RHSA-2026:42079","https://access.redhat.com/errata/RHSA-2026:56366","https://access.redhat.com/errata/RHSA-2026:56431","https://access.redhat.com/errata/RHSA-2026:56928","https://access.redhat.com/errata/RHSA-2026:57013","https://access.redhat.com/security/cve/CVE-2026-6321","https://bugzilla.redhat.com/show_bug.cgi?id=2466582","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6321.json"],"description":"fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. Encoded path data was treated like real slashes and parent-directory references, so distinct URIs could collapse onto the same normalized path. Applications that normalize or compare attacker-controlled URLs to enforce path-based policy can be bypassed, with a path that appears confined under an allowed prefix normalizing to a different location. Versions <= 3.1.0 are affected. Update to 3.1.1 or later.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-6321","epss":0.00634,"percentile":0.50399,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-6321","cwe":"CWE-22","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-6321","cwe":"CWE-22","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"3.1.0"}},"found":{"vulnerabilityID":"GHSA-q3j6-qgpj-74h6","versionConstraint":">=3.0.0,<=3.1.0 (semantic)"},"fix":{"suggestedVersion":"3.1.1"}}],"artifact":{"id":"pkg:npm/fast-uri@3.1.0?package-id=a87bf2e2258cda95","name":"fast-uri","version":"3.1.0","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:openjsf:fast-uri:3.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@3.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-62hf-57xw-28j9","dataSource":"https://github.com/advisories/GHSA-62hf-57xw-28j9","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-62hf-57xw-28j9","https://nvd.nist.gov/vuln/detail/CVE-2026-42039","https://github.com/axios/axios/commit/85132ffba1a77609ea5d101c8a413dea7174932f","https://github.com/axios/axios/releases/tag/v1.15.1"],"description":"Axios: unbounded recursion in toFormData causes DoS via deeply nested request data","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42039","epss":0.00772,"percentile":0.55694,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42039","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-42039","cwe":"CWE-770","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["1.15.1"],"state":"fixed","available":[{"version":"1.15.1","date":"2026-05-05","kind":"first-observed"}]},"advisories":[],"risk":0.47092},"relatedVulnerabilities":[{"id":"CVE-2026-42039","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42039","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-62hf-57xw-28j9","https://access.redhat.com/errata/RHSA-2026:14937","https://access.redhat.com/errata/RHSA-2026:16476","https://access.redhat.com/errata/RHSA-2026:16532","https://access.redhat.com/errata/RHSA-2026:16534","https://access.redhat.com/errata/RHSA-2026:16535","https://access.redhat.com/errata/RHSA-2026:16542","https://access.redhat.com/errata/RHSA-2026:16874","https://access.redhat.com/errata/RHSA-2026:17468","https://access.redhat.com/errata/RHSA-2026:17474","https://access.redhat.com/errata/RHSA-2026:17657","https://access.redhat.com/errata/RHSA-2026:17699","https://access.redhat.com/errata/RHSA-2026:19109","https://access.redhat.com/errata/RHSA-2026:19375","https://access.redhat.com/errata/RHSA-2026:20889","https://access.redhat.com/errata/RHSA-2026:20938","https://access.redhat.com/errata/RHSA-2026:21017","https://access.redhat.com/errata/RHSA-2026:21338","https://access.redhat.com/errata/RHSA-2026:21772","https://access.redhat.com/errata/RHSA-2026:22465","https://access.redhat.com/errata/RHSA-2026:22619","https://access.redhat.com/errata/RHSA-2026:22629","https://access.redhat.com/errata/RHSA-2026:22840","https://access.redhat.com/errata/RHSA-2026:23361","https://access.redhat.com/errata/RHSA-2026:24473","https://access.redhat.com/errata/RHSA-2026:24536","https://access.redhat.com/errata/RHSA-2026:24539","https://access.redhat.com/errata/RHSA-2026:24853","https://access.redhat.com/errata/RHSA-2026:24977","https://access.redhat.com/errata/RHSA-2026:25041","https://access.redhat.com/errata/RHSA-2026:25089","https://access.redhat.com/errata/RHSA-2026:25271","https://access.redhat.com/errata/RHSA-2026:25273","https://access.redhat.com/errata/RHSA-2026:26214","https://access.redhat.com/errata/RHSA-2026:26225","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:36882","https://access.redhat.com/errata/RHSA-2026:48085","https://access.redhat.com/errata/RHSA-2026:48670","https://access.redhat.com/errata/RHSA-2026:50300","https://access.redhat.com/security/cve/CVE-2026-42039","https://bugzilla.redhat.com/show_bug.cgi?id=2461630","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42039.json"],"description":"Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects with no depth limit, so a deeply nested value passed as request data crashes the Node.js process with a RangeError. This vulnerability is fixed in 1.15.1 and 0.31.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42039","epss":0.00772,"percentile":0.55694,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42039","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-42039","cwe":"CWE-770","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.15.0"}},"found":{"vulnerabilityID":"GHSA-62hf-57xw-28j9","versionConstraint":">=1.0.0,<1.15.1 (semantic)"},"fix":{"suggestedVersion":"1.15.1"}}],"artifact":{"id":"pkg:npm/axios@1.15.0?package-id=520b8e92ffff8054","name":"axios","version":"1.15.0","type":"npm","locations":[{"path":"/sink/oidc-server/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.15.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.15.0","upstreams":[]}},{"vulnerability":{"id":"GO-2026-6603","dataSource":"https://go.dev/cl/847185","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/cl/847314","https://go.dev/issue/81857","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"],"description":"When \"Trailer\" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a \"Trailer\" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78659","epss":0.00627,"percentile":0.50086,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78659","cwe":"CWE-405","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.60.0"],"state":"fixed","available":[{"version":"0.60.0","date":"2026-10-08","kind":"release"}]},"advisories":[],"risk":0.47025},"relatedVulnerabilities":[{"id":"CVE-2026-78659","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78659","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/847185","https://go.dev/cl/847314","https://go.dev/issue/81857","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://pkg.go.dev/vuln/GO-2026-6603"],"description":"When \"Trailer\" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a \"Trailer\" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78659","epss":0.00627,"percentile":0.50086,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78659","cwe":"CWE-405","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.56.0"}},"found":{"vulnerabilityID":"GO-2026-6603","versionConstraint":"<0.60.0 (go)"},"fix":{"suggestedVersion":"0.60.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.56.0?package-id=ab49808757d6d4dc","name":"golang.org/x/net","version":"v0.56.0","type":"go-module","locations":[{"path":"/backend-go/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.56.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.56.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.56.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o="}}},{"vulnerability":{"id":"GHSA-xjh9-v7x6-24jw","dataSource":"https://github.com/advisories/GHSA-xjh9-v7x6-24jw","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/fastify/busboy/security/advisories/GHSA-xjh9-v7x6-24jw","https://nvd.nist.gov/vuln/detail/CVE-2026-19484","https://github.com/fastify/busboy/commit/632a237e7fb6b3b7a30e0de8fab2ee72ca5bf722","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/busboy/releases/tag/v3.2.1"],"description":"@fastify/busboy vulnerable to Denial of Service via oversized multipart boundary","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-19484","epss":0.00615,"percentile":0.49453,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-19484","cwe":"CWE-835","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-19484","cwe":"CWE-1322","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["3.2.1"],"state":"fixed","available":[{"version":"3.2.1","date":"2026-10-03","kind":"first-observed"}]},"advisories":[],"risk":0.46125000000000005},"relatedVulnerabilities":[{"id":"CVE-2026-19484","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19484","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/busboy/security/advisories/GHSA-xjh9-v7x6-24jw"],"description":"@fastify/busboy is a multipart form-data parser. In versions 3.1.0 through 3.2.0, a remote unauthenticated attacker can stall the Node.js event loop by sending a multipart request whose boundary is crafted to a specific length. The vendored streaming search stores its skip table in a fixed 256 entry byte array, and a boundary of exactly 252 bytes makes the search needle 256 bytes, which truncates the default skip distance to zero and turns the search into a CPU bound loop on a small body. A single small request can keep one core busy and deny service to other requests handled by the same process. The issue is fixed in @fastify/busboy 3.2.1, which widens the skip table so the skip distance is preserved. Users should upgrade to 3.2.1.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-19484","epss":0.00615,"percentile":0.49453,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-19484","cwe":"CWE-835","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-19484","cwe":"CWE-1322","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@fastify/busboy","version":"3.1.1"}},"found":{"vulnerabilityID":"GHSA-xjh9-v7x6-24jw","versionConstraint":">=3.1.0,<3.2.1 (semantic)"},"fix":{"suggestedVersion":"3.2.1"}}],"artifact":{"id":"pkg:npm/%40fastify/busboy@3.1.1?package-id=fc5e1f1a506dbd6b","name":"@fastify/busboy","version":"3.1.1","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:fastify:fastify\\/busyboy:3.1.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/%40fastify/busboy@3.1.1","upstreams":[]}},{"vulnerability":{"id":"GO-2026-6611","dataSource":"https://go.dev/cl/847186","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/cl/847308","https://go.dev/issue/81742","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"],"description":"A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78669","epss":0.00614,"percentile":0.49429,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78669","cwe":"CWE-405","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.60.0"],"state":"fixed","available":[{"version":"0.60.0","date":"2026-10-08","kind":"release"}]},"advisories":[],"risk":0.46049999999999996},"relatedVulnerabilities":[{"id":"CVE-2026-78669","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78669","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/847186","https://go.dev/cl/847308","https://go.dev/issue/81742","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://pkg.go.dev/vuln/GO-2026-6611"],"description":"A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78669","epss":0.00614,"percentile":0.49429,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78669","cwe":"CWE-405","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.56.0"}},"found":{"vulnerabilityID":"GO-2026-6611","versionConstraint":"<0.60.0 (go)"},"fix":{"suggestedVersion":"0.60.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.56.0?package-id=ab49808757d6d4dc","name":"golang.org/x/net","version":"v0.56.0","type":"go-module","locations":[{"path":"/backend-go/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.56.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.56.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.56.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o="}}},{"vulnerability":{"id":"GHSA-5gmw-xhrv-c9v3","dataSource":"https://github.com/advisories/GHSA-5gmw-xhrv-c9v3","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/tinylibs/tinypool/security/advisories/GHSA-5gmw-xhrv-c9v3","https://nvd.nist.gov/vuln/detail/CVE-2026-104848","https://github.com/tinylibs/tinypool/pull/134","https://github.com/tinylibs/tinypool/commit/24df4e730e7d0857a6d226c9b58f8924227404fd","https://github.com/tinylibs/tinypool/releases/tag/v2.1.1"],"description":"Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","metrics":{"baseScore":9.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-104848","epss":0.00497,"percentile":0.42657,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-104848","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.1.1"],"state":"fixed","available":[{"version":"2.1.1","date":"2026-10-06","kind":"first-observed"}]},"advisories":[],"risk":0.459725},"relatedVulnerabilities":[{"id":"CVE-2026-104848","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-104848","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/tinylibs/tinypool/commit/24df4e730e7d0857a6d226c9b58f8924227404fd","https://github.com/tinylibs/tinypool/pull/134","https://github.com/tinylibs/tinypool/releases/tag/v2.1.1","https://github.com/tinylibs/tinypool/security/advisories/GHSA-5gmw-xhrv-c9v3"],"description":"Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.1, Tinypool constructs ThreadPool.options from a normal options object and reads the execArgv and env worker options in dist/index.js, allowing values inherited from a polluted Object.prototype to be copied into own properties and passed to worker_threads.Worker. An attacker who can first pollute either property can cause each newly spawned worker to load attacker-selected JavaScript through command-line preload arguments or NODE_OPTIONS, resulting in code execution with the host process's privileges and possible access to CI secrets, signing material, or build artifacts. This issue is fixed in version 2.1.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-104848","epss":0.00497,"percentile":0.42657,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-104848","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tinypool","version":"1.1.1"}},"found":{"vulnerabilityID":"GHSA-5gmw-xhrv-c9v3","versionConstraint":"<=2.1.0 (semantic)"},"fix":{"suggestedVersion":"2.1.1"}}],"artifact":{"id":"pkg:npm/tinypool@1.1.1?package-id=2c697870f1256dd6","name":"tinypool","version":"1.1.1","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:tinypool:tinypool:1.1.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/tinypool@1.1.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-5gmw-xhrv-c9v3","dataSource":"https://github.com/advisories/GHSA-5gmw-xhrv-c9v3","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/tinylibs/tinypool/security/advisories/GHSA-5gmw-xhrv-c9v3","https://nvd.nist.gov/vuln/detail/CVE-2026-104848","https://github.com/tinylibs/tinypool/pull/134","https://github.com/tinylibs/tinypool/commit/24df4e730e7d0857a6d226c9b58f8924227404fd","https://github.com/tinylibs/tinypool/releases/tag/v2.1.1"],"description":"Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","metrics":{"baseScore":9.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-104848","epss":0.00497,"percentile":0.42657,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-104848","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.1.1"],"state":"fixed","available":[{"version":"2.1.1","date":"2026-10-06","kind":"first-observed"}]},"advisories":[],"risk":0.459725},"relatedVulnerabilities":[{"id":"CVE-2026-104848","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-104848","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/tinylibs/tinypool/commit/24df4e730e7d0857a6d226c9b58f8924227404fd","https://github.com/tinylibs/tinypool/pull/134","https://github.com/tinylibs/tinypool/releases/tag/v2.1.1","https://github.com/tinylibs/tinypool/security/advisories/GHSA-5gmw-xhrv-c9v3"],"description":"Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.1, Tinypool constructs ThreadPool.options from a normal options object and reads the execArgv and env worker options in dist/index.js, allowing values inherited from a polluted Object.prototype to be copied into own properties and passed to worker_threads.Worker. An attacker who can first pollute either property can cause each newly spawned worker to load attacker-selected JavaScript through command-line preload arguments or NODE_OPTIONS, resulting in code execution with the host process's privileges and possible access to CI secrets, signing material, or build artifacts. This issue is fixed in version 2.1.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-104848","epss":0.00497,"percentile":0.42657,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-104848","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tinypool","version":"1.1.1"}},"found":{"vulnerabilityID":"GHSA-5gmw-xhrv-c9v3","versionConstraint":"<=2.1.0 (semantic)"},"fix":{"suggestedVersion":"2.1.1"}}],"artifact":{"id":"pkg:npm/tinypool@1.1.1?package-id=7518b0282cc86926","name":"tinypool","version":"1.1.1","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:tinypool:tinypool:1.1.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/tinypool@1.1.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-6g55-p6wh-862q","dataSource":"https://github.com/advisories/GHSA-6g55-p6wh-862q","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/postcss/postcss/security/advisories/GHSA-6g55-p6wh-862q","https://github.com/postcss/postcss/commit/aaec7b78b3ce2792585b4b300ef1bd5dd5b3e8ad","https://github.com/postcss/postcss/commit/c64b7488d2731dfa16213739b42c34faf5a9eba3","https://github.com/postcss/postcss/releases/tag/8.5.12"],"description":"PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-45623","epss":0.00608,"percentile":0.4909,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-45623","cwe":"CWE-22","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-45623","cwe":"CWE-200","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["8.5.12"],"state":"fixed","available":[{"version":"8.5.12","date":"2026-07-23","kind":"first-observed"}]},"advisories":[],"risk":0.45599999999999996},"relatedVulnerabilities":[{"id":"CVE-2026-45623","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45623","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/postcss/postcss/security/advisories/GHSA-6g55-p6wh-862q"],"description":"PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by Node and leak the first ~10 bytes of its content through the resulting JSON.parse SyntaxError message. The bug also yields a precise file-existence oracle and a controllable-read primitive that may be combined with large-file targets for DoS. The behaviour is triggered with PostCSS's default options — no from, no map, no plugins required — and is therefore reachable from any pipeline that runs untrusted CSS through PostCSS (CMS themes, user-uploaded styles, browser-extension/userstyle processors, build pipelines for third-party packages, blog comment renderers, etc.). This issue has been fixed in version 8.5.12.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-45623","epss":0.00608,"percentile":0.4909,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-45623","cwe":"CWE-22","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-45623","cwe":"CWE-200","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"postcss","version":"8.4.31"}},"found":{"vulnerabilityID":"GHSA-6g55-p6wh-862q","versionConstraint":"<=8.5.11 (semantic)"},"fix":{"suggestedVersion":"8.5.12"}}],"artifact":{"id":"pkg:npm/postcss@8.4.31?package-id=5e383ddf2a230a67","name":"postcss","version":"8.4.31","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:postcss:postcss:8.4.31:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/postcss@8.4.31","upstreams":[]}},{"vulnerability":{"id":"GHSA-6g55-p6wh-862q","dataSource":"https://github.com/advisories/GHSA-6g55-p6wh-862q","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/postcss/postcss/security/advisories/GHSA-6g55-p6wh-862q","https://github.com/postcss/postcss/commit/aaec7b78b3ce2792585b4b300ef1bd5dd5b3e8ad","https://github.com/postcss/postcss/commit/c64b7488d2731dfa16213739b42c34faf5a9eba3","https://github.com/postcss/postcss/releases/tag/8.5.12"],"description":"PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-45623","epss":0.00608,"percentile":0.4909,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-45623","cwe":"CWE-22","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-45623","cwe":"CWE-200","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["8.5.12"],"state":"fixed","available":[{"version":"8.5.12","date":"2026-07-23","kind":"first-observed"}]},"advisories":[],"risk":0.45599999999999996},"relatedVulnerabilities":[{"id":"CVE-2026-45623","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45623","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/postcss/postcss/security/advisories/GHSA-6g55-p6wh-862q"],"description":"PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by Node and leak the first ~10 bytes of its content through the resulting JSON.parse SyntaxError message. The bug also yields a precise file-existence oracle and a controllable-read primitive that may be combined with large-file targets for DoS. The behaviour is triggered with PostCSS's default options — no from, no map, no plugins required — and is therefore reachable from any pipeline that runs untrusted CSS through PostCSS (CMS themes, user-uploaded styles, browser-extension/userstyle processors, build pipelines for third-party packages, blog comment renderers, etc.). This issue has been fixed in version 8.5.12.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-45623","epss":0.00608,"percentile":0.4909,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-45623","cwe":"CWE-22","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-45623","cwe":"CWE-200","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"postcss","version":"8.5.6"}},"found":{"vulnerabilityID":"GHSA-6g55-p6wh-862q","versionConstraint":"<=8.5.11 (semantic)"},"fix":{"suggestedVersion":"8.5.12"}}],"artifact":{"id":"pkg:npm/postcss@8.5.6?package-id=ff850f5fca433458","name":"postcss","version":"8.5.6","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:postcss:postcss:8.5.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/postcss@8.5.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-26hh-7cqf-hhc6","dataSource":"https://github.com/advisories/GHSA-26hh-7cqf-hhc6","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f","https://github.com/vercel/next.js/security/advisories/GHSA-26hh-7cqf-hhc6","https://github.com/vercel/next.js/releases/tag/v15.5.18","https://github.com/vercel/next.js/releases/tag/v16.2.6","https://nvd.nist.gov/vuln/detail/CVE-2026-45109"],"description":"Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-45109","epss":0.00602,"percentile":0.48804,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-45109","cwe":"CWE-288","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-45109","cwe":"CWE-358","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["16.2.6"],"state":"fixed","available":[{"version":"16.2.6","date":"2026-05-11","kind":"first-observed"}]},"advisories":[],"risk":0.4515},"relatedVulnerabilities":[{"id":"CVE-2026-45109","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45109","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/vercel/next.js/security/advisories/GHSA-26hh-7cqf-hhc6","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:37272","https://access.redhat.com/errata/RHSA-2026:40974","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/security/cve/CVE-2026-45109","https://bugzilla.redhat.com/show_bug.cgi?id=2477190","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45109.json"],"description":"Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.18 and 16.2.6, it was found that the fix addressing CVE-2026-44575 did not apply to middleware.ts with Turbopack. This vulnerability is fixed in 15.5.18 and 16.2.6.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-45109","epss":0.00602,"percentile":0.48804,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-45109","cwe":"CWE-288","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-45109","cwe":"CWE-358","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"next","version":"16.1.7"}},"found":{"vulnerabilityID":"GHSA-26hh-7cqf-hhc6","versionConstraint":">=16.0.0,<16.2.6 (semantic)"},"fix":{"suggestedVersion":"16.2.6"}}],"artifact":{"id":"pkg:npm/next@16.1.7?package-id=662de087d22e519d","name":"next","version":"16.1.7","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vercel:next.js:16.1.7:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/next@16.1.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-85c8-ppgw-ccpr","dataSource":"https://github.com/advisories/GHSA-85c8-ppgw-ccpr","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/tinylibs/tinypool/security/advisories/GHSA-85c8-ppgw-ccpr","https://nvd.nist.gov/vuln/detail/CVE-2026-104849","https://github.com/tinylibs/tinypool/pull/135","https://github.com/tinylibs/tinypool/commit/f41411a3e23324c674f35a19a3240f7a7c40ffbf","https://github.com/tinylibs/tinypool/releases/tag/v2.1.2"],"description":"Tinypool: Prototype Pollution Gadget to RCE in run() options","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","metrics":{"baseScore":9.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-104849","epss":0.00485,"percentile":0.41784,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-104849","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-104849","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.1.2"],"state":"fixed","available":[{"version":"2.1.2","date":"2026-10-06","kind":"first-observed"}]},"advisories":[],"risk":0.44862500000000005},"relatedVulnerabilities":[{"id":"CVE-2026-104849","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-104849","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/tinylibs/tinypool/commit/f41411a3e23324c674f35a19a3240f7a7c40ffbf","https://github.com/tinylibs/tinypool/pull/135","https://github.com/tinylibs/tinypool/releases/tag/v2.1.2","https://github.com/tinylibs/tinypool/security/advisories/GHSA-85c8-ppgw-ccpr"],"description":"Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.2, Tinypool reads filename from a caller-supplied options object in pool.run(task, options) without requiring an own property, so a polluted Object.prototype.filename can replace the intended worker module. Applications are affected only when they pass their own second-argument options object to pool.run(); calls without that argument use the trusted default options object. An attacker who can first pollute the prototype can cause the worker pool to load attacker-selected JavaScript and can read or modify task data with the host process's privileges. This issue is fixed in version 2.1.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-104849","epss":0.00485,"percentile":0.41784,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-104849","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-104849","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tinypool","version":"1.1.1"}},"found":{"vulnerabilityID":"GHSA-85c8-ppgw-ccpr","versionConstraint":"<2.1.2 (semantic)"},"fix":{"suggestedVersion":"2.1.2"}}],"artifact":{"id":"pkg:npm/tinypool@1.1.1?package-id=2c697870f1256dd6","name":"tinypool","version":"1.1.1","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:tinypool:tinypool:1.1.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/tinypool@1.1.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-85c8-ppgw-ccpr","dataSource":"https://github.com/advisories/GHSA-85c8-ppgw-ccpr","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/tinylibs/tinypool/security/advisories/GHSA-85c8-ppgw-ccpr","https://nvd.nist.gov/vuln/detail/CVE-2026-104849","https://github.com/tinylibs/tinypool/pull/135","https://github.com/tinylibs/tinypool/commit/f41411a3e23324c674f35a19a3240f7a7c40ffbf","https://github.com/tinylibs/tinypool/releases/tag/v2.1.2"],"description":"Tinypool: Prototype Pollution Gadget to RCE in run() options","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","metrics":{"baseScore":9.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-104849","epss":0.00485,"percentile":0.41784,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-104849","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-104849","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.1.2"],"state":"fixed","available":[{"version":"2.1.2","date":"2026-10-06","kind":"first-observed"}]},"advisories":[],"risk":0.44862500000000005},"relatedVulnerabilities":[{"id":"CVE-2026-104849","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-104849","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/tinylibs/tinypool/commit/f41411a3e23324c674f35a19a3240f7a7c40ffbf","https://github.com/tinylibs/tinypool/pull/135","https://github.com/tinylibs/tinypool/releases/tag/v2.1.2","https://github.com/tinylibs/tinypool/security/advisories/GHSA-85c8-ppgw-ccpr"],"description":"Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.2, Tinypool reads filename from a caller-supplied options object in pool.run(task, options) without requiring an own property, so a polluted Object.prototype.filename can replace the intended worker module. Applications are affected only when they pass their own second-argument options object to pool.run(); calls without that argument use the trusted default options object. An attacker who can first pollute the prototype can cause the worker pool to load attacker-selected JavaScript and can read or modify task data with the host process's privileges. This issue is fixed in version 2.1.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-104849","epss":0.00485,"percentile":0.41784,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-104849","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-104849","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tinypool","version":"1.1.1"}},"found":{"vulnerabilityID":"GHSA-85c8-ppgw-ccpr","versionConstraint":"<2.1.2 (semantic)"},"fix":{"suggestedVersion":"2.1.2"}}],"artifact":{"id":"pkg:npm/tinypool@1.1.1?package-id=7518b0282cc86926","name":"tinypool","version":"1.1.1","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:tinypool:tinypool:1.1.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/tinypool@1.1.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-52cp-r559-cp3m","dataSource":"https://github.com/advisories/GHSA-52cp-r559-cp3m","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m","https://nvd.nist.gov/vuln/detail/CVE-2026-59869","https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7","https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4","https://github.com/nodeca/js-yaml/releases/tag/3.15.0","https://github.com/nodeca/js-yaml/releases/tag/4.3.0"],"description":"js-yaml: YAML merge-key chains can force quadratic CPU consumption","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59869","epss":0.00585,"percentile":0.47999,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59869","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.3.0"],"state":"fixed","available":[{"version":"4.3.0","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.43875},"relatedVulnerabilities":[{"id":"CVE-2026-59869","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59869","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7","https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4","https://github.com/nodeca/js-yaml/releases/tag/3.15.0","https://github.com/nodeca/js-yaml/releases/tag/4.3.0","https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m"],"description":"js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in versions 3.15.0 and 4.3.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59869","epss":0.00585,"percentile":0.47999,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59869","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"4.1.1"}},"found":{"vulnerabilityID":"GHSA-52cp-r559-cp3m","versionConstraint":">=4.0.0,<4.3.0 (semantic)"},"fix":{"suggestedVersion":"4.3.0"}}],"artifact":{"id":"pkg:npm/js-yaml@4.1.1?package-id=b47d2ee1a6cdb382","name":"js-yaml","version":"4.1.1","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodeca:js-yaml:4.1.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@4.1.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-52cp-r559-cp3m","dataSource":"https://github.com/advisories/GHSA-52cp-r559-cp3m","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m","https://nvd.nist.gov/vuln/detail/CVE-2026-59869","https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7","https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4","https://github.com/nodeca/js-yaml/releases/tag/3.15.0","https://github.com/nodeca/js-yaml/releases/tag/4.3.0"],"description":"js-yaml: YAML merge-key chains can force quadratic CPU consumption","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59869","epss":0.00585,"percentile":0.47999,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59869","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.3.0"],"state":"fixed","available":[{"version":"4.3.0","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.43875},"relatedVulnerabilities":[{"id":"CVE-2026-59869","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59869","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7","https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4","https://github.com/nodeca/js-yaml/releases/tag/3.15.0","https://github.com/nodeca/js-yaml/releases/tag/4.3.0","https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m"],"description":"js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in versions 3.15.0 and 4.3.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59869","epss":0.00585,"percentile":0.47999,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59869","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"4.1.1"}},"found":{"vulnerabilityID":"GHSA-52cp-r559-cp3m","versionConstraint":">=4.0.0,<4.3.0 (semantic)"},"fix":{"suggestedVersion":"4.3.0"}}],"artifact":{"id":"pkg:npm/js-yaml@4.1.1?package-id=15e5564f07e87e23","name":"js-yaml","version":"4.1.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodeca:js-yaml:4.1.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@4.1.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-2gc4-cqfq-p2gv","dataSource":"https://github.com/advisories/GHSA-2gc4-cqfq-p2gv","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/socketio/socket.io/security/advisories/GHSA-2gc4-cqfq-p2gv","https://github.com/socketio/socket.io/commit/86db1fc3db2cd315a065d64c4e48918ccf9b4729","https://github.com/socketio/socket.io/releases/tag/engine.io@6.6.10"],"description":"Socket.IO: Engine.IO Protocol Revision Mismatch DoS","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102599","epss":0.00576,"percentile":0.47516,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102599","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["6.6.10"],"state":"fixed","available":[{"version":"6.6.10","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.432},"relatedVulnerabilities":[{"id":"CVE-2026-102599","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102599","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/socketio/socket.io/commit/86db1fc3db2cd315a065d64c4e48918ccf9b4729","https://github.com/socketio/socket.io/releases/tag/engine.io@6.6.10","https://github.com/socketio/socket.io/security/advisories/GHSA-2gc4-cqfq-p2gv"],"description":"Socket.IO enables bidirectional and low-latency communication for every platform. From Engine.IO 6.6.0 until 6.6.10, a transport upgrade can independently derive an Engine.IO protocol revision from the upgrade request instead of enforcing the revision stored on the existing session. A malicious client can establish a valid session and send an upgrade request with a different or omitted EIO query parameter, attaching a transport with incompatible parser and heartbeat behavior. A crafted heartbeat packet can then trigger an uncaught exception and terminate the Node.js process, including when Engine.IO v3 compatibility is disabled because an omitted EIO value is interpreted as revision 3 on the affected path. This issue is fixed in Engine.IO 6.6.10.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102599","epss":0.00576,"percentile":0.47516,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102599","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"engine.io","version":"6.6.9"}},"found":{"vulnerabilityID":"GHSA-2gc4-cqfq-p2gv","versionConstraint":">=6.6.0,<6.6.10 (semantic)"},"fix":{"suggestedVersion":"6.6.10"}}],"artifact":{"id":"pkg:npm/engine.io@6.6.9?package-id=d22d0b758818e165","name":"engine.io","version":"6.6.9","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:socket:engine.io:6.6.9:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/engine.io@6.6.9","upstreams":[]}},{"vulnerability":{"id":"GHSA-259r-337f-4rfw","dataSource":"https://github.com/advisories/GHSA-259r-337f-4rfw","namespace":"github:language:go","severity":"High","urls":["https://github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw","https://nvd.nist.gov/vuln/detail/CVE-2026-63209","https://github.com/klauspost/compress/pull/1163","https://github.com/klauspost/compress/commit/539243b8823ee8f03e49969823d57c348c917536","https://github.com/klauspost/compress/commit/8668e357e776d5152ed62f33c17f21b8690664fa","https://github.com/klauspost/compress/releases/tag/v1.18.7"],"description":"Compress/s2: Integer Overflow or Wraparound and Out-of-bounds Write in compress","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-63209","epss":0.00572,"percentile":0.47335,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-63209","cwe":"CWE-190","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-63209","cwe":"CWE-787","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.18.7"],"state":"fixed","available":[{"version":"1.18.7","date":"2026-10-20","kind":"first-observed"}]},"advisories":[],"risk":0.42900000000000005},"relatedVulnerabilities":[{"id":"CVE-2026-63209","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63209","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/klauspost/compress/commit/539243b8823ee8f03e49969823d57c348c917536","https://github.com/klauspost/compress/releases/tag/v1.18.7","https://github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw"],"description":"compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV. This issue has been patched in version 1.18.7.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-63209","epss":0.00572,"percentile":0.47335,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-63209","cwe":"CWE-190","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-63209","cwe":"CWE-787","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/klauspost/compress","version":"v1.18.3"}},"found":{"vulnerabilityID":"GHSA-259r-337f-4rfw","versionConstraint":"<=1.18.6 (go)"},"fix":{"suggestedVersion":"1.18.7"}}],"artifact":{"id":"pkg:golang/github.com/klauspost/compress@v1.18.3?package-id=a785403a228f5380","name":"github.com/klauspost/compress","version":"v1.18.3","type":"go-module","locations":[{"path":"/backend-go/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:klauspost:compress:v1.18.3:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/klauspost/compress@v1.18.3","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:9PJRvfbmTabkOX8moIpXPbMMbYN60bWImDDU7L+/6zw="}}},{"vulnerability":{"id":"GHSA-px85-f4q5-jh77","dataSource":"https://github.com/advisories/GHSA-px85-f4q5-jh77","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/storybookjs/storybook/security/advisories/GHSA-px85-f4q5-jh77","https://nvd.nist.gov/vuln/detail/CVE-2026-114126","https://github.com/storybookjs/storybook/pull/36726","https://github.com/storybookjs/storybook/commit/243c06bf8f1e2f09446c44868ea100261e1374da","https://github.com/storybookjs/storybook/commit/3be03ec6f11f4616471cebc3fc65c13e1bf8c178","https://github.com/storybookjs/storybook/commit/5540f03b209cc56c66f56a9c7cb4b2ee5b883ce5","https://github.com/storybookjs/storybook/commit/a9ef9345d73224c73e0b81dc2701ec5b465ea9bb","https://github.com/storybookjs/storybook/commit/d9b09e332510a88689c71ecc081bbbc2d072476e","https://github.com/storybookjs/storybook/commit/df3fed468c9b4830605f00068c4bc6b7e1e215ed","https://github.com/storybookjs/storybook/releases/tag/v10.6.2","https://github.com/storybookjs/storybook/releases/tag/v11.0.0-alpha.6","https://github.com/storybookjs/storybook/releases/tag/v8.6.19","https://github.com/storybookjs/storybook/releases/tag/v9.1.21"],"description":"Storybook dev server vulnerable to code injection from the local network","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-114126","epss":0.00529,"percentile":0.4478,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-114126","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-114126","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-114126","cwe":"CWE-306","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["10.6.2"],"state":"fixed","available":[{"version":"10.6.2","date":"2026-10-23","kind":"first-observed"}]},"advisories":[],"risk":0.42849000000000004},"relatedVulnerabilities":[{"id":"CVE-2026-114126","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114126","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/storybookjs/storybook/commit/243c06bf8f1e2f09446c44868ea100261e1374da","https://github.com/storybookjs/storybook/commit/3be03ec6f11f4616471cebc3fc65c13e1bf8c178","https://github.com/storybookjs/storybook/commit/5540f03b209cc56c66f56a9c7cb4b2ee5b883ce5","https://github.com/storybookjs/storybook/commit/a9ef9345d73224c73e0b81dc2701ec5b465ea9bb","https://github.com/storybookjs/storybook/commit/d9b09e332510a88689c71ecc081bbbc2d072476e","https://github.com/storybookjs/storybook/commit/df3fed468c9b4830605f00068c4bc6b7e1e215ed","https://github.com/storybookjs/storybook/pull/36726","https://github.com/storybookjs/storybook/releases/tag/v10.6.2","https://github.com/storybookjs/storybook/releases/tag/v11.0.0-alpha.6","https://github.com/storybookjs/storybook/releases/tag/v8.6.19","https://github.com/storybookjs/storybook/releases/tag/v9.1.21","https://github.com/storybookjs/storybook/security/advisories/GHSA-px85-f4q5-jh77"],"description":"Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, the Storybook development server can expose its WebSocket authentication token to clients able to load its HTML pages over a local network. A LAN attacker can obtain the token and invoke WebSocket-backed file-writing or testing functionality. Weak story-write validation can allow code to be placed in story files. If the Storybook Vitest addon is installed with an old version of Vitest, the payload can use a Vitest API to write additional files or execute commands. Depending on the payload and local tooling, the attack can lead to code execution with the developer's privileges. This issue is fixed in 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-114126","epss":0.00529,"percentile":0.4478,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-114126","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-114126","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-114126","cwe":"CWE-306","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"storybook","version":"10.3.6"}},"found":{"vulnerabilityID":"GHSA-px85-f4q5-jh77","versionConstraint":">=10.0.0,<10.6.2 (semantic)"},"fix":{"suggestedVersion":"10.6.2"}}],"artifact":{"id":"pkg:npm/storybook@10.3.6?package-id=b959d3df36e335bc","name":"storybook","version":"10.3.6","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:storybook:storybook:10.3.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/storybook@10.3.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-542g-h47m-68v8","dataSource":"https://github.com/advisories/GHSA-542g-h47m-68v8","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-542g-h47m-68v8","https://nvd.nist.gov/vuln/detail/CVE-2026-101901","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/releases/tag/v1.20.0"],"description":"Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101901","epss":0.00536,"percentile":0.45211,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101901","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.20.0"],"state":"fixed","available":[{"version":"1.20.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.42075999999999997},"relatedVulnerabilities":[{"id":"CVE-2026-101901","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101901","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/axios/axios/security/advisories/GHSA-542g-h47m-68v8"],"description":"Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Http2Sessions does not install adequate error handling for a ClientHttp2Session during Axios HTTP/2 session initialization or reuse. A request uses httpVersion: 2 and the ClientHttp2Session emits an error during session initialization or reuse. The unhandled session error escapes normal Promise rejection handling. The uncaught error can terminate the Node.js process and cause denial of service. This issue is fixed in version 1.20.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101901","epss":0.00536,"percentile":0.45211,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101901","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.15.0"}},"found":{"vulnerabilityID":"GHSA-542g-h47m-68v8","versionConstraint":">=1.13.0,<1.20.0 (semantic)"},"fix":{"suggestedVersion":"1.20.0"}}],"artifact":{"id":"pkg:npm/axios@1.15.0?package-id=520b8e92ffff8054","name":"axios","version":"1.15.0","type":"npm","locations":[{"path":"/sink/oidc-server/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.15.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.15.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-542g-h47m-68v8","dataSource":"https://github.com/advisories/GHSA-542g-h47m-68v8","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-542g-h47m-68v8","https://nvd.nist.gov/vuln/detail/CVE-2026-101901","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/releases/tag/v1.20.0"],"description":"Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101901","epss":0.00536,"percentile":0.45211,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101901","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.20.0"],"state":"fixed","available":[{"version":"1.20.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.42075999999999997},"relatedVulnerabilities":[{"id":"CVE-2026-101901","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101901","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/axios/axios/security/advisories/GHSA-542g-h47m-68v8"],"description":"Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Http2Sessions does not install adequate error handling for a ClientHttp2Session during Axios HTTP/2 session initialization or reuse. A request uses httpVersion: 2 and the ClientHttp2Session emits an error during session initialization or reuse. The unhandled session error escapes normal Promise rejection handling. The uncaught error can terminate the Node.js process and cause denial of service. This issue is fixed in version 1.20.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101901","epss":0.00536,"percentile":0.45211,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101901","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.16.1"}},"found":{"vulnerabilityID":"GHSA-542g-h47m-68v8","versionConstraint":">=1.13.0,<1.20.0 (semantic)"},"fix":{"suggestedVersion":"1.20.0"}}],"artifact":{"id":"pkg:npm/axios@1.16.1?package-id=8545c428c207f9fb","name":"axios","version":"1.16.1","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.16.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.16.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-542g-h47m-68v8","dataSource":"https://github.com/advisories/GHSA-542g-h47m-68v8","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-542g-h47m-68v8","https://nvd.nist.gov/vuln/detail/CVE-2026-101901","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/releases/tag/v1.20.0"],"description":"Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101901","epss":0.00536,"percentile":0.45211,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101901","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.20.0"],"state":"fixed","available":[{"version":"1.20.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.42075999999999997},"relatedVulnerabilities":[{"id":"CVE-2026-101901","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101901","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/axios/axios/security/advisories/GHSA-542g-h47m-68v8"],"description":"Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Http2Sessions does not install adequate error handling for a ClientHttp2Session during Axios HTTP/2 session initialization or reuse. A request uses httpVersion: 2 and the ClientHttp2Session emits an error during session initialization or reuse. The unhandled session error escapes normal Promise rejection handling. The uncaught error can terminate the Node.js process and cause denial of service. This issue is fixed in version 1.20.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101901","epss":0.00536,"percentile":0.45211,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101901","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.18.1"}},"found":{"vulnerabilityID":"GHSA-542g-h47m-68v8","versionConstraint":">=1.13.0,<1.20.0 (semantic)"},"fix":{"suggestedVersion":"1.20.0"}}],"artifact":{"id":"pkg:npm/axios@1.18.1?package-id=1350ab3e8bd97544","name":"axios","version":"1.18.1","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.18.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.18.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-7wch-p9px-956x","dataSource":"https://github.com/advisories/GHSA-7wch-p9px-956x","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/digitalbazaar/forge/security/advisories/GHSA-7wch-p9px-956x","https://nvd.nist.gov/vuln/detail/CVE-2026-118779","https://github.com/digitalbazaar/forge/commit/412345db583cd28a9d23636d0d93e9f751b935f3","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1"],"description":"Forge: Regular expression denial of service in PEM decoding (pem.decode)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118779","epss":0.00556,"percentile":0.46406,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118779","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-118779","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.4.1"],"state":"fixed","available":[{"version":"1.4.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.41700000000000004},"relatedVulnerabilities":[{"id":"CVE-2026-118779","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118779","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/digitalbazaar/forge/commit/412345db583cd28a9d23636d0d93e9f751b935f3","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","https://github.com/digitalbazaar/forge/security/advisories/GHSA-7wch-p9px-956x"],"description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used pem.decode(), lib/pem.js, missing END line to process the relevant input or security decision. node-forge used polynomial-time regular expressions in pem.decode(), including when searching for a matching END line and parsing encapsulated headers. An unauthenticated attacker able to supply PEM input to any high-level parser could consume excessive CPU with a long malformed message and cause denial of service. This issue is fixed in version 1.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118779","epss":0.00556,"percentile":0.46406,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118779","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-118779","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"node-forge","version":"1.4.0"}},"found":{"vulnerabilityID":"GHSA-7wch-p9px-956x","versionConstraint":"<=1.4.0 (semantic)"},"fix":{"suggestedVersion":"1.4.1"}}],"artifact":{"id":"pkg:npm/node-forge@1.4.0?package-id=86ba9cb3dfe9125a","name":"node-forge","version":"1.4.0","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause OR GPL-2.0"],"cpes":["cpe:2.3:a:digitalbazaar:forge:1.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/node-forge@1.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-7wch-p9px-956x","dataSource":"https://github.com/advisories/GHSA-7wch-p9px-956x","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/digitalbazaar/forge/security/advisories/GHSA-7wch-p9px-956x","https://nvd.nist.gov/vuln/detail/CVE-2026-118779","https://github.com/digitalbazaar/forge/commit/412345db583cd28a9d23636d0d93e9f751b935f3","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1"],"description":"Forge: Regular expression denial of service in PEM decoding (pem.decode)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118779","epss":0.00556,"percentile":0.46406,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118779","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-118779","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.4.1"],"state":"fixed","available":[{"version":"1.4.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.41700000000000004},"relatedVulnerabilities":[{"id":"CVE-2026-118779","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118779","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/digitalbazaar/forge/commit/412345db583cd28a9d23636d0d93e9f751b935f3","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","https://github.com/digitalbazaar/forge/security/advisories/GHSA-7wch-p9px-956x"],"description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used pem.decode(), lib/pem.js, missing END line to process the relevant input or security decision. node-forge used polynomial-time regular expressions in pem.decode(), including when searching for a matching END line and parsing encapsulated headers. An unauthenticated attacker able to supply PEM input to any high-level parser could consume excessive CPU with a long malformed message and cause denial of service. This issue is fixed in version 1.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118779","epss":0.00556,"percentile":0.46406,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118779","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-118779","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"node-forge","version":"1.4.0"}},"found":{"vulnerabilityID":"GHSA-7wch-p9px-956x","versionConstraint":"<=1.4.0 (semantic)"},"fix":{"suggestedVersion":"1.4.1"}}],"artifact":{"id":"pkg:npm/node-forge@1.4.0?package-id=1e94284aa936f13c","name":"node-forge","version":"1.4.0","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause OR GPL-2.0"],"cpes":["cpe:2.3:a:digitalbazaar:forge:1.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/node-forge@1.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-j5f8-grm9-p9fc","dataSource":"https://github.com/advisories/GHSA-j5f8-grm9-p9fc","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-j5f8-grm9-p9fc","https://github.com/axios/axios/pull/10794","https://github.com/axios/axios/commit/afca61a070728e717203c2bc21e7b589b59b858b","https://github.com/axios/axios/releases/tag/v0.32.0","https://github.com/axios/axios/releases/tag/v1.16.0","https://nvd.nist.gov/vuln/detail/CVE-2026-44486"],"description":"Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44486","epss":0.00552,"percentile":0.46149,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44486","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-44486","cwe":"CWE-201","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["1.16.0"],"state":"fixed","available":[{"version":"1.16.0","date":"2026-06-04","kind":"first-observed"}]},"advisories":[],"risk":0.414},"relatedVulnerabilities":[{"id":"CVE-2026-44486","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44486","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-j5f8-grm9-p9fc","https://access.redhat.com/errata/RHSA-2026:20889","https://access.redhat.com/errata/RHSA-2026:20938","https://access.redhat.com/errata/RHSA-2026:27044","https://access.redhat.com/errata/RHSA-2026:27063","https://access.redhat.com/errata/RHSA-2026:28964","https://access.redhat.com/errata/RHSA-2026:29082","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:30650","https://access.redhat.com/errata/RHSA-2026:30651","https://access.redhat.com/errata/RHSA-2026:33155","https://access.redhat.com/errata/RHSA-2026:33160","https://access.redhat.com/errata/RHSA-2026:33163","https://access.redhat.com/errata/RHSA-2026:33173","https://access.redhat.com/errata/RHSA-2026:33183","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:34766","https://access.redhat.com/errata/RHSA-2026:36611","https://access.redhat.com/errata/RHSA-2026:36754","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:36882","https://access.redhat.com/errata/RHSA-2026:36883","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41055","https://access.redhat.com/errata/RHSA-2026:41064","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:42078","https://access.redhat.com/errata/RHSA-2026:42085","https://access.redhat.com/errata/RHSA-2026:42142","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:46885","https://access.redhat.com/errata/RHSA-2026:46903","https://access.redhat.com/errata/RHSA-2026:50300","https://access.redhat.com/errata/RHSA-2026:50681","https://access.redhat.com/errata/RHSA-2026:54188","https://access.redhat.com/errata/RHSA-2026:54206","https://access.redhat.com/errata/RHSA-2026:57191","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-44486","https://bugzilla.redhat.com/show_bug.cgi?id=2487947","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44486.json"],"description":"Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a request is sent through an authenticated proxy, Axios may add a Proxy-Authorization header. If Axios then follows a redirect and the redirected request is no longer sent through that proxy, the stale Proxy-Authorization header can remain on the redirected request and be sent to the redirect target. This affects Node.js's use of Axios with automatic redirects enabled and an authenticated proxy configuration. Browser adapters are not affected. This vulnerability is fixed in 0.32.0 and 1.16.0.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44486","epss":0.00552,"percentile":0.46149,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44486","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-44486","cwe":"CWE-201","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.15.0"}},"found":{"vulnerabilityID":"GHSA-j5f8-grm9-p9fc","versionConstraint":">=1.0.0,<1.16.0 (semantic)"},"fix":{"suggestedVersion":"1.16.0"}}],"artifact":{"id":"pkg:npm/axios@1.15.0?package-id=520b8e92ffff8054","name":"axios","version":"1.15.0","type":"npm","locations":[{"path":"/sink/oidc-server/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.15.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.15.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-gcfj-64vw-6mp9","dataSource":"https://github.com/advisories/GHSA-gcfj-64vw-6mp9","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-gcfj-64vw-6mp9","https://github.com/axios/axios/pull/11000","https://github.com/axios/axios/pull/11001","https://github.com/axios/axios/commit/1417285c69344bbcc6420a021f67dee0c6fedb2d","https://github.com/axios/axios/commit/32fc489632377d214db55bfa4e2c48486a7d7ce2","https://github.com/axios/axios/releases/tag/v0.33.0","https://github.com/axios/axios/releases/tag/v1.18.0","https://nvd.nist.gov/vuln/detail/CVE-2026-67320","https://nvd.nist.gov/vuln/detail/CVE-2026-69124","https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-node-http-adapter"],"description":"Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67320","epss":0.00523,"percentile":0.4437,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67320","cwe":"CWE-200","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["1.18.0"],"state":"fixed","available":[{"version":"1.18.0","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.41317000000000004},"relatedVulnerabilities":[{"id":"CVE-2026-67320","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-67320","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/axios/axios/commit/df53d7dd99b202fb194217abd127ae6a630e70dc","https://github.com/axios/axios/security/advisories/GHSA-gcfj-64vw-6mp9","https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-node-http-adapter"],"description":"axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hardens merged request configuration by creating a null-prototype object, but request interceptors run after the merge; a common immutable interceptor pattern such as {...config} or Object.assign({}, config) converts the hardened config back into a regular object. axios then dispatches that object without re-hardening it, and the Node HTTP adapter reads config.proxy through the prototype chain. If an attacker can pollute Object.prototype.proxy, affected requests can be routed through an attacker-controlled proxy. For plaintext HTTP requests, the proxy can observe Authorization headers, Basic auth from config.auth, method, absolute URL, Host, and request body, and can return its own response. This does not establish browser impact or HTTPS header/body disclosure under normal TLS validation. Affected versions are >=0.31.1 (fixed in 0.33.0) and >=1.15.2 (fixed in 1.18.0).","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67320","epss":0.00523,"percentile":0.4437,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67320","cwe":"CWE-200","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.16.1"}},"found":{"vulnerabilityID":"GHSA-gcfj-64vw-6mp9","versionConstraint":">=1.15.2,<1.18.0 (semantic)"},"fix":{"suggestedVersion":"1.18.0"}}],"artifact":{"id":"pkg:npm/axios@1.16.1?package-id=8545c428c207f9fb","name":"axios","version":"1.16.1","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.16.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.16.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-2883-xcg3-v3hh","dataSource":"https://github.com/advisories/GHSA-2883-xcg3-v3hh","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh","https://nvd.nist.gov/vuln/detail/CVE-2026-84375","https://github.com/nodeca/js-yaml/pull/797","https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639","https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480","https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b","https://github.com/nodeca/js-yaml/releases/tag/3.15.2","https://github.com/nodeca/js-yaml/releases/tag/4.3.2"],"description":"js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84375","epss":0.00541,"percentile":0.45507,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84375","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-84375","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.3.2"],"state":"fixed","available":[{"version":"4.3.2","date":"2026-09-09","kind":"first-observed"}]},"advisories":[],"risk":0.40575000000000006},"relatedVulnerabilities":[{"id":"CVE-2026-84375","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84375","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639","https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480","https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b","https://github.com/nodeca/js-yaml/pull/797","https://github.com/nodeca/js-yaml/releases/tag/3.15.2","https://github.com/nodeca/js-yaml/releases/tag/4.3.2","https://github.com/nodeca/js-yaml/releases/tag/5.4.1","https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh"],"description":"js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2, 4.3.2, and 5.4.1, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key <<. An attacker can alias a large sequence of empty mappings into many merge targets, causing O(N * K) processing while totalMergeKeys remains unchanged and the configured resource limit is never reached. A relatively small YAML document can therefore cause prolonged CPU consumption in applications that parse untrusted YAML, and merge processing is enabled by default on these release lines. In v3 & v4, merge is enabled by default so the severity score is higher. This issue is fixed in versions 3.15.2, 4.3.2, and 5.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84375","epss":0.00541,"percentile":0.45507,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84375","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-84375","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"4.1.1"}},"found":{"vulnerabilityID":"GHSA-2883-xcg3-v3hh","versionConstraint":">=4.0.0,<4.3.2 (semantic)"},"fix":{"suggestedVersion":"4.3.2"}}],"artifact":{"id":"pkg:npm/js-yaml@4.1.1?package-id=15e5564f07e87e23","name":"js-yaml","version":"4.1.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodeca:js-yaml:4.1.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@4.1.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-2883-xcg3-v3hh","dataSource":"https://github.com/advisories/GHSA-2883-xcg3-v3hh","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh","https://nvd.nist.gov/vuln/detail/CVE-2026-84375","https://github.com/nodeca/js-yaml/pull/797","https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639","https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480","https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b","https://github.com/nodeca/js-yaml/releases/tag/3.15.2","https://github.com/nodeca/js-yaml/releases/tag/4.3.2"],"description":"js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84375","epss":0.00541,"percentile":0.45507,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84375","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-84375","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.3.2"],"state":"fixed","available":[{"version":"4.3.2","date":"2026-09-09","kind":"first-observed"}]},"advisories":[],"risk":0.40575000000000006},"relatedVulnerabilities":[{"id":"CVE-2026-84375","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84375","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639","https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480","https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b","https://github.com/nodeca/js-yaml/pull/797","https://github.com/nodeca/js-yaml/releases/tag/3.15.2","https://github.com/nodeca/js-yaml/releases/tag/4.3.2","https://github.com/nodeca/js-yaml/releases/tag/5.4.1","https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh"],"description":"js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2, 4.3.2, and 5.4.1, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key <<. An attacker can alias a large sequence of empty mappings into many merge targets, causing O(N * K) processing while totalMergeKeys remains unchanged and the configured resource limit is never reached. A relatively small YAML document can therefore cause prolonged CPU consumption in applications that parse untrusted YAML, and merge processing is enabled by default on these release lines. In v3 & v4, merge is enabled by default so the severity score is higher. This issue is fixed in versions 3.15.2, 4.3.2, and 5.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84375","epss":0.00541,"percentile":0.45507,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84375","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-84375","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"4.1.1"}},"found":{"vulnerabilityID":"GHSA-2883-xcg3-v3hh","versionConstraint":">=4.0.0,<4.3.2 (semantic)"},"fix":{"suggestedVersion":"4.3.2"}}],"artifact":{"id":"pkg:npm/js-yaml@4.1.1?package-id=b47d2ee1a6cdb382","name":"js-yaml","version":"4.1.1","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodeca:js-yaml:4.1.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@4.1.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-h64f-5h5j-jqjh","dataSource":"https://github.com/advisories/GHSA-h64f-5h5j-jqjh","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/vercel/next.js/security/advisories/GHSA-h64f-5h5j-jqjh","https://github.com/vercel/next.js/releases/tag/v15.5.16","https://github.com/vercel/next.js/releases/tag/v16.2.5","https://nvd.nist.gov/vuln/detail/CVE-2026-44577"],"description":"Next.js has a Denial of Service in the Image Optimization API","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44577","epss":0.00739,"percentile":0.54564,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44577","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-44577","cwe":"CWE-770","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["16.2.5"],"state":"fixed","available":[{"version":"16.2.5","date":"2026-05-11","kind":"first-observed"}]},"advisories":[],"risk":0.40275500000000003},"relatedVulnerabilities":[{"id":"CVE-2026-44577","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44577","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/vercel/next.js/security/advisories/GHSA-h64f-5h5j-jqjh","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:37272","https://access.redhat.com/errata/RHSA-2026:40974","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/security/cve/CVE-2026-44577","https://bugzilla.redhat.com/show_bug.cgi?id=2477194","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44577.json"],"description":"Next.js is a React framework for building full-stack web applications. From 10.0.0 to before 15.5.16 and 16.2.5, when self-hosting Next.js with the default image loader, the Image Optimization API fetches local images entirely into memory without enforcing a maximum size limit. An attacker could cause out-of-memory conditions by requesting large local assets from the /_next/image endpoint that match the images.localPatterns configuration (by default, all patterns are allowed). This vulnerability is fixed in 15.5.16 and 16.2.5.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44577","epss":0.00739,"percentile":0.54564,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44577","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-44577","cwe":"CWE-770","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"next","version":"16.1.7"}},"found":{"vulnerabilityID":"GHSA-h64f-5h5j-jqjh","versionConstraint":">=16.0.0,<16.2.5 (semantic)"},"fix":{"suggestedVersion":"16.2.5"}}],"artifact":{"id":"pkg:npm/next@16.1.7?package-id=662de087d22e519d","name":"next","version":"16.1.7","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vercel:next.js:16.1.7:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/next@16.1.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-r825-w8mm-5pxw","dataSource":"https://github.com/advisories/GHSA-r825-w8mm-5pxw","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/vitejs/launch-editor/security/advisories/GHSA-r825-w8mm-5pxw","https://nvd.nist.gov/vuln/detail/CVE-2026-112944","https://github.com/vitejs/launch-editor/pull/156","https://github.com/vitejs/launch-editor/commit/f6e6701bb1f16f2dd242b321374f1b6cca6eb6d4","https://github.com/vitejs/launch-editor/releases/tag/v2.14.2"],"description":"launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112944","epss":0.00705,"percentile":0.53381,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112944","cwe":"CWE-88","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.3.7"],"state":"fixed","available":[{"version":"7.3.7","date":"2026-10-21","kind":"first-observed"}]},"advisories":[],"risk":0.398325},"relatedVulnerabilities":[{"id":"CVE-2026-112944","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112944","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/vitejs/launch-editor/commit/f6e6701bb1f16f2dd242b321374f1b6cca6eb6d4","https://github.com/vitejs/launch-editor/pull/156","https://github.com/vitejs/launch-editor/releases/tag/v2.14.2","https://github.com/vitejs/launch-editor/security/advisories/GHSA-r825-w8mm-5pxw"],"description":"launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, when an attacker can create a filesystem entry beginning with plus or minus in the working directory, an affected editor is selected, and the path can remain relative or is converted to a relative WSL path, launchEditor forwards the path without forcing it to be interpreted as a positional filename. Editor option parsing then treats the attacker-controlled filename as a command-line flag, which can cause unintended file overwrite or arbitrary command execution by the selected editor. The affected editors are Vim and gVim, MacVim, Emacs and Emacsclient, and Notepad++ when a plugin exposes dangerous operations; WSL path conversion keeps Vite and newer middleware callers exposed. This issue is fixed in version 2.14.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112944","epss":0.00705,"percentile":0.53381,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112944","cwe":"CWE-88","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"vite","version":"7.3.2"}},"found":{"vulnerabilityID":"GHSA-r825-w8mm-5pxw","versionConstraint":">=7.0.0,<=7.3.6 (semantic)"},"fix":{"suggestedVersion":"7.3.7"}}],"artifact":{"id":"pkg:npm/vite@7.3.2?package-id=5c0ce5d7d525ae42","name":"vite","version":"7.3.2","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vitejs:vite:7.3.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/vite@7.3.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-r825-w8mm-5pxw","dataSource":"https://github.com/advisories/GHSA-r825-w8mm-5pxw","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/vitejs/launch-editor/security/advisories/GHSA-r825-w8mm-5pxw","https://nvd.nist.gov/vuln/detail/CVE-2026-112944","https://github.com/vitejs/launch-editor/pull/156","https://github.com/vitejs/launch-editor/commit/f6e6701bb1f16f2dd242b321374f1b6cca6eb6d4","https://github.com/vitejs/launch-editor/releases/tag/v2.14.2"],"description":"launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112944","epss":0.00705,"percentile":0.53381,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112944","cwe":"CWE-88","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.3.7"],"state":"fixed","available":[{"version":"7.3.7","date":"2026-10-21","kind":"first-observed"}]},"advisories":[],"risk":0.398325},"relatedVulnerabilities":[{"id":"CVE-2026-112944","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112944","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/vitejs/launch-editor/commit/f6e6701bb1f16f2dd242b321374f1b6cca6eb6d4","https://github.com/vitejs/launch-editor/pull/156","https://github.com/vitejs/launch-editor/releases/tag/v2.14.2","https://github.com/vitejs/launch-editor/security/advisories/GHSA-r825-w8mm-5pxw"],"description":"launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, when an attacker can create a filesystem entry beginning with plus or minus in the working directory, an affected editor is selected, and the path can remain relative or is converted to a relative WSL path, launchEditor forwards the path without forcing it to be interpreted as a positional filename. Editor option parsing then treats the attacker-controlled filename as a command-line flag, which can cause unintended file overwrite or arbitrary command execution by the selected editor. The affected editors are Vim and gVim, MacVim, Emacs and Emacsclient, and Notepad++ when a plugin exposes dangerous operations; WSL path conversion keeps Vite and newer middleware callers exposed. This issue is fixed in version 2.14.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112944","epss":0.00705,"percentile":0.53381,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112944","cwe":"CWE-88","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"vite","version":"7.3.6"}},"found":{"vulnerabilityID":"GHSA-r825-w8mm-5pxw","versionConstraint":">=7.0.0,<=7.3.6 (semantic)"},"fix":{"suggestedVersion":"7.3.7"}}],"artifact":{"id":"pkg:npm/vite@7.3.6?package-id=dcc7b510dec05363","name":"vite","version":"7.3.6","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vitejs:vite:7.3.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/vite@7.3.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-r825-w8mm-5pxw","dataSource":"https://github.com/advisories/GHSA-r825-w8mm-5pxw","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/vitejs/launch-editor/security/advisories/GHSA-r825-w8mm-5pxw","https://nvd.nist.gov/vuln/detail/CVE-2026-112944","https://github.com/vitejs/launch-editor/pull/156","https://github.com/vitejs/launch-editor/commit/f6e6701bb1f16f2dd242b321374f1b6cca6eb6d4","https://github.com/vitejs/launch-editor/releases/tag/v2.14.2"],"description":"launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112944","epss":0.00705,"percentile":0.53381,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112944","cwe":"CWE-88","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["8.2.4"],"state":"fixed","available":[{"version":"8.2.4","date":"2026-10-21","kind":"first-observed"}]},"advisories":[],"risk":0.398325},"relatedVulnerabilities":[{"id":"CVE-2026-112944","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112944","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/vitejs/launch-editor/commit/f6e6701bb1f16f2dd242b321374f1b6cca6eb6d4","https://github.com/vitejs/launch-editor/pull/156","https://github.com/vitejs/launch-editor/releases/tag/v2.14.2","https://github.com/vitejs/launch-editor/security/advisories/GHSA-r825-w8mm-5pxw"],"description":"launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, when an attacker can create a filesystem entry beginning with plus or minus in the working directory, an affected editor is selected, and the path can remain relative or is converted to a relative WSL path, launchEditor forwards the path without forcing it to be interpreted as a positional filename. Editor option parsing then treats the attacker-controlled filename as a command-line flag, which can cause unintended file overwrite or arbitrary command execution by the selected editor. The affected editors are Vim and gVim, MacVim, Emacs and Emacsclient, and Notepad++ when a plugin exposes dangerous operations; WSL path conversion keeps Vite and newer middleware callers exposed. This issue is fixed in version 2.14.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112944","epss":0.00705,"percentile":0.53381,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112944","cwe":"CWE-88","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"vite","version":"8.2.2"}},"found":{"vulnerabilityID":"GHSA-r825-w8mm-5pxw","versionConstraint":">=8.2.0,<=8.2.3 (semantic)"},"fix":{"suggestedVersion":"8.2.4"}}],"artifact":{"id":"pkg:npm/vite@8.2.2?package-id=ae073bacc7b8ee83","name":"vite","version":"8.2.2","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vitejs:vite:8.2.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/vite@8.2.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-r292-9mhp-454m","dataSource":"https://github.com/advisories/GHSA-r292-9mhp-454m","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-r292-9mhp-454m","https://github.com/isaacs/node-tar/commit/631ae59121bf8fc8a22bbae35f074cb9b789cd4a","https://github.com/isaacs/node-tar/releases/tag/v7.5.21","https://nvd.nist.gov/vuln/detail/CVE-2026-73566"],"description":"node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73566","epss":0.00531,"percentile":0.44907,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73566","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-73566","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.5.21"],"state":"fixed","available":[{"version":"7.5.21","date":"2026-07-24","kind":"first-observed"}]},"advisories":[],"risk":0.39825},"relatedVulnerabilities":[{"id":"CVE-2026-73566","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-73566","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/node-tar/commit/631ae59121bf8fc8a22bbae35f074cb9b789cd4a","https://github.com/isaacs/node-tar/security/advisories/GHSA-r292-9mhp-454m"],"description":"node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an archive entry path upward with path.dirname() and no segment cap when tar.t(...) or tar.x(...) receives a non-empty member-selection list. A crafted GNU L or PAX x long-path header with thousands of slash-separated segments reaches this.filter(entry.path, entry) in Parser[CONSUMEHEADER] in src/parse.ts before Unpack[CHECKPATH] applies maxDepth, causing an uncatchable RangeError stack overflow that terminates asynchronous and streaming Node.js consumers. This issue is fixed in version 7.5.21.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73566","epss":0.00531,"percentile":0.44907,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73566","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-73566","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"7.5.13"}},"found":{"vulnerabilityID":"GHSA-r292-9mhp-454m","versionConstraint":"<=7.5.20 (semantic)"},"fix":{"suggestedVersion":"7.5.21"}}],"artifact":{"id":"pkg:npm/tar@7.5.13?package-id=c08fe2f2d0b796ea","name":"tar","version":"7.5.13","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BlueOak-1.0.0"],"cpes":["cpe:2.3:a:tar_project:tar:7.5.13:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:7.5.13:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:7.5.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@7.5.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-p68q-wchp-6fh7","dataSource":"https://github.com/advisories/GHSA-p68q-wchp-6fh7","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/fastify/fastify/security/advisories/GHSA-p68q-wchp-6fh7","https://nvd.nist.gov/vuln/detail/CVE-2026-76169","https://github.com/fastify/fastify/commit/93c239a380f3f2778bb7565fcdf777e91cfe1fbc","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fastify/releases/tag/v5.12.2"],"description":"fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-76169","epss":0.0053,"percentile":0.44856,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-76169","cwe":"CWE-288","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["5.12.2"],"state":"fixed","available":[{"version":"5.12.2","date":"2026-10-01","kind":"first-observed"}]},"advisories":[],"risk":0.3975},"relatedVulnerabilities":[{"id":"CVE-2026-76169","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76169","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fastify/security/advisories/GHSA-p68q-wchp-6fh7"],"description":"fastify versions >= 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix to the custom not-found handler of a different sibling plugin, and invoke it without the preHandler hook declared for that handler. The internal not-found router for encapsulated handlers dispatches malformed paths through a single shared handler pointer before URL decoding, ignoring the prefix and skipping the selected handler's normal lifecycle. An unauthenticated attacker can therefore reach an authentication-protected private fallback through an unrelated public prefix and read its full response, bypassing the authentication hook and breaking prefix encapsulation. Users should upgrade to fastify 5.12.2 or later.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-76169","epss":0.0053,"percentile":0.44856,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-76169","cwe":"CWE-288","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fastify","version":"5.8.5"}},"found":{"vulnerabilityID":"GHSA-p68q-wchp-6fh7","versionConstraint":">=4.0.0,<5.12.2 (semantic)"},"fix":{"suggestedVersion":"5.12.2"}}],"artifact":{"id":"pkg:npm/fastify@5.8.5?package-id=72dfb6219c562dcc","name":"fastify","version":"5.8.5","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:fastify:fastify:5.8.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fastify@5.8.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-r28c-9q8g-f849","dataSource":"https://github.com/advisories/GHSA-r28c-9q8g-f849","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/postcss/postcss/security/advisories/GHSA-r28c-9q8g-f849","https://github.com/postcss/postcss/commit/95663d3eb7ba26f4854dd19d3b4f4425760cf56c","https://github.com/postcss/postcss/releases/tag/8.5.18"],"description":"PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73646","epss":0.0053,"percentile":0.44819,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73646","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["8.5.18"],"state":"fixed","available":[{"version":"8.5.18","date":"2026-07-24","kind":"first-observed"}]},"advisories":[],"risk":0.3975},"relatedVulnerabilities":[{"id":"CVE-2026-73646","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-73646","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/postcss/postcss/commit/95663d3eb7ba26f4854dd19d3b4f4425760cf56c","https://github.com/postcss/postcss/releases/tag/8.5.18","https://github.com/postcss/postcss/security/advisories/GHSA-r28c-9q8g-f849"],"description":"PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute .map paths, allowing untrusted CSS processed without map: false to disclose sourcesContent from arbitrary reachable .map files through result.map. This issue is fixed in version 8.5.18.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73646","epss":0.0053,"percentile":0.44819,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73646","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"postcss","version":"8.4.31"}},"found":{"vulnerabilityID":"GHSA-r28c-9q8g-f849","versionConstraint":"<=8.5.17 (semantic)"},"fix":{"suggestedVersion":"8.5.18"}}],"artifact":{"id":"pkg:npm/postcss@8.4.31?package-id=5e383ddf2a230a67","name":"postcss","version":"8.4.31","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:postcss:postcss:8.4.31:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/postcss@8.4.31","upstreams":[]}},{"vulnerability":{"id":"GHSA-r28c-9q8g-f849","dataSource":"https://github.com/advisories/GHSA-r28c-9q8g-f849","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/postcss/postcss/security/advisories/GHSA-r28c-9q8g-f849","https://github.com/postcss/postcss/commit/95663d3eb7ba26f4854dd19d3b4f4425760cf56c","https://github.com/postcss/postcss/releases/tag/8.5.18"],"description":"PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73646","epss":0.0053,"percentile":0.44819,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73646","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["8.5.18"],"state":"fixed","available":[{"version":"8.5.18","date":"2026-07-24","kind":"first-observed"}]},"advisories":[],"risk":0.3975},"relatedVulnerabilities":[{"id":"CVE-2026-73646","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-73646","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/postcss/postcss/commit/95663d3eb7ba26f4854dd19d3b4f4425760cf56c","https://github.com/postcss/postcss/releases/tag/8.5.18","https://github.com/postcss/postcss/security/advisories/GHSA-r28c-9q8g-f849"],"description":"PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute .map paths, allowing untrusted CSS processed without map: false to disclose sourcesContent from arbitrary reachable .map files through result.map. This issue is fixed in version 8.5.18.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73646","epss":0.0053,"percentile":0.44819,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73646","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"postcss","version":"8.5.12"}},"found":{"vulnerabilityID":"GHSA-r28c-9q8g-f849","versionConstraint":"<=8.5.17 (semantic)"},"fix":{"suggestedVersion":"8.5.18"}}],"artifact":{"id":"pkg:npm/postcss@8.5.12?package-id=61b54a3748eae187","name":"postcss","version":"8.5.12","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:postcss:postcss:8.5.12:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/postcss@8.5.12","upstreams":[]}},{"vulnerability":{"id":"GHSA-r28c-9q8g-f849","dataSource":"https://github.com/advisories/GHSA-r28c-9q8g-f849","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/postcss/postcss/security/advisories/GHSA-r28c-9q8g-f849","https://github.com/postcss/postcss/commit/95663d3eb7ba26f4854dd19d3b4f4425760cf56c","https://github.com/postcss/postcss/releases/tag/8.5.18"],"description":"PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73646","epss":0.0053,"percentile":0.44819,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73646","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["8.5.18"],"state":"fixed","available":[{"version":"8.5.18","date":"2026-07-24","kind":"first-observed"}]},"advisories":[],"risk":0.3975},"relatedVulnerabilities":[{"id":"CVE-2026-73646","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-73646","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/postcss/postcss/commit/95663d3eb7ba26f4854dd19d3b4f4425760cf56c","https://github.com/postcss/postcss/releases/tag/8.5.18","https://github.com/postcss/postcss/security/advisories/GHSA-r28c-9q8g-f849"],"description":"PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute .map paths, allowing untrusted CSS processed without map: false to disclose sourcesContent from arbitrary reachable .map files through result.map. This issue is fixed in version 8.5.18.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73646","epss":0.0053,"percentile":0.44819,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73646","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"postcss","version":"8.5.6"}},"found":{"vulnerabilityID":"GHSA-r28c-9q8g-f849","versionConstraint":"<=8.5.17 (semantic)"},"fix":{"suggestedVersion":"8.5.18"}}],"artifact":{"id":"pkg:npm/postcss@8.5.6?package-id=ff850f5fca433458","name":"postcss","version":"8.5.6","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:postcss:postcss:8.5.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/postcss@8.5.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-3pq3-5fj3-cg6v","dataSource":"https://github.com/advisories/GHSA-3pq3-5fj3-cg6v","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-3pq3-5fj3-cg6v","https://nvd.nist.gov/vuln/detail/CVE-2026-101898","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/releases/tag/v1.20.0"],"description":"Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","metrics":{"baseScore":7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101898","epss":0.00545,"percentile":0.45769,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101898","cwe":"CWE-918","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["1.20.0"],"state":"fixed","available":[{"version":"1.20.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.395125},"relatedVulnerabilities":[{"id":"CVE-2026-101898","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101898","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/axios/axios/security/advisories/GHSA-3pq3-5fj3-cg6v"],"description":"Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Axios HTTP/2 request setup does not consistently apply proxy settings and caller-supplied DNS lookup policy. An HTTPS request uses httpVersion: 2 with explicit config.proxy or environment-derived proxy settings, or relies on caller-supplied config.lookup DNS policy. The HTTP/2 path can connect without the configured proxy behavior or without applying the caller-supplied config.lookup policy before http2.connect(). Requests can bypass the intended proxy route or the caller-supplied DNS resolution policy. This issue is fixed in version 1.20.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101898","epss":0.00545,"percentile":0.45769,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101898","cwe":"CWE-918","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.15.0"}},"found":{"vulnerabilityID":"GHSA-3pq3-5fj3-cg6v","versionConstraint":">=1.13.0,<1.20.0 (semantic)"},"fix":{"suggestedVersion":"1.20.0"}}],"artifact":{"id":"pkg:npm/axios@1.15.0?package-id=520b8e92ffff8054","name":"axios","version":"1.15.0","type":"npm","locations":[{"path":"/sink/oidc-server/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.15.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.15.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-3pq3-5fj3-cg6v","dataSource":"https://github.com/advisories/GHSA-3pq3-5fj3-cg6v","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-3pq3-5fj3-cg6v","https://nvd.nist.gov/vuln/detail/CVE-2026-101898","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/releases/tag/v1.20.0"],"description":"Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","metrics":{"baseScore":7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101898","epss":0.00545,"percentile":0.45769,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101898","cwe":"CWE-918","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["1.20.0"],"state":"fixed","available":[{"version":"1.20.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.395125},"relatedVulnerabilities":[{"id":"CVE-2026-101898","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101898","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/axios/axios/security/advisories/GHSA-3pq3-5fj3-cg6v"],"description":"Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Axios HTTP/2 request setup does not consistently apply proxy settings and caller-supplied DNS lookup policy. An HTTPS request uses httpVersion: 2 with explicit config.proxy or environment-derived proxy settings, or relies on caller-supplied config.lookup DNS policy. The HTTP/2 path can connect without the configured proxy behavior or without applying the caller-supplied config.lookup policy before http2.connect(). Requests can bypass the intended proxy route or the caller-supplied DNS resolution policy. This issue is fixed in version 1.20.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101898","epss":0.00545,"percentile":0.45769,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101898","cwe":"CWE-918","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.16.1"}},"found":{"vulnerabilityID":"GHSA-3pq3-5fj3-cg6v","versionConstraint":">=1.13.0,<1.20.0 (semantic)"},"fix":{"suggestedVersion":"1.20.0"}}],"artifact":{"id":"pkg:npm/axios@1.16.1?package-id=8545c428c207f9fb","name":"axios","version":"1.16.1","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.16.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.16.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-3pq3-5fj3-cg6v","dataSource":"https://github.com/advisories/GHSA-3pq3-5fj3-cg6v","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-3pq3-5fj3-cg6v","https://nvd.nist.gov/vuln/detail/CVE-2026-101898","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/releases/tag/v1.20.0"],"description":"Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","metrics":{"baseScore":7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101898","epss":0.00545,"percentile":0.45769,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101898","cwe":"CWE-918","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["1.20.0"],"state":"fixed","available":[{"version":"1.20.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.395125},"relatedVulnerabilities":[{"id":"CVE-2026-101898","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101898","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/axios/axios/security/advisories/GHSA-3pq3-5fj3-cg6v"],"description":"Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Axios HTTP/2 request setup does not consistently apply proxy settings and caller-supplied DNS lookup policy. An HTTPS request uses httpVersion: 2 with explicit config.proxy or environment-derived proxy settings, or relies on caller-supplied config.lookup DNS policy. The HTTP/2 path can connect without the configured proxy behavior or without applying the caller-supplied config.lookup policy before http2.connect(). Requests can bypass the intended proxy route or the caller-supplied DNS resolution policy. This issue is fixed in version 1.20.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101898","epss":0.00545,"percentile":0.45769,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101898","cwe":"CWE-918","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.18.1"}},"found":{"vulnerabilityID":"GHSA-3pq3-5fj3-cg6v","versionConstraint":">=1.13.0,<1.20.0 (semantic)"},"fix":{"suggestedVersion":"1.20.0"}}],"artifact":{"id":"pkg:npm/axios@1.18.1?package-id=1350ab3e8bd97544","name":"axios","version":"1.18.1","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.18.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.18.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-9q9j-q6p8-xq58","dataSource":"https://github.com/advisories/GHSA-9q9j-q6p8-xq58","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/fastify/fastify/security/advisories/GHSA-9q9j-q6p8-xq58","https://nvd.nist.gov/vuln/detail/CVE-2026-84428","https://github.com/fastify/fastify/commit/179619c8e99d54924309b9933402151ef9af37e0","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fastify/releases/tag/v5.12.2"],"description":"fastify vulnerable to header validation bypass via incomplete schema case normalization","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84428","epss":0.00524,"percentile":0.44492,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84428","cwe":"CWE-178","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["5.12.2"],"state":"fixed","available":[{"version":"5.12.2","date":"2026-10-01","kind":"first-observed"}]},"advisories":[],"risk":0.39299999999999996},"relatedVulnerabilities":[{"id":"CVE-2026-84428","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84428","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fastify/security/advisories/GHSA-9q9j-q6p8-xq58"],"description":"fastify versions before 5.12.2 implement the case-insensitive nature of HTTP header names by lowercasing names in a route's header schema before compiling it, but the transformation is incomplete: it lowercases the properties keys and the root-level required array, and does not lowercase the trigger and dependent names inside the JSON Schema Draft 7 dependencies keyword. Because Node stores request header names in lowercase, a canonical-case dependency such as requiring an authentication header whenever a privileged-mode header is present never matches, and the presence assertion is silently skipped. An unauthenticated remote client can therefore send the header that activates a privileged branch while omitting the header the dependency was meant to require, bypassing the conditional check. Users should upgrade to fastify 5.12.2 or later.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84428","epss":0.00524,"percentile":0.44492,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84428","cwe":"CWE-178","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fastify","version":"5.8.5"}},"found":{"vulnerabilityID":"GHSA-9q9j-q6p8-xq58","versionConstraint":"<5.12.2 (semantic)"},"fix":{"suggestedVersion":"5.12.2"}}],"artifact":{"id":"pkg:npm/fastify@5.8.5?package-id=72dfb6219c562dcc","name":"fastify","version":"5.8.5","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:fastify:fastify:5.8.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fastify@5.8.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-x97p-jq2g-jp4f","dataSource":"https://github.com/advisories/GHSA-x97p-jq2g-jp4f","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-x97p-jq2g-jp4f","https://nvd.nist.gov/vuln/detail/CVE-2026-101909","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/commit/d29be181f85f6fe93397a07b1f69606d9622637b","https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0"],"description":"Axios: Prototype Pollution Gadget in axios toFormData Options","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101909","epss":0.00497,"percentile":0.42653,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101909","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.20.0"],"state":"fixed","available":[{"version":"1.20.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.39263},"relatedVulnerabilities":[{"id":"CVE-2026-101909","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101909","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/commit/d29be181f85f6fe93397a07b1f69606d9622637b","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/axios/axios/security/advisories/GHSA-x97p-jq2g-jp4f"],"description":"Axios is a promise-based HTTP client for the browser and Node.js. From 0.28.0 until 0.34.0 and 1.15.1 until 1.20.0, ToFormData processes inherited serialization options and visitor properties supplied through prototype pollution. A separate same-process prototype-pollution flaw supplies inherited dots, indexes, metaTokens, maxDepth, visitor, or Blob values before object serialization. The inherited options alter toFormData field naming and data interpretation, maxDepth can force request failure, Blob changes value handling, and a polluted visitor can execute when an attacker already has the stronger ability to inject a function. Serialized field naming and data interpretation can change, maxDepth can cause request failure, Blob can alter value handling, and a polluted visitor can execute under the stronger function-injection primitive. This issue is fixed in versions 0.34.0 and 1.20.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101909","epss":0.00497,"percentile":0.42653,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101909","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.16.1"}},"found":{"vulnerabilityID":"GHSA-x97p-jq2g-jp4f","versionConstraint":">=1.15.1,<1.20.0 (semantic)"},"fix":{"suggestedVersion":"1.20.0"}}],"artifact":{"id":"pkg:npm/axios@1.16.1?package-id=8545c428c207f9fb","name":"axios","version":"1.16.1","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.16.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.16.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-x97p-jq2g-jp4f","dataSource":"https://github.com/advisories/GHSA-x97p-jq2g-jp4f","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-x97p-jq2g-jp4f","https://nvd.nist.gov/vuln/detail/CVE-2026-101909","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/commit/d29be181f85f6fe93397a07b1f69606d9622637b","https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0"],"description":"Axios: Prototype Pollution Gadget in axios toFormData Options","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101909","epss":0.00497,"percentile":0.42653,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101909","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.20.0"],"state":"fixed","available":[{"version":"1.20.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.39263},"relatedVulnerabilities":[{"id":"CVE-2026-101909","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101909","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/commit/d29be181f85f6fe93397a07b1f69606d9622637b","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/axios/axios/security/advisories/GHSA-x97p-jq2g-jp4f"],"description":"Axios is a promise-based HTTP client for the browser and Node.js. From 0.28.0 until 0.34.0 and 1.15.1 until 1.20.0, ToFormData processes inherited serialization options and visitor properties supplied through prototype pollution. A separate same-process prototype-pollution flaw supplies inherited dots, indexes, metaTokens, maxDepth, visitor, or Blob values before object serialization. The inherited options alter toFormData field naming and data interpretation, maxDepth can force request failure, Blob changes value handling, and a polluted visitor can execute when an attacker already has the stronger ability to inject a function. Serialized field naming and data interpretation can change, maxDepth can cause request failure, Blob can alter value handling, and a polluted visitor can execute under the stronger function-injection primitive. This issue is fixed in versions 0.34.0 and 1.20.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101909","epss":0.00497,"percentile":0.42653,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101909","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.18.1"}},"found":{"vulnerabilityID":"GHSA-x97p-jq2g-jp4f","versionConstraint":">=1.15.1,<1.20.0 (semantic)"},"fix":{"suggestedVersion":"1.20.0"}}],"artifact":{"id":"pkg:npm/axios@1.18.1?package-id=1350ab3e8bd97544","name":"axios","version":"1.18.1","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.18.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.18.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-v39h-62p7-jpjc","dataSource":"https://github.com/advisories/GHSA-v39h-62p7-jpjc","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-v39h-62p7-jpjc","https://nvd.nist.gov/vuln/detail/CVE-2026-6322","https://cna.openjsf.org/security-advisories.html","https://access.redhat.com/errata/RHSA-2026:37186","https://access.redhat.com/errata/RHSA-2026:37385","https://access.redhat.com/errata/RHSA-2026:37628","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:42078","https://access.redhat.com/errata/RHSA-2026:42142","https://access.redhat.com/errata/RHSA-2026:43038","https://access.redhat.com/security/cve/CVE-2026-6322","https://bugzilla.redhat.com/show_bug.cgi?id=2466684","https://github.com/fastify/fast-uri/releases/tag/v2.4.1","https://github.com/fastify/fast-uri/releases/tag/v3.1.2","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6322.json","https://access.redhat.com/errata/RHSA-2026:25271","https://access.redhat.com/errata/RHSA-2026:25273","https://access.redhat.com/errata/RHSA-2026:26225","https://access.redhat.com/errata/RHSA-2026:26234","https://access.redhat.com/errata/RHSA-2026:28571","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:29795","https://access.redhat.com/errata/RHSA-2026:29796","https://access.redhat.com/errata/RHSA-2026:29800","https://access.redhat.com/errata/RHSA-2026:29834","https://access.redhat.com/errata/RHSA-2026:30076","https://access.redhat.com/errata/RHSA-2026:33683","https://access.redhat.com/errata/RHSA-2026:34160","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:34374","https://access.redhat.com/errata/RHSA-2026:34766","https://access.redhat.com/errata/RHSA-2026:34770","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:36754","https://access.redhat.com/errata/RHSA-2026:54395","https://access.redhat.com/errata/RHSA-2026:56366","https://access.redhat.com/errata/RHSA-2026:56431","https://access.redhat.com/errata/RHSA-2026:54555","https://access.redhat.com/errata/RHSA-2026:56928","https://access.redhat.com/errata/RHSA-2026:56968","https://access.redhat.com/errata/RHSA-2026:57013","https://access.redhat.com/errata/RHSA-2026:57487","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:60855","https://access.redhat.com/errata/RHSA-2026:61783"],"description":"fast-uri vulnerable to host confusion via percent-encoded authority delimiters","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-6322","epss":0.00512,"percentile":0.43677,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-6322","cwe":"CWE-436","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-6322","cwe":"CWE-140","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["3.1.2"],"state":"fixed","available":[{"version":"3.1.2","date":"2026-05-09","kind":"first-observed"}]},"advisories":[],"risk":0.38400000000000006},"relatedVulnerabilities":[{"id":"CVE-2026-6322","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6322","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-v39h-62p7-jpjc","https://access.redhat.com/errata/RHSA-2026:25271","https://access.redhat.com/errata/RHSA-2026:25273","https://access.redhat.com/errata/RHSA-2026:26225","https://access.redhat.com/errata/RHSA-2026:26234","https://access.redhat.com/errata/RHSA-2026:28571","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:29795","https://access.redhat.com/errata/RHSA-2026:29796","https://access.redhat.com/errata/RHSA-2026:29800","https://access.redhat.com/errata/RHSA-2026:29834","https://access.redhat.com/errata/RHSA-2026:30076","https://access.redhat.com/errata/RHSA-2026:33683","https://access.redhat.com/errata/RHSA-2026:34160","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:34374","https://access.redhat.com/errata/RHSA-2026:34766","https://access.redhat.com/errata/RHSA-2026:34770","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:36754","https://access.redhat.com/errata/RHSA-2026:37186","https://access.redhat.com/errata/RHSA-2026:37385","https://access.redhat.com/errata/RHSA-2026:37628","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:42078","https://access.redhat.com/errata/RHSA-2026:42142","https://access.redhat.com/errata/RHSA-2026:43038","https://access.redhat.com/errata/RHSA-2026:54395","https://access.redhat.com/errata/RHSA-2026:54555","https://access.redhat.com/errata/RHSA-2026:56366","https://access.redhat.com/errata/RHSA-2026:56431","https://access.redhat.com/errata/RHSA-2026:56928","https://access.redhat.com/errata/RHSA-2026:56968","https://access.redhat.com/errata/RHSA-2026:57013","https://access.redhat.com/errata/RHSA-2026:57487","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:60855","https://access.redhat.com/errata/RHSA-2026:61783","https://access.redhat.com/security/cve/CVE-2026-6322","https://bugzilla.redhat.com/show_bug.cgi?id=2466684","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6322.json"],"description":"fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization. A host that combined an allowed domain, an encoded at-sign, and a different domain was re-emitted with the at-sign as a raw userinfo separator, changing the URI's authority to the second domain. Applications that normalize untrusted URLs before host allowlist checks, redirect validation, or outbound request routing can be steered to a different authority than the input appeared to specify. Versions <= 3.1.1 are affected. Update to 3.1.2 or later.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-6322","epss":0.00512,"percentile":0.43677,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-6322","cwe":"CWE-436","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-6322","cwe":"CWE-140","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"3.1.0"}},"found":{"vulnerabilityID":"GHSA-v39h-62p7-jpjc","versionConstraint":">=3.0.0,<=3.1.1 (semantic)"},"fix":{"suggestedVersion":"3.1.2"}}],"artifact":{"id":"pkg:npm/fast-uri@3.1.0?package-id=a87bf2e2258cda95","name":"fast-uri","version":"3.1.0","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:openjsf:fast-uri:3.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@3.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-4qx8-w7c3-pj3p","dataSource":"https://github.com/advisories/GHSA-4qx8-w7c3-pj3p","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-4qx8-w7c3-pj3p","https://nvd.nist.gov/vuln/detail/CVE-2026-114141","https://github.com/BinaryMuse/toml-node/commit/609c873fffea0a27ebe5b4dd098eed2b3daf3606","https://github.com/BinaryMuse/toml-node/releases/tag/v5.0.1"],"description":"toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-114141","epss":0.00473,"percentile":0.40898,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-114141","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["5.0.1"],"state":"fixed","available":[{"version":"5.0.1","date":"2026-10-23","kind":"first-observed"}]},"advisories":[],"risk":0.38312999999999997},"relatedVulnerabilities":[{"id":"CVE-2026-114141","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114141","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/BinaryMuse/toml-node/commit/609c873fffea0a27ebe5b4dd098eed2b3daf3606","https://github.com/BinaryMuse/toml-node/releases/tag/v5.0.1","https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-4qx8-w7c3-pj3p"],"description":"toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, the toml.parse() compiler's addTableArray() function in lib/compiler.js rescans the complete assignedPaths and valueAssignments bookkeeping sets for every array-of-tables header. Distinct [[name]] paths are not pruned, so a document with many such headers causes quadratic synchronous work and can block the Node.js event loop, denying service to other operations in the process. This issue is fixed in version 5.0.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-114141","epss":0.00473,"percentile":0.40898,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-114141","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"toml","version":"5.0.0"}},"found":{"vulnerabilityID":"GHSA-4qx8-w7c3-pj3p","versionConstraint":"<=5.0.0 (semantic)"},"fix":{"suggestedVersion":"5.0.1"}}],"artifact":{"id":"pkg:npm/toml@5.0.0?package-id=052b84fded26719d","name":"toml","version":"5.0.0","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:toml:toml:5.0.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/toml@5.0.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-9j65-hcg3-gc64","dataSource":"https://github.com/advisories/GHSA-9j65-hcg3-gc64","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-9j65-hcg3-gc64","https://nvd.nist.gov/vuln/detail/CVE-2026-114143","https://github.com/BinaryMuse/toml-node/commit/609c873fffea0a27ebe5b4dd098eed2b3daf3606","https://github.com/BinaryMuse/toml-node/releases/tag/v5.0.1"],"description":"toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-114143","epss":0.00473,"percentile":0.40898,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-114143","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["5.0.1"],"state":"fixed","available":[{"version":"5.0.1","date":"2026-10-23","kind":"first-observed"}]},"advisories":[],"risk":0.38312999999999997},"relatedVulnerabilities":[{"id":"CVE-2026-114143","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114143","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/BinaryMuse/toml-node/commit/609c873fffea0a27ebe5b4dd098eed2b3daf3606","https://github.com/BinaryMuse/toml-node/releases/tag/v5.0.1","https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-9j65-hcg3-gc64"],"description":"toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() repeatedly slices and rejoins every path prefix in lib/compiler.js while processing long dotted keys, table headers, array-of-tables headers, and inline-table keys in assign(), deepRef(), and setNestedKey(). The resulting quadratic work can block the Node.js event loop for several seconds, and sufficiently long paths can terminate the process through memory exhaustion. The maxDepth option does not limit key-segment count and therefore does not mitigate this path. This issue is fixed in version 5.0.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-114143","epss":0.00473,"percentile":0.40898,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-114143","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"toml","version":"5.0.0"}},"found":{"vulnerabilityID":"GHSA-9j65-hcg3-gc64","versionConstraint":"<=5.0.0 (semantic)"},"fix":{"suggestedVersion":"5.0.1"}}],"artifact":{"id":"pkg:npm/toml@5.0.0?package-id=052b84fded26719d","name":"toml","version":"5.0.0","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:toml:toml:5.0.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/toml@5.0.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-q8wf-6r8g-63ch","dataSource":"https://github.com/advisories/GHSA-q8wf-6r8g-63ch","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch","https://github.com/vercel/next.js/pull/96006","https://github.com/vercel/next.js/commit/93cb90891402fa4c47798d03cb9e05c13233766c","https://github.com/vercel/next.js/releases/tag/v15.5.21","https://github.com/vercel/next.js/releases/tag/v16.2.11"],"description":"Next.js: Denial of Service in the Image Optimization API using SVGs","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-64644","epss":0.00666,"percentile":0.51865,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-64644","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["16.2.11"],"state":"fixed","available":[{"version":"16.2.11","date":"2026-07-23","kind":"first-observed"}]},"advisories":[],"risk":0.37628999999999996},"relatedVulnerabilities":[{"id":"CVE-2026-64644","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64644","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/vercel/next.js/commit/93cb90891402fa4c47798d03cb9e05c13233766c","https://github.com/vercel/next.js/pull/96006","https://github.com/vercel/next.js/releases/tag/v15.5.21","https://github.com/vercel/next.js/releases/tag/v16.2.11","https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch"],"description":"Next.js is a React framework for building full-stack web applications. In versions 15.5.0 through 15.5.20 and 16.0.0 through 16.2.10, when self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if configured (not enabled by default). If those images contain malicious content, they can cause CPU exhaustion in /_next/image endpoints.Only config.images.remotePatterns is affected, and just the patterns in that array, whereas config.images.unoptimized: true, config.images.loader: 'custom', and Vercel are not impacted. This issue has been fixed in versions 15.5.21 and 16.2.11.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-64644","epss":0.00666,"percentile":0.51865,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-64644","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"next","version":"16.1.7"}},"found":{"vulnerabilityID":"GHSA-q8wf-6r8g-63ch","versionConstraint":">=16.0.0,<16.2.11 (semantic)"},"fix":{"suggestedVersion":"16.2.11"}}],"artifact":{"id":"pkg:npm/next@16.1.7?package-id=662de087d22e519d","name":"next","version":"16.1.7","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vercel:next.js:16.1.7:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/next@16.1.7","upstreams":[]}},{"vulnerability":{"id":"GO-2026-6355","dataSource":"https://go.dev/issue/81317","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/cl/826524","https://groups.google.com/g/golang-announce/c/1y3fb2np35U"],"description":"Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection.\n\nNow, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-56855","epss":0.005,"percentile":0.4287,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-56855","cwe":"CWE-770","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.56.0"],"state":"fixed","available":[{"version":"0.56.0","date":"2026-09-02","kind":"release"}]},"advisories":[],"risk":0.375},"relatedVulnerabilities":[{"id":"CVE-2026-56855","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56855","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/826524","https://go.dev/issue/81317","https://groups.google.com/g/golang-announce/c/1y3fb2np35U","https://pkg.go.dev/vuln/GO-2026-6355"],"description":"Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-56855","epss":0.005,"percentile":0.4287,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-56855","cwe":"CWE-770","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/crypto","version":"v0.53.0"}},"found":{"vulnerabilityID":"GO-2026-6355","versionConstraint":"<0.56.0 (go)"},"fix":{"suggestedVersion":"0.56.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.53.0?package-id=2cfa42269238d9de","name":"golang.org/x/crypto","version":"v0.53.0","type":"go-module","locations":[{"path":"/backend-go/go.mod","accessPath":""}],"language":"go","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:golang:crypto:v0.53.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.53.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.53.0","upstreams":[],"metadataType":"GolangSourceMetadata","metadata":{"h1Digest":"h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto=","os":"linux","architecture":"amd64","cgoEnabled":true}}},{"vulnerability":{"id":"GHSA-x8mw-p69m-v3mx","dataSource":"https://github.com/advisories/GHSA-x8mw-p69m-v3mx","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/fastify/busboy/security/advisories/GHSA-x8mw-p69m-v3mx","https://nvd.nist.gov/vuln/detail/CVE-2026-19481","https://github.com/fastify/busboy/commit/957a24b66d5915e6d0a6ac988c9dbcee86373e9b","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/busboy/releases/tag/v3.2.1"],"description":"@fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-19481","epss":0.00493,"percentile":0.42383,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-19481","cwe":"CWE-754","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["3.2.1"],"state":"fixed","available":[{"version":"3.2.1","date":"2026-10-03","kind":"first-observed"}]},"advisories":[],"risk":0.36975},"relatedVulnerabilities":[{"id":"CVE-2026-19481","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19481","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/busboy/security/advisories/GHSA-x8mw-p69m-v3mx"],"description":"@fastify/busboy is a multipart form-data parser. In versions 1.0.0 through 3.2.0, an attacker who can submit multipart form-data can crash the parser by sending a part header whose name is a prototype-inherited property such as __proto__ or constructor. The internal header parser stores headers in a plain JavaScript object and assumes each value is an array, so an inherited property name resolves to a truthy non-array value and triggers a TypeError. In the common pipe integration the failure surfaces as an error event, but in direct write or end usage the exception is thrown synchronously and can terminate the Node.js process, causing an unauthenticated denial of service. The issue is fixed in @fastify/busboy 3.2.1, which creates the header object with a null prototype. Users should upgrade to 3.2.1.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-19481","epss":0.00493,"percentile":0.42383,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-19481","cwe":"CWE-754","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@fastify/busboy","version":"3.1.1"}},"found":{"vulnerabilityID":"GHSA-x8mw-p69m-v3mx","versionConstraint":">=1.0.0,<3.2.1 (semantic)"},"fix":{"suggestedVersion":"3.2.1"}}],"artifact":{"id":"pkg:npm/%40fastify/busboy@3.1.1?package-id=fc5e1f1a506dbd6b","name":"@fastify/busboy","version":"3.1.1","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:fastify:fastify\\/busyboy:3.1.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/%40fastify/busboy@3.1.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-8r9p-f939-6h3c","dataSource":"https://github.com/advisories/GHSA-8r9p-f939-6h3c","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-8r9p-f939-6h3c","https://nvd.nist.gov/vuln/detail/CVE-2026-111755","https://github.com/follow-redirects/follow-redirects/commit/080a76d0e125b37bf81717368a61d5dc37aa56c8","https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1"],"description":"follow-redirects sensitiveHeaders regex escaping can expose credential headers","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111755","epss":0.00471,"percentile":0.40769,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111755","cwe":"CWE-185","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-111755","cwe":"CWE-200","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["1.16.1"],"state":"fixed","available":[{"version":"1.16.1","date":"2026-10-21","kind":"first-observed"}]},"advisories":[],"risk":0.3697349999999999},"relatedVulnerabilities":[{"id":"CVE-2026-111755","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111755","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/follow-redirects/follow-redirects/commit/080a76d0e125b37bf81717368a61d5dc37aa56c8","https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1","https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-8r9p-f939-6h3c"],"description":"follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.1, escapeRegex leaves valid header-name metacharacters unescaped in sensitiveHeaders. When an application declares a sensitive header whose name contains ^ or | and follows a cross-origin or HTTPS-to-HTTP redirect, unescaped regular-expression metacharacters prevent the generated filter from matching the declared header name, and the credential header is forwarded to an attacker-controlled redirect target. This issue is fixed in version 1.16.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111755","epss":0.00471,"percentile":0.40769,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111755","cwe":"CWE-185","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-111755","cwe":"CWE-200","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"follow-redirects","version":"1.16.0"}},"found":{"vulnerabilityID":"GHSA-8r9p-f939-6h3c","versionConstraint":">=1.16.0,<1.16.1 (semantic)"},"fix":{"suggestedVersion":"1.16.1"}}],"artifact":{"id":"pkg:npm/follow-redirects@1.16.0?package-id=d07533023657bf9b","name":"follow-redirects","version":"1.16.0","type":"npm","locations":[{"path":"/sink/oidc-server/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:follow-redirects:follow_redirects:1.16.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/follow-redirects@1.16.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-8r9p-f939-6h3c","dataSource":"https://github.com/advisories/GHSA-8r9p-f939-6h3c","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-8r9p-f939-6h3c","https://nvd.nist.gov/vuln/detail/CVE-2026-111755","https://github.com/follow-redirects/follow-redirects/commit/080a76d0e125b37bf81717368a61d5dc37aa56c8","https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1"],"description":"follow-redirects sensitiveHeaders regex escaping can expose credential headers","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111755","epss":0.00471,"percentile":0.40769,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111755","cwe":"CWE-185","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-111755","cwe":"CWE-200","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["1.16.1"],"state":"fixed","available":[{"version":"1.16.1","date":"2026-10-21","kind":"first-observed"}]},"advisories":[],"risk":0.3697349999999999},"relatedVulnerabilities":[{"id":"CVE-2026-111755","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111755","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/follow-redirects/follow-redirects/commit/080a76d0e125b37bf81717368a61d5dc37aa56c8","https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1","https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-8r9p-f939-6h3c"],"description":"follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.1, escapeRegex leaves valid header-name metacharacters unescaped in sensitiveHeaders. When an application declares a sensitive header whose name contains ^ or | and follows a cross-origin or HTTPS-to-HTTP redirect, unescaped regular-expression metacharacters prevent the generated filter from matching the declared header name, and the credential header is forwarded to an attacker-controlled redirect target. This issue is fixed in version 1.16.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111755","epss":0.00471,"percentile":0.40769,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111755","cwe":"CWE-185","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-111755","cwe":"CWE-200","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"follow-redirects","version":"1.16.0"}},"found":{"vulnerabilityID":"GHSA-8r9p-f939-6h3c","versionConstraint":">=1.16.0,<1.16.1 (semantic)"},"fix":{"suggestedVersion":"1.16.1"}}],"artifact":{"id":"pkg:npm/follow-redirects@1.16.0?package-id=5844d5fd4e00c830","name":"follow-redirects","version":"1.16.0","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:follow-redirects:follow_redirects:1.16.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/follow-redirects@1.16.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-8r9p-f939-6h3c","dataSource":"https://github.com/advisories/GHSA-8r9p-f939-6h3c","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-8r9p-f939-6h3c","https://nvd.nist.gov/vuln/detail/CVE-2026-111755","https://github.com/follow-redirects/follow-redirects/commit/080a76d0e125b37bf81717368a61d5dc37aa56c8","https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1"],"description":"follow-redirects sensitiveHeaders regex escaping can expose credential headers","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111755","epss":0.00471,"percentile":0.40769,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111755","cwe":"CWE-185","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-111755","cwe":"CWE-200","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["1.16.1"],"state":"fixed","available":[{"version":"1.16.1","date":"2026-10-21","kind":"first-observed"}]},"advisories":[],"risk":0.3697349999999999},"relatedVulnerabilities":[{"id":"CVE-2026-111755","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111755","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/follow-redirects/follow-redirects/commit/080a76d0e125b37bf81717368a61d5dc37aa56c8","https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1","https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-8r9p-f939-6h3c"],"description":"follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.1, escapeRegex leaves valid header-name metacharacters unescaped in sensitiveHeaders. When an application declares a sensitive header whose name contains ^ or | and follows a cross-origin or HTTPS-to-HTTP redirect, unescaped regular-expression metacharacters prevent the generated filter from matching the declared header name, and the credential header is forwarded to an attacker-controlled redirect target. This issue is fixed in version 1.16.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111755","epss":0.00471,"percentile":0.40769,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111755","cwe":"CWE-185","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-111755","cwe":"CWE-200","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"follow-redirects","version":"1.16.0"}},"found":{"vulnerabilityID":"GHSA-8r9p-f939-6h3c","versionConstraint":">=1.16.0,<1.16.1 (semantic)"},"fix":{"suggestedVersion":"1.16.1"}}],"artifact":{"id":"pkg:npm/follow-redirects@1.16.0?package-id=343e29d6598af447","name":"follow-redirects","version":"1.16.0","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:follow-redirects:follow_redirects:1.16.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/follow-redirects@1.16.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-q3jh-wrc6-jgq8","dataSource":"https://github.com/advisories/GHSA-q3jh-wrc6-jgq8","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-q3jh-wrc6-jgq8","https://github.com/follow-redirects/follow-redirects/commit/9865ca45490e4d0f7b6944870318408344570aff","https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1"],"description":"follow-redirects array-form headers bypass cross-origin credential stripping","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111756","epss":0.00471,"percentile":0.40769,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111756","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-111756","cwe":"CWE-212","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.16.1"],"state":"fixed","available":[{"version":"1.16.1","date":"2026-10-21","kind":"first-observed"}]},"advisories":[],"risk":0.3697349999999999},"relatedVulnerabilities":[{"id":"CVE-2026-111756","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111756","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/follow-redirects/follow-redirects/commit/9865ca45490e4d0f7b6944870318408344570aff","https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1","https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-q3jh-wrc6-jgq8"],"description":"follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to before version 1.16.1, follow-redirects removes sensitive credential headers (Authorization, Proxy-Authorization, Cookie, and any caller-declared sensitiveHeaders) before following a redirect that crosses to a different host or downgrades to a less secure protocol. The removal routine iterates the caller's headers container with for...in and matches header names against a filter. This assumes the headers container is a plain object keyed by header names. Node's underlying http.request, which follow-redirects is a drop-in replacement for, also accepts headers as an alternating array of names and values. For an array, for...in yields the numeric indices \"0\", \"1\", \"2\" and so on, which never match a header-name filter, so nothing is removed. An application that sends array-form headers and follows an attacker-controlled cross-origin redirect therefore forwards its Authorization, Cookie, and Proxy-Authorization headers verbatim to the attacker-controlled destination, with no error or warning. The sensitiveHeaders option added to fix CVE-2026-40895 / GHSA-r4q5-vmmm-2653 is equally ineffective, because it relies on the same helper. This is an unauthenticated confidentiality vulnerability: any remote server the victim application contacts can harvest the victim's credential headers by responding with a cross-origin redirect. This issue has been patched in version 1.16.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111756","epss":0.00471,"percentile":0.40769,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111756","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-111756","cwe":"CWE-212","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"follow-redirects","version":"1.16.0"}},"found":{"vulnerabilityID":"GHSA-q3jh-wrc6-jgq8","versionConstraint":">=1.16.0,<1.16.1 (semantic)"},"fix":{"suggestedVersion":"1.16.1"}}],"artifact":{"id":"pkg:npm/follow-redirects@1.16.0?package-id=343e29d6598af447","name":"follow-redirects","version":"1.16.0","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:follow-redirects:follow_redirects:1.16.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/follow-redirects@1.16.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-q3jh-wrc6-jgq8","dataSource":"https://github.com/advisories/GHSA-q3jh-wrc6-jgq8","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-q3jh-wrc6-jgq8","https://github.com/follow-redirects/follow-redirects/commit/9865ca45490e4d0f7b6944870318408344570aff","https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1"],"description":"follow-redirects array-form headers bypass cross-origin credential stripping","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111756","epss":0.00471,"percentile":0.40769,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111756","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-111756","cwe":"CWE-212","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.16.1"],"state":"fixed","available":[{"version":"1.16.1","date":"2026-10-21","kind":"first-observed"}]},"advisories":[],"risk":0.3697349999999999},"relatedVulnerabilities":[{"id":"CVE-2026-111756","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111756","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/follow-redirects/follow-redirects/commit/9865ca45490e4d0f7b6944870318408344570aff","https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1","https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-q3jh-wrc6-jgq8"],"description":"follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to before version 1.16.1, follow-redirects removes sensitive credential headers (Authorization, Proxy-Authorization, Cookie, and any caller-declared sensitiveHeaders) before following a redirect that crosses to a different host or downgrades to a less secure protocol. The removal routine iterates the caller's headers container with for...in and matches header names against a filter. This assumes the headers container is a plain object keyed by header names. Node's underlying http.request, which follow-redirects is a drop-in replacement for, also accepts headers as an alternating array of names and values. For an array, for...in yields the numeric indices \"0\", \"1\", \"2\" and so on, which never match a header-name filter, so nothing is removed. An application that sends array-form headers and follows an attacker-controlled cross-origin redirect therefore forwards its Authorization, Cookie, and Proxy-Authorization headers verbatim to the attacker-controlled destination, with no error or warning. The sensitiveHeaders option added to fix CVE-2026-40895 / GHSA-r4q5-vmmm-2653 is equally ineffective, because it relies on the same helper. This is an unauthenticated confidentiality vulnerability: any remote server the victim application contacts can harvest the victim's credential headers by responding with a cross-origin redirect. This issue has been patched in version 1.16.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111756","epss":0.00471,"percentile":0.40769,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111756","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-111756","cwe":"CWE-212","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"follow-redirects","version":"1.16.0"}},"found":{"vulnerabilityID":"GHSA-q3jh-wrc6-jgq8","versionConstraint":">=1.16.0,<1.16.1 (semantic)"},"fix":{"suggestedVersion":"1.16.1"}}],"artifact":{"id":"pkg:npm/follow-redirects@1.16.0?package-id=d07533023657bf9b","name":"follow-redirects","version":"1.16.0","type":"npm","locations":[{"path":"/sink/oidc-server/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:follow-redirects:follow_redirects:1.16.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/follow-redirects@1.16.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-q3jh-wrc6-jgq8","dataSource":"https://github.com/advisories/GHSA-q3jh-wrc6-jgq8","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-q3jh-wrc6-jgq8","https://github.com/follow-redirects/follow-redirects/commit/9865ca45490e4d0f7b6944870318408344570aff","https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1"],"description":"follow-redirects array-form headers bypass cross-origin credential stripping","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111756","epss":0.00471,"percentile":0.40769,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111756","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-111756","cwe":"CWE-212","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.16.1"],"state":"fixed","available":[{"version":"1.16.1","date":"2026-10-21","kind":"first-observed"}]},"advisories":[],"risk":0.3697349999999999},"relatedVulnerabilities":[{"id":"CVE-2026-111756","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111756","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/follow-redirects/follow-redirects/commit/9865ca45490e4d0f7b6944870318408344570aff","https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1","https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-q3jh-wrc6-jgq8"],"description":"follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to before version 1.16.1, follow-redirects removes sensitive credential headers (Authorization, Proxy-Authorization, Cookie, and any caller-declared sensitiveHeaders) before following a redirect that crosses to a different host or downgrades to a less secure protocol. The removal routine iterates the caller's headers container with for...in and matches header names against a filter. This assumes the headers container is a plain object keyed by header names. Node's underlying http.request, which follow-redirects is a drop-in replacement for, also accepts headers as an alternating array of names and values. For an array, for...in yields the numeric indices \"0\", \"1\", \"2\" and so on, which never match a header-name filter, so nothing is removed. An application that sends array-form headers and follows an attacker-controlled cross-origin redirect therefore forwards its Authorization, Cookie, and Proxy-Authorization headers verbatim to the attacker-controlled destination, with no error or warning. The sensitiveHeaders option added to fix CVE-2026-40895 / GHSA-r4q5-vmmm-2653 is equally ineffective, because it relies on the same helper. This is an unauthenticated confidentiality vulnerability: any remote server the victim application contacts can harvest the victim's credential headers by responding with a cross-origin redirect. This issue has been patched in version 1.16.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111756","epss":0.00471,"percentile":0.40769,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111756","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-111756","cwe":"CWE-212","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"follow-redirects","version":"1.16.0"}},"found":{"vulnerabilityID":"GHSA-q3jh-wrc6-jgq8","versionConstraint":">=1.16.0,<1.16.1 (semantic)"},"fix":{"suggestedVersion":"1.16.1"}}],"artifact":{"id":"pkg:npm/follow-redirects@1.16.0?package-id=5844d5fd4e00c830","name":"follow-redirects","version":"1.16.0","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:follow-redirects:follow_redirects:1.16.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/follow-redirects@1.16.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-hwr6-493r-vm6h","dataSource":"https://github.com/advisories/GHSA-hwr6-493r-vm6h","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/fastify/fastify/security/advisories/GHSA-hwr6-493r-vm6h","https://nvd.nist.gov/vuln/detail/CVE-2026-84469","https://github.com/fastify/fastify/commit/7de6e81697778f9f41bd327a3b1c5c9a0d9637b4","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fastify/releases/tag/v5.12.2"],"description":"fastify vulnerable to request validation bypass via skipped boolean false schemas","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84469","epss":0.00492,"percentile":0.42298,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84469","cwe":"CWE-20","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["5.12.2"],"state":"fixed","available":[{"version":"5.12.2","date":"2026-10-01","kind":"first-observed"}]},"advisories":[],"risk":0.369},"relatedVulnerabilities":[{"id":"CVE-2026-84469","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84469","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fastify/security/advisories/GHSA-hwr6-493r-vm6h"],"description":"fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthiness, but JSON Schema Draft 7 defines the boolean false as a valid schema that rejects every instance. When an application assigns false to a route's body, querystring, params, or headers schema to deny all input, fastify treats it as a missing schema, compiles no validator, and runs the route handler on any request. An unauthenticated remote client can therefore reach a handler that a valid deny-all schema was intended to make unreachable, a complete validation bypass that can lead to unauthorized state changes or execution of disabled operations. Users should upgrade to fastify 5.12.2 or later.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84469","epss":0.00492,"percentile":0.42298,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84469","cwe":"CWE-20","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fastify","version":"5.8.5"}},"found":{"vulnerabilityID":"GHSA-hwr6-493r-vm6h","versionConstraint":"<5.12.2 (semantic)"},"fix":{"suggestedVersion":"5.12.2"}}],"artifact":{"id":"pkg:npm/fastify@5.8.5?package-id=72dfb6219c562dcc","name":"fastify","version":"5.8.5","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:fastify:fastify:5.8.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fastify@5.8.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-qhr7-859c-m2p7","dataSource":"https://github.com/advisories/GHSA-qhr7-859c-m2p7","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7","https://nvd.nist.gov/vuln/detail/CVE-2026-102278","https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db"],"description":"brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102278","epss":0.00491,"percentile":0.42217,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102278","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102278","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.1.20"],"state":"fixed","available":[{"version":"1.1.20","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.36825},"relatedVulnerabilities":[{"id":"CVE-2026-102278","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102278","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102278","epss":0.00491,"percentile":0.42217,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102278","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102278","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.14"}},"found":{"vulnerabilityID":"GHSA-qhr7-859c-m2p7","versionConstraint":"<1.1.20 (semantic)"},"fix":{"suggestedVersion":"1.1.20"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.14?package-id=fa326f252298de13","name":"brace-expansion","version":"1.1.14","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.14:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.14","upstreams":[]}},{"vulnerability":{"id":"GHSA-qhr7-859c-m2p7","dataSource":"https://github.com/advisories/GHSA-qhr7-859c-m2p7","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7","https://nvd.nist.gov/vuln/detail/CVE-2026-102278","https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db"],"description":"brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102278","epss":0.00491,"percentile":0.42217,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102278","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102278","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.1.20"],"state":"fixed","available":[{"version":"1.1.20","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.36825},"relatedVulnerabilities":[{"id":"CVE-2026-102278","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102278","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102278","epss":0.00491,"percentile":0.42217,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102278","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102278","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.14"}},"found":{"vulnerabilityID":"GHSA-qhr7-859c-m2p7","versionConstraint":"<1.1.20 (semantic)"},"fix":{"suggestedVersion":"1.1.20"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.14?package-id=e9bc4db499821f08","name":"brace-expansion","version":"1.1.14","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.14:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.14","upstreams":[]}},{"vulnerability":{"id":"GHSA-qhr7-859c-m2p7","dataSource":"https://github.com/advisories/GHSA-qhr7-859c-m2p7","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7","https://nvd.nist.gov/vuln/detail/CVE-2026-102278","https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db"],"description":"brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102278","epss":0.00491,"percentile":0.42217,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102278","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102278","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.1.6"],"state":"fixed","available":[{"version":"2.1.6","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.36825},"relatedVulnerabilities":[{"id":"CVE-2026-102278","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102278","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102278","epss":0.00491,"percentile":0.42217,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102278","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102278","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"2.1.0"}},"found":{"vulnerabilityID":"GHSA-qhr7-859c-m2p7","versionConstraint":">=2.0.0,<2.1.6 (semantic)"},"fix":{"suggestedVersion":"2.1.6"}}],"artifact":{"id":"pkg:npm/brace-expansion@2.1.0?package-id=5b11ade77bad45b9","name":"brace-expansion","version":"2.1.0","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:2.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@2.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-qhr7-859c-m2p7","dataSource":"https://github.com/advisories/GHSA-qhr7-859c-m2p7","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7","https://nvd.nist.gov/vuln/detail/CVE-2026-102278","https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db"],"description":"brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102278","epss":0.00491,"percentile":0.42217,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102278","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102278","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["5.0.11"],"state":"fixed","available":[{"version":"5.0.11","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.36825},"relatedVulnerabilities":[{"id":"CVE-2026-102278","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102278","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102278","epss":0.00491,"percentile":0.42217,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102278","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102278","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"5.0.9"}},"found":{"vulnerabilityID":"GHSA-qhr7-859c-m2p7","versionConstraint":">=4.0.0,<5.0.11 (semantic)"},"fix":{"suggestedVersion":"5.0.11"}}],"artifact":{"id":"pkg:npm/brace-expansion@5.0.9?package-id=2a3f60339f328dc4","name":"brace-expansion","version":"5.0.9","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:5.0.9:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@5.0.9","upstreams":[]}},{"vulnerability":{"id":"GO-2026-6617","dataSource":"https://go.dev/cl/847188","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/cl/847313","https://go.dev/issue/81867","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"],"description":"HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-97032","epss":0.0049,"percentile":0.42162,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-97032","cwe":"CWE-362","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.60.0"],"state":"fixed","available":[{"version":"0.60.0","date":"2026-10-08","kind":"release"}]},"advisories":[],"risk":0.3675},"relatedVulnerabilities":[{"id":"CVE-2026-97032","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97032","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/847188","https://go.dev/cl/847313","https://go.dev/issue/81867","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://pkg.go.dev/vuln/GO-2026-6617"],"description":"HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-97032","epss":0.0049,"percentile":0.42162,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-97032","cwe":"CWE-362","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.56.0"}},"found":{"vulnerabilityID":"GO-2026-6617","versionConstraint":"<0.60.0 (go)"},"fix":{"suggestedVersion":"0.60.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.56.0?package-id=ab49808757d6d4dc","name":"golang.org/x/net","version":"v0.56.0","type":"go-module","locations":[{"path":"/backend-go/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.56.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.56.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.56.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o="}}},{"vulnerability":{"id":"GHSA-x94g-w73q-hpcw","dataSource":"https://github.com/advisories/GHSA-x94g-w73q-hpcw","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/DataDog/dd-trace-js/security/advisories/GHSA-x94g-w73q-hpcw","https://github.com/DataDog/dd-trace-js/pull/10675","https://github.com/DataDog/dd-trace-js/commit/5eeee790c93036a50549056fc890028cb4c86b1b","https://github.com/DataDog/dd-trace-js/commit/cf4e68a45fa1442c9850f2086c81901258e821b8","https://github.com/DataDog/dd-trace-js/releases/tag/v5.131.1","https://github.com/DataDog/dd-trace-js/releases/tag/v6.20.1"],"description":"dd-trace: ReDOS in URL query string obfuscation","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-116693","epss":0.00449,"percentile":0.39042,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-116693","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["5.131.1"],"state":"fixed","available":[{"version":"5.131.1","date":"2026-10-28","kind":"first-observed"}]},"advisories":[],"risk":0.36368999999999996},"relatedVulnerabilities":[{"id":"CVE-2026-116693","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116693","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/DataDog/dd-trace-js/commit/5eeee790c93036a50549056fc890028cb4c86b1b","https://github.com/DataDog/dd-trace-js/commit/cf4e68a45fa1442c9850f2086c81901258e821b8","https://github.com/DataDog/dd-trace-js/pull/10675","https://github.com/DataDog/dd-trace-js/releases/tag/v5.131.1","https://github.com/DataDog/dd-trace-js/releases/tag/v6.20.1","https://github.com/DataDog/dd-trace-js/security/advisories/GHSA-x94g-w73q-hpcw"],"description":"dd-trace is the Datadog APM client for Node.js. From 2.0.0 until 5.131.1 and 6.20.1, the default DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP can perform excessive backtracking on attacker-controlled URL query strings. The expression is applied synchronously while recording HTTP URL metadata, allowing a crafted request to consume excessive CPU, stall request processing, and make the instrumented application unavailable. This issue is fixed in versions 5.131.1 and 6.20.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-116693","epss":0.00449,"percentile":0.39042,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-116693","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"dd-trace","version":"5.129.0"}},"found":{"vulnerabilityID":"GHSA-x94g-w73q-hpcw","versionConstraint":">=2.0.0,<5.131.1 (semantic)"},"fix":{"suggestedVersion":"5.131.1"}}],"artifact":{"id":"pkg:npm/dd-trace@5.129.0?package-id=2db76be3f4c68c82","name":"dd-trace","version":"5.129.0","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["Apache-2.0 OR BSD-3-Clause"],"cpes":["cpe:2.3:a:dd-trace:dd-trace:5.129.0:*:*:*:*:*:*:*","cpe:2.3:a:dd-trace:dd_trace:5.129.0:*:*:*:*:*:*:*","cpe:2.3:a:dd_trace:dd-trace:5.129.0:*:*:*:*:*:*:*","cpe:2.3:a:dd_trace:dd_trace:5.129.0:*:*:*:*:*:*:*","cpe:2.3:a:dd:dd-trace:5.129.0:*:*:*:*:*:*:*","cpe:2.3:a:dd:dd_trace:5.129.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/dd-trace@5.129.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-89xv-2m56-2m9x","dataSource":"https://github.com/advisories/GHSA-89xv-2m56-2m9x","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x","https://github.com/vercel/next.js/commit/b51206321854193208c0805ba42acc49287f942b","https://github.com/vercel/next.js/commit/e3e5666ccead3a15162793d697af5e48b7cc0498","https://github.com/vercel/next.js/releases/tag/v15.5.21","https://github.com/vercel/next.js/releases/tag/v16.2.11"],"description":"Next.js: Server-Side Request Forgery in Server Actions on custom servers","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-64649","epss":0.00459,"percentile":0.3981,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-64649","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["16.2.11"],"state":"fixed","available":[{"version":"16.2.11","date":"2026-07-23","kind":"first-observed"}]},"advisories":[],"risk":0.36261000000000004},"relatedVulnerabilities":[{"id":"CVE-2026-64649","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64649","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/vercel/next.js/commit/b51206321854193208c0805ba42acc49287f942b","https://github.com/vercel/next.js/commit/e3e5666ccead3a15162793d697af5e48b7cc0498","https://github.com/vercel/next.js/releases/tag/v15.5.21","https://github.com/vercel/next.js/releases/tag/v16.2.11","https://github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x"],"description":"Next.js is a React framework for building full-stack web applications. In versions 14.1.1 through 15.5.20 and 16.0.0 through 16.2.10, when a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host (Server-Side Request Forgery). This requires the attacker's request to control Host-associated headers. In some configurations, it's also possible to obtain internal values that weaken middleware/proxy authorization. Applications that use Server Actions are affected when the incoming host header is not fixed to a trusted value. This typically occurs on custom servers, or on deployments not behind a proxy that pins the host. Managed hosting pins the host upstream and is not affected; next start and standalone output do the same from version 14.2 onward. This issue has been fixed in versions 15.5.21 and 16.2.11.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-64649","epss":0.00459,"percentile":0.3981,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-64649","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"next","version":"16.1.7"}},"found":{"vulnerabilityID":"GHSA-89xv-2m56-2m9x","versionConstraint":">=16.0.0,<16.2.11 (semantic)"},"fix":{"suggestedVersion":"16.2.11"}}],"artifact":{"id":"pkg:npm/next@16.1.7?package-id=662de087d22e519d","name":"next","version":"16.1.7","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vercel:next.js:16.1.7:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/next@16.1.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-mghh-pgcx-3jjj","dataSource":"https://github.com/advisories/GHSA-mghh-pgcx-3jjj","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-mghh-pgcx-3jjj","https://nvd.nist.gov/vuln/detail/CVE-2026-101906","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/releases/tag/v1.20.0"],"description":"Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101906","epss":0.00457,"percentile":0.39684,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101906","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-101906","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.20.0"],"state":"fixed","available":[{"version":"1.20.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.358745},"relatedVulnerabilities":[{"id":"CVE-2026-101906","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101906","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/axios/axios/security/advisories/GHSA-mghh-pgcx-3jjj"],"description":"Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy applies a quadratic trailing-dot regular expression to redirect hostnames. HTTP_PROXY or HTTPS_PROXY is configured, NO_PROXY or no_proxy is non-empty, redirects are followed, and a crafted redirect Location contains many dots followed by a non-dot character. Hostname.replace(/.+$/, '') backtracks quadratically while processing the crafted redirect hostname. Synchronous regular-expression processing can block the Node.js event loop and cause denial of service. This issue is fixed in version 1.20.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101906","epss":0.00457,"percentile":0.39684,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101906","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-101906","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.15.0"}},"found":{"vulnerabilityID":"GHSA-mghh-pgcx-3jjj","versionConstraint":">=1.15.0,<1.20.0 (semantic)"},"fix":{"suggestedVersion":"1.20.0"}}],"artifact":{"id":"pkg:npm/axios@1.15.0?package-id=520b8e92ffff8054","name":"axios","version":"1.15.0","type":"npm","locations":[{"path":"/sink/oidc-server/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.15.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.15.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-mghh-pgcx-3jjj","dataSource":"https://github.com/advisories/GHSA-mghh-pgcx-3jjj","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-mghh-pgcx-3jjj","https://nvd.nist.gov/vuln/detail/CVE-2026-101906","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/releases/tag/v1.20.0"],"description":"Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101906","epss":0.00457,"percentile":0.39684,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101906","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-101906","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.20.0"],"state":"fixed","available":[{"version":"1.20.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.358745},"relatedVulnerabilities":[{"id":"CVE-2026-101906","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101906","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/axios/axios/security/advisories/GHSA-mghh-pgcx-3jjj"],"description":"Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy applies a quadratic trailing-dot regular expression to redirect hostnames. HTTP_PROXY or HTTPS_PROXY is configured, NO_PROXY or no_proxy is non-empty, redirects are followed, and a crafted redirect Location contains many dots followed by a non-dot character. Hostname.replace(/.+$/, '') backtracks quadratically while processing the crafted redirect hostname. Synchronous regular-expression processing can block the Node.js event loop and cause denial of service. This issue is fixed in version 1.20.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101906","epss":0.00457,"percentile":0.39684,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101906","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-101906","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.16.1"}},"found":{"vulnerabilityID":"GHSA-mghh-pgcx-3jjj","versionConstraint":">=1.15.0,<1.20.0 (semantic)"},"fix":{"suggestedVersion":"1.20.0"}}],"artifact":{"id":"pkg:npm/axios@1.16.1?package-id=8545c428c207f9fb","name":"axios","version":"1.16.1","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.16.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.16.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-mghh-pgcx-3jjj","dataSource":"https://github.com/advisories/GHSA-mghh-pgcx-3jjj","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-mghh-pgcx-3jjj","https://nvd.nist.gov/vuln/detail/CVE-2026-101906","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/releases/tag/v1.20.0"],"description":"Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101906","epss":0.00457,"percentile":0.39684,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101906","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-101906","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.20.0"],"state":"fixed","available":[{"version":"1.20.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.358745},"relatedVulnerabilities":[{"id":"CVE-2026-101906","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101906","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/axios/axios/security/advisories/GHSA-mghh-pgcx-3jjj"],"description":"Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy applies a quadratic trailing-dot regular expression to redirect hostnames. HTTP_PROXY or HTTPS_PROXY is configured, NO_PROXY or no_proxy is non-empty, redirects are followed, and a crafted redirect Location contains many dots followed by a non-dot character. Hostname.replace(/.+$/, '') backtracks quadratically while processing the crafted redirect hostname. Synchronous regular-expression processing can block the Node.js event loop and cause denial of service. This issue is fixed in version 1.20.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101906","epss":0.00457,"percentile":0.39684,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101906","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-101906","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.18.1"}},"found":{"vulnerabilityID":"GHSA-mghh-pgcx-3jjj","versionConstraint":">=1.15.0,<1.20.0 (semantic)"},"fix":{"suggestedVersion":"1.20.0"}}],"artifact":{"id":"pkg:npm/axios@1.18.1?package-id=1350ab3e8bd97544","name":"axios","version":"1.18.1","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.18.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.18.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-3w6x-2g7m-8v23","dataSource":"https://github.com/advisories/GHSA-3w6x-2g7m-8v23","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-3w6x-2g7m-8v23","https://nvd.nist.gov/vuln/detail/CVE-2026-42044"],"description":"Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.3,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42044","epss":0.00618,"percentile":0.49617,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42044","cwe":"CWE-915","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-42044","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-42044","cwe":"CWE-915","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["1.15.2"],"state":"fixed","available":[{"version":"1.15.2","date":"2026-05-05","kind":"first-observed"}]},"advisories":[],"risk":0.35534999999999994},"relatedVulnerabilities":[{"id":"CVE-2026-42044","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42044","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/axios/axios/security/advisories/GHSA-3w6x-2g7m-8v23","https://access.redhat.com/errata/RHSA-2026:16532","https://access.redhat.com/errata/RHSA-2026:16534","https://access.redhat.com/errata/RHSA-2026:16535","https://access.redhat.com/errata/RHSA-2026:16542","https://access.redhat.com/errata/RHSA-2026:17657","https://access.redhat.com/errata/RHSA-2026:17699","https://access.redhat.com/errata/RHSA-2026:19109","https://access.redhat.com/errata/RHSA-2026:19375","https://access.redhat.com/errata/RHSA-2026:20338","https://access.redhat.com/errata/RHSA-2026:20454","https://access.redhat.com/errata/RHSA-2026:20889","https://access.redhat.com/errata/RHSA-2026:20938","https://access.redhat.com/errata/RHSA-2026:21017","https://access.redhat.com/errata/RHSA-2026:21338","https://access.redhat.com/errata/RHSA-2026:21772","https://access.redhat.com/errata/RHSA-2026:22465","https://access.redhat.com/errata/RHSA-2026:22629","https://access.redhat.com/errata/RHSA-2026:22840","https://access.redhat.com/errata/RHSA-2026:23361","https://access.redhat.com/errata/RHSA-2026:24471","https://access.redhat.com/errata/RHSA-2026:24473","https://access.redhat.com/errata/RHSA-2026:24536","https://access.redhat.com/errata/RHSA-2026:24539","https://access.redhat.com/errata/RHSA-2026:24853","https://access.redhat.com/errata/RHSA-2026:25041","https://access.redhat.com/errata/RHSA-2026:25089","https://access.redhat.com/errata/RHSA-2026:25271","https://access.redhat.com/errata/RHSA-2026:25273","https://access.redhat.com/errata/RHSA-2026:26214","https://access.redhat.com/errata/RHSA-2026:26225","https://access.redhat.com/errata/RHSA-2026:26232","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:36107","https://access.redhat.com/errata/RHSA-2026:36882","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:42078","https://access.redhat.com/errata/RHSA-2026:50300","https://access.redhat.com/security/cve/CVE-2026-42044","https://bugzilla.redhat.com/show_bug.cgi?id=2461624","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42044.json"],"description":"Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.2, he Axios library is vulnerable to a Prototype Pollution \"Gadget\" attack that allows any Object.prototype pollution in the application's dependency tree to be escalated into surgical, invisible modification of all JSON API responses — including privilege escalation, balance manipulation, and authorization bypass. The default transformResponse function at lib/defaults/index.js:124 calls JSON.parse(data, this.parseReviver), where this is the merged config object. Because parseReviver is not present in Axios defaults, not validated by assertOptions, and not subject to any constraints, a polluted Object.prototype.parseReviver function is called for every key-value pair in every JSON response, allowing the attacker to selectively modify individual values while leaving the rest of the response intact. This vulnerability is fixed in 1.15.2.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.3,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42044","epss":0.00618,"percentile":0.49617,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42044","cwe":"CWE-915","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-42044","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-42044","cwe":"CWE-915","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.15.0"}},"found":{"vulnerabilityID":"GHSA-3w6x-2g7m-8v23","versionConstraint":">=1.0.0,<1.15.2 (semantic)"},"fix":{"suggestedVersion":"1.15.2"}}],"artifact":{"id":"pkg:npm/axios@1.15.0?package-id=520b8e92ffff8054","name":"axios","version":"1.15.0","type":"npm","locations":[{"path":"/sink/oidc-server/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.15.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.15.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-68fv-2mgg-jv7q","dataSource":"https://github.com/advisories/GHSA-68fv-2mgg-jv7q","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-93749","https://github.com/7rulnik/source-map-js/issues/76","https://github.com/7rulnik/source-map-js","https://github.com/7rulnik/source-map-js/blob/c1cd8904bb7bd0c7fb5879fcda48134d82a27934/lib/source-node.js#L115-L118","https://www.vulncheck.com/advisories/source-map-js-through-1.2.1-event-loop-denial-of-service","https://github.com/7rulnik/source-map-js/pull/79","https://github.com/7rulnik/source-map-js/commit/cf7658058ceeaa8619d5ae0ec90be6905209d016","https://github.com/7rulnik/source-map-js/releases/tag/v1.2.2"],"description":"source-map-js allows event-loop denial of service through indexed source-map section offsets","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-93749","epss":0.00455,"percentile":0.3952,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-93749","cwe":"CWE-1284","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["1.2.2"],"state":"fixed","available":[{"version":"1.2.2","date":"2026-10-06","kind":"first-observed"}]},"advisories":[],"risk":0.35490000000000005},"relatedVulnerabilities":[{"id":"CVE-2026-93749","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93749","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/7rulnik/source-map-js","https://github.com/7rulnik/source-map-js/blob/c1cd8904bb7bd0c7fb5879fcda48134d82a27934/lib/source-node.js#L115-L118","https://github.com/7rulnik/source-map-js/issues/76","https://www.vulncheck.com/advisories/source-map-js-through-1.2.1-event-loop-denial-of-service"],"description":"source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the service from handling other requests.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-93749","epss":0.00455,"percentile":0.3952,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-93749","cwe":"CWE-1284","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"source-map-js","version":"1.2.1"}},"found":{"vulnerabilityID":"GHSA-68fv-2mgg-jv7q","versionConstraint":">=1.0.0,<1.2.2 (semantic)"},"fix":{"suggestedVersion":"1.2.2"}}],"artifact":{"id":"pkg:npm/source-map-js@1.2.1?package-id=2e74af622fb4e93a","name":"source-map-js","version":"1.2.1","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:source-map-js:source-map-js:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:source-map-js:source_map_js:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:source_map_js:source-map-js:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:source_map_js:source_map_js:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:source-map:source-map-js:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:source-map:source_map_js:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:source_map:source-map-js:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:source_map:source_map_js:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:source:source-map-js:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:source:source_map_js:1.2.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/source-map-js@1.2.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-68fv-2mgg-jv7q","dataSource":"https://github.com/advisories/GHSA-68fv-2mgg-jv7q","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-93749","https://github.com/7rulnik/source-map-js/issues/76","https://github.com/7rulnik/source-map-js","https://github.com/7rulnik/source-map-js/blob/c1cd8904bb7bd0c7fb5879fcda48134d82a27934/lib/source-node.js#L115-L118","https://www.vulncheck.com/advisories/source-map-js-through-1.2.1-event-loop-denial-of-service","https://github.com/7rulnik/source-map-js/pull/79","https://github.com/7rulnik/source-map-js/commit/cf7658058ceeaa8619d5ae0ec90be6905209d016","https://github.com/7rulnik/source-map-js/releases/tag/v1.2.2"],"description":"source-map-js allows event-loop denial of service through indexed source-map section offsets","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-93749","epss":0.00455,"percentile":0.3952,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-93749","cwe":"CWE-1284","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["1.2.2"],"state":"fixed","available":[{"version":"1.2.2","date":"2026-10-06","kind":"first-observed"}]},"advisories":[],"risk":0.35490000000000005},"relatedVulnerabilities":[{"id":"CVE-2026-93749","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93749","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/7rulnik/source-map-js","https://github.com/7rulnik/source-map-js/blob/c1cd8904bb7bd0c7fb5879fcda48134d82a27934/lib/source-node.js#L115-L118","https://github.com/7rulnik/source-map-js/issues/76","https://www.vulncheck.com/advisories/source-map-js-through-1.2.1-event-loop-denial-of-service"],"description":"source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the service from handling other requests.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-93749","epss":0.00455,"percentile":0.3952,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-93749","cwe":"CWE-1284","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"source-map-js","version":"1.2.1"}},"found":{"vulnerabilityID":"GHSA-68fv-2mgg-jv7q","versionConstraint":">=1.0.0,<1.2.2 (semantic)"},"fix":{"suggestedVersion":"1.2.2"}}],"artifact":{"id":"pkg:npm/source-map-js@1.2.1?package-id=bac00b4de389b96c","name":"source-map-js","version":"1.2.1","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:source-map-js:source-map-js:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:source-map-js:source_map_js:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:source_map_js:source-map-js:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:source_map_js:source_map_js:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:source-map:source-map-js:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:source-map:source_map_js:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:source_map:source-map-js:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:source_map:source_map_js:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:source:source-map-js:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:source:source_map_js:1.2.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/source-map-js@1.2.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-68fv-2mgg-jv7q","dataSource":"https://github.com/advisories/GHSA-68fv-2mgg-jv7q","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-93749","https://github.com/7rulnik/source-map-js/issues/76","https://github.com/7rulnik/source-map-js","https://github.com/7rulnik/source-map-js/blob/c1cd8904bb7bd0c7fb5879fcda48134d82a27934/lib/source-node.js#L115-L118","https://www.vulncheck.com/advisories/source-map-js-through-1.2.1-event-loop-denial-of-service","https://github.com/7rulnik/source-map-js/pull/79","https://github.com/7rulnik/source-map-js/commit/cf7658058ceeaa8619d5ae0ec90be6905209d016","https://github.com/7rulnik/source-map-js/releases/tag/v1.2.2"],"description":"source-map-js allows event-loop denial of service through indexed source-map section offsets","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-93749","epss":0.00455,"percentile":0.3952,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-93749","cwe":"CWE-1284","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["1.2.2"],"state":"fixed","available":[{"version":"1.2.2","date":"2026-10-06","kind":"first-observed"}]},"advisories":[],"risk":0.35490000000000005},"relatedVulnerabilities":[{"id":"CVE-2026-93749","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93749","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/7rulnik/source-map-js","https://github.com/7rulnik/source-map-js/blob/c1cd8904bb7bd0c7fb5879fcda48134d82a27934/lib/source-node.js#L115-L118","https://github.com/7rulnik/source-map-js/issues/76","https://www.vulncheck.com/advisories/source-map-js-through-1.2.1-event-loop-denial-of-service"],"description":"source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the service from handling other requests.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-93749","epss":0.00455,"percentile":0.3952,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-93749","cwe":"CWE-1284","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"source-map-js","version":"1.2.1"}},"found":{"vulnerabilityID":"GHSA-68fv-2mgg-jv7q","versionConstraint":">=1.0.0,<1.2.2 (semantic)"},"fix":{"suggestedVersion":"1.2.2"}}],"artifact":{"id":"pkg:npm/source-map-js@1.2.1?package-id=8fe9f161f3323196","name":"source-map-js","version":"1.2.1","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:source-map-js:source-map-js:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:source-map-js:source_map_js:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:source_map_js:source-map-js:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:source_map_js:source_map_js:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:source-map:source-map-js:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:source-map:source_map_js:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:source_map:source-map-js:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:source_map:source_map_js:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:source:source-map-js:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:source:source_map_js:1.2.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/source-map-js@1.2.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-f2ph-cmg5-wxc8","dataSource":"https://github.com/advisories/GHSA-f2ph-cmg5-wxc8","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/storybookjs/storybook/security/advisories/GHSA-f2ph-cmg5-wxc8","https://github.com/storybookjs/storybook/pull/36726","https://github.com/storybookjs/storybook/commit/243c06bf8f1e2f09446c44868ea100261e1374da","https://github.com/storybookjs/storybook/commit/3be03ec6f11f4616471cebc3fc65c13e1bf8c178","https://github.com/storybookjs/storybook/commit/a9ef9345d73224c73e0b81dc2701ec5b465ea9bb","https://github.com/storybookjs/storybook/commit/d9b09e332510a88689c71ecc081bbbc2d072476e","https://github.com/storybookjs/storybook/commit/df3fed468c9b4830605f00068c4bc6b7e1e215ed","https://github.com/storybookjs/storybook/releases/tag/v10.6.2","https://github.com/storybookjs/storybook/releases/tag/v11.0.0-alpha.6","https://github.com/storybookjs/storybook/releases/tag/v8.6.19","https://github.com/storybookjs/storybook/releases/tag/v9.1.21"],"description":"Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","metrics":{"baseScore":9.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-114125","epss":0.00385,"percentile":0.3257,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-114125","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-114125","cwe":"CWE-346","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-114125","cwe":"CWE-1021","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["10.6.2"],"state":"fixed","available":[{"version":"10.6.2","date":"2026-10-22","kind":"first-observed"}]},"advisories":[],"risk":0.35420000000000007},"relatedVulnerabilities":[{"id":"CVE-2026-114125","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114125","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/storybookjs/storybook/commit/243c06bf8f1e2f09446c44868ea100261e1374da","https://github.com/storybookjs/storybook/commit/3be03ec6f11f4616471cebc3fc65c13e1bf8c178","https://github.com/storybookjs/storybook/commit/97513d999910d071c2b36830495dab63e17d9fe0","https://github.com/storybookjs/storybook/commit/d9b09e332510a88689c71ecc081bbbc2d072476e","https://github.com/storybookjs/storybook/commit/df3fed468c9b4830605f00068c4bc6b7e1e215ed","https://github.com/storybookjs/storybook/pull/36726","https://github.com/storybookjs/storybook/releases/tag/v10.6.2","https://github.com/storybookjs/storybook/releases/tag/v11.0.0-alpha.6","https://github.com/storybookjs/storybook/releases/tag/v8.6.19","https://github.com/storybookjs/storybook/releases/tag/v9.1.21","https://github.com/storybookjs/storybook/security/advisories/GHSA-f2ph-cmg5-wxc8"],"description":"Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook development server. Insufficient iframe embedding and message-origin restrictions can allow attacker-controlled events to reach the running preview. A developer must visit the malicious website and interact with the injected interface. The attack can cause unauthorized changes to story files and, if a changed file is later executed by a local runtime, arbitrary code execution with the developer's privileges. This issue is fixed in 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-114125","epss":0.00385,"percentile":0.3257,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-114125","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-114125","cwe":"CWE-346","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-114125","cwe":"CWE-1021","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"storybook","version":"10.3.6"}},"found":{"vulnerabilityID":"GHSA-f2ph-cmg5-wxc8","versionConstraint":">=10.0.0,<10.6.2 (semantic)"},"fix":{"suggestedVersion":"10.6.2"}}],"artifact":{"id":"pkg:npm/storybook@10.3.6?package-id=b959d3df36e335bc","name":"storybook","version":"10.3.6","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:storybook:storybook:10.3.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/storybook@10.3.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-mwp4-54f8-5fhr","dataSource":"https://github.com/advisories/GHSA-mwp4-54f8-5fhr","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-mwp4-54f8-5fhr","https://github.com/beaugunderson/ip-address/commit/56368cb3d66c73ba0ee9b6b834fd31b22c2fd71e","https://github.com/beaugunderson/ip-address/releases/tag/v10.3.1"],"description":"ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69192","epss":0.00465,"percentile":0.40276,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69192","cwe":"CWE-20","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69192","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["10.3.1"],"state":"fixed","available":[{"version":"10.3.1","date":"2026-08-04","kind":"first-observed"}]},"advisories":[],"risk":0.3534},"relatedVulnerabilities":[{"id":"CVE-2026-69192","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-69192","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/beaugunderson/ip-address/commit/56368cb3d66c73ba0ee9b6b834fd31b22c2fd71e","https://github.com/beaugunderson/ip-address/releases/tag/v10.3.1","https://github.com/beaugunderson/ip-address/security/advisories/GHSA-mwp4-54f8-5fhr"],"description":"ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.3.1, Address4 accepts an octet written with a leading zero and decodes it as decimal, while the WHATWG URL host parser, inet_aton, and getaddrinfo all decode a leading zero as octal. The library and the network stack therefore disagree about which host a string names. new Address4('012.0.0.1') reports correctForm() of 12.0.0.1 and isPrivate() of false, but fetch('http://012.0.0.1/') connects to 10.0.0.1. An application that builds a network trust-boundary decision on these checks, for example a filter intended to block Server-Side Request Forgery, or SSRF, will classify an internal target as external and allow the request. The defect is in the parse gate rather than in any one classifier, so every consumer of Address4 inherits it: isPrivate(), isLoopback(), isLinkLocal(), isCGNAT(), isInSubnet(), isHostInSubnet(), and correctForm() are all computed from the mis-decoded octets. This issue is fixed in version 10.3.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69192","epss":0.00465,"percentile":0.40276,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69192","cwe":"CWE-20","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69192","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"ip-address","version":"10.1.0"}},"found":{"vulnerabilityID":"GHSA-mwp4-54f8-5fhr","versionConstraint":"<=10.3.0 (semantic)"},"fix":{"suggestedVersion":"10.3.1"}}],"artifact":{"id":"pkg:npm/ip-address@10.1.0?package-id=d0c928307aa7dbe2","name":"ip-address","version":"10.1.0","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:beaugunderson:ip-address:10.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/ip-address@10.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-58qx-3vcg-4xpx","dataSource":"https://github.com/advisories/GHSA-58qx-3vcg-4xpx","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/websockets/ws/security/advisories/GHSA-58qx-3vcg-4xpx","https://nvd.nist.gov/vuln/detail/CVE-2026-45736","https://github.com/websockets/ws/commit/c0327ec15a54d701eb6ccefaa8bef328cfc03086"],"description":"ws: Uninitialized memory disclosure","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.4,"exploitabilityScore":0.8,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-45736","epss":0.00745,"percentile":0.54803,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-45736","cwe":"CWE-908","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-45736","cwe":"CWE-824","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["8.20.1"],"state":"fixed","available":[{"version":"8.20.1","date":"2026-05-19","kind":"first-observed"}]},"advisories":[],"risk":0.35015},"relatedVulnerabilities":[{"id":"CVE-2026-45736","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45736","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/websockets/ws/commit/c0327ec15a54d701eb6ccefaa8bef328cfc03086","https://github.com/websockets/ws/security/advisories/GHSA-58qx-3vcg-4xpx","https://access.redhat.com/errata/RHSA-2026:26638","https://access.redhat.com/errata/RHSA-2026:26994","https://access.redhat.com/errata/RHSA-2026:27171","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:34374","https://access.redhat.com/errata/RHSA-2026:36754","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37272","https://access.redhat.com/errata/RHSA-2026:40768","https://access.redhat.com/errata/RHSA-2026:40792","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:44235","https://access.redhat.com/errata/RHSA-2026:44263","https://access.redhat.com/errata/RHSA-2026:44267","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:48693","https://access.redhat.com/errata/RHSA-2026:56366","https://access.redhat.com/errata/RHSA-2026:56431","https://access.redhat.com/errata/RHSA-2026:56928","https://access.redhat.com/errata/RHSA-2026:57013","https://access.redhat.com/errata/RHSA-2026:57590","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/errata/RHSA-2026:7655","https://access.redhat.com/security/cve/CVE-2026-45736","https://bugzilla.redhat.com/show_bug.cgi?id=2477914","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45736.json"],"description":"ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.4,"exploitabilityScore":0.8,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-45736","epss":0.00745,"percentile":0.54803,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-45736","cwe":"CWE-908","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-45736","cwe":"CWE-824","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"ws","version":"8.20.0"}},"found":{"vulnerabilityID":"GHSA-58qx-3vcg-4xpx","versionConstraint":">=8.0.0,<8.20.1 (semantic)"},"fix":{"suggestedVersion":"8.20.1"}}],"artifact":{"id":"pkg:npm/ws@8.20.0?package-id=3efe55bdcc2b3e36","name":"ws","version":"8.20.0","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:ws_project:ws:8.20.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/ws@8.20.0","upstreams":[]}},{"vulnerability":{"id":"GO-2026-6629","dataSource":"https://go.dev/cl/793360","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/issue/80112"],"description":"The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-56851","epss":0.00466,"percentile":0.40322,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-56851","cwe":"CWE-787","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.41.0"],"state":"fixed","available":[{"version":"0.41.0","date":"2026-08-11","kind":"release"}]},"advisories":[],"risk":0.3495},"relatedVulnerabilities":[{"id":"CVE-2026-56851","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56851","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/793360","https://go.dev/issue/80112","https://pkg.go.dev/vuln/GO-2026-6629"],"description":"The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-56851","epss":0.00466,"percentile":0.40322,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-56851","cwe":"CWE-787","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/text","version":"v0.39.0"}},"found":{"vulnerabilityID":"GO-2026-6629","versionConstraint":"<0.41.0 (go)"},"fix":{"suggestedVersion":"0.41.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/text@v0.39.0?package-id=81dde97f9741b1b0","name":"golang.org/x/text","version":"v0.39.0","type":"go-module","locations":[{"path":"/backend-go/go.mod","accessPath":""}],"language":"go","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:golang:text:v0.39.0:*:*:*:*:*:*:*"],"purl":"pkg:golang/golang.org/x/text@v0.39.0","upstreams":[],"metadataType":"GolangSourceMetadata","metadata":{"h1Digest":"h1:UbZz4pLOvn600D6Oh6GGEI6VAmndrEBLv8/6BEXzyus=","os":"linux","architecture":"amd64","cgoEnabled":true}}},{"vulnerability":{"id":"GHSA-mwf2-3pr3-8698","dataSource":"https://github.com/advisories/GHSA-mwf2-3pr3-8698","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-mwf2-3pr3-8698","https://github.com/axios/axios/pull/11000","https://github.com/axios/axios/commit/32fc489632377d214db55bfa4e2c48486a7d7ce2","https://github.com/axios/axios/releases/tag/v1.18.0","https://nvd.nist.gov/vuln/detail/CVE-2026-67318","https://nvd.nist.gov/vuln/detail/CVE-2026-68948"],"description":"Axios: HTTP/2 streamed uploads bypass `maxBodyLength`","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67318","epss":0.00616,"percentile":0.49543,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67318","cwe":"CWE-400","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["1.18.0"],"state":"fixed","available":[{"version":"1.18.0","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.34803999999999996},"relatedVulnerabilities":[{"id":"CVE-2026-67318","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-67318","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-mwf2-3pr3-8698","https://www.vulncheck.com/advisories/axios-before-maxbodylength-bypass-via-http-2"],"description":"axios versions >=1.13.0 (Node.js HTTP adapter) fail to enforce the configured maxBodyLength limit on streamed request bodies when requests are sent with httpVersion: 2. Because Node's HTTP/2 request API does not honor the maxBodyLength option and axios's byte-counting stream wrapper is gated on maxRedirects === 0, an attacker who controls a stream passed to axios can cause the application to transmit outbound data exceeding the configured finite maxBodyLength. Impact is limited to resource consumption and policy bypass (excess egress, upstream quota consumption, limited availability); it does not enable code execution, credential disclosure, or request-destination control. Calls using the default maxBodyLength: -1 and browser adapters are not affected.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67318","epss":0.00616,"percentile":0.49543,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67318","cwe":"CWE-400","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.15.0"}},"found":{"vulnerabilityID":"GHSA-mwf2-3pr3-8698","versionConstraint":">=1.13.0,<1.18.0 (semantic)"},"fix":{"suggestedVersion":"1.18.0"}}],"artifact":{"id":"pkg:npm/axios@1.15.0?package-id=520b8e92ffff8054","name":"axios","version":"1.15.0","type":"npm","locations":[{"path":"/sink/oidc-server/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.15.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.15.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-mwf2-3pr3-8698","dataSource":"https://github.com/advisories/GHSA-mwf2-3pr3-8698","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-mwf2-3pr3-8698","https://github.com/axios/axios/pull/11000","https://github.com/axios/axios/commit/32fc489632377d214db55bfa4e2c48486a7d7ce2","https://github.com/axios/axios/releases/tag/v1.18.0","https://nvd.nist.gov/vuln/detail/CVE-2026-67318","https://nvd.nist.gov/vuln/detail/CVE-2026-68948"],"description":"Axios: HTTP/2 streamed uploads bypass `maxBodyLength`","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67318","epss":0.00616,"percentile":0.49543,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67318","cwe":"CWE-400","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["1.18.0"],"state":"fixed","available":[{"version":"1.18.0","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.34803999999999996},"relatedVulnerabilities":[{"id":"CVE-2026-67318","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-67318","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-mwf2-3pr3-8698","https://www.vulncheck.com/advisories/axios-before-maxbodylength-bypass-via-http-2"],"description":"axios versions >=1.13.0 (Node.js HTTP adapter) fail to enforce the configured maxBodyLength limit on streamed request bodies when requests are sent with httpVersion: 2. Because Node's HTTP/2 request API does not honor the maxBodyLength option and axios's byte-counting stream wrapper is gated on maxRedirects === 0, an attacker who controls a stream passed to axios can cause the application to transmit outbound data exceeding the configured finite maxBodyLength. Impact is limited to resource consumption and policy bypass (excess egress, upstream quota consumption, limited availability); it does not enable code execution, credential disclosure, or request-destination control. Calls using the default maxBodyLength: -1 and browser adapters are not affected.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67318","epss":0.00616,"percentile":0.49543,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67318","cwe":"CWE-400","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.16.1"}},"found":{"vulnerabilityID":"GHSA-mwf2-3pr3-8698","versionConstraint":">=1.13.0,<1.18.0 (semantic)"},"fix":{"suggestedVersion":"1.18.0"}}],"artifact":{"id":"pkg:npm/axios@1.16.1?package-id=8545c428c207f9fb","name":"axios","version":"1.16.1","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.16.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.16.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-wcpc-wj8m-hjx6","dataSource":"https://github.com/advisories/GHSA-wcpc-wj8m-hjx6","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-wcpc-wj8m-hjx6","https://nvd.nist.gov/vuln/detail/CVE-2026-48712"],"description":"protobufjs: Denial of service through unbounded Any expansion during JSON conversion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-48712","epss":0.0046,"percentile":0.39886,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-48712","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.6.1"],"state":"fixed","available":[{"version":"7.6.1","date":"2026-06-15","kind":"first-observed"}]},"advisories":[],"risk":0.345},"relatedVulnerabilities":[{"id":"CVE-2026-48712","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48712","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-wcpc-wj8m-hjx6"],"description":"protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.1 and 8.4.1, protobufjs could recurse without a depth limit while converting decoded messages to plain objects or JSON. This affected generated toObject() conversion and the custom google.protobuf.Any JSON conversion path. A crafted protobuf binary payload containing deeply nested Any values could cause the JavaScript call stack to be exhausted during conversion to JSON. This vulnerability is fixed in 7.6.1 and 8.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-48712","epss":0.0046,"percentile":0.39886,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-48712","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"protobufjs","version":"7.5.6"}},"found":{"vulnerabilityID":"GHSA-wcpc-wj8m-hjx6","versionConstraint":"<=7.6.0 (semantic)"},"fix":{"suggestedVersion":"7.6.1"}}],"artifact":{"id":"pkg:npm/protobufjs@7.5.6?package-id=7ceb7c776b63b6ac","name":"protobufjs","version":"7.5.6","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:protobufjs_project:protobufjs:7.5.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/protobufjs@7.5.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-fx2h-pf6j-xcff","dataSource":"https://github.com/advisories/GHSA-fx2h-pf6j-xcff","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/vitejs/vite/security/advisories/GHSA-fx2h-pf6j-xcff","https://nvd.nist.gov/vuln/detail/CVE-2026-53571"],"description":"vite: `server.fs.deny` bypass on Windows alternate paths","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53571","epss":0.00577,"percentile":0.47549,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53571","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-53571","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.3.5"],"state":"fixed","available":[{"version":"7.3.5","date":"2026-06-15","kind":"first-observed"}]},"advisories":[],"risk":0.343315},"relatedVulnerabilities":[{"id":"CVE-2026-53571","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53571","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/vitejs/vite/security/advisories/GHSA-fx2h-pf6j-xcff"],"description":"Vite is a frontend tooling framework for JavaScript. Prior to 8.0.16, 7.3.5, and 6.4.3, the contents of files that are specified by server.fs.deny can be returned to the browser on Windows. Vite’s dev server denies direct access to sensitive files through server.fs.deny, including entries such as .env, .env.*, and *.{crt,pem}. However, on Windows, the deny logic does not correctly normalize NTFS ADS path forms before access checks are applied. Because of this, requests such as /.env::$DATA?raw are treated as allowed paths, while Windows resolves them to the original file's default data stream. Similar to that, Windows allows accessing a file using a different name with the 8.3 short name compatibility feature. Vite did not reject accessing files via them. This vulnerability is fixed in 8.0.16, 7.3.5, and 6.4.3.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53571","epss":0.00577,"percentile":0.47549,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53571","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-53571","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"vite","version":"7.3.2"}},"found":{"vulnerabilityID":"GHSA-fx2h-pf6j-xcff","versionConstraint":">=7.0.0,<=7.3.4 (semantic)"},"fix":{"suggestedVersion":"7.3.5"}}],"artifact":{"id":"pkg:npm/vite@7.3.2?package-id=5c0ce5d7d525ae42","name":"vite","version":"7.3.2","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vitejs:vite:7.3.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/vite@7.3.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-c29m-xwm3-cm6r","dataSource":"https://github.com/advisories/GHSA-c29m-xwm3-cm6r","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-c29m-xwm3-cm6r","https://nvd.nist.gov/vuln/detail/CVE-2026-101903","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/releases/tag/v1.20.0"],"description":"Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101903","epss":0.00436,"percentile":0.37884,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101903","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["1.20.0"],"state":"fixed","available":[{"version":"1.20.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.34225999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-101903","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101903","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/axios/axios/security/advisories/GHSA-c29m-xwm3-cm6r"],"description":"Axios is a promise-based HTTP client for the browser and Node.js. From 1.16.1 until 1.20.0, the RFC 2397 regular expression allows slash characters on both sides of the media-type separator. An application passes an attacker-controlled malformed data URL containing many slash characters and no comma. the JavaScript regular-expression engine explores many separator placements before rejecting the URL. Synchronous excessive backtracking can block the Node.js event loop and cause denial of service. The affected identifiers are fromDataURI, DATA_URL_PATTERN, data:. This issue is fixed in version 1.20.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101903","epss":0.00436,"percentile":0.37884,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101903","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.16.1"}},"found":{"vulnerabilityID":"GHSA-c29m-xwm3-cm6r","versionConstraint":">=1.16.1,<1.20.0 (semantic)"},"fix":{"suggestedVersion":"1.20.0"}}],"artifact":{"id":"pkg:npm/axios@1.16.1?package-id=8545c428c207f9fb","name":"axios","version":"1.16.1","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.16.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.16.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-c29m-xwm3-cm6r","dataSource":"https://github.com/advisories/GHSA-c29m-xwm3-cm6r","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-c29m-xwm3-cm6r","https://nvd.nist.gov/vuln/detail/CVE-2026-101903","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/releases/tag/v1.20.0"],"description":"Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101903","epss":0.00436,"percentile":0.37884,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101903","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["1.20.0"],"state":"fixed","available":[{"version":"1.20.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.34225999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-101903","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101903","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/axios/axios/security/advisories/GHSA-c29m-xwm3-cm6r"],"description":"Axios is a promise-based HTTP client for the browser and Node.js. From 1.16.1 until 1.20.0, the RFC 2397 regular expression allows slash characters on both sides of the media-type separator. An application passes an attacker-controlled malformed data URL containing many slash characters and no comma. the JavaScript regular-expression engine explores many separator placements before rejecting the URL. Synchronous excessive backtracking can block the Node.js event loop and cause denial of service. The affected identifiers are fromDataURI, DATA_URL_PATTERN, data:. This issue is fixed in version 1.20.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101903","epss":0.00436,"percentile":0.37884,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101903","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.18.1"}},"found":{"vulnerabilityID":"GHSA-c29m-xwm3-cm6r","versionConstraint":">=1.16.1,<1.20.0 (semantic)"},"fix":{"suggestedVersion":"1.20.0"}}],"artifact":{"id":"pkg:npm/axios@1.18.1?package-id=1350ab3e8bd97544","name":"axios","version":"1.18.1","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.18.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.18.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-r4gj-5m52-g5wh","dataSource":"https://github.com/advisories/GHSA-r4gj-5m52-g5wh","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-r4gj-5m52-g5wh","https://nvd.nist.gov/vuln/detail/CVE-2026-101907","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/releases/tag/v1.20.0"],"description":"Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","metrics":{"baseScore":7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101907","epss":0.00471,"percentile":0.40796,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101907","cwe":"CWE-441","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-101907","cwe":"CWE-601","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.20.0"],"state":"fixed","available":[{"version":"1.20.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.341475},"relatedVulnerabilities":[{"id":"CVE-2026-101907","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101907","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/axios/axios/security/advisories/GHSA-r4gj-5m52-g5wh"],"description":"Axios is a promise-based HTTP client for the browser and Node.js. From 1.17.0 until 1.20.0, the fetch adapter bypasses the maxRedirects: 0 redirect policy. An Axios request uses the fetch adapter with maxRedirects set to zero and receives a redirect response. The underlying fetch implementation follows the redirect instead of returning the redirect response unchanged. The redirected request can access internal responses or reach state-changing internal endpoints despite redirects being disabled. This issue is fixed in version 1.20.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101907","epss":0.00471,"percentile":0.40796,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101907","cwe":"CWE-441","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-101907","cwe":"CWE-601","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.18.1"}},"found":{"vulnerabilityID":"GHSA-r4gj-5m52-g5wh","versionConstraint":">=1.17.0,<1.20.0 (semantic)"},"fix":{"suggestedVersion":"1.20.0"}}],"artifact":{"id":"pkg:npm/axios@1.18.1?package-id=1350ab3e8bd97544","name":"axios","version":"1.18.1","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.18.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.18.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-6j4f-fj2g-mc7p","dataSource":"https://github.com/advisories/GHSA-6j4f-fj2g-mc7p","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"],"description":"brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102276","epss":0.00455,"percentile":0.3952,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102276","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102276","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.1.19"],"state":"fixed","available":[{"version":"1.1.19","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.34125},"relatedVulnerabilities":[{"id":"CVE-2026-102276","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102276","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102276","epss":0.00455,"percentile":0.3952,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102276","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102276","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.14"}},"found":{"vulnerabilityID":"GHSA-6j4f-fj2g-mc7p","versionConstraint":"<1.1.19 (semantic)"},"fix":{"suggestedVersion":"1.1.19"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.14?package-id=fa326f252298de13","name":"brace-expansion","version":"1.1.14","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.14:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.14","upstreams":[]}},{"vulnerability":{"id":"GHSA-6j4f-fj2g-mc7p","dataSource":"https://github.com/advisories/GHSA-6j4f-fj2g-mc7p","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"],"description":"brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102276","epss":0.00455,"percentile":0.3952,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102276","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102276","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.1.19"],"state":"fixed","available":[{"version":"1.1.19","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.34125},"relatedVulnerabilities":[{"id":"CVE-2026-102276","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102276","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102276","epss":0.00455,"percentile":0.3952,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102276","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102276","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.14"}},"found":{"vulnerabilityID":"GHSA-6j4f-fj2g-mc7p","versionConstraint":"<1.1.19 (semantic)"},"fix":{"suggestedVersion":"1.1.19"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.14?package-id=e9bc4db499821f08","name":"brace-expansion","version":"1.1.14","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.14:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.14","upstreams":[]}},{"vulnerability":{"id":"GHSA-6j4f-fj2g-mc7p","dataSource":"https://github.com/advisories/GHSA-6j4f-fj2g-mc7p","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"],"description":"brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102276","epss":0.00455,"percentile":0.3952,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102276","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102276","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.1.5"],"state":"fixed","available":[{"version":"2.1.5","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.34125},"relatedVulnerabilities":[{"id":"CVE-2026-102276","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102276","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102276","epss":0.00455,"percentile":0.3952,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102276","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102276","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"2.1.0"}},"found":{"vulnerabilityID":"GHSA-6j4f-fj2g-mc7p","versionConstraint":">=2.0.0,<2.1.5 (semantic)"},"fix":{"suggestedVersion":"2.1.5"}}],"artifact":{"id":"pkg:npm/brace-expansion@2.1.0?package-id=5b11ade77bad45b9","name":"brace-expansion","version":"2.1.0","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:2.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@2.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-6j4f-fj2g-mc7p","dataSource":"https://github.com/advisories/GHSA-6j4f-fj2g-mc7p","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"],"description":"brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102276","epss":0.00455,"percentile":0.3952,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102276","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102276","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["5.0.10"],"state":"fixed","available":[{"version":"5.0.10","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.34125},"relatedVulnerabilities":[{"id":"CVE-2026-102276","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102276","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102276","epss":0.00455,"percentile":0.3952,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102276","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102276","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"5.0.9"}},"found":{"vulnerabilityID":"GHSA-6j4f-fj2g-mc7p","versionConstraint":">=4.0.0,<5.0.10 (semantic)"},"fix":{"suggestedVersion":"5.0.10"}}],"artifact":{"id":"pkg:npm/brace-expansion@5.0.9?package-id=2a3f60339f328dc4","name":"brace-expansion","version":"5.0.9","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:5.0.9:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@5.0.9","upstreams":[]}},{"vulnerability":{"id":"GHSA-jqh4-m9w3-8hp9","dataSource":"https://github.com/advisories/GHSA-jqh4-m9w3-8hp9","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-jqh4-m9w3-8hp9","https://github.com/axios/axios/pull/11000","https://github.com/axios/axios/commit/32fc489632377d214db55bfa4e2c48486a7d7ce2","https://github.com/axios/axios/releases/tag/v1.18.0","https://nvd.nist.gov/vuln/detail/CVE-2026-67317","https://nvd.nist.gov/vuln/detail/CVE-2026-68947","https://www.vulncheck.com/advisories/axios-before-maxbodylength-bypass-via-readablestream"],"description":"Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67317","epss":0.00602,"percentile":0.48794,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67317","cwe":"CWE-770","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["1.18.0"],"state":"fixed","available":[{"version":"1.18.0","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.34013},"relatedVulnerabilities":[{"id":"CVE-2026-67317","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-67317","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-jqh4-m9w3-8hp9","https://www.vulncheck.com/advisories/axios-before-maxbodylength-bypass-via-readablestream"],"description":"axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream request bodies in the fetch adapter when Content-Length cannot be determined. Attackers can supply unknown-length stream data to bypass upload size limits and cause uncontrolled network egress or resource exhaustion.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67317","epss":0.00602,"percentile":0.48794,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67317","cwe":"CWE-770","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.15.0"}},"found":{"vulnerabilityID":"GHSA-jqh4-m9w3-8hp9","versionConstraint":">=1.7.0,<1.18.0 (semantic)"},"fix":{"suggestedVersion":"1.18.0"}}],"artifact":{"id":"pkg:npm/axios@1.15.0?package-id=520b8e92ffff8054","name":"axios","version":"1.15.0","type":"npm","locations":[{"path":"/sink/oidc-server/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.15.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.15.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-jqh4-m9w3-8hp9","dataSource":"https://github.com/advisories/GHSA-jqh4-m9w3-8hp9","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-jqh4-m9w3-8hp9","https://github.com/axios/axios/pull/11000","https://github.com/axios/axios/commit/32fc489632377d214db55bfa4e2c48486a7d7ce2","https://github.com/axios/axios/releases/tag/v1.18.0","https://nvd.nist.gov/vuln/detail/CVE-2026-67317","https://nvd.nist.gov/vuln/detail/CVE-2026-68947","https://www.vulncheck.com/advisories/axios-before-maxbodylength-bypass-via-readablestream"],"description":"Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67317","epss":0.00602,"percentile":0.48794,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67317","cwe":"CWE-770","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["1.18.0"],"state":"fixed","available":[{"version":"1.18.0","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.34013},"relatedVulnerabilities":[{"id":"CVE-2026-67317","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-67317","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-jqh4-m9w3-8hp9","https://www.vulncheck.com/advisories/axios-before-maxbodylength-bypass-via-readablestream"],"description":"axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream request bodies in the fetch adapter when Content-Length cannot be determined. Attackers can supply unknown-length stream data to bypass upload size limits and cause uncontrolled network egress or resource exhaustion.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67317","epss":0.00602,"percentile":0.48794,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67317","cwe":"CWE-770","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.16.1"}},"found":{"vulnerabilityID":"GHSA-jqh4-m9w3-8hp9","versionConstraint":">=1.7.0,<1.18.0 (semantic)"},"fix":{"suggestedVersion":"1.18.0"}}],"artifact":{"id":"pkg:npm/axios@1.16.1?package-id=8545c428c207f9fb","name":"axios","version":"1.16.1","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.16.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.16.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-8x88-c5mf-7j5w","dataSource":"https://github.com/advisories/GHSA-8x88-c5mf-7j5w","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w","https://nvd.nist.gov/vuln/detail/CVE-2026-59874","https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5","https://github.com/isaacs/node-tar/releases/tag/v7.5.18"],"description":"node-tar: Negative tar entry size causes infinite loop in archive replace","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59874","epss":0.00434,"percentile":0.37694,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59874","cwe":"CWE-835","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.5.18"],"state":"fixed","available":[{"version":"7.5.18","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.33852},"relatedVulnerabilities":[{"id":"CVE-2026-59874","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59874","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5","https://github.com/isaacs/node-tar/releases/tag/v7.5.18","https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w"],"description":"node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59874","epss":0.00434,"percentile":0.37694,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59874","cwe":"CWE-835","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"7.5.13"}},"found":{"vulnerabilityID":"GHSA-8x88-c5mf-7j5w","versionConstraint":"<=7.5.17 (semantic)"},"fix":{"suggestedVersion":"7.5.18"}}],"artifact":{"id":"pkg:npm/tar@7.5.13?package-id=c08fe2f2d0b796ea","name":"tar","version":"7.5.13","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BlueOak-1.0.0"],"cpes":["cpe:2.3:a:tar_project:tar:7.5.13:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:7.5.13:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:7.5.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@7.5.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-8cw4-87c7-c6xx","dataSource":"https://github.com/advisories/GHSA-8cw4-87c7-c6xx","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/adaltas/node-csv/security/advisories/GHSA-8cw4-87c7-c6xx","https://nvd.nist.gov/vuln/detail/CVE-2026-85063","https://github.com/adaltas/node-csv/issues/496","https://github.com/adaltas/node-csv/pull/497","https://github.com/adaltas/node-csv/commit/eb4d1484589c976dcb977db8dd0b90e015a6f66e"],"description":"node-csv: Prototype replacement still reachable via columns path","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-85063","epss":0.00566,"percentile":0.46974,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-85063","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.0.2"],"state":"fixed","available":[{"version":"7.0.2","date":"2026-09-09","kind":"first-observed"}]},"advisories":[],"risk":0.33677},"relatedVulnerabilities":[{"id":"CVE-2026-85063","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85063","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/adaltas/node-csv/commit/eb4d1484589c976dcb977db8dd0b90e015a6f66e","https://github.com/adaltas/node-csv/issues/496","https://github.com/adaltas/node-csv/pull/497","https://github.com/adaltas/node-csv/security/advisories/GHSA-8cw4-87c7-c6xx"],"description":"node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and group_columns_by_name options enabled treats a duplicate __proto__ header as an existing property in packages/csv-parse/lib/api/index.js, assigns an attacker-controlled array through obj['__proto__'], and replaces the parsed record object's prototype. A malicious CSV header can therefore inject inherited array values into the returned record, hide those inherited values from JSON serialization, and affect property enumeration and type or shape checks in applications that process the record. This issue is fixed in version 7.0.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-85063","epss":0.00566,"percentile":0.46974,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-85063","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"csv-parse","version":"5.6.0"}},"found":{"vulnerabilityID":"GHSA-8cw4-87c7-c6xx","versionConstraint":"<7.0.2 (semantic)"},"fix":{"suggestedVersion":"7.0.2"}}],"artifact":{"id":"pkg:npm/csv-parse@5.6.0?package-id=b5217fb5925150ca","name":"csv-parse","version":"5.6.0","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:csv-parse_project:csv-parse:5.6.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/csv-parse@5.6.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-667r-xxjv-c9mm","dataSource":"https://github.com/advisories/GHSA-667r-xxjv-c9mm","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/fastify/fastify/security/advisories/GHSA-667r-xxjv-c9mm","https://nvd.nist.gov/vuln/detail/CVE-2026-84504","https://github.com/fastify/fastify/commit/f02d8d4ab1ab208f10819c4dc213595b06497833","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fastify/releases/tag/v5.12.2"],"description":"fastify vulnerable to request body replacement via an async validation result collision","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"exploitabilityScore":2.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84504","epss":0.00428,"percentile":0.37109,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84504","cwe":"CWE-20","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["5.12.2"],"state":"fixed","available":[{"version":"5.12.2","date":"2026-10-01","kind":"first-observed"}]},"advisories":[],"risk":0.33384},"relatedVulnerabilities":[{"id":"CVE-2026-84504","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84504","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fastify/security/advisories/GHSA-667r-xxjv-c9mm"],"description":"fastify versions before 5.12.2 treat the object resolved by a successful Ajv async validator as the value result protocol used by custom validator compilers. If a request that passes its route schema contains a property named value at the root, fastify replaces the entire request body with that property's value before the handler runs, so the handler receives a different object than the one that satisfied the schema. An authenticated low-privilege caller can use this to make nested data replace the validated body and trigger an operation the route schema did not authorize, leading to unauthorized state changes and data disclosure. Users should upgrade to fastify 5.12.2 or later.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"exploitabilityScore":2.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84504","epss":0.00428,"percentile":0.37109,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84504","cwe":"CWE-20","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fastify","version":"5.8.5"}},"found":{"vulnerabilityID":"GHSA-667r-xxjv-c9mm","versionConstraint":"<5.12.2 (semantic)"},"fix":{"suggestedVersion":"5.12.2"}}],"artifact":{"id":"pkg:npm/fastify@5.8.5?package-id=72dfb6219c562dcc","name":"fastify","version":"5.8.5","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:fastify:fastify:5.8.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fastify@5.8.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-w8wr-v893-vjvp","dataSource":"https://github.com/advisories/GHSA-w8wr-v893-vjvp","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-w8wr-v893-vjvp","https://nvd.nist.gov/vuln/detail/CVE-2026-59871","https://github.com/isaacs/node-tar/commit/e02a4e9e013c4be95302e2eb2047a942b883c27b","https://github.com/isaacs/node-tar/releases/tag/v7.5.18"],"description":"node-tar: Process crash via PAX numeric path type confusion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59871","epss":0.00644,"percentile":0.50876,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59871","cwe":"CWE-704","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.5.18"],"state":"fixed","available":[{"version":"7.5.18","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.33166},"relatedVulnerabilities":[{"id":"CVE-2026-59871","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59871","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/node-tar/commit/e02a4e9e013c4be95302e2eb2047a942b883c27b","https://github.com/isaacs/node-tar/releases/tag/v7.5.18","https://github.com/isaacs/node-tar/security/advisories/GHSA-w8wr-v893-vjvp"],"description":"node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as normalizeWindowsPath(entry.path).split('/') to throw an uncaught TypeError. This issue is fixed in version 7.5.18.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59871","epss":0.00644,"percentile":0.50876,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59871","cwe":"CWE-704","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"7.5.13"}},"found":{"vulnerabilityID":"GHSA-w8wr-v893-vjvp","versionConstraint":"<=7.5.17 (semantic)"},"fix":{"suggestedVersion":"7.5.18"}}],"artifact":{"id":"pkg:npm/tar@7.5.13?package-id=c08fe2f2d0b796ea","name":"tar","version":"7.5.13","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BlueOak-1.0.0"],"cpes":["cpe:2.3:a:tar_project:tar:7.5.13:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:7.5.13:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:7.5.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@7.5.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-9qmh-m7c6-f92p","dataSource":"https://github.com/advisories/GHSA-9qmh-m7c6-f92p","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-9qmh-m7c6-f92p","https://nvd.nist.gov/vuln/detail/CVE-2026-114144","https://github.com/BinaryMuse/toml-node/commit/9d52e384f6030932174d1afb0d910154dd62dead","https://github.com/BinaryMuse/toml-node/releases/tag/v5.0.1"],"description":"toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-114144","epss":0.0044,"percentile":0.38281,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-114144","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-114144","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["5.0.1"],"state":"fixed","available":[{"version":"5.0.1","date":"2026-10-23","kind":"first-observed"}]},"advisories":[],"risk":0.33},"relatedVulnerabilities":[{"id":"CVE-2026-114144","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114144","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/BinaryMuse/toml-node/commit/9d52e384f6030932174d1afb0d910154dd62dead","https://github.com/BinaryMuse/toml-node/releases/tag/v5.0.1","https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-9qmh-m7c6-f92p"],"description":"toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() passes unbounded hexadecimal, octal, binary, and decimal digit sequences from lib/parser.js to BigInt() before reduceInteger() in lib/compiler.js checks whether the resulting value fits the TOML 64-bit integer range. Converting a sufficiently long integer string consumes super-linear CPU time and synchronously blocks the Node.js event loop, allowing one attacker-supplied TOML document to deny service to concurrent work in the process. The later range check cannot prevent the conversion cost because it executes after BigInt(). This issue is fixed in version 5.0.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-114144","epss":0.0044,"percentile":0.38281,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-114144","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-114144","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"toml","version":"5.0.0"}},"found":{"vulnerabilityID":"GHSA-9qmh-m7c6-f92p","versionConstraint":"<=5.0.0 (semantic)"},"fix":{"suggestedVersion":"5.0.1"}}],"artifact":{"id":"pkg:npm/toml@5.0.0?package-id=052b84fded26719d","name":"toml","version":"5.0.0","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:toml:toml:5.0.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/toml@5.0.0","upstreams":[]}},{"vulnerability":{"id":"GO-2026-6303","dataSource":"https://go.dev/issue/80213","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/cl/797040"],"description":"The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-56854","epss":0.00437,"percentile":0.38031,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-56854","cwe":"CWE-863","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.55.0"],"state":"fixed","available":[{"version":"0.55.0","date":"2026-08-11","kind":"release"}]},"advisories":[],"risk":0.32775},"relatedVulnerabilities":[{"id":"CVE-2026-56854","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56854","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/797040","https://go.dev/issue/80213","https://pkg.go.dev/vuln/GO-2026-6303"],"description":"The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-56854","epss":0.00437,"percentile":0.38031,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-56854","cwe":"CWE-863","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/crypto","version":"v0.53.0"}},"found":{"vulnerabilityID":"GO-2026-6303","versionConstraint":"<0.55.0 (go)"},"fix":{"suggestedVersion":"0.55.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.53.0?package-id=2cfa42269238d9de","name":"golang.org/x/crypto","version":"v0.53.0","type":"go-module","locations":[{"path":"/backend-go/go.mod","accessPath":""}],"language":"go","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:golang:crypto:v0.53.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.53.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.53.0","upstreams":[],"metadataType":"GolangSourceMetadata","metadata":{"h1Digest":"h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto=","os":"linux","architecture":"amd64","cgoEnabled":true}}},{"vulnerability":{"id":"GHSA-p9j2-gv94-2wf4","dataSource":"https://github.com/advisories/GHSA-p9j2-gv94-2wf4","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4","https://github.com/vercel/next.js/commit/35f501357e9b0fe7c950b0d6aa8fcf5343f707e9","https://github.com/vercel/next.js/commit/d3033266c6dff23f7be71e19341fe3a8c6e2c599","https://github.com/vercel/next.js/releases/tag/v15.5.21","https://github.com/vercel/next.js/releases/tag/v16.2.11"],"description":"Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N","metrics":{"baseScore":8.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-64645","epss":0.00414,"percentile":0.35679,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-64645","cwe":"CWE-601","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-64645","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["16.2.11"],"state":"fixed","available":[{"version":"16.2.11","date":"2026-07-23","kind":"first-observed"}]},"advisories":[],"risk":0.32705999999999996},"relatedVulnerabilities":[{"id":"CVE-2026-64645","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64645","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/vercel/next.js/commit/35f501357e9b0fe7c950b0d6aa8fcf5343f707e9","https://github.com/vercel/next.js/commit/d3033266c6dff23f7be71e19341fe3a8c6e2c599","https://github.com/vercel/next.js/releases/tag/v15.5.21","https://github.com/vercel/next.js/releases/tag/v16.2.11","https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4"],"description":"Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a\n rewrites() or redirects() rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule's hostname suffix. For a rewrite, Next.js proxies the request to that arbitrary host and serves the response from the application's origin, leading to Server-Side Request forgery. A redirects() rule configured this way is vulnerable to an Open Redirect. This issue has been fixed in versions 15.5.21 and 16.2.11.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-64645","epss":0.00414,"percentile":0.35679,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-64645","cwe":"CWE-601","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-64645","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"next","version":"16.1.7"}},"found":{"vulnerabilityID":"GHSA-p9j2-gv94-2wf4","versionConstraint":">=16.0.0,<16.2.11 (semantic)"},"fix":{"suggestedVersion":"16.2.11"}}],"artifact":{"id":"pkg:npm/next@16.1.7?package-id=662de087d22e519d","name":"next","version":"16.1.7","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vercel:next.js:16.1.7:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/next@16.1.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-v2hh-gcrm-f6hx","dataSource":"https://github.com/advisories/GHSA-v2hh-gcrm-f6hx","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-v2hh-gcrm-f6hx","https://nvd.nist.gov/vuln/detail/CVE-2026-16221","https://github.com/fastify/fast-uri/commit/0542a216860fd70c062a4730e620576f62ded057","https://github.com/fastify/fast-uri/commit/2d50fbabc80e4d0884fe0f6a98fe118ce6faa353","https://github.com/fastify/fast-uri/commit/9438266d6a7ded688c8bc7c4ba506da17f44a17b","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v2.4.3","https://github.com/fastify/fast-uri/releases/tag/v3.1.4","https://github.com/fastify/fast-uri/releases/tag/v4.1.1"],"description":"fast-uri vulnerable to host confusion via literal backslash authority delimiter","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-16221","epss":0.00436,"percentile":0.37868,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-16221","cwe":"CWE-436","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["3.1.4"],"state":"fixed","available":[{"version":"3.1.4","date":"2026-07-22","kind":"first-observed"}]},"advisories":[],"risk":0.327},"relatedVulnerabilities":[{"id":"CVE-2026-16221","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16221","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-v2hh-gcrm-f6hx"],"description":"Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Node's http and https clients, normalizes the backslash to a forward slash for special schemes such as http, https, ws, wss, ftp, and file. As a result, the two parsers extract different hosts from the same input string. Applications that use fast-uri to enforce host-based policy such as allowlists, denylists, loopback or SSRF filtering, redirect validation, or outbound proxy routing before passing the same URL into Node's URL or fetch consumers can be steered to an unintended destination, including cloud metadata endpoints, loopback, or internal hosts. \n\nPatches: upgrade to fast-uri 4.1.1, 3.1.4, or 2.4.3.\n\nWorkarounds: none.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-16221","epss":0.00436,"percentile":0.37868,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-16221","cwe":"CWE-436","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"3.1.0"}},"found":{"vulnerabilityID":"GHSA-v2hh-gcrm-f6hx","versionConstraint":">=3.0.0,<=3.1.3 (semantic)"},"fix":{"suggestedVersion":"3.1.4"}}],"artifact":{"id":"pkg:npm/fast-uri@3.1.0?package-id=a87bf2e2258cda95","name":"fast-uri","version":"3.1.0","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:openjsf:fast-uri:3.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@3.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-4hqw-qxg8-jxx2","dataSource":"https://github.com/advisories/GHSA-4hqw-qxg8-jxx2","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-4hqw-qxg8-jxx2","https://nvd.nist.gov/vuln/detail/CVE-2026-101900","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/releases/tag/v1.20.0"],"description":"Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101900","epss":0.00546,"percentile":0.45812,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101900","cwe":"CWE-74","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-101900","cwe":"CWE-693","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-101900","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["1.20.0"],"state":"fixed","available":[{"version":"1.20.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.32487},"relatedVulnerabilities":[{"id":"CVE-2026-101900","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101900","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/axios/axios/security/advisories/GHSA-4hqw-qxg8-jxx2"],"description":"Axios is a promise-based HTTP client for the browser and Node.js. From 1.12.0 until 1.20.0, ResolveConfig reads inherited Symbol.toStringTag, append, and getHeaders properties while resolving FormData headers. A separate same-process prototype-pollution flaw supplies an array or non-plain class instance whose inherited properties make it appear FormData-like; plain objects are blocked. The inherited getHeaders function can return attacker-controlled headers that resolveConfig merges into a fetch adapter request. Attacker-controlled headers can alter authorization, cache, metadata-service, or application-specific request behavior. This issue is fixed in version 1.20.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101900","epss":0.00546,"percentile":0.45812,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101900","cwe":"CWE-74","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-101900","cwe":"CWE-693","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-101900","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.15.0"}},"found":{"vulnerabilityID":"GHSA-4hqw-qxg8-jxx2","versionConstraint":">=1.12.0,<1.20.0 (semantic)"},"fix":{"suggestedVersion":"1.20.0"}}],"artifact":{"id":"pkg:npm/axios@1.15.0?package-id=520b8e92ffff8054","name":"axios","version":"1.15.0","type":"npm","locations":[{"path":"/sink/oidc-server/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.15.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.15.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-4hqw-qxg8-jxx2","dataSource":"https://github.com/advisories/GHSA-4hqw-qxg8-jxx2","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-4hqw-qxg8-jxx2","https://nvd.nist.gov/vuln/detail/CVE-2026-101900","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/releases/tag/v1.20.0"],"description":"Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101900","epss":0.00546,"percentile":0.45812,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101900","cwe":"CWE-74","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-101900","cwe":"CWE-693","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-101900","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["1.20.0"],"state":"fixed","available":[{"version":"1.20.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.32487},"relatedVulnerabilities":[{"id":"CVE-2026-101900","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101900","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/axios/axios/security/advisories/GHSA-4hqw-qxg8-jxx2"],"description":"Axios is a promise-based HTTP client for the browser and Node.js. From 1.12.0 until 1.20.0, ResolveConfig reads inherited Symbol.toStringTag, append, and getHeaders properties while resolving FormData headers. A separate same-process prototype-pollution flaw supplies an array or non-plain class instance whose inherited properties make it appear FormData-like; plain objects are blocked. The inherited getHeaders function can return attacker-controlled headers that resolveConfig merges into a fetch adapter request. Attacker-controlled headers can alter authorization, cache, metadata-service, or application-specific request behavior. This issue is fixed in version 1.20.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101900","epss":0.00546,"percentile":0.45812,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101900","cwe":"CWE-74","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-101900","cwe":"CWE-693","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-101900","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.16.1"}},"found":{"vulnerabilityID":"GHSA-4hqw-qxg8-jxx2","versionConstraint":">=1.12.0,<1.20.0 (semantic)"},"fix":{"suggestedVersion":"1.20.0"}}],"artifact":{"id":"pkg:npm/axios@1.16.1?package-id=8545c428c207f9fb","name":"axios","version":"1.16.1","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.16.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.16.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-4hqw-qxg8-jxx2","dataSource":"https://github.com/advisories/GHSA-4hqw-qxg8-jxx2","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-4hqw-qxg8-jxx2","https://nvd.nist.gov/vuln/detail/CVE-2026-101900","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/releases/tag/v1.20.0"],"description":"Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101900","epss":0.00546,"percentile":0.45812,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101900","cwe":"CWE-74","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-101900","cwe":"CWE-693","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-101900","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["1.20.0"],"state":"fixed","available":[{"version":"1.20.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.32487},"relatedVulnerabilities":[{"id":"CVE-2026-101900","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101900","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/axios/axios/security/advisories/GHSA-4hqw-qxg8-jxx2"],"description":"Axios is a promise-based HTTP client for the browser and Node.js. From 1.12.0 until 1.20.0, ResolveConfig reads inherited Symbol.toStringTag, append, and getHeaders properties while resolving FormData headers. A separate same-process prototype-pollution flaw supplies an array or non-plain class instance whose inherited properties make it appear FormData-like; plain objects are blocked. The inherited getHeaders function can return attacker-controlled headers that resolveConfig merges into a fetch adapter request. Attacker-controlled headers can alter authorization, cache, metadata-service, or application-specific request behavior. This issue is fixed in version 1.20.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101900","epss":0.00546,"percentile":0.45812,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101900","cwe":"CWE-74","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-101900","cwe":"CWE-693","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-101900","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.18.1"}},"found":{"vulnerabilityID":"GHSA-4hqw-qxg8-jxx2","versionConstraint":">=1.12.0,<1.20.0 (semantic)"},"fix":{"suggestedVersion":"1.20.0"}}],"artifact":{"id":"pkg:npm/axios@1.18.1?package-id=1350ab3e8bd97544","name":"axios","version":"1.18.1","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.18.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.18.1","upstreams":[]}},{"vulnerability":{"id":"GO-2026-6354","dataSource":"https://go.dev/issue/81316","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/cl/826504","https://groups.google.com/g/golang-announce/c/1y3fb2np35U"],"description":"Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection.\n\nNow, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78662","epss":0.00431,"percentile":0.37397,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78662","cwe":"CWE-770","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.56.0"],"state":"fixed","available":[{"version":"0.56.0","date":"2026-09-02","kind":"release"}]},"advisories":[],"risk":0.32325},"relatedVulnerabilities":[{"id":"CVE-2026-78662","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78662","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/826504","https://go.dev/issue/81316","https://groups.google.com/g/golang-announce/c/1y3fb2np35U","https://pkg.go.dev/vuln/GO-2026-6354"],"description":"Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78662","epss":0.00431,"percentile":0.37397,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78662","cwe":"CWE-770","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/crypto","version":"v0.53.0"}},"found":{"vulnerabilityID":"GO-2026-6354","versionConstraint":"<0.56.0 (go)"},"fix":{"suggestedVersion":"0.56.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.53.0?package-id=2cfa42269238d9de","name":"golang.org/x/crypto","version":"v0.53.0","type":"go-module","locations":[{"path":"/backend-go/go.mod","accessPath":""}],"language":"go","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:golang:crypto:v0.53.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.53.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.53.0","upstreams":[],"metadataType":"GolangSourceMetadata","metadata":{"h1Digest":"h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto=","os":"linux","architecture":"amd64","cgoEnabled":true}}},{"vulnerability":{"id":"GHSA-w9j2-pvgh-6h63","dataSource":"https://github.com/advisories/GHSA-w9j2-pvgh-6h63","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-w9j2-pvgh-6h63","https://nvd.nist.gov/vuln/detail/CVE-2026-42041"],"description":"Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42041","epss":0.00656,"percentile":0.51428,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42041","cwe":"CWE-287","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-42041","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-42041","cwe":"CWE-915","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["1.15.1"],"state":"fixed","available":[{"version":"1.15.1","date":"2026-05-05","kind":"first-observed"}]},"advisories":[],"risk":0.32144},"relatedVulnerabilities":[{"id":"CVE-2026-42041","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42041","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-w9j2-pvgh-6h63","https://access.redhat.com/errata/RHSA-2026:14937","https://access.redhat.com/errata/RHSA-2026:16476","https://access.redhat.com/errata/RHSA-2026:16532","https://access.redhat.com/errata/RHSA-2026:16534","https://access.redhat.com/errata/RHSA-2026:16535","https://access.redhat.com/errata/RHSA-2026:16542","https://access.redhat.com/errata/RHSA-2026:16874","https://access.redhat.com/errata/RHSA-2026:17468","https://access.redhat.com/errata/RHSA-2026:17474","https://access.redhat.com/errata/RHSA-2026:17657","https://access.redhat.com/errata/RHSA-2026:17699","https://access.redhat.com/errata/RHSA-2026:19109","https://access.redhat.com/errata/RHSA-2026:19375","https://access.redhat.com/errata/RHSA-2026:20889","https://access.redhat.com/errata/RHSA-2026:20938","https://access.redhat.com/errata/RHSA-2026:21017","https://access.redhat.com/errata/RHSA-2026:21338","https://access.redhat.com/errata/RHSA-2026:21772","https://access.redhat.com/errata/RHSA-2026:22465","https://access.redhat.com/errata/RHSA-2026:22619","https://access.redhat.com/errata/RHSA-2026:22629","https://access.redhat.com/errata/RHSA-2026:22840","https://access.redhat.com/errata/RHSA-2026:23361","https://access.redhat.com/errata/RHSA-2026:24536","https://access.redhat.com/errata/RHSA-2026:24539","https://access.redhat.com/errata/RHSA-2026:24853","https://access.redhat.com/errata/RHSA-2026:24977","https://access.redhat.com/errata/RHSA-2026:25041","https://access.redhat.com/errata/RHSA-2026:25089","https://access.redhat.com/errata/RHSA-2026:25271","https://access.redhat.com/errata/RHSA-2026:25273","https://access.redhat.com/errata/RHSA-2026:26214","https://access.redhat.com/errata/RHSA-2026:26225","https://access.redhat.com/errata/RHSA-2026:26232","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:36882","https://access.redhat.com/errata/RHSA-2026:50300","https://access.redhat.com/security/cve/CVE-2026-42041","https://bugzilla.redhat.com/show_bug.cgi?id=2461629","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42041.json"],"description":"Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library is vulnerable to a Prototype Pollution \"Gadget\" attack that allows any Object.prototype pollution to silently suppress all HTTP error responses (401, 403, 500, etc.), causing them to be treated as successful responses. This completely bypasses application-level authentication and error handling. The root cause is that validateStatus is the only config property using the mergeDirectKeys merge strategy, which uses JavaScript's in operator — an operator that inherently traverses the prototype chain. When Object.prototype.validateStatus is polluted with () => true, all HTTP status codes are accepted as success. This vulnerability is fixed in 1.15.1 and 0.31.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":3.9,"impactScore":4.3},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42041","epss":0.00656,"percentile":0.51428,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42041","cwe":"CWE-287","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-42041","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-42041","cwe":"CWE-915","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.15.0"}},"found":{"vulnerabilityID":"GHSA-w9j2-pvgh-6h63","versionConstraint":">=1.0.0,<1.15.1 (semantic)"},"fix":{"suggestedVersion":"1.15.1"}}],"artifact":{"id":"pkg:npm/axios@1.15.0?package-id=520b8e92ffff8054","name":"axios","version":"1.15.0","type":"npm","locations":[{"path":"/sink/oidc-server/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.15.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.15.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-hfg8-hc9c-6c3h","dataSource":"https://github.com/advisories/GHSA-hfg8-hc9c-6c3h","namespace":"github:language:go","severity":"High","urls":["https://github.com/moby/go-archive/security/advisories/GHSA-hfg8-hc9c-6c3h","https://github.com/moby/moby/issues/52948","https://docs.docker.com/desktop/release-notes/#4860","https://github.com/bikini/exploitarium/tree/main/docker-cp-copyout-destination-escape","https://github.com/docker/cli/releases/tag/v29.7.0","https://github.com/moby/moby/releases/tag/docker-v29.7.0","https://www.imperva.com/blog/copyescape-taking-over-docker-hosts-with-docker-cp"],"description":"moby/go-archive: Crafted tar archive can write outside the extraction directory","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":7.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-17106","epss":0.0044,"percentile":0.3829,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-17106","cwe":"CWE-59","source":"security@docker.com","type":"Secondary"}],"fix":{"versions":["0.3.0"],"state":"fixed","available":[{"version":"0.3.0","date":"2026-08-19","kind":"first-observed"}]},"advisories":[],"risk":0.3212},"relatedVulnerabilities":[{"id":"CVE-2026-17106","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-17106","namespace":"nvd:cpe","severity":"High","urls":["https://docs.docker.com/desktop/release-notes/#4860","https://docs.docker.com/engine/release-notes/29/#2970","https://github.com/docker/cli/releases/tag/v29.7.0","https://github.com/docker/compose/releases/tag/v5.4.0","https://github.com/docker/sbx-releases/releases/tag/v0.38.0","https://github.com/moby/go-archive/releases/tag/v0.3.0","https://github.com/moby/go-archive/security/advisories/GHSA-hfg8-hc9c-6c3h","https://github.com/masasron/CopyEscape-CVE-2026-17106"],"description":"The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the filesystem operation on a path that is resolved by the OS, so links introduced by the archive can be followed out of the destination directory. An attacker who controls the contents of an archive can create or overwrite files at arbitrary paths writable by the extracting process.","cvss":[{"source":"security@docker.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-17106","epss":0.0044,"percentile":0.3829,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-17106","cwe":"CWE-59","source":"security@docker.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/moby/go-archive","version":"v0.2.0"}},"found":{"vulnerabilityID":"GHSA-hfg8-hc9c-6c3h","versionConstraint":"<0.3.0 (go)"},"fix":{"suggestedVersion":"0.3.0"}}],"artifact":{"id":"pkg:golang/github.com/moby/go-archive@v0.2.0?package-id=df2865631e69fa0d","name":"github.com/moby/go-archive","version":"v0.2.0","type":"go-module","locations":[{"path":"/backend-go/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:moby:go-archive:v0.2.0:*:*:*:*:*:*:*","cpe:2.3:a:moby:go_archive:v0.2.0:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/moby/go-archive@v0.2.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:zg5QDUM2mi0JIM9fdQZWC7U8+2ZfixfTYoHL7rWUcP8="}}},{"vulnerability":{"id":"GO-2026-6610","dataSource":"https://go.dev/cl/835145","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/cl/836385","https://go.dev/issue/81115","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"description":"Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78660","epss":0.00425,"percentile":0.36847,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78660","cwe":"CWE-444","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.60.0"],"state":"fixed","available":[{"version":"0.60.0","date":"2026-10-08","kind":"release"}]},"advisories":[],"risk":0.31875000000000003},"relatedVulnerabilities":[{"id":"CVE-2026-78660","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78660","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/835145","https://go.dev/cl/836385","https://go.dev/issue/81115","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6610"],"description":"Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78660","epss":0.00425,"percentile":0.36847,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78660","cwe":"CWE-444","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.56.0"}},"found":{"vulnerabilityID":"GO-2026-6610","versionConstraint":"<0.60.0 (go)"},"fix":{"suggestedVersion":"0.60.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.56.0?package-id=ab49808757d6d4dc","name":"golang.org/x/net","version":"v0.56.0","type":"go-module","locations":[{"path":"/backend-go/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.56.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.56.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.56.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o="}}},{"vulnerability":{"id":"GHSA-hcpx-6fm6-wx23","dataSource":"https://github.com/advisories/GHSA-hcpx-6fm6-wx23","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-hcpx-6fm6-wx23","https://github.com/axios/axios/pull/11000","https://github.com/axios/axios/pull/11001","https://github.com/axios/axios/commit/1417285c69344bbcc6420a021f67dee0c6fedb2d","https://github.com/axios/axios/commit/32fc489632377d214db55bfa4e2c48486a7d7ce2","https://github.com/axios/axios/releases/tag/v0.33.0","https://github.com/axios/axios/releases/tag/v1.18.0","https://nvd.nist.gov/vuln/detail/CVE-2026-67321","https://nvd.nist.gov/vuln/detail/CVE-2026-69125","https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-maxdepth-bypass"],"description":"Axios form serializer maxDepth bypass via {} metatoken","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67321","epss":0.00534,"percentile":0.451,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67321","cwe":"CWE-674","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["1.18.0"],"state":"fixed","available":[{"version":"1.18.0","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.31773},"relatedVulnerabilities":[{"id":"CVE-2026-67321","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-67321","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-hcpx-6fm6-wx23","https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-maxdepth-bypass"],"description":"axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in '{}'. Attackers who control object keys and nested values passed to axios form or parameter serialization can trigger a RangeError from JSON.stringify, causing denial of service in the affected request path.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67321","epss":0.00534,"percentile":0.451,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67321","cwe":"CWE-674","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.16.1"}},"found":{"vulnerabilityID":"GHSA-hcpx-6fm6-wx23","versionConstraint":">=1.15.1,<1.18.0 (semantic)"},"fix":{"suggestedVersion":"1.18.0"}}],"artifact":{"id":"pkg:npm/axios@1.16.1?package-id=8545c428c207f9fb","name":"axios","version":"1.16.1","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.16.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.16.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-m8m8-qj5v-23w3","dataSource":"https://github.com/advisories/GHSA-m8m8-qj5v-23w3","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-m8m8-qj5v-23w3","https://nvd.nist.gov/vuln/detail/CVE-2026-101905","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/releases/tag/v1.20.0"],"description":"Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":7.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101905","epss":0.00418,"percentile":0.36131,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101905","cwe":"CWE-441","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-101905","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.20.0"],"state":"fixed","available":[{"version":"1.20.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.31559},"relatedVulnerabilities":[{"id":"CVE-2026-101905","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101905","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/axios/axios/security/advisories/GHSA-m8m8-qj5v-23w3"],"description":"Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.2 until 1.20.0, the Node HTTP adapter in lib/adapters/http.js supplies request options without an own createConnection value. A separate same-process prototype-pollution flaw places a function on Object.prototype.createConnection. Node resolves and invokes the inherited createConnection socket factory, allowing the attacker-controlled function to select the transport endpoint. The attacker endpoint can receive request headers and bodies, including credentials, and return attacker-controlled responses while the URL appears legitimate. This issue is fixed in version 1.20.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101905","epss":0.00418,"percentile":0.36131,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101905","cwe":"CWE-441","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-101905","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.16.1"}},"found":{"vulnerabilityID":"GHSA-m8m8-qj5v-23w3","versionConstraint":">=1.15.2,<1.20.0 (semantic)"},"fix":{"suggestedVersion":"1.20.0"}}],"artifact":{"id":"pkg:npm/axios@1.16.1?package-id=8545c428c207f9fb","name":"axios","version":"1.16.1","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.16.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.16.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-m8m8-qj5v-23w3","dataSource":"https://github.com/advisories/GHSA-m8m8-qj5v-23w3","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-m8m8-qj5v-23w3","https://nvd.nist.gov/vuln/detail/CVE-2026-101905","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/releases/tag/v1.20.0"],"description":"Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":7.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101905","epss":0.00418,"percentile":0.36131,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101905","cwe":"CWE-441","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-101905","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.20.0"],"state":"fixed","available":[{"version":"1.20.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.31559},"relatedVulnerabilities":[{"id":"CVE-2026-101905","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101905","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/axios/axios/security/advisories/GHSA-m8m8-qj5v-23w3"],"description":"Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.2 until 1.20.0, the Node HTTP adapter in lib/adapters/http.js supplies request options without an own createConnection value. A separate same-process prototype-pollution flaw places a function on Object.prototype.createConnection. Node resolves and invokes the inherited createConnection socket factory, allowing the attacker-controlled function to select the transport endpoint. The attacker endpoint can receive request headers and bodies, including credentials, and return attacker-controlled responses while the URL appears legitimate. This issue is fixed in version 1.20.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101905","epss":0.00418,"percentile":0.36131,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101905","cwe":"CWE-441","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-101905","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.18.1"}},"found":{"vulnerabilityID":"GHSA-m8m8-qj5v-23w3","versionConstraint":">=1.15.2,<1.20.0 (semantic)"},"fix":{"suggestedVersion":"1.20.0"}}],"artifact":{"id":"pkg:npm/axios@1.18.1?package-id=1350ab3e8bd97544","name":"axios","version":"1.18.1","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.18.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.18.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-8j4g-w8fx-2239","dataSource":"https://github.com/advisories/GHSA-8j4g-w8fx-2239","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/honojs/hono/security/advisories/GHSA-8j4g-w8fx-2239","https://github.com/honojs/hono/commit/93fc250d8b4df58ea542cb945171de8013d5e6d5","https://github.com/honojs/hono/releases/tag/v4.12.34"],"description":"Hono: ReDoS in CORS middleware via Access-Control-Request-Headers","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69207","epss":0.00609,"percentile":0.4917,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69207","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.12.34"],"state":"fixed","available":[{"version":"4.12.34","date":"2026-08-04","kind":"first-observed"}]},"advisories":[],"risk":0.313635},"relatedVulnerabilities":[{"id":"CVE-2026-69207","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-69207","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/honojs/hono/commit/93fc250d8b4df58ea542cb945171de8013d5e6d5","https://github.com/honojs/hono/releases/tag/v4.12.34","https://github.com/honojs/hono/security/advisories/GHSA-8j4g-w8fx-2239"],"description":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.34, the built-in CORS middleware, hono/cors, is vulnerable to a regular expression denial of service (ReDoS). During a preflight OPTIONS request, the middleware parses the attacker-controlled Access-Control-Request-Headers header using a whitespace-tolerant regular expression whose backtracking makes its running time quadratic in the input length. Because the header value is bounded only by the deployment's maximum HTTP header size, a single preflight carrying a long run of whitespace can consume seconds of CPU and block request processing. On runtimes that share one execution thread across requests, this stalls concurrent requests as well, and repeated requests can render the service unresponsive. This affects the default configuration, since the vulnerable path is reached whenever cors() is used with an unset or empty allowHeaders. Applications that set a non-empty allowHeaders are not affected. This issue is fixed in version 4.12.34.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69207","epss":0.00609,"percentile":0.4917,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69207","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"hono","version":"4.12.16"}},"found":{"vulnerabilityID":"GHSA-8j4g-w8fx-2239","versionConstraint":"<4.12.34 (semantic)"},"fix":{"suggestedVersion":"4.12.34"}}],"artifact":{"id":"pkg:npm/hono@4.12.16?package-id=000f2baa1e593039","name":"hono","version":"4.12.16","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:hono:hono:4.12.16:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/hono@4.12.16","upstreams":[]}},{"vulnerability":{"id":"GHSA-hqq3-7jhf-c5jx","dataSource":"https://github.com/advisories/GHSA-hqq3-7jhf-c5jx","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/digitalbazaar/forge/security/advisories/GHSA-hqq3-7jhf-c5jx","https://nvd.nist.gov/vuln/detail/CVE-2026-119187","https://github.com/digitalbazaar/forge/commit/817e2ce0d0f6d8a25bc9c2670615c38a9ffdc51c","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1"],"description":"Forge: Denial of service in TLS record processing via call stack exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119187","epss":0.00415,"percentile":0.35807,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119187","cwe":"CWE-674","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["1.4.1"],"state":"fixed","available":[{"version":"1.4.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.31124999999999997},"relatedVulnerabilities":[{"id":"CVE-2026-119187","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119187","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/digitalbazaar/forge/commit/817e2ce0d0f6d8a25bc9c2670615c38a9ffdc51c","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","https://github.com/digitalbazaar/forge/security/advisories/GHSA-hqq3-7jhf-c5jx"],"description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection(), TLS record processing, process() to process the relevant input or security decision. node-forge processed received TLS records recursively, consuming one JavaScript stack frame per record in a single input chunk. A remote peer could send thousands of small records together and exhaust the call stack, causing an uncaught exception and denial of service. This issue is fixed in version 1.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119187","epss":0.00415,"percentile":0.35807,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119187","cwe":"CWE-674","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"node-forge","version":"1.4.0"}},"found":{"vulnerabilityID":"GHSA-hqq3-7jhf-c5jx","versionConstraint":"<=1.4.0 (semantic)"},"fix":{"suggestedVersion":"1.4.1"}}],"artifact":{"id":"pkg:npm/node-forge@1.4.0?package-id=86ba9cb3dfe9125a","name":"node-forge","version":"1.4.0","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause OR GPL-2.0"],"cpes":["cpe:2.3:a:digitalbazaar:forge:1.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/node-forge@1.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-hqq3-7jhf-c5jx","dataSource":"https://github.com/advisories/GHSA-hqq3-7jhf-c5jx","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/digitalbazaar/forge/security/advisories/GHSA-hqq3-7jhf-c5jx","https://nvd.nist.gov/vuln/detail/CVE-2026-119187","https://github.com/digitalbazaar/forge/commit/817e2ce0d0f6d8a25bc9c2670615c38a9ffdc51c","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1"],"description":"Forge: Denial of service in TLS record processing via call stack exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119187","epss":0.00415,"percentile":0.35807,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119187","cwe":"CWE-674","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["1.4.1"],"state":"fixed","available":[{"version":"1.4.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.31124999999999997},"relatedVulnerabilities":[{"id":"CVE-2026-119187","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119187","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/digitalbazaar/forge/commit/817e2ce0d0f6d8a25bc9c2670615c38a9ffdc51c","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","https://github.com/digitalbazaar/forge/security/advisories/GHSA-hqq3-7jhf-c5jx"],"description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection(), TLS record processing, process() to process the relevant input or security decision. node-forge processed received TLS records recursively, consuming one JavaScript stack frame per record in a single input chunk. A remote peer could send thousands of small records together and exhaust the call stack, causing an uncaught exception and denial of service. This issue is fixed in version 1.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119187","epss":0.00415,"percentile":0.35807,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119187","cwe":"CWE-674","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"node-forge","version":"1.4.0"}},"found":{"vulnerabilityID":"GHSA-hqq3-7jhf-c5jx","versionConstraint":"<=1.4.0 (semantic)"},"fix":{"suggestedVersion":"1.4.1"}}],"artifact":{"id":"pkg:npm/node-forge@1.4.0?package-id=1e94284aa936f13c","name":"node-forge","version":"1.4.0","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause OR GPL-2.0"],"cpes":["cpe:2.3:a:digitalbazaar:forge:1.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/node-forge@1.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-8hrf-8g6f-7xwp","dataSource":"https://github.com/advisories/GHSA-8hrf-8g6f-7xwp","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/digitalbazaar/forge/security/advisories/GHSA-8hrf-8g6f-7xwp","https://nvd.nist.gov/vuln/detail/CVE-2026-119188","https://github.com/digitalbazaar/forge/commit/700d977d39f9f8f896c55b0763eebb940a2c087e","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1"],"description":"Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119188","epss":0.00411,"percentile":0.35424,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119188","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-119188","cwe":"CWE-476","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.4.1"],"state":"fixed","available":[{"version":"1.4.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.30825},"relatedVulnerabilities":[{"id":"CVE-2026-119188","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119188","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/digitalbazaar/forge/commit/700d977d39f9f8f896c55b0763eebb940a2c087e","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","https://github.com/digitalbazaar/forge/security/advisories/GHSA-8hrf-8g6f-7xwp"],"description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection(), fragmented handshake message, interleaved record to process the relevant input or security decision. node-forge continued processing after a TLS record of another content type interrupted a fragmented handshake message. A remote peer could trigger an uncaught TypeError in process(), causing the connection or hosting process to fail. This issue is fixed in version 1.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119188","epss":0.00411,"percentile":0.35424,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119188","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-119188","cwe":"CWE-476","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"node-forge","version":"1.4.0"}},"found":{"vulnerabilityID":"GHSA-8hrf-8g6f-7xwp","versionConstraint":"<=1.4.0 (semantic)"},"fix":{"suggestedVersion":"1.4.1"}}],"artifact":{"id":"pkg:npm/node-forge@1.4.0?package-id=1e94284aa936f13c","name":"node-forge","version":"1.4.0","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause OR GPL-2.0"],"cpes":["cpe:2.3:a:digitalbazaar:forge:1.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/node-forge@1.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-8hrf-8g6f-7xwp","dataSource":"https://github.com/advisories/GHSA-8hrf-8g6f-7xwp","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/digitalbazaar/forge/security/advisories/GHSA-8hrf-8g6f-7xwp","https://nvd.nist.gov/vuln/detail/CVE-2026-119188","https://github.com/digitalbazaar/forge/commit/700d977d39f9f8f896c55b0763eebb940a2c087e","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1"],"description":"Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119188","epss":0.00411,"percentile":0.35424,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119188","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-119188","cwe":"CWE-476","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.4.1"],"state":"fixed","available":[{"version":"1.4.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.30825},"relatedVulnerabilities":[{"id":"CVE-2026-119188","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119188","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/digitalbazaar/forge/commit/700d977d39f9f8f896c55b0763eebb940a2c087e","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","https://github.com/digitalbazaar/forge/security/advisories/GHSA-8hrf-8g6f-7xwp"],"description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection(), fragmented handshake message, interleaved record to process the relevant input or security decision. node-forge continued processing after a TLS record of another content type interrupted a fragmented handshake message. A remote peer could trigger an uncaught TypeError in process(), causing the connection or hosting process to fail. This issue is fixed in version 1.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119188","epss":0.00411,"percentile":0.35424,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119188","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-119188","cwe":"CWE-476","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"node-forge","version":"1.4.0"}},"found":{"vulnerabilityID":"GHSA-8hrf-8g6f-7xwp","versionConstraint":"<=1.4.0 (semantic)"},"fix":{"suggestedVersion":"1.4.1"}}],"artifact":{"id":"pkg:npm/node-forge@1.4.0?package-id=86ba9cb3dfe9125a","name":"node-forge","version":"1.4.0","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause OR GPL-2.0"],"cpes":["cpe:2.3:a:digitalbazaar:forge:1.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/node-forge@1.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-44g4-m2mj-wpvx","dataSource":"https://github.com/advisories/GHSA-44g4-m2mj-wpvx","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-44g4-m2mj-wpvx","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/releases/tag/v1.20.0"],"description":"Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101899","epss":0.00512,"percentile":0.43695,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101899","cwe":"CWE-693","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.20.0"],"state":"fixed","available":[{"version":"1.20.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.30464},"relatedVulnerabilities":[{"id":"CVE-2026-101899","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101899","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/axios/axios/security/advisories/GHSA-44g4-m2mj-wpvx"],"description":"Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy treats the NO_PROXY CIDR form as a textual hostname suffix instead of evaluating the network range. A request targets an address covered by a CIDR entry in NO_PROXY while a proxy is configured. The CIDR bypass rule is not matched, so the request is sent through the configured proxy. For plaintext HTTP, the proxy can observe and modify URLs, headers, and bodies; for HTTPS, it can observe connection metadata and CONNECT requests. This issue is fixed in version 1.20.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101899","epss":0.00512,"percentile":0.43695,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101899","cwe":"CWE-693","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.15.0"}},"found":{"vulnerabilityID":"GHSA-44g4-m2mj-wpvx","versionConstraint":">=1.15.0,<1.20.0 (semantic)"},"fix":{"suggestedVersion":"1.20.0"}}],"artifact":{"id":"pkg:npm/axios@1.15.0?package-id=520b8e92ffff8054","name":"axios","version":"1.15.0","type":"npm","locations":[{"path":"/sink/oidc-server/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.15.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.15.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-44g4-m2mj-wpvx","dataSource":"https://github.com/advisories/GHSA-44g4-m2mj-wpvx","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-44g4-m2mj-wpvx","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/releases/tag/v1.20.0"],"description":"Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101899","epss":0.00512,"percentile":0.43695,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101899","cwe":"CWE-693","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.20.0"],"state":"fixed","available":[{"version":"1.20.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.30464},"relatedVulnerabilities":[{"id":"CVE-2026-101899","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101899","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/axios/axios/security/advisories/GHSA-44g4-m2mj-wpvx"],"description":"Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy treats the NO_PROXY CIDR form as a textual hostname suffix instead of evaluating the network range. A request targets an address covered by a CIDR entry in NO_PROXY while a proxy is configured. The CIDR bypass rule is not matched, so the request is sent through the configured proxy. For plaintext HTTP, the proxy can observe and modify URLs, headers, and bodies; for HTTPS, it can observe connection metadata and CONNECT requests. This issue is fixed in version 1.20.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101899","epss":0.00512,"percentile":0.43695,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101899","cwe":"CWE-693","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.16.1"}},"found":{"vulnerabilityID":"GHSA-44g4-m2mj-wpvx","versionConstraint":">=1.15.0,<1.20.0 (semantic)"},"fix":{"suggestedVersion":"1.20.0"}}],"artifact":{"id":"pkg:npm/axios@1.16.1?package-id=8545c428c207f9fb","name":"axios","version":"1.16.1","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.16.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.16.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-44g4-m2mj-wpvx","dataSource":"https://github.com/advisories/GHSA-44g4-m2mj-wpvx","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-44g4-m2mj-wpvx","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/releases/tag/v1.20.0"],"description":"Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101899","epss":0.00512,"percentile":0.43695,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101899","cwe":"CWE-693","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.20.0"],"state":"fixed","available":[{"version":"1.20.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.30464},"relatedVulnerabilities":[{"id":"CVE-2026-101899","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101899","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/axios/axios/security/advisories/GHSA-44g4-m2mj-wpvx"],"description":"Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy treats the NO_PROXY CIDR form as a textual hostname suffix instead of evaluating the network range. A request targets an address covered by a CIDR entry in NO_PROXY while a proxy is configured. The CIDR bypass rule is not matched, so the request is sent through the configured proxy. For plaintext HTTP, the proxy can observe and modify URLs, headers, and bodies; for HTTPS, it can observe connection metadata and CONNECT requests. This issue is fixed in version 1.20.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101899","epss":0.00512,"percentile":0.43695,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101899","cwe":"CWE-693","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.18.1"}},"found":{"vulnerabilityID":"GHSA-44g4-m2mj-wpvx","versionConstraint":">=1.15.0,<1.20.0 (semantic)"},"fix":{"suggestedVersion":"1.20.0"}}],"artifact":{"id":"pkg:npm/axios@1.18.1?package-id=1350ab3e8bd97544","name":"axios","version":"1.18.1","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.18.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.18.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-p3m5-59mp-jv5r","dataSource":"https://github.com/advisories/GHSA-p3m5-59mp-jv5r","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/vercel/next.js/security/advisories/GHSA-p3m5-59mp-jv5r","https://github.com/vercel/next.js/releases/tag/v15.5.28","https://github.com/vercel/next.js/releases/tag/v16.4.1"],"description":"Next.js: Denial of Service in App Router using Server Actions","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-94482","epss":0.00386,"percentile":0.32737,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-94482","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["16.4.1"],"state":"fixed","available":[{"version":"16.4.1","date":"2026-10-22","kind":"first-observed"}]},"advisories":[],"risk":0.30301},"relatedVulnerabilities":[{"id":"CVE-2026-94482","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94482","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/vercel/next.js/releases/tag/v15.5.28","https://github.com/vercel/next.js/releases/tag/v16.4.1","https://github.com/vercel/next.js/security/advisories/GHSA-p3m5-59mp-jv5r"],"description":"Next.js is a React framework for building full-stack web applications. From 13.0.0 until 15.5.28 and 16.4.1, crafted requests targeting App Router applications with at least one Server Action can cause excessive CPU consumption and block processing of further requests in the same process. Applications using the Pages Router and App Router applications without Server Actions are not affected. This issue is fixed in versions 15.5.28 and 16.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-94482","epss":0.00386,"percentile":0.32737,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-94482","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"next","version":"16.1.7"}},"found":{"vulnerabilityID":"GHSA-p3m5-59mp-jv5r","versionConstraint":">=16.0.0,<=16.4.0 (semantic)"},"fix":{"suggestedVersion":"16.4.1"}}],"artifact":{"id":"pkg:npm/next@16.1.7?package-id=662de087d22e519d","name":"next","version":"16.1.7","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vercel:next.js:16.1.7:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/next@16.1.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-6chq-wfr3-2hj9","dataSource":"https://github.com/advisories/GHSA-6chq-wfr3-2hj9","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-6chq-wfr3-2hj9","https://nvd.nist.gov/vuln/detail/CVE-2026-42035"],"description":"Axios: Header Injection via Prototype Pollution","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42035","epss":0.00403,"percentile":0.3453,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42035","cwe":"CWE-113","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-42035","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.15.1"],"state":"fixed","available":[{"version":"1.15.1","date":"2026-05-05","kind":"first-observed"}]},"advisories":[],"risk":0.300235},"relatedVulnerabilities":[{"id":"CVE-2026-42035","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42035","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-6chq-wfr3-2hj9"],"description":"Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, a prototype pollution gadget exists in the Axios HTTP adapter (lib/adapters/http.js) that allows an attacker to inject arbitrary HTTP headers into outgoing requests. The vulnerability exploits duck-type checking of the data payload, where if Object.prototype is polluted with getHeaders, append, pipe, on, once, and Symbol.toStringTag, Axios misidentifies any plain object payload as a FormData instance and calls the attacker-controlled getHeaders() function, merging the returned headers into the outgoing request. The vulnerable code resides exclusively in lib/adapters/http.js. The prototype pollution source does not need to originate from Axios itself — any prototype pollution primitive in any dependency in the application's dependency tree is sufficient to trigger this gadget. This vulnerability is fixed in 1.15.1 and 0.31.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42035","epss":0.00403,"percentile":0.3453,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42035","cwe":"CWE-113","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-42035","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.15.0"}},"found":{"vulnerabilityID":"GHSA-6chq-wfr3-2hj9","versionConstraint":">=1.0.0,<1.15.1 (semantic)"},"fix":{"suggestedVersion":"1.15.1"}}],"artifact":{"id":"pkg:npm/axios@1.15.0?package-id=520b8e92ffff8054","name":"axios","version":"1.15.0","type":"npm","locations":[{"path":"/sink/oidc-server/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.15.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.15.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-4c39-4ccg-62r3","dataSource":"https://github.com/advisories/GHSA-4c39-4ccg-62r3","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3","https://github.com/vercel/next.js/commit/57c31f724d746e86a9e8b92aa8be538a922446a4","https://github.com/vercel/next.js/commit/9a4651e754f70b12e397694ffc41f44c3ba8cc17","https://github.com/vercel/next.js/releases/tag/v15.5.21","https://github.com/vercel/next.js/releases/tag/v16.2.11"],"description":"Next.js: Unbounded Server Action payload in Edge runtime","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-64646","epss":0.00524,"percentile":0.44441,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-64646","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["16.2.11"],"state":"fixed","available":[{"version":"16.2.11","date":"2026-07-23","kind":"first-observed"}]},"advisories":[],"risk":0.29605999999999993},"relatedVulnerabilities":[{"id":"CVE-2026-64646","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64646","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/vercel/next.js/commit/57c31f724d746e86a9e8b92aa8be538a922446a4","https://github.com/vercel/next.js/commit/9a4651e754f70b12e397694ffc41f44c3ba8cc17","https://github.com/vercel/next.js/releases/tag/v15.5.21","https://github.com/vercel/next.js/releases/tag/v16.2.11","https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3"],"description":"Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the Edge runtime. This issue has been fixed in versions 15.5.21 and 16.2.11.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-64646","epss":0.00524,"percentile":0.44441,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-64646","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"next","version":"16.1.7"}},"found":{"vulnerabilityID":"GHSA-4c39-4ccg-62r3","versionConstraint":">=16.0.0,<16.2.11 (semantic)"},"fix":{"suggestedVersion":"16.2.11"}}],"artifact":{"id":"pkg:npm/next@16.1.7?package-id=662de087d22e519d","name":"next","version":"16.1.7","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vercel:next.js:16.1.7:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/next@16.1.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-xp26-3454-mjgp","dataSource":"https://github.com/advisories/GHSA-xp26-3454-mjgp","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/vitest-dev/vitest/security/advisories/GHSA-xp26-3454-mjgp","https://nvd.nist.gov/vuln/detail/CVE-2026-112950","https://github.com/vitest-dev/vitest/commit/15cc006aa9f8683dc5f7e895d011fa7dc751ce35","https://github.com/vitest-dev/vitest/commit/b825313243dc55757e8d7c0f9e7a792135e13473","https://github.com/vitest-dev/vitest/releases/tag/v4.1.12","https://github.com/vitest-dev/vitest/releases/tag/v5.0.3"],"description":"Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112950","epss":0.00542,"percentile":0.45574,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112950","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.1.12"],"state":"fixed","available":[{"version":"4.1.12","date":"2026-10-22","kind":"first-observed"}]},"advisories":[],"risk":0.29539000000000004},"relatedVulnerabilities":[{"id":"CVE-2026-112950","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112950","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/vitest-dev/vitest/commit/15cc006aa9f8683dc5f7e895d011fa7dc751ce35","https://github.com/vitest-dev/vitest/commit/b825313243dc55757e8d7c0f9e7a792135e13473","https://github.com/vitest-dev/vitest/releases/tag/v4.1.12","https://github.com/vitest-dev/vitest/releases/tag/v5.0.3","https://github.com/vitest-dev/vitest/security/advisories/GHSA-xp26-3454-mjgp"],"description":"Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 4.1.11 until 4.1.12 and 5.0.3, isFileLoadingAllowed and the filesystem read interpret backslashes differently on Windows in packages/mocker/src/node/interceptorPlugin.ts. When a client can reach the Vite dev server on Windows and register a redirect mock containing backslash traversal, POSIX joining preserves a Windows backslash traversal that the later filesystem read interprets as a path separator, so the client can read a file outside server.fs.allow that the Vitest process can access. This issue is fixed in versions 4.1.12 and 5.0.3.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112950","epss":0.00542,"percentile":0.45574,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112950","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@vitest/mocker","version":"4.1.11"}},"found":{"vulnerabilityID":"GHSA-xp26-3454-mjgp","versionConstraint":">=4.1.11,<4.1.12 (semantic)"},"fix":{"suggestedVersion":"4.1.12"}}],"artifact":{"id":"pkg:npm/%40vitest/mocker@4.1.11?package-id=0432182f39ed4750","name":"@vitest/mocker","version":"4.1.11","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:\\@vitest\\/mocker:\\@vitest\\/mocker:4.1.11:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40vitest/mocker@4.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-42h9-826w-cgv3","dataSource":"https://github.com/advisories/GHSA-42h9-826w-cgv3","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-42h9-826w-cgv3","https://github.com/axios/axios/pull/11000","https://github.com/axios/axios/pull/11001","https://github.com/axios/axios/commit/1417285c69344bbcc6420a021f67dee0c6fedb2d","https://github.com/axios/axios/commit/32fc489632377d214db55bfa4e2c48486a7d7ce2","https://github.com/axios/axios/releases/tag/v0.33.0","https://github.com/axios/axios/releases/tag/v1.18.0","https://nvd.nist.gov/vuln/detail/CVE-2026-67313","https://nvd.nist.gov/vuln/detail/CVE-2026-68942","https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-formdatatojson"],"description":"Axios: Excessive recursion in formDataToJSON can cause denial of service","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67313","epss":0.00521,"percentile":0.44267,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67313","cwe":"CWE-400","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["1.18.0"],"state":"fixed","available":[{"version":"1.18.0","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.294365},"relatedVulnerabilities":[{"id":"CVE-2026-67313","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-67313","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-42h9-826w-cgv3","https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-formdatatojson"],"description":"axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments. Attackers can supply FormData with field names containing thousands of nested brackets to exhaust the JavaScript call stack and trigger RangeError, causing request failure or process termination in applications that do not handle the exception.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67313","epss":0.00521,"percentile":0.44267,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67313","cwe":"CWE-400","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.15.0"}},"found":{"vulnerabilityID":"GHSA-42h9-826w-cgv3","versionConstraint":">=1.0.0,<1.18.0 (semantic)"},"fix":{"suggestedVersion":"1.18.0"}}],"artifact":{"id":"pkg:npm/axios@1.15.0?package-id=520b8e92ffff8054","name":"axios","version":"1.15.0","type":"npm","locations":[{"path":"/sink/oidc-server/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.15.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.15.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-pmv8-rq9r-6j72","dataSource":"https://github.com/advisories/GHSA-pmv8-rq9r-6j72","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-pmv8-rq9r-6j72","https://github.com/axios/axios/pull/11000","https://github.com/axios/axios/pull/11001","https://github.com/axios/axios/commit/1417285c69344bbcc6420a021f67dee0c6fedb2d","https://github.com/axios/axios/commit/32fc489632377d214db55bfa4e2c48486a7d7ce2","https://github.com/axios/axios/releases/tag/v0.33.0","https://github.com/axios/axios/releases/tag/v1.18.0","https://nvd.nist.gov/vuln/detail/CVE-2026-67312","https://nvd.nist.gov/vuln/detail/CVE-2026-68941","https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-formtojson"],"description":"Axios: Deep formToJSON Key Recursion Can Cause Denial of Service","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67312","epss":0.00521,"percentile":0.44267,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67312","cwe":"CWE-400","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["1.18.0"],"state":"fixed","available":[{"version":"1.18.0","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.294365},"relatedVulnerabilities":[{"id":"CVE-2026-67312","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-67312","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-pmv8-rq9r-6j72","https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-formtojson"],"description":"axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDataToJSON (exposed as axios.formToJSON() and used internally when serializing FormData with Content-Type: application/json). When an application passes attacker-controlled FormData field names, a field name with thousands of nested bracket-delimited segments causes unbounded recursion in buildPath(), exhausting the JavaScript call stack (RangeError: Maximum call stack size exceeded) and causing denial of service for that request, or process termination in applications without appropriate error handling.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67312","epss":0.00521,"percentile":0.44267,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67312","cwe":"CWE-400","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.15.0"}},"found":{"vulnerabilityID":"GHSA-pmv8-rq9r-6j72","versionConstraint":">=1.0.0,<1.18.0 (semantic)"},"fix":{"suggestedVersion":"1.18.0"}}],"artifact":{"id":"pkg:npm/axios@1.15.0?package-id=520b8e92ffff8054","name":"axios","version":"1.15.0","type":"npm","locations":[{"path":"/sink/oidc-server/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.15.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.15.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-42h9-826w-cgv3","dataSource":"https://github.com/advisories/GHSA-42h9-826w-cgv3","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-42h9-826w-cgv3","https://github.com/axios/axios/pull/11000","https://github.com/axios/axios/pull/11001","https://github.com/axios/axios/commit/1417285c69344bbcc6420a021f67dee0c6fedb2d","https://github.com/axios/axios/commit/32fc489632377d214db55bfa4e2c48486a7d7ce2","https://github.com/axios/axios/releases/tag/v0.33.0","https://github.com/axios/axios/releases/tag/v1.18.0","https://nvd.nist.gov/vuln/detail/CVE-2026-67313","https://nvd.nist.gov/vuln/detail/CVE-2026-68942","https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-formdatatojson"],"description":"Axios: Excessive recursion in formDataToJSON can cause denial of service","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67313","epss":0.00521,"percentile":0.44267,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67313","cwe":"CWE-400","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["1.18.0"],"state":"fixed","available":[{"version":"1.18.0","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.294365},"relatedVulnerabilities":[{"id":"CVE-2026-67313","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-67313","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-42h9-826w-cgv3","https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-formdatatojson"],"description":"axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments. Attackers can supply FormData with field names containing thousands of nested brackets to exhaust the JavaScript call stack and trigger RangeError, causing request failure or process termination in applications that do not handle the exception.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67313","epss":0.00521,"percentile":0.44267,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67313","cwe":"CWE-400","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.16.1"}},"found":{"vulnerabilityID":"GHSA-42h9-826w-cgv3","versionConstraint":">=1.0.0,<1.18.0 (semantic)"},"fix":{"suggestedVersion":"1.18.0"}}],"artifact":{"id":"pkg:npm/axios@1.16.1?package-id=8545c428c207f9fb","name":"axios","version":"1.16.1","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.16.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.16.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-pmv8-rq9r-6j72","dataSource":"https://github.com/advisories/GHSA-pmv8-rq9r-6j72","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-pmv8-rq9r-6j72","https://github.com/axios/axios/pull/11000","https://github.com/axios/axios/pull/11001","https://github.com/axios/axios/commit/1417285c69344bbcc6420a021f67dee0c6fedb2d","https://github.com/axios/axios/commit/32fc489632377d214db55bfa4e2c48486a7d7ce2","https://github.com/axios/axios/releases/tag/v0.33.0","https://github.com/axios/axios/releases/tag/v1.18.0","https://nvd.nist.gov/vuln/detail/CVE-2026-67312","https://nvd.nist.gov/vuln/detail/CVE-2026-68941","https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-formtojson"],"description":"Axios: Deep formToJSON Key Recursion Can Cause Denial of Service","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67312","epss":0.00521,"percentile":0.44267,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67312","cwe":"CWE-400","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["1.18.0"],"state":"fixed","available":[{"version":"1.18.0","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.294365},"relatedVulnerabilities":[{"id":"CVE-2026-67312","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-67312","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-pmv8-rq9r-6j72","https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-formtojson"],"description":"axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDataToJSON (exposed as axios.formToJSON() and used internally when serializing FormData with Content-Type: application/json). When an application passes attacker-controlled FormData field names, a field name with thousands of nested bracket-delimited segments causes unbounded recursion in buildPath(), exhausting the JavaScript call stack (RangeError: Maximum call stack size exceeded) and causing denial of service for that request, or process termination in applications without appropriate error handling.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67312","epss":0.00521,"percentile":0.44267,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67312","cwe":"CWE-400","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.16.1"}},"found":{"vulnerabilityID":"GHSA-pmv8-rq9r-6j72","versionConstraint":">=1.0.0,<1.18.0 (semantic)"},"fix":{"suggestedVersion":"1.18.0"}}],"artifact":{"id":"pkg:npm/axios@1.16.1?package-id=8545c428c207f9fb","name":"axios","version":"1.16.1","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.16.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.16.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-w5vr-8v7q-w6rv","dataSource":"https://github.com/advisories/GHSA-w5vr-8v7q-w6rv","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-45819","https://github.com/web-platform-dx/baseline-browser-mapping/pull/137/changes#diff-7ae45ad102eab3b6d7e7896acd08c427a9b25b346470d7bc6507b6481575d519","https://github.com/web-platform-dx/baseline-browser-mapping/blob/b7881aa61c8a057e24468ab5ee18c5ecedbbf691/src/index.ts#L142","https://www.npmjs.com/package/baseline-browser-mapping","https://github.com/web-platform-dx/baseline-browser-mapping/pull/137","https://github.com/web-platform-dx/baseline-browser-mapping/commit/de733e2d8959559f7bb255d5927f3afcb6f31589","https://github.com/web-platform-dx/baseline-browser-mapping/releases/tag/v2.11.0"],"description":"baseline-browser-mapping process termination on invalid input causes denial of service","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","metrics":{"baseScore":6.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-45819","epss":0.00507,"percentile":0.43261,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-45819","cwe":"CWE-705","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-45819","cwe":"CWE-755","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}],"fix":{"versions":["2.11.0"],"state":"fixed","available":[{"version":"2.11.0","date":"2026-09-09","kind":"first-observed"}]},"advisories":[],"risk":0.29406},"relatedVulnerabilities":[{"id":"CVE-2026-45819","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45819","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/web-platform-dx/baseline-browser-mapping/blob/b7881aa61c8a057e24468ab5ee18c5ecedbbf691/src/index.ts#L142","https://github.com/web-platform-dx/baseline-browser-mapping/pull/137/changes#diff-7ae45ad102eab3b6d7e7896acd08c427a9b25b346470d7bc6507b6481575d519","https://www.npmjs.com/package/baseline-browser-mapping"],"description":"baseline-browser-mapping 2.x before 2.11.0 calls process.exit() instead of throwing on invalid or conflicting input parameters, and can trigger immediate process termination, causing denial of service.","cvss":[{"source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","metrics":{"baseScore":6.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-45819","epss":0.00507,"percentile":0.43261,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-45819","cwe":"CWE-705","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-45819","cwe":"CWE-755","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"baseline-browser-mapping","version":"2.8.19"}},"found":{"vulnerabilityID":"GHSA-w5vr-8v7q-w6rv","versionConstraint":">=2.0.0,<2.11.0 (semantic)"},"fix":{"suggestedVersion":"2.11.0"}}],"artifact":{"id":"pkg:npm/baseline-browser-mapping@2.8.19?package-id=0df76bf82ecea19f","name":"baseline-browser-mapping","version":"2.8.19","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["Apache-2.0"],"cpes":["cpe:2.3:a:baseline-browser-mapping:baseline-browser-mapping:2.8.19:*:*:*:*:*:*:*","cpe:2.3:a:baseline-browser-mapping:baseline_browser_mapping:2.8.19:*:*:*:*:*:*:*","cpe:2.3:a:baseline_browser_mapping:baseline-browser-mapping:2.8.19:*:*:*:*:*:*:*","cpe:2.3:a:baseline_browser_mapping:baseline_browser_mapping:2.8.19:*:*:*:*:*:*:*","cpe:2.3:a:baseline-browser:baseline-browser-mapping:2.8.19:*:*:*:*:*:*:*","cpe:2.3:a:baseline-browser:baseline_browser_mapping:2.8.19:*:*:*:*:*:*:*","cpe:2.3:a:baseline_browser:baseline-browser-mapping:2.8.19:*:*:*:*:*:*:*","cpe:2.3:a:baseline_browser:baseline_browser_mapping:2.8.19:*:*:*:*:*:*:*","cpe:2.3:a:baseline:baseline-browser-mapping:2.8.19:*:*:*:*:*:*:*","cpe:2.3:a:baseline:baseline_browser_mapping:2.8.19:*:*:*:*:*:*:*"],"purl":"pkg:npm/baseline-browser-mapping@2.8.19","upstreams":[]}},{"vulnerability":{"id":"GHSA-27r3-jxmh-p828","dataSource":"https://github.com/advisories/GHSA-27r3-jxmh-p828","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/expressjs/body-parser/security/advisories/GHSA-27r3-jxmh-p828","https://nvd.nist.gov/vuln/detail/CVE-2026-111181","https://github.com/expressjs/body-parser/commit/1260c3845f54502a05a87594f09a334786bb34d7","https://github.com/expressjs/body-parser/commit/f7075eae3a84c3473ab4bf0a777da28db208e916","https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/body-parser/releases/tag/1.20.9","https://github.com/expressjs/body-parser/releases/tag/v2.4.0"],"description":"body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111181","epss":0.00388,"percentile":0.32923,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111181","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["1.20.9"],"state":"fixed","available":[{"version":"1.20.9","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.29100000000000004},"relatedVulnerabilities":[{"id":"CVE-2026-111181","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111181","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/body-parser/security/advisories/GHSA-27r3-jxmh-p828"],"description":"body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding such as gzip, body-parser pipes it into a decompression stream and, after reading the body, leaves that stream with no error listener. A payload of one valid compressed frame followed by trailing bytes decodes and the application responds normally, but the trailing bytes then reach the already-finished decoder, which emits an error that is re-thrown as an uncaught exception and terminates the process. No matching route is required because body parsing runs before routing, so any endpoint that parses a body is affected. The issue is fixed in body-parser 2.4.0 and 1.20.9, and users should upgrade to one of those versions or later. As a workaround, disable request-body inflation (set the body-parser inflate option to false) so encoded requests are rejected before any decompression stream is created.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111181","epss":0.00388,"percentile":0.32923,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111181","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"body-parser","version":"1.20.3"}},"found":{"vulnerabilityID":"GHSA-27r3-jxmh-p828","versionConstraint":"<1.20.9 (semantic)"},"fix":{"suggestedVersion":"1.20.9"}}],"artifact":{"id":"pkg:npm/body-parser@1.20.3?package-id=0026492c8e052563","name":"body-parser","version":"1.20.3","type":"npm","locations":[{"path":"/sink/oidc-server/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:openjsf:body-parser:1.20.3:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/body-parser@1.20.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-27r3-jxmh-p828","dataSource":"https://github.com/advisories/GHSA-27r3-jxmh-p828","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/expressjs/body-parser/security/advisories/GHSA-27r3-jxmh-p828","https://nvd.nist.gov/vuln/detail/CVE-2026-111181","https://github.com/expressjs/body-parser/commit/1260c3845f54502a05a87594f09a334786bb34d7","https://github.com/expressjs/body-parser/commit/f7075eae3a84c3473ab4bf0a777da28db208e916","https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/body-parser/releases/tag/1.20.9","https://github.com/expressjs/body-parser/releases/tag/v2.4.0"],"description":"body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111181","epss":0.00388,"percentile":0.32923,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111181","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["1.20.9"],"state":"fixed","available":[{"version":"1.20.9","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.29100000000000004},"relatedVulnerabilities":[{"id":"CVE-2026-111181","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111181","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/body-parser/security/advisories/GHSA-27r3-jxmh-p828"],"description":"body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding such as gzip, body-parser pipes it into a decompression stream and, after reading the body, leaves that stream with no error listener. A payload of one valid compressed frame followed by trailing bytes decodes and the application responds normally, but the trailing bytes then reach the already-finished decoder, which emits an error that is re-thrown as an uncaught exception and terminates the process. No matching route is required because body parsing runs before routing, so any endpoint that parses a body is affected. The issue is fixed in body-parser 2.4.0 and 1.20.9, and users should upgrade to one of those versions or later. As a workaround, disable request-body inflation (set the body-parser inflate option to false) so encoded requests are rejected before any decompression stream is created.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111181","epss":0.00388,"percentile":0.32923,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111181","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"body-parser","version":"1.20.6"}},"found":{"vulnerabilityID":"GHSA-27r3-jxmh-p828","versionConstraint":"<1.20.9 (semantic)"},"fix":{"suggestedVersion":"1.20.9"}}],"artifact":{"id":"pkg:npm/body-parser@1.20.6?package-id=c53798c49b5a1ea0","name":"body-parser","version":"1.20.6","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:openjsf:body-parser:1.20.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/body-parser@1.20.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-27r3-jxmh-p828","dataSource":"https://github.com/advisories/GHSA-27r3-jxmh-p828","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/expressjs/body-parser/security/advisories/GHSA-27r3-jxmh-p828","https://nvd.nist.gov/vuln/detail/CVE-2026-111181","https://github.com/expressjs/body-parser/commit/1260c3845f54502a05a87594f09a334786bb34d7","https://github.com/expressjs/body-parser/commit/f7075eae3a84c3473ab4bf0a777da28db208e916","https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/body-parser/releases/tag/1.20.9","https://github.com/expressjs/body-parser/releases/tag/v2.4.0"],"description":"body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111181","epss":0.00388,"percentile":0.32923,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111181","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["2.4.0"],"state":"fixed","available":[{"version":"2.4.0","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.29100000000000004},"relatedVulnerabilities":[{"id":"CVE-2026-111181","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111181","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/body-parser/security/advisories/GHSA-27r3-jxmh-p828"],"description":"body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding such as gzip, body-parser pipes it into a decompression stream and, after reading the body, leaves that stream with no error listener. A payload of one valid compressed frame followed by trailing bytes decodes and the application responds normally, but the trailing bytes then reach the already-finished decoder, which emits an error that is re-thrown as an uncaught exception and terminates the process. No matching route is required because body parsing runs before routing, so any endpoint that parses a body is affected. The issue is fixed in body-parser 2.4.0 and 1.20.9, and users should upgrade to one of those versions or later. As a workaround, disable request-body inflation (set the body-parser inflate option to false) so encoded requests are rejected before any decompression stream is created.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111181","epss":0.00388,"percentile":0.32923,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111181","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"body-parser","version":"2.2.2"}},"found":{"vulnerabilityID":"GHSA-27r3-jxmh-p828","versionConstraint":">=2.0.0,<2.4.0 (semantic)"},"fix":{"suggestedVersion":"2.4.0"}}],"artifact":{"id":"pkg:npm/body-parser@2.2.2?package-id=d62d872155de6806","name":"body-parser","version":"2.2.2","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:openjsf:body-parser:2.2.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/body-parser@2.2.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-j8rh-479h-cp32","dataSource":"https://github.com/advisories/GHSA-j8rh-479h-cp32","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-j8rh-479h-cp32","https://nvd.nist.gov/vuln/detail/CVE-2026-101904","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/releases/tag/v1.20.0"],"description":"Axios: Header Injection via Inherited headers After Minimal Interceptor","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101904","epss":0.00488,"percentile":0.42046,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101904","cwe":"CWE-74","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-101904","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["1.20.0"],"state":"fixed","available":[{"version":"1.20.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.29035999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-101904","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101904","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/axios/axios/security/advisories/GHSA-j8rh-479h-cp32"],"description":"Axios is a promise-based HTTP client for the browser and Node.js. From 1.0.0 until 1.20.0, the dispatchRequest function normalizes inherited Object.prototype.headers from a replacement request configuration. A separate same-process prototype-pollution flaw sets Object.prototype.headers, and trusted request interceptors return a new ordinary configuration without an own headers property. After the interceptor chain, dispatchRequest resolves the inherited headers during normalization. Downstream request processing can observe attacker-controlled headers, including authorization-related values. This issue is fixed in version 1.20.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101904","epss":0.00488,"percentile":0.42046,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101904","cwe":"CWE-74","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-101904","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.15.0"}},"found":{"vulnerabilityID":"GHSA-j8rh-479h-cp32","versionConstraint":">=1.0.0,<1.20.0 (semantic)"},"fix":{"suggestedVersion":"1.20.0"}}],"artifact":{"id":"pkg:npm/axios@1.15.0?package-id=520b8e92ffff8054","name":"axios","version":"1.15.0","type":"npm","locations":[{"path":"/sink/oidc-server/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.15.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.15.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-j8rh-479h-cp32","dataSource":"https://github.com/advisories/GHSA-j8rh-479h-cp32","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-j8rh-479h-cp32","https://nvd.nist.gov/vuln/detail/CVE-2026-101904","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/releases/tag/v1.20.0"],"description":"Axios: Header Injection via Inherited headers After Minimal Interceptor","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101904","epss":0.00488,"percentile":0.42046,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101904","cwe":"CWE-74","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-101904","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["1.20.0"],"state":"fixed","available":[{"version":"1.20.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.29035999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-101904","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101904","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/axios/axios/security/advisories/GHSA-j8rh-479h-cp32"],"description":"Axios is a promise-based HTTP client for the browser and Node.js. From 1.0.0 until 1.20.0, the dispatchRequest function normalizes inherited Object.prototype.headers from a replacement request configuration. A separate same-process prototype-pollution flaw sets Object.prototype.headers, and trusted request interceptors return a new ordinary configuration without an own headers property. After the interceptor chain, dispatchRequest resolves the inherited headers during normalization. Downstream request processing can observe attacker-controlled headers, including authorization-related values. This issue is fixed in version 1.20.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101904","epss":0.00488,"percentile":0.42046,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101904","cwe":"CWE-74","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-101904","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.16.1"}},"found":{"vulnerabilityID":"GHSA-j8rh-479h-cp32","versionConstraint":">=1.0.0,<1.20.0 (semantic)"},"fix":{"suggestedVersion":"1.20.0"}}],"artifact":{"id":"pkg:npm/axios@1.16.1?package-id=8545c428c207f9fb","name":"axios","version":"1.16.1","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.16.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.16.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-j8rh-479h-cp32","dataSource":"https://github.com/advisories/GHSA-j8rh-479h-cp32","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-j8rh-479h-cp32","https://nvd.nist.gov/vuln/detail/CVE-2026-101904","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/releases/tag/v1.20.0"],"description":"Axios: Header Injection via Inherited headers After Minimal Interceptor","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101904","epss":0.00488,"percentile":0.42046,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101904","cwe":"CWE-74","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-101904","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["1.20.0"],"state":"fixed","available":[{"version":"1.20.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.29035999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-101904","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101904","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/axios/axios/security/advisories/GHSA-j8rh-479h-cp32"],"description":"Axios is a promise-based HTTP client for the browser and Node.js. From 1.0.0 until 1.20.0, the dispatchRequest function normalizes inherited Object.prototype.headers from a replacement request configuration. A separate same-process prototype-pollution flaw sets Object.prototype.headers, and trusted request interceptors return a new ordinary configuration without an own headers property. After the interceptor chain, dispatchRequest resolves the inherited headers during normalization. Downstream request processing can observe attacker-controlled headers, including authorization-related values. This issue is fixed in version 1.20.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101904","epss":0.00488,"percentile":0.42046,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101904","cwe":"CWE-74","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-101904","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.18.1"}},"found":{"vulnerabilityID":"GHSA-j8rh-479h-cp32","versionConstraint":">=1.0.0,<1.20.0 (semantic)"},"fix":{"suggestedVersion":"1.20.0"}}],"artifact":{"id":"pkg:npm/axios@1.18.1?package-id=1350ab3e8bd97544","name":"axios","version":"1.18.1","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.18.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.18.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-955p-x3mx-jcvp","dataSource":"https://github.com/advisories/GHSA-955p-x3mx-jcvp","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp","https://github.com/vercel/next.js/commit/1b0c3ae912a3ad925c60065cc8d55b070fa8bcd3","https://github.com/vercel/next.js/commit/ff12a6124e1504f17b62de948b8a553fdecaef7b","https://github.com/vercel/next.js/releases/tag/v15.5.21","https://github.com/vercel/next.js/releases/tag/v16.2.11"],"description":"Next.js: Unauthenticated disclosure of internal Server Function endpoints","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-64643","epss":0.0051,"percentile":0.43521,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-64643","cwe":"CWE-201","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["16.2.11"],"state":"fixed","available":[{"version":"16.2.11","date":"2026-07-23","kind":"first-observed"}]},"advisories":[],"risk":0.28815},"relatedVulnerabilities":[{"id":"CVE-2026-64643","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64643","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/vercel/next.js/commit/1b0c3ae912a3ad925c60065cc8d55b070fa8bcd3","https://github.com/vercel/next.js/commit/ff12a6124e1504f17b62de948b8a553fdecaef7b","https://github.com/vercel/next.js/releases/tag/v15.5.21","https://github.com/vercel/next.js/releases/tag/v16.2.11","https://github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp"],"description":"Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, Next.js applications using App Router, Server Actions (use server) or use cache endpoints can be disclosed bypassing any authentication on the pages where these endpoints are usually used. Server Action IDs can be disclosed to unauthenticated users via publicly served client artifacts (for example, static chunks containing action references). Affected users are applications using App Router and Server Actions. By itself, this disclosure is typically a recon/enumeration primitive; however, it can increase risk when combined with other weaknesses. This issue has been fixed in versions 15.5.21 and 16.2.11.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-64643","epss":0.0051,"percentile":0.43521,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-64643","cwe":"CWE-201","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"next","version":"16.1.7"}},"found":{"vulnerabilityID":"GHSA-955p-x3mx-jcvp","versionConstraint":">=16.0.0,<16.2.11 (semantic)"},"fix":{"suggestedVersion":"16.2.11"}}],"artifact":{"id":"pkg:npm/next@16.1.7?package-id=662de087d22e519d","name":"next","version":"16.1.7","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vercel:next.js:16.1.7:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/next@16.1.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-82fw-gwwq-j7x9","dataSource":"https://github.com/advisories/GHSA-82fw-gwwq-j7x9","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/vitest-dev/vitest/security/advisories/GHSA-82fw-gwwq-j7x9","https://nvd.nist.gov/vuln/detail/CVE-2026-84373","https://github.com/vitest-dev/vitest/pull/10972","https://github.com/vitest-dev/vitest/pull/10974","https://github.com/vitest-dev/vitest/commit/51edf2b072902aec6d30c90ebaafd8f121c6f9d8","https://github.com/vitest-dev/vitest/commit/8ff9b9a9efca7c6cfd5243569440de8d7a33aec4","https://github.com/vitest-dev/vitest/commit/fe5a11d3ceac5ec10d6d7d21a46d4caca132c48f","https://github.com/vitest-dev/vitest/releases/tag/v4.1.11","https://github.com/vitest-dev/vitest/releases/tag/v5.0.0-rc.2"],"description":"Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84373","epss":0.00527,"percentile":0.44677,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84373","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.1.11"],"state":"fixed","available":[{"version":"4.1.11","date":"2026-09-09","kind":"first-observed"}]},"advisories":[],"risk":0.28721500000000005},"relatedVulnerabilities":[{"id":"CVE-2026-84373","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84373","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/vitest-dev/vitest/commit/51edf2b072902aec6d30c90ebaafd8f121c6f9d8","https://github.com/vitest-dev/vitest/commit/8ff9b9a9efca7c6cfd5243569440de8d7a33aec4","https://github.com/vitest-dev/vitest/commit/fe5a11d3ceac5ec10d6d7d21a46d4caca132c48f","https://github.com/vitest-dev/vitest/pull/10972","https://github.com/vitest-dev/vitest/pull/10974","https://github.com/vitest-dev/vitest/releases/tag/v4.1.11","https://github.com/vitest-dev/vitest/releases/tag/v5.0.0-rc.2","https://github.com/vitest-dev/vitest/security/advisories/GHSA-82fw-gwwq-j7x9"],"description":"Vitest is a testing framework powered by Vite. From 2.1.0 until 4.1.11 and 5.0.0-rc.2, the public mockerPlugin and standalone interceptorPlugin exports in packages/mocker/src/node/interceptorPlugin.ts register the vitest:interceptor:register handler on Vite's unauthenticated HMR WebSocket without validating redirect targets against the file-serving allowlist. The implementation processes event.redirect without enforcing server.fs.allow and server.fs.deny through isFileLoadingAllowed. A remote client that can reach an exposed development server can submit an opaque URL scheme preserving .. segments, causing join(server.config.root, redirectUrl.pathname) to resolve outside the project root. The plugin's load hook then returns readFile(mock.redirect, 'utf-8') as module source, disclosing local files readable by the dev-server process. Vitest browser mode uses a token-authenticated RPC and is not remotely unauthenticated by default, although the same boundary check was missing on that path. This issue is fixed in versions 4.1.11 and 5.0.0-rc.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84373","epss":0.00527,"percentile":0.44677,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84373","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@vitest/mocker","version":"3.2.4"}},"found":{"vulnerabilityID":"GHSA-82fw-gwwq-j7x9","versionConstraint":">=2.1.0,<4.1.11 (semantic)"},"fix":{"suggestedVersion":"4.1.11"}}],"artifact":{"id":"pkg:npm/%40vitest/mocker@3.2.4?package-id=6912e5a1f712edf6","name":"@vitest/mocker","version":"3.2.4","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:\\@vitest\\/mocker:\\@vitest\\/mocker:3.2.4:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40vitest/mocker@3.2.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-82fw-gwwq-j7x9","dataSource":"https://github.com/advisories/GHSA-82fw-gwwq-j7x9","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/vitest-dev/vitest/security/advisories/GHSA-82fw-gwwq-j7x9","https://nvd.nist.gov/vuln/detail/CVE-2026-84373","https://github.com/vitest-dev/vitest/pull/10972","https://github.com/vitest-dev/vitest/pull/10974","https://github.com/vitest-dev/vitest/commit/51edf2b072902aec6d30c90ebaafd8f121c6f9d8","https://github.com/vitest-dev/vitest/commit/8ff9b9a9efca7c6cfd5243569440de8d7a33aec4","https://github.com/vitest-dev/vitest/commit/fe5a11d3ceac5ec10d6d7d21a46d4caca132c48f","https://github.com/vitest-dev/vitest/releases/tag/v4.1.11","https://github.com/vitest-dev/vitest/releases/tag/v5.0.0-rc.2"],"description":"Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84373","epss":0.00527,"percentile":0.44677,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84373","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.1.11"],"state":"fixed","available":[{"version":"4.1.11","date":"2026-09-09","kind":"first-observed"}]},"advisories":[],"risk":0.28721500000000005},"relatedVulnerabilities":[{"id":"CVE-2026-84373","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84373","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/vitest-dev/vitest/commit/51edf2b072902aec6d30c90ebaafd8f121c6f9d8","https://github.com/vitest-dev/vitest/commit/8ff9b9a9efca7c6cfd5243569440de8d7a33aec4","https://github.com/vitest-dev/vitest/commit/fe5a11d3ceac5ec10d6d7d21a46d4caca132c48f","https://github.com/vitest-dev/vitest/pull/10972","https://github.com/vitest-dev/vitest/pull/10974","https://github.com/vitest-dev/vitest/releases/tag/v4.1.11","https://github.com/vitest-dev/vitest/releases/tag/v5.0.0-rc.2","https://github.com/vitest-dev/vitest/security/advisories/GHSA-82fw-gwwq-j7x9"],"description":"Vitest is a testing framework powered by Vite. From 2.1.0 until 4.1.11 and 5.0.0-rc.2, the public mockerPlugin and standalone interceptorPlugin exports in packages/mocker/src/node/interceptorPlugin.ts register the vitest:interceptor:register handler on Vite's unauthenticated HMR WebSocket without validating redirect targets against the file-serving allowlist. The implementation processes event.redirect without enforcing server.fs.allow and server.fs.deny through isFileLoadingAllowed. A remote client that can reach an exposed development server can submit an opaque URL scheme preserving .. segments, causing join(server.config.root, redirectUrl.pathname) to resolve outside the project root. The plugin's load hook then returns readFile(mock.redirect, 'utf-8') as module source, disclosing local files readable by the dev-server process. Vitest browser mode uses a token-authenticated RPC and is not remotely unauthenticated by default, although the same boundary check was missing on that path. This issue is fixed in versions 4.1.11 and 5.0.0-rc.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84373","epss":0.00527,"percentile":0.44677,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84373","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@vitest/mocker","version":"3.2.7"}},"found":{"vulnerabilityID":"GHSA-82fw-gwwq-j7x9","versionConstraint":">=2.1.0,<4.1.11 (semantic)"},"fix":{"suggestedVersion":"4.1.11"}}],"artifact":{"id":"pkg:npm/%40vitest/mocker@3.2.7?package-id=23876eef3f02174f","name":"@vitest/mocker","version":"3.2.7","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:\\@vitest\\/mocker:\\@vitest\\/mocker:3.2.7:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40vitest/mocker@3.2.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-82fw-gwwq-j7x9","dataSource":"https://github.com/advisories/GHSA-82fw-gwwq-j7x9","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/vitest-dev/vitest/security/advisories/GHSA-82fw-gwwq-j7x9","https://nvd.nist.gov/vuln/detail/CVE-2026-84373","https://github.com/vitest-dev/vitest/pull/10972","https://github.com/vitest-dev/vitest/pull/10974","https://github.com/vitest-dev/vitest/commit/51edf2b072902aec6d30c90ebaafd8f121c6f9d8","https://github.com/vitest-dev/vitest/commit/8ff9b9a9efca7c6cfd5243569440de8d7a33aec4","https://github.com/vitest-dev/vitest/commit/fe5a11d3ceac5ec10d6d7d21a46d4caca132c48f","https://github.com/vitest-dev/vitest/releases/tag/v4.1.11","https://github.com/vitest-dev/vitest/releases/tag/v5.0.0-rc.2"],"description":"Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84373","epss":0.00527,"percentile":0.44677,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84373","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.1.11"],"state":"fixed","available":[{"version":"4.1.11","date":"2026-09-09","kind":"first-observed"}]},"advisories":[],"risk":0.28721500000000005},"relatedVulnerabilities":[{"id":"CVE-2026-84373","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84373","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/vitest-dev/vitest/commit/51edf2b072902aec6d30c90ebaafd8f121c6f9d8","https://github.com/vitest-dev/vitest/commit/8ff9b9a9efca7c6cfd5243569440de8d7a33aec4","https://github.com/vitest-dev/vitest/commit/fe5a11d3ceac5ec10d6d7d21a46d4caca132c48f","https://github.com/vitest-dev/vitest/pull/10972","https://github.com/vitest-dev/vitest/pull/10974","https://github.com/vitest-dev/vitest/releases/tag/v4.1.11","https://github.com/vitest-dev/vitest/releases/tag/v5.0.0-rc.2","https://github.com/vitest-dev/vitest/security/advisories/GHSA-82fw-gwwq-j7x9"],"description":"Vitest is a testing framework powered by Vite. From 2.1.0 until 4.1.11 and 5.0.0-rc.2, the public mockerPlugin and standalone interceptorPlugin exports in packages/mocker/src/node/interceptorPlugin.ts register the vitest:interceptor:register handler on Vite's unauthenticated HMR WebSocket without validating redirect targets against the file-serving allowlist. The implementation processes event.redirect without enforcing server.fs.allow and server.fs.deny through isFileLoadingAllowed. A remote client that can reach an exposed development server can submit an opaque URL scheme preserving .. segments, causing join(server.config.root, redirectUrl.pathname) to resolve outside the project root. The plugin's load hook then returns readFile(mock.redirect, 'utf-8') as module source, disclosing local files readable by the dev-server process. Vitest browser mode uses a token-authenticated RPC and is not remotely unauthenticated by default, although the same boundary check was missing on that path. This issue is fixed in versions 4.1.11 and 5.0.0-rc.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84373","epss":0.00527,"percentile":0.44677,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84373","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"vitest","version":"3.2.4"}},"found":{"vulnerabilityID":"GHSA-82fw-gwwq-j7x9","versionConstraint":">=2.1.0,<4.1.11 (semantic)"},"fix":{"suggestedVersion":"4.1.11"}}],"artifact":{"id":"pkg:npm/vitest@3.2.4?package-id=dd5686aba11d6a74","name":"vitest","version":"3.2.4","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vitest.dev:vitest:3.2.4:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/vitest@3.2.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-82fw-gwwq-j7x9","dataSource":"https://github.com/advisories/GHSA-82fw-gwwq-j7x9","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/vitest-dev/vitest/security/advisories/GHSA-82fw-gwwq-j7x9","https://nvd.nist.gov/vuln/detail/CVE-2026-84373","https://github.com/vitest-dev/vitest/pull/10972","https://github.com/vitest-dev/vitest/pull/10974","https://github.com/vitest-dev/vitest/commit/51edf2b072902aec6d30c90ebaafd8f121c6f9d8","https://github.com/vitest-dev/vitest/commit/8ff9b9a9efca7c6cfd5243569440de8d7a33aec4","https://github.com/vitest-dev/vitest/commit/fe5a11d3ceac5ec10d6d7d21a46d4caca132c48f","https://github.com/vitest-dev/vitest/releases/tag/v4.1.11","https://github.com/vitest-dev/vitest/releases/tag/v5.0.0-rc.2"],"description":"Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84373","epss":0.00527,"percentile":0.44677,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84373","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.1.11"],"state":"fixed","available":[{"version":"4.1.11","date":"2026-09-09","kind":"first-observed"}]},"advisories":[],"risk":0.28721500000000005},"relatedVulnerabilities":[{"id":"CVE-2026-84373","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84373","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/vitest-dev/vitest/commit/51edf2b072902aec6d30c90ebaafd8f121c6f9d8","https://github.com/vitest-dev/vitest/commit/8ff9b9a9efca7c6cfd5243569440de8d7a33aec4","https://github.com/vitest-dev/vitest/commit/fe5a11d3ceac5ec10d6d7d21a46d4caca132c48f","https://github.com/vitest-dev/vitest/pull/10972","https://github.com/vitest-dev/vitest/pull/10974","https://github.com/vitest-dev/vitest/releases/tag/v4.1.11","https://github.com/vitest-dev/vitest/releases/tag/v5.0.0-rc.2","https://github.com/vitest-dev/vitest/security/advisories/GHSA-82fw-gwwq-j7x9"],"description":"Vitest is a testing framework powered by Vite. From 2.1.0 until 4.1.11 and 5.0.0-rc.2, the public mockerPlugin and standalone interceptorPlugin exports in packages/mocker/src/node/interceptorPlugin.ts register the vitest:interceptor:register handler on Vite's unauthenticated HMR WebSocket without validating redirect targets against the file-serving allowlist. The implementation processes event.redirect without enforcing server.fs.allow and server.fs.deny through isFileLoadingAllowed. A remote client that can reach an exposed development server can submit an opaque URL scheme preserving .. segments, causing join(server.config.root, redirectUrl.pathname) to resolve outside the project root. The plugin's load hook then returns readFile(mock.redirect, 'utf-8') as module source, disclosing local files readable by the dev-server process. Vitest browser mode uses a token-authenticated RPC and is not remotely unauthenticated by default, although the same boundary check was missing on that path. This issue is fixed in versions 4.1.11 and 5.0.0-rc.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84373","epss":0.00527,"percentile":0.44677,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84373","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"vitest","version":"3.2.7"}},"found":{"vulnerabilityID":"GHSA-82fw-gwwq-j7x9","versionConstraint":">=2.1.0,<4.1.11 (semantic)"},"fix":{"suggestedVersion":"4.1.11"}}],"artifact":{"id":"pkg:npm/vitest@3.2.7?package-id=c27344b7c86e9b44","name":"vitest","version":"3.2.7","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vitest.dev:vitest:3.2.7:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/vitest@3.2.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-7p8r-x3mc-p8w7","dataSource":"https://github.com/advisories/GHSA-7p8r-x3mc-p8w7","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-7p8r-x3mc-p8w7","https://nvd.nist.gov/vuln/detail/CVE-2026-18446","https://github.com/fastify/fast-uri/commit/f3c6c905f47831007490f466c5945012e905cc52","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v4.1.2"],"description":"fast-uri vulnerable to host confusion via backslash authority introducer","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-18446","epss":0.0038,"percentile":0.32009,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-18446","cwe":"CWE-436","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["3.1.5"],"state":"fixed","available":[{"version":"3.1.5","date":"2026-08-04","kind":"first-observed"}]},"advisories":[],"risk":0.28500000000000003},"relatedVulnerabilities":[{"id":"CVE-2026-18446","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18446","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-7p8r-x3mc-p8w7"],"description":"fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based introducer in place of it (backslash backslash, forward slash backslash, or backslash forward slash) is parsed with no authority and folds into the path. Node's native WHATWG URL parser instead treats a backslash as interchangeable with a forward slash for special schemes, so the two parsers extract different hosts from the same input. Applications that use fast-uri to enforce host based policy such as allowlists, SSRF filtering, or redirect validation before passing the same URL into Node's URL or fetch consumers can be steered to an unintended host. Upgrade to fast-uri 4.1.2, 3.1.5, or 2.4.4.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-18446","epss":0.0038,"percentile":0.32009,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-18446","cwe":"CWE-436","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"3.1.0"}},"found":{"vulnerabilityID":"GHSA-7p8r-x3mc-p8w7","versionConstraint":">=3.0.0,<3.1.5 (semantic)"},"fix":{"suggestedVersion":"3.1.5"}}],"artifact":{"id":"pkg:npm/fast-uri@3.1.0?package-id=a87bf2e2258cda95","name":"fast-uri","version":"3.1.0","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:openjsf:fast-uri:3.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@3.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-vfpm-58rq-9qcg","dataSource":"https://github.com/advisories/GHSA-vfpm-58rq-9qcg","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/vitejs/vite/security/advisories/GHSA-vfpm-58rq-9qcg","https://nvd.nist.gov/vuln/detail/CVE-2026-112947","https://github.com/vitejs/vite/pull/23655","https://github.com/vitejs/vite/commit/b6c6d2fb3f853aab4092dc25f0d6816a96c23dff","https://github.com/vitejs/vite/commit/ba8b7ab43b4afa5d0292ab4b6e3a7b5033cc9c73"],"description":"Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112947","epss":0.00502,"percentile":0.42987,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112947","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-112947","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-112947","cwe":"CWE-209","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["8.2.4"],"state":"fixed","available":[{"version":"8.2.4","date":"2026-10-22","kind":"first-observed"}]},"advisories":[],"risk":0.28363},"relatedVulnerabilities":[{"id":"CVE-2026-112947","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112947","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/vitejs/vite/commit/b6c6d2fb3f853aab4092dc25f0d6816a96c23dff","https://github.com/vitejs/vite/commit/ba8b7ab43b4afa5d0292ab4b6e3a7b5033cc9c73","https://github.com/vitejs/vite/pull/23655","https://github.com/vitejs/vite/security/advisories/GHSA-vfpm-58rq-9qcg"],"description":"Vite is a frontend tooling framework for JavaScript. From 8.2.0 until 8.2.4 and 8.3.3, the first 4 bytes of files outside of server.fs setting can be returned to the browser by a request containing ?vite-wasm-instance. Requests containing the ?vite-wasm-instance query are handled by the internal Wasm plugin's load hook. The hook removes the query and reads the resulting path directly from disk, but the server.fs checks were not applied. After reading the file, Vite attempts to parse it as WebAssembly. When that parse fails, Node and deno throws an error that contains the first 4 bytes of the file. This vulnerability is fixed in 8.2.4 and 8.3.3.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112947","epss":0.00502,"percentile":0.42987,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112947","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-112947","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-112947","cwe":"CWE-209","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"vite","version":"8.2.2"}},"found":{"vulnerabilityID":"GHSA-vfpm-58rq-9qcg","versionConstraint":">=8.2.0,<=8.2.3 (semantic)"},"fix":{"suggestedVersion":"8.2.4"}}],"artifact":{"id":"pkg:npm/vite@8.2.2?package-id=ae073bacc7b8ee83","name":"vite","version":"8.2.2","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vitejs:vite:8.2.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/vite@8.2.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-vh66-26gq-q6x8","dataSource":"https://github.com/advisories/GHSA-vh66-26gq-q6x8","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-vh66-26gq-q6x8","https://nvd.nist.gov/vuln/detail/CVE-2026-101908","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/releases/tag/v1.20.0"],"description":"Axios: Prototype pollution gadget in fetch adapter can alter outbound requests","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101908","epss":0.00471,"percentile":0.40719,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101908","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.20.0"],"state":"fixed","available":[{"version":"1.20.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.28024499999999997},"relatedVulnerabilities":[{"id":"CVE-2026-101908","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101908","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/axios/axios/security/advisories/GHSA-vh66-26gq-q6x8"],"description":"Axios is a promise-based HTTP client for the browser and Node.js. From 1.7.0 until 1.20.0, the fetch adapter constructs a Request with sanitized resolvedOptions but then calls fetch with the original fetchOptions. A separate same-process prototype-pollution flaw populates Object.prototype.headers so fetchOptions.headers resolves through inheritance. The inherited fetchOptions.headers value overrides the sanitized Request headers through the second argument to fetch after Request construction. Attacker-controlled request headers can alter authorization, caching, metadata-service access, or application-specific behavior. This issue is fixed in version 1.20.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101908","epss":0.00471,"percentile":0.40719,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101908","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.15.0"}},"found":{"vulnerabilityID":"GHSA-vh66-26gq-q6x8","versionConstraint":">=1.7.0,<1.20.0 (semantic)"},"fix":{"suggestedVersion":"1.20.0"}}],"artifact":{"id":"pkg:npm/axios@1.15.0?package-id=520b8e92ffff8054","name":"axios","version":"1.15.0","type":"npm","locations":[{"path":"/sink/oidc-server/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.15.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.15.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-vh66-26gq-q6x8","dataSource":"https://github.com/advisories/GHSA-vh66-26gq-q6x8","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-vh66-26gq-q6x8","https://nvd.nist.gov/vuln/detail/CVE-2026-101908","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/releases/tag/v1.20.0"],"description":"Axios: Prototype pollution gadget in fetch adapter can alter outbound requests","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101908","epss":0.00471,"percentile":0.40719,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101908","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.20.0"],"state":"fixed","available":[{"version":"1.20.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.28024499999999997},"relatedVulnerabilities":[{"id":"CVE-2026-101908","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101908","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/axios/axios/security/advisories/GHSA-vh66-26gq-q6x8"],"description":"Axios is a promise-based HTTP client for the browser and Node.js. From 1.7.0 until 1.20.0, the fetch adapter constructs a Request with sanitized resolvedOptions but then calls fetch with the original fetchOptions. A separate same-process prototype-pollution flaw populates Object.prototype.headers so fetchOptions.headers resolves through inheritance. The inherited fetchOptions.headers value overrides the sanitized Request headers through the second argument to fetch after Request construction. Attacker-controlled request headers can alter authorization, caching, metadata-service access, or application-specific behavior. This issue is fixed in version 1.20.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101908","epss":0.00471,"percentile":0.40719,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101908","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.16.1"}},"found":{"vulnerabilityID":"GHSA-vh66-26gq-q6x8","versionConstraint":">=1.7.0,<1.20.0 (semantic)"},"fix":{"suggestedVersion":"1.20.0"}}],"artifact":{"id":"pkg:npm/axios@1.16.1?package-id=8545c428c207f9fb","name":"axios","version":"1.16.1","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.16.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.16.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-vh66-26gq-q6x8","dataSource":"https://github.com/advisories/GHSA-vh66-26gq-q6x8","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-vh66-26gq-q6x8","https://nvd.nist.gov/vuln/detail/CVE-2026-101908","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/releases/tag/v1.20.0"],"description":"Axios: Prototype pollution gadget in fetch adapter can alter outbound requests","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101908","epss":0.00471,"percentile":0.40719,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101908","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.20.0"],"state":"fixed","available":[{"version":"1.20.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.28024499999999997},"relatedVulnerabilities":[{"id":"CVE-2026-101908","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101908","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/axios/axios/security/advisories/GHSA-vh66-26gq-q6x8"],"description":"Axios is a promise-based HTTP client for the browser and Node.js. From 1.7.0 until 1.20.0, the fetch adapter constructs a Request with sanitized resolvedOptions but then calls fetch with the original fetchOptions. A separate same-process prototype-pollution flaw populates Object.prototype.headers so fetchOptions.headers resolves through inheritance. The inherited fetchOptions.headers value overrides the sanitized Request headers through the second argument to fetch after Request construction. Attacker-controlled request headers can alter authorization, caching, metadata-service access, or application-specific behavior. This issue is fixed in version 1.20.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101908","epss":0.00471,"percentile":0.40719,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101908","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.18.1"}},"found":{"vulnerabilityID":"GHSA-vh66-26gq-q6x8","versionConstraint":">=1.7.0,<1.20.0 (semantic)"},"fix":{"suggestedVersion":"1.20.0"}}],"artifact":{"id":"pkg:npm/axios@1.18.1?package-id=1350ab3e8bd97544","name":"axios","version":"1.18.1","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.18.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.18.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-22jm-h49p-29qw","dataSource":"https://github.com/advisories/GHSA-22jm-h49p-29qw","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-22jm-h49p-29qw","https://github.com/modelcontextprotocol/typescript-sdk/pull/2925","https://github.com/modelcontextprotocol/typescript-sdk/commit/727075b5bbeb77fbea22041b36b72a73042160fa"],"description":"MCP TypeScript SDK: Experimental tasks were not tied to the session that created them","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","metrics":{"baseScore":8.6,"exploitabilityScore":3.9,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111767","epss":0.00345,"percentile":0.28049,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111767","cwe":"CWE-639","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-111767","cwe":"CWE-862","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["1.32.0"],"state":"fixed","available":[{"version":"1.32.0","date":"2026-10-21","kind":"first-observed"}]},"advisories":[],"risk":0.277725},"relatedVulnerabilities":[{"id":"CVE-2026-111767","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111767","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/modelcontextprotocol/typescript-sdk/commit/727075b5bbeb77fbea22041b36b72a73042160fa","https://github.com/modelcontextprotocol/typescript-sdk/pull/2925","https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-22jm-h49p-29qw"],"description":"MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.24.0 to before version 1.32.0, the experimental tasks feature (taskStore) did not check which session created a task. Clients sharing one InMemoryTaskStore could list, read and cancel each other's tasks. This issue has been patched in version 1.32.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","metrics":{"baseScore":8.6,"exploitabilityScore":3.9,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111767","epss":0.00345,"percentile":0.28049,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111767","cwe":"CWE-639","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-111767","cwe":"CWE-862","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@modelcontextprotocol/sdk","version":"1.29.0"}},"found":{"vulnerabilityID":"GHSA-22jm-h49p-29qw","versionConstraint":">=1.24.0,<1.32.0 (semantic)"},"fix":{"suggestedVersion":"1.32.0"}}],"artifact":{"id":"pkg:npm/%40modelcontextprotocol/sdk@1.29.0?package-id=0c66cca13b59eb9b","name":"@modelcontextprotocol/sdk","version":"1.29.0","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:\\@modelcontextprotocol\\/sdk:\\@modelcontextprotocol\\/sdk:1.29.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40modelcontextprotocol/sdk@1.29.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-vxq7-64xx-v4gw","dataSource":"https://github.com/advisories/GHSA-vxq7-64xx-v4gw","namespace":"github:language:python","severity":"High","urls":["https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw","https://nvd.nist.gov/vuln/detail/CVE-2026-97689","https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed","https://github.com/urllib3/urllib3/releases/tag/2.8.0"],"description":"urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","metrics":{"baseScore":8.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-97689","epss":0.00335,"percentile":0.26859,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-97689","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.8.0"],"state":"fixed","available":[{"version":"2.8.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.27470000000000006},"relatedVulnerabilities":[{"id":"CVE-2026-97689","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97689","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed","https://github.com/urllib3/urllib3/releases/tag/2.8.0","https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw"],"description":"urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a length bound. The trigger is that a malicious server returns Transfer-Encoding: chunked followed by a very long run of bytes without a newline. The attack mechanism is that a malicious HTTP server sends a very long unterminated chunk-size line. The impact is that unbounded memory allocation can exhaust the client process. This issue is fixed in version 2.8.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-97689","epss":0.00335,"percentile":0.26859,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-97689","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"urllib3","version":"2.6.3"}},"found":{"vulnerabilityID":"GHSA-vxq7-64xx-v4gw","versionConstraint":">=1.10.3,<2.8.0 (python)"},"fix":{"suggestedVersion":"2.8.0"}}],"artifact":{"id":"pkg:pypi/urllib3@2.6.3?package-id=0526caf26f90afee","name":"urllib3","version":"2.6.3","type":"python","locations":[{"path":"/backend/bdd/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python:urllib3:2.6.3:*:*:*:*:*:*:*"],"purl":"pkg:pypi/urllib3@2.6.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-4jqv-mc3x-m676","dataSource":"https://github.com/advisories/GHSA-4jqv-mc3x-m676","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/vercel/next.js/security/advisories/GHSA-4jqv-mc3x-m676","https://nvd.nist.gov/vuln/detail/CVE-2026-94543","https://github.com/vercel/next.js/commit/52c94abdd2ea5f416f5e8353ea8a2edd3fe311b8","https://github.com/vercel/next.js/commit/719e4c67d6e92df60246f95e1d96e2dd60789a52","https://github.com/vercel/next.js/releases/tag/v15.5.27","https://github.com/vercel/next.js/releases/tag/v16.3.8"],"description":"Next.js has cache poisoning of SSG and ISR pages in self-hosted applications","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-94543","epss":0.00506,"percentile":0.43221,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-94543","cwe":"CWE-524","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["16.3.8"],"state":"fixed","available":[{"version":"16.3.8","date":"2026-10-08","kind":"first-observed"}]},"advisories":[],"risk":0.27324000000000004},"relatedVulnerabilities":[{"id":"CVE-2026-94543","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94543","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/vercel/next.js/commit/52c94abdd2ea5f416f5e8353ea8a2edd3fe311b8","https://github.com/vercel/next.js/commit/719e4c67d6e92df60246f95e1d96e2dd60789a52","https://github.com/vercel/next.js/releases/tag/v15.5.27","https://github.com/vercel/next.js/releases/tag/v16.3.8","https://github.com/vercel/next.js/security/advisories/GHSA-4jqv-mc3x-m676"],"description":"Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, self-hosted applications using the Pages Router with statically generated or Incremental Static Regeneration pages can key a response cache entry without sufficiently binding it to the source route. A request can replace one page's cache entry with content from a different route, causing the affected page to serve incorrect content to every visitor until revalidation. Applications deployed on Vercel are not affected. This issue is fixed in versions 15.5.27 and 16.3.8.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-94543","epss":0.00506,"percentile":0.43221,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-94543","cwe":"CWE-524","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"next","version":"16.1.7"}},"found":{"vulnerabilityID":"GHSA-4jqv-mc3x-m676","versionConstraint":">=16.0.0,<16.3.8 (semantic)"},"fix":{"suggestedVersion":"16.3.8"}}],"artifact":{"id":"pkg:npm/next@16.1.7?package-id=662de087d22e519d","name":"next","version":"16.1.7","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vercel:next.js:16.1.7:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/next@16.1.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-g6gw-c38x-mqfc","dataSource":"https://github.com/advisories/GHSA-g6gw-c38x-mqfc","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/honojs/hono/security/advisories/GHSA-g6gw-c38x-mqfc","https://nvd.nist.gov/vuln/detail/CVE-2026-84364","https://github.com/honojs/hono/commit/531e9c5a3ae058d10de33f643055bd4009a87178","https://github.com/honojs/hono/releases/tag/v4.13.5"],"description":"Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84364","epss":0.00529,"percentile":0.44782,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84364","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.13.5"],"state":"fixed","available":[{"version":"4.13.5","date":"2026-09-09","kind":"first-observed"}]},"advisories":[],"risk":0.27243500000000004},"relatedVulnerabilities":[{"id":"CVE-2026-84364","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84364","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/honojs/hono/commit/531e9c5a3ae058d10de33f643055bd4009a87178","https://github.com/honojs/hono/releases/tag/v4.13.5","https://github.com/honojs/hono/security/advisories/GHSA-g6gw-c38x-mqfc"],"description":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, when parseBody() expands dot-separated form field names into nested objects with dot-notation parsing enabled, it does not limit the nesting depth or the total number of intermediate objects created. Empty segments are preserved, so one deeply dotted field name can encode one nesting level per byte, while a large number of shallowly dotted fields can create the same amplification across a request. A request body within a normal size limit can therefore allocate an object graph far larger than the request after the body has already been accepted. An unauthenticated attacker who can reach an affected endpoint can send concurrent requests that exhaust the JavaScript heap, terminate the server process, and leave the service unavailable until restart. Dot-notation parsing is not enabled by default, and applications using the default behavior are not affected. This issue is fixed in version 4.13.5.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84364","epss":0.00529,"percentile":0.44782,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84364","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"hono","version":"4.12.16"}},"found":{"vulnerabilityID":"GHSA-g6gw-c38x-mqfc","versionConstraint":"<4.13.5 (semantic)"},"fix":{"suggestedVersion":"4.13.5"}}],"artifact":{"id":"pkg:npm/hono@4.12.16?package-id=000f2baa1e593039","name":"hono","version":"4.12.16","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:hono:hono:4.12.16:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/hono@4.12.16","upstreams":[]}},{"vulnerability":{"id":"GHSA-xcx6-jx8p-x3h5","dataSource":"https://github.com/advisories/GHSA-xcx6-jx8p-x3h5","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/AzureAD/microsoft-authentication-library-for-js/security/advisories/GHSA-xcx6-jx8p-x3h5","https://nvd.nist.gov/vuln/detail/CVE-2026-109461","https://github.com/AzureAD/microsoft-authentication-library-for-js/pull/8901","https://github.com/AzureAD/microsoft-authentication-library-for-js/commit/f550958586475dbfeb1cd44be14a2d653728850e","https://github.com/AzureAD/microsoft-authentication-library-for-js/releases/tag/msal-node-v7.1.0","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109461"],"description":"MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-109461","epss":0.00361,"percentile":0.29968,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-109461","cwe":"CWE-346","source":"secure@microsoft.com","type":"Secondary"}],"fix":{"versions":["7.1.0"],"state":"fixed","available":[{"version":"7.1.0","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.27075},"relatedVulnerabilities":[{"id":"CVE-2026-109461","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109461","namespace":"nvd:cpe","severity":"Medium","urls":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109461"],"description":"Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network.","cvss":[{"source":"secure@microsoft.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-109461","epss":0.00361,"percentile":0.29968,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-109461","cwe":"CWE-346","source":"secure@microsoft.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@azure/msal-node","version":"6.0.1"}},"found":{"vulnerabilityID":"GHSA-xcx6-jx8p-x3h5","versionConstraint":">=5.0.0-beta.0,<7.1.0 (semantic)"},"fix":{"suggestedVersion":"7.1.0"}}],"artifact":{"id":"pkg:npm/%40azure/msal-node@6.0.1?package-id=104e34c3bfa4f2c1","name":"@azure/msal-node","version":"6.0.1","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:microsoft:azure\\/msal-node:6.0.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/%40azure/msal-node@6.0.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-f4gw-2p7v-4548","dataSource":"https://github.com/advisories/GHSA-f4gw-2p7v-4548","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-f4gw-2p7v-4548","https://github.com/axios/axios/pull/11000","https://github.com/axios/axios/pull/11001","https://github.com/axios/axios/commit/1417285c69344bbcc6420a021f67dee0c6fedb2d","https://github.com/axios/axios/commit/32fc489632377d214db55bfa4e2c48486a7d7ce2","https://github.com/axios/axios/releases/tag/v0.33.0","https://github.com/axios/axios/releases/tag/v1.18.0","https://nvd.nist.gov/vuln/detail/CVE-2026-67315","https://nvd.nist.gov/vuln/detail/CVE-2026-68946","https://www.vulncheck.com/advisories/axios-before-no-proxy-bypass-via"],"description":"Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67315","epss":0.00455,"percentile":0.39479,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67315","cwe":"CWE-183","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["1.18.0"],"state":"fixed","available":[{"version":"1.18.0","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.270725},"relatedVulnerabilities":[{"id":"CVE-2026-67315","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-67315","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-f4gw-2p7v-4548","https://www.vulncheck.com/advisories/axios-before-no-proxy-bypass-via"],"description":"axios versions 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address in shouldBypassProxy.js, allowing requests to 0.0.0.0 to bypass NO_PROXY rules. Attackers can supply 0.0.0.0 URLs to route requests through configured proxies, potentially exposing local services when the proxy can reach the destination.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67315","epss":0.00455,"percentile":0.39479,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67315","cwe":"CWE-183","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.15.0"}},"found":{"vulnerabilityID":"GHSA-f4gw-2p7v-4548","versionConstraint":">=1.15.0,<1.18.0 (semantic)"},"fix":{"suggestedVersion":"1.18.0"}}],"artifact":{"id":"pkg:npm/axios@1.15.0?package-id=520b8e92ffff8054","name":"axios","version":"1.15.0","type":"npm","locations":[{"path":"/sink/oidc-server/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.15.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.15.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-f4gw-2p7v-4548","dataSource":"https://github.com/advisories/GHSA-f4gw-2p7v-4548","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-f4gw-2p7v-4548","https://github.com/axios/axios/pull/11000","https://github.com/axios/axios/pull/11001","https://github.com/axios/axios/commit/1417285c69344bbcc6420a021f67dee0c6fedb2d","https://github.com/axios/axios/commit/32fc489632377d214db55bfa4e2c48486a7d7ce2","https://github.com/axios/axios/releases/tag/v0.33.0","https://github.com/axios/axios/releases/tag/v1.18.0","https://nvd.nist.gov/vuln/detail/CVE-2026-67315","https://nvd.nist.gov/vuln/detail/CVE-2026-68946","https://www.vulncheck.com/advisories/axios-before-no-proxy-bypass-via"],"description":"Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67315","epss":0.00455,"percentile":0.39479,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67315","cwe":"CWE-183","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["1.18.0"],"state":"fixed","available":[{"version":"1.18.0","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.270725},"relatedVulnerabilities":[{"id":"CVE-2026-67315","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-67315","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-f4gw-2p7v-4548","https://www.vulncheck.com/advisories/axios-before-no-proxy-bypass-via"],"description":"axios versions 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address in shouldBypassProxy.js, allowing requests to 0.0.0.0 to bypass NO_PROXY rules. Attackers can supply 0.0.0.0 URLs to route requests through configured proxies, potentially exposing local services when the proxy can reach the destination.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67315","epss":0.00455,"percentile":0.39479,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67315","cwe":"CWE-183","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.16.1"}},"found":{"vulnerabilityID":"GHSA-f4gw-2p7v-4548","versionConstraint":">=1.15.0,<1.18.0 (semantic)"},"fix":{"suggestedVersion":"1.18.0"}}],"artifact":{"id":"pkg:npm/axios@1.16.1?package-id=8545c428c207f9fb","name":"axios","version":"1.16.1","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.16.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.16.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-x5fp-wj9c-mxmx","dataSource":"https://github.com/advisories/GHSA-x5fp-wj9c-mxmx","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/ljharb/qs/security/advisories/GHSA-w7fw-mjwx-w883","https://github.com/ljharb/qs/security/advisories/GHSA-x5fp-wj9c-mxmx","https://nvd.nist.gov/vuln/detail/CVE-2026-82562","https://github.com/ljharb/qs/commit/8859c37470e11b42b547b275e4e9bd0bc8cc5464"],"description":"qs array-limit bypass via bracket-key comma parsing","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-82562","epss":0.0054,"percentile":0.45457,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-82562","cwe":"CWE-770","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}],"fix":{"versions":["6.16.0"],"state":"fixed","available":[{"version":"6.16.0","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.27},"relatedVulnerabilities":[{"id":"CVE-2026-82562","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82562","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/ljharb/qs/commit/8859c37470e11b42b547b275e4e9bd0bc8cc5464","https://github.com/ljharb/qs/security/advisories/GHSA-w7fw-mjwx-w883","https://github.com/ljharb/qs/security/advisories/GHSA-x5fp-wj9c-mxmx"],"description":"### Summary\n\n\n\nWhen `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comma-separated value under a bracket-push key (`a[]=1,2,3,4`) is split into an array without being compared against `arrayLimit`, while the same value under a flat key (`a=1,2,3,4`), an indexed key (`a[0]=`), a nested key (`a[b]=`), or a dotted key (`a.b=` with `allowDots`) throws the documented `RangeError`. A single parameter such as `a[]=1,2,2,...` therefore produces an inner array of arbitrary length even though the caller opted into the hard limit. This is the `[]=` key form that the fix for CVE-2026-2391 (qs 6.14.2) did not cover.\n\n\n\n### Details\n\n\n\nIn `lib/parse.js`, a comma-separated value under a `[]=` key is split and then wrapped as a single nested element (`val = [val]`, so that each `a[]=x,y` group counts as one element of the outer array). The `arrayLimit` check that 6.14.2 added for comma values runs after that wrap, so for `[]=` parts it only ever saw the wrapper of length 1. 6.15.3 added a pre-split comma count so that an oversized value throws before it is allocated, but gated it on an `isFlatArrayValue` flag that `parseValues` set to `false` for any part containing `[]=`, and did not pass it for object-valued input, so the gap remained.\n\n\n\n#### PoC\n\n\n\n```js\n\n\n\nvar qs = require('qs');\n\n\n\nvar options = { comma: true, arrayLimit: 3, throwOnLimitExceeded: true };\n\n\n\nqs.parse('a=1,2,3,4', options);   // RangeError: Array limit exceeded. Only 3 elements allowed in an array.\n\n\n\nqs.parse('a[]=1,2,3,4', options); // { a: [ [ '1', '2', '3', '4' ] ] }  (no throw)\n\n\n\nqs.parse('a[]=' + '1,'.repeat(1000000) + '1', { comma: true, arrayLimit: 20, throwOnLimitExceeded: true });\n\n\n\n// no throw; a 1,000,001-element inner array is allocated\n\n\n\n```\n\n\n\n#### Fix\n\n\n\n`lib/parse.js`, applied in 8859c37 on `main` and released as v6.16.0: the `isFlatArrayValue` gate is removed, so every comma-split value is counted against `arrayLimit` before splitting regardless of key form. An in-limit group under `a[]=` still counts as one element of the outer array, and the default (`throwOnLimitExceeded: false`) path is unchanged.\n\n\n\n### Affected versions\n\n\n\n`>=6.14.2 <6.16.0`, fixed in v6.16.0.\n\n\n\nv6.14.2 introduced `arrayLimit` enforcement for comma values (the fix for CVE-2026-2391) but only for values not under a `[]=` key, and every release from v6.14.2 through v6.15.3 has the same gap. v6.14.0 and v6.14.1, where `throwOnLimitExceeded` exists but does not apply to any comma form, are covered by CVE-2026-2391 rather than this record. Earlier lines (6.7.x through 6.13.x) have `comma` but no `throwOnLimitExceeded`, so there is no hard cap on any comma path to bypass; releases before 6.7.0 have no `comma` option.\n\n\n\n### Impact\n\n\n\nAn unauthenticated attacker who can reach an application that parses untrusted query strings or urlencoded bodies with both `comma: true` and `throwOnLimitExceeded: true` (both non-default) can bypass the configured limit with a single `a[]=` parameter and force the parser to allocate an array proportional to the request size. The cost is strictly linear in the attacker-supplied bytes (about 0.1 microseconds and 6 to 7 retained bytes per input byte; the same out-of-memory threshold as the documented default `throwOnLimitExceeded: false` path), so a transport-layer request or body size limit bounds it completely (and node's default maximum HTTP header size of 16 KB already bounds the request line, so multi-megabyte payloads need a body parser). The impact is that an opt-in hard limit fails open on one key spelling, not unbounded allocation from a small input.","cvss":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-82562","epss":0.0054,"percentile":0.45457,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-82562","cwe":"CWE-770","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"qs","version":"6.15.0"}},"found":{"vulnerabilityID":"GHSA-x5fp-wj9c-mxmx","versionConstraint":">=6.14.2,<=6.15.3 (semantic)"},"fix":{"suggestedVersion":"6.16.0"}}],"artifact":{"id":"pkg:npm/qs@6.15.0?package-id=09311111c4f6e298","name":"qs","version":"6.15.0","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:qs_project:qs:6.15.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/qs@6.15.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-x5fp-wj9c-mxmx","dataSource":"https://github.com/advisories/GHSA-x5fp-wj9c-mxmx","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/ljharb/qs/security/advisories/GHSA-w7fw-mjwx-w883","https://github.com/ljharb/qs/security/advisories/GHSA-x5fp-wj9c-mxmx","https://nvd.nist.gov/vuln/detail/CVE-2026-82562","https://github.com/ljharb/qs/commit/8859c37470e11b42b547b275e4e9bd0bc8cc5464"],"description":"qs array-limit bypass via bracket-key comma parsing","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-82562","epss":0.0054,"percentile":0.45457,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-82562","cwe":"CWE-770","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}],"fix":{"versions":["6.16.0"],"state":"fixed","available":[{"version":"6.16.0","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.27},"relatedVulnerabilities":[{"id":"CVE-2026-82562","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82562","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/ljharb/qs/commit/8859c37470e11b42b547b275e4e9bd0bc8cc5464","https://github.com/ljharb/qs/security/advisories/GHSA-w7fw-mjwx-w883","https://github.com/ljharb/qs/security/advisories/GHSA-x5fp-wj9c-mxmx"],"description":"### Summary\n\n\n\nWhen `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comma-separated value under a bracket-push key (`a[]=1,2,3,4`) is split into an array without being compared against `arrayLimit`, while the same value under a flat key (`a=1,2,3,4`), an indexed key (`a[0]=`), a nested key (`a[b]=`), or a dotted key (`a.b=` with `allowDots`) throws the documented `RangeError`. A single parameter such as `a[]=1,2,2,...` therefore produces an inner array of arbitrary length even though the caller opted into the hard limit. This is the `[]=` key form that the fix for CVE-2026-2391 (qs 6.14.2) did not cover.\n\n\n\n### Details\n\n\n\nIn `lib/parse.js`, a comma-separated value under a `[]=` key is split and then wrapped as a single nested element (`val = [val]`, so that each `a[]=x,y` group counts as one element of the outer array). The `arrayLimit` check that 6.14.2 added for comma values runs after that wrap, so for `[]=` parts it only ever saw the wrapper of length 1. 6.15.3 added a pre-split comma count so that an oversized value throws before it is allocated, but gated it on an `isFlatArrayValue` flag that `parseValues` set to `false` for any part containing `[]=`, and did not pass it for object-valued input, so the gap remained.\n\n\n\n#### PoC\n\n\n\n```js\n\n\n\nvar qs = require('qs');\n\n\n\nvar options = { comma: true, arrayLimit: 3, throwOnLimitExceeded: true };\n\n\n\nqs.parse('a=1,2,3,4', options);   // RangeError: Array limit exceeded. Only 3 elements allowed in an array.\n\n\n\nqs.parse('a[]=1,2,3,4', options); // { a: [ [ '1', '2', '3', '4' ] ] }  (no throw)\n\n\n\nqs.parse('a[]=' + '1,'.repeat(1000000) + '1', { comma: true, arrayLimit: 20, throwOnLimitExceeded: true });\n\n\n\n// no throw; a 1,000,001-element inner array is allocated\n\n\n\n```\n\n\n\n#### Fix\n\n\n\n`lib/parse.js`, applied in 8859c37 on `main` and released as v6.16.0: the `isFlatArrayValue` gate is removed, so every comma-split value is counted against `arrayLimit` before splitting regardless of key form. An in-limit group under `a[]=` still counts as one element of the outer array, and the default (`throwOnLimitExceeded: false`) path is unchanged.\n\n\n\n### Affected versions\n\n\n\n`>=6.14.2 <6.16.0`, fixed in v6.16.0.\n\n\n\nv6.14.2 introduced `arrayLimit` enforcement for comma values (the fix for CVE-2026-2391) but only for values not under a `[]=` key, and every release from v6.14.2 through v6.15.3 has the same gap. v6.14.0 and v6.14.1, where `throwOnLimitExceeded` exists but does not apply to any comma form, are covered by CVE-2026-2391 rather than this record. Earlier lines (6.7.x through 6.13.x) have `comma` but no `throwOnLimitExceeded`, so there is no hard cap on any comma path to bypass; releases before 6.7.0 have no `comma` option.\n\n\n\n### Impact\n\n\n\nAn unauthenticated attacker who can reach an application that parses untrusted query strings or urlencoded bodies with both `comma: true` and `throwOnLimitExceeded: true` (both non-default) can bypass the configured limit with a single `a[]=` parameter and force the parser to allocate an array proportional to the request size. The cost is strictly linear in the attacker-supplied bytes (about 0.1 microseconds and 6 to 7 retained bytes per input byte; the same out-of-memory threshold as the documented default `throwOnLimitExceeded: false` path), so a transport-layer request or body size limit bounds it completely (and node's default maximum HTTP header size of 16 KB already bounds the request line, so multi-megabyte payloads need a body parser). The impact is that an opt-in hard limit fails open on one key spelling, not unbounded allocation from a small input.","cvss":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-82562","epss":0.0054,"percentile":0.45457,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-82562","cwe":"CWE-770","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"qs","version":"6.15.1"}},"found":{"vulnerabilityID":"GHSA-x5fp-wj9c-mxmx","versionConstraint":">=6.14.2,<=6.15.3 (semantic)"},"fix":{"suggestedVersion":"6.16.0"}}],"artifact":{"id":"pkg:npm/qs@6.15.1?package-id=fb3e21030488c9a8","name":"qs","version":"6.15.1","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:qs_project:qs:6.15.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/qs@6.15.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-x5fp-wj9c-mxmx","dataSource":"https://github.com/advisories/GHSA-x5fp-wj9c-mxmx","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/ljharb/qs/security/advisories/GHSA-w7fw-mjwx-w883","https://github.com/ljharb/qs/security/advisories/GHSA-x5fp-wj9c-mxmx","https://nvd.nist.gov/vuln/detail/CVE-2026-82562","https://github.com/ljharb/qs/commit/8859c37470e11b42b547b275e4e9bd0bc8cc5464"],"description":"qs array-limit bypass via bracket-key comma parsing","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-82562","epss":0.0054,"percentile":0.45457,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-82562","cwe":"CWE-770","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}],"fix":{"versions":["6.16.0"],"state":"fixed","available":[{"version":"6.16.0","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.27},"relatedVulnerabilities":[{"id":"CVE-2026-82562","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82562","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/ljharb/qs/commit/8859c37470e11b42b547b275e4e9bd0bc8cc5464","https://github.com/ljharb/qs/security/advisories/GHSA-w7fw-mjwx-w883","https://github.com/ljharb/qs/security/advisories/GHSA-x5fp-wj9c-mxmx"],"description":"### Summary\n\n\n\nWhen `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comma-separated value under a bracket-push key (`a[]=1,2,3,4`) is split into an array without being compared against `arrayLimit`, while the same value under a flat key (`a=1,2,3,4`), an indexed key (`a[0]=`), a nested key (`a[b]=`), or a dotted key (`a.b=` with `allowDots`) throws the documented `RangeError`. A single parameter such as `a[]=1,2,2,...` therefore produces an inner array of arbitrary length even though the caller opted into the hard limit. This is the `[]=` key form that the fix for CVE-2026-2391 (qs 6.14.2) did not cover.\n\n\n\n### Details\n\n\n\nIn `lib/parse.js`, a comma-separated value under a `[]=` key is split and then wrapped as a single nested element (`val = [val]`, so that each `a[]=x,y` group counts as one element of the outer array). The `arrayLimit` check that 6.14.2 added for comma values runs after that wrap, so for `[]=` parts it only ever saw the wrapper of length 1. 6.15.3 added a pre-split comma count so that an oversized value throws before it is allocated, but gated it on an `isFlatArrayValue` flag that `parseValues` set to `false` for any part containing `[]=`, and did not pass it for object-valued input, so the gap remained.\n\n\n\n#### PoC\n\n\n\n```js\n\n\n\nvar qs = require('qs');\n\n\n\nvar options = { comma: true, arrayLimit: 3, throwOnLimitExceeded: true };\n\n\n\nqs.parse('a=1,2,3,4', options);   // RangeError: Array limit exceeded. Only 3 elements allowed in an array.\n\n\n\nqs.parse('a[]=1,2,3,4', options); // { a: [ [ '1', '2', '3', '4' ] ] }  (no throw)\n\n\n\nqs.parse('a[]=' + '1,'.repeat(1000000) + '1', { comma: true, arrayLimit: 20, throwOnLimitExceeded: true });\n\n\n\n// no throw; a 1,000,001-element inner array is allocated\n\n\n\n```\n\n\n\n#### Fix\n\n\n\n`lib/parse.js`, applied in 8859c37 on `main` and released as v6.16.0: the `isFlatArrayValue` gate is removed, so every comma-split value is counted against `arrayLimit` before splitting regardless of key form. An in-limit group under `a[]=` still counts as one element of the outer array, and the default (`throwOnLimitExceeded: false`) path is unchanged.\n\n\n\n### Affected versions\n\n\n\n`>=6.14.2 <6.16.0`, fixed in v6.16.0.\n\n\n\nv6.14.2 introduced `arrayLimit` enforcement for comma values (the fix for CVE-2026-2391) but only for values not under a `[]=` key, and every release from v6.14.2 through v6.15.3 has the same gap. v6.14.0 and v6.14.1, where `throwOnLimitExceeded` exists but does not apply to any comma form, are covered by CVE-2026-2391 rather than this record. Earlier lines (6.7.x through 6.13.x) have `comma` but no `throwOnLimitExceeded`, so there is no hard cap on any comma path to bypass; releases before 6.7.0 have no `comma` option.\n\n\n\n### Impact\n\n\n\nAn unauthenticated attacker who can reach an application that parses untrusted query strings or urlencoded bodies with both `comma: true` and `throwOnLimitExceeded: true` (both non-default) can bypass the configured limit with a single `a[]=` parameter and force the parser to allocate an array proportional to the request size. The cost is strictly linear in the attacker-supplied bytes (about 0.1 microseconds and 6 to 7 retained bytes per input byte; the same out-of-memory threshold as the documented default `throwOnLimitExceeded: false` path), so a transport-layer request or body size limit bounds it completely (and node's default maximum HTTP header size of 16 KB already bounds the request line, so multi-megabyte payloads need a body parser). The impact is that an opt-in hard limit fails open on one key spelling, not unbounded allocation from a small input.","cvss":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-82562","epss":0.0054,"percentile":0.45457,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-82562","cwe":"CWE-770","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"qs","version":"6.15.1"}},"found":{"vulnerabilityID":"GHSA-x5fp-wj9c-mxmx","versionConstraint":">=6.14.2,<=6.15.3 (semantic)"},"fix":{"suggestedVersion":"6.16.0"}}],"artifact":{"id":"pkg:npm/qs@6.15.1?package-id=226c68780f5d5463","name":"qs","version":"6.15.1","type":"npm","locations":[{"path":"/sink/oidc-server/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:qs_project:qs:6.15.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/qs@6.15.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-82r6-8w77-94w6","dataSource":"https://github.com/advisories/GHSA-82r6-8w77-94w6","namespace":"github:language:python","severity":"Critical","urls":["https://github.com/agronholm/anyio/security/advisories/GHSA-82r6-8w77-94w6","https://github.com/agronholm/anyio/pull/1208","https://github.com/agronholm/anyio/commit/68f58915f82d9be8109ebbbd8f5d70577d43f2ce","https://github.com/agronholm/anyio/releases/tag/4.14.2"],"description":"AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":9.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-63374","epss":0.00289,"percentile":0.21496,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-63374","cwe":"CWE-295","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-63374","cwe":"CWE-297","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.14.2"],"state":"fixed","available":[{"version":"4.14.2","date":"2026-09-19","kind":"first-observed"}]},"advisories":[],"risk":0.26443500000000003},"relatedVulnerabilities":[{"id":"CVE-2026-63374","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63374","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/agronholm/anyio/commit/68f58915f82d9be8109ebbbd8f5d70577d43f2ce","https://github.com/agronholm/anyio/pull/1208","https://github.com/agronholm/anyio/releases/tag/4.14.2","https://github.com/agronholm/anyio/security/advisories/GHSA-82r6-8w77-94w6"],"description":"AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, connect_tcp() and TLSStream.wrap() can validate internationalized host names after the standard library converts them with IDNA 2003 instead of IDNA 2008. When a connection to a non-ASCII domain is hijacked or redirected, an attacker can obtain a legitimate certificate for the different ASCII hostname produced by IDNA 2003 and present it to the client, causing the malicious endpoint's certificate to validate. This issue is fixed in version 4.14.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-63374","epss":0.00289,"percentile":0.21496,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-63374","cwe":"CWE-295","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-63374","cwe":"CWE-297","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"anyio","version":"4.11.0"}},"found":{"vulnerabilityID":"GHSA-82r6-8w77-94w6","versionConstraint":"<4.14.2 (python)"},"fix":{"suggestedVersion":"4.14.2"}}],"artifact":{"id":"pkg:pypi/anyio@4.11.0?package-id=db69f8163af3e835","name":"anyio","version":"4.11.0","type":"python","locations":[{"path":"/backend/bdd/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-anyio:python-anyio:4.11.0:*:*:*:*:*:*:*","cpe:2.3:a:python-anyio:python_anyio:4.11.0:*:*:*:*:*:*:*","cpe:2.3:a:python_anyio:python-anyio:4.11.0:*:*:*:*:*:*:*","cpe:2.3:a:python_anyio:python_anyio:4.11.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-anyio:4.11.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_anyio:4.11.0:*:*:*:*:*:*:*","cpe:2.3:a:anyio:python-anyio:4.11.0:*:*:*:*:*:*:*","cpe:2.3:a:anyio:python_anyio:4.11.0:*:*:*:*:*:*:*","cpe:2.3:a:python-anyio:anyio:4.11.0:*:*:*:*:*:*:*","cpe:2.3:a:python_anyio:anyio:4.11.0:*:*:*:*:*:*:*","cpe:2.3:a:python:anyio:4.11.0:*:*:*:*:*:*:*","cpe:2.3:a:anyio:anyio:4.11.0:*:*:*:*:*:*:*"],"purl":"pkg:pypi/anyio@4.11.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-54fx-42gc-7vw4","dataSource":"https://github.com/advisories/GHSA-54fx-42gc-7vw4","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/honojs/hono/security/advisories/GHSA-54fx-42gc-7vw4","https://github.com/honojs/hono/commit/f70e2c31684387b3231cc38512a31df6ca76a1c7","https://github.com/honojs/hono/releases/tag/v4.12.34"],"description":"Hono: Algorithmic Complexity DoS in Language Middleware","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-71848","epss":0.00507,"percentile":0.43263,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-71848","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.12.34"],"state":"fixed","available":[{"version":"4.12.34","date":"2026-08-08","kind":"first-observed"}]},"advisories":[],"risk":0.26110500000000003},"relatedVulnerabilities":[{"id":"CVE-2026-71848","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-71848","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/honojs/hono/commit/f70e2c31684387b3231cc38512a31df6ca76a1c7","https://github.com/honojs/hono/releases/tag/v4.12.34","https://github.com/honojs/hono/security/advisories/GHSA-54fx-42gc-7vw4"],"description":"Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.0 to 4.12.33, the languageDetector middleware is vulnerable to algorithmic complexity denial of service when processing a crafted language tag containing a large number of hyphen separated subtags. To implement progressive language tag truncation, normalizeLanguage() repeatedly calls parts.slice(0, i).join('-') for every possible prefix, so the total amount of string processing grows quadratically with the number of subtags. Language values may come from a query parameter, cookie, Accept-Language header, or URL path, depending on the detector configuration, and the default detector order enables query string, cookie, and header detection, so applications using languageDetector() may expose this processing to unauthenticated requests. An attacker may repeatedly send requests containing long, hyphen separated language tags, causing excessive CPU consumption and preventing unrelated requests from being processed. This issue is fixed in version 4.12.34.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-71848","epss":0.00507,"percentile":0.43263,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-71848","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"hono","version":"4.12.16"}},"found":{"vulnerabilityID":"GHSA-54fx-42gc-7vw4","versionConstraint":">=4.12.0,<4.12.34 (semantic)"},"fix":{"suggestedVersion":"4.12.34"}}],"artifact":{"id":"pkg:npm/hono@4.12.16?package-id=000f2baa1e593039","name":"hono","version":"4.12.16","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:hono:hono:4.12.16:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/hono@4.12.16","upstreams":[]}},{"vulnerability":{"id":"GHSA-xjj6-f33q-929c","dataSource":"https://github.com/advisories/GHSA-xjj6-f33q-929c","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nodejs/undici/security/advisories/GHSA-xjj6-f33q-929c","https://nvd.nist.gov/vuln/detail/CVE-2026-109869","https://github.com/nodejs/undici/commit/07ded4941b1e72afec862958c3b8ddf468f3b429","https://github.com/nodejs/undici/commit/1325a87dfb3492f8e87e6b0a84b3bda4e82e3436","https://github.com/nodejs/undici/commit/b5084c7dc239172d75c336b1cd51ddac023938a5","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v6.29.1","https://github.com/nodejs/undici/releases/tag/v7.30.1","https://github.com/nodejs/undici/releases/tag/v8.12.2"],"description":"undici vulnerable to Denial of Service via unhandled error on excessive content-encodings","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-109869","epss":0.00344,"percentile":0.27941,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-109869","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-109869","cwe":"CWE-459","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["7.30.1"],"state":"fixed","available":[{"version":"7.30.1","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.258},"relatedVulnerabilities":[{"id":"CVE-2026-109869","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109869","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-xjj6-f33q-929c"],"description":"undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1, its fetch() implementation crashes the Node.js process when a malicious server returns a response with more than five content codings and closes the connection before sending the body. undici rejects such responses because of a content-encoding limit, but it created the internal response stream before that check and returned without attaching an error listener or aborting the request, so the early close surfaces a content-length mismatch on the orphaned stream, which Node.js treats as an unhandled error and terminates the process. A remote, unauthenticated server can trigger this with a single response, even when the application correctly catches the fetch() rejection, resulting in a denial of service. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, and users should upgrade to one of those versions or later. There is no workaround.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-109869","epss":0.00344,"percentile":0.27941,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-109869","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-109869","cwe":"CWE-459","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"undici","version":"7.30.0"}},"found":{"vulnerabilityID":"GHSA-xjj6-f33q-929c","versionConstraint":">=7.18.0,<7.30.1 (semantic)"},"fix":{"suggestedVersion":"7.30.1"}}],"artifact":{"id":"pkg:npm/undici@7.30.0?package-id=2e4d483351b6bc03","name":"undici","version":"7.30.0","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodejs:undici:7.30.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/undici@7.30.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-fxqj-rqcc-2cmp","dataSource":"https://github.com/advisories/GHSA-fxqj-rqcc-2cmp","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp","https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8","https://github.com/postcss/postcss/releases/tag/8.5.19"],"description":"PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69153","epss":0.00451,"percentile":0.39211,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69153","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69153","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["8.5.23"],"state":"fixed","available":[{"version":"8.5.23","date":"2026-08-04","kind":"first-observed"}]},"advisories":[],"risk":0.254815},"relatedVulnerabilities":[{"id":"CVE-2026-69153","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-69153","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8","https://github.com/postcss/postcss/releases/tag/8.5.19","https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp"],"description":"PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69153","epss":0.00451,"percentile":0.39211,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69153","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69153","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"postcss","version":"8.4.31"}},"found":{"vulnerabilityID":"GHSA-fxqj-rqcc-2cmp","versionConstraint":"<=8.5.22 (semantic)"},"fix":{"suggestedVersion":"8.5.23"}}],"artifact":{"id":"pkg:npm/postcss@8.4.31?package-id=5e383ddf2a230a67","name":"postcss","version":"8.4.31","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:postcss:postcss:8.4.31:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/postcss@8.4.31","upstreams":[]}},{"vulnerability":{"id":"GHSA-fxqj-rqcc-2cmp","dataSource":"https://github.com/advisories/GHSA-fxqj-rqcc-2cmp","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp","https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8","https://github.com/postcss/postcss/releases/tag/8.5.19"],"description":"PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69153","epss":0.00451,"percentile":0.39211,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69153","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69153","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["8.5.23"],"state":"fixed","available":[{"version":"8.5.23","date":"2026-08-04","kind":"first-observed"}]},"advisories":[],"risk":0.254815},"relatedVulnerabilities":[{"id":"CVE-2026-69153","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-69153","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8","https://github.com/postcss/postcss/releases/tag/8.5.19","https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp"],"description":"PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69153","epss":0.00451,"percentile":0.39211,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69153","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69153","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"postcss","version":"8.5.12"}},"found":{"vulnerabilityID":"GHSA-fxqj-rqcc-2cmp","versionConstraint":"<=8.5.22 (semantic)"},"fix":{"suggestedVersion":"8.5.23"}}],"artifact":{"id":"pkg:npm/postcss@8.5.12?package-id=61b54a3748eae187","name":"postcss","version":"8.5.12","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:postcss:postcss:8.5.12:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/postcss@8.5.12","upstreams":[]}},{"vulnerability":{"id":"GHSA-fxqj-rqcc-2cmp","dataSource":"https://github.com/advisories/GHSA-fxqj-rqcc-2cmp","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp","https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8","https://github.com/postcss/postcss/releases/tag/8.5.19"],"description":"PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69153","epss":0.00451,"percentile":0.39211,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69153","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69153","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["8.5.23"],"state":"fixed","available":[{"version":"8.5.23","date":"2026-08-04","kind":"first-observed"}]},"advisories":[],"risk":0.254815},"relatedVulnerabilities":[{"id":"CVE-2026-69153","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-69153","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8","https://github.com/postcss/postcss/releases/tag/8.5.19","https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp"],"description":"PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69153","epss":0.00451,"percentile":0.39211,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69153","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69153","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"postcss","version":"8.5.6"}},"found":{"vulnerabilityID":"GHSA-fxqj-rqcc-2cmp","versionConstraint":"<=8.5.22 (semantic)"},"fix":{"suggestedVersion":"8.5.23"}}],"artifact":{"id":"pkg:npm/postcss@8.5.6?package-id=ff850f5fca433458","name":"postcss","version":"8.5.6","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:postcss:postcss:8.5.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/postcss@8.5.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-3jxr-9vmj-r5cp","dataSource":"https://github.com/advisories/GHSA-3jxr-9vmj-r5cp","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-3jxr-9vmj-r5cp","https://nvd.nist.gov/vuln/detail/CVE-2026-13149","https://github.com/juliangruber/brace-expansion/pull/122","https://github.com/juliangruber/brace-expansion/pull/123","https://github.com/juliangruber/brace-expansion/commit/835d6be91201122d9adffb0c0c8c094189ace265","https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754","https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95","https://github.com/juliangruber/brace-expansion/releases/tag/v1.1.16","https://github.com/juliangruber/brace-expansion/releases/tag/v2.1.2","https://github.com/juliangruber/brace-expansion/releases/tag/v5.0.7","https://www.npmjs.com/package/brace-expansion"],"description":"brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-13149","epss":0.00364,"percentile":0.30245,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-13149","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-13149","cwe":"CWE-407","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}],"fix":{"versions":["1.1.16"],"state":"fixed","available":[{"version":"1.1.16","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.25479999999999997},"relatedVulnerabilities":[{"id":"CVE-2026-13149","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13149","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754","https://www.npmjs.com/package/brace-expansion"],"description":"brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.","cvss":[{"source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-13149","epss":0.00364,"percentile":0.30245,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-13149","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-13149","cwe":"CWE-407","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.14"}},"found":{"vulnerabilityID":"GHSA-3jxr-9vmj-r5cp","versionConstraint":"<1.1.16 (semantic)"},"fix":{"suggestedVersion":"1.1.16"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.14?package-id=e9bc4db499821f08","name":"brace-expansion","version":"1.1.14","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.14:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.14","upstreams":[]}},{"vulnerability":{"id":"GHSA-3jxr-9vmj-r5cp","dataSource":"https://github.com/advisories/GHSA-3jxr-9vmj-r5cp","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-3jxr-9vmj-r5cp","https://nvd.nist.gov/vuln/detail/CVE-2026-13149","https://github.com/juliangruber/brace-expansion/pull/122","https://github.com/juliangruber/brace-expansion/pull/123","https://github.com/juliangruber/brace-expansion/commit/835d6be91201122d9adffb0c0c8c094189ace265","https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754","https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95","https://github.com/juliangruber/brace-expansion/releases/tag/v1.1.16","https://github.com/juliangruber/brace-expansion/releases/tag/v2.1.2","https://github.com/juliangruber/brace-expansion/releases/tag/v5.0.7","https://www.npmjs.com/package/brace-expansion"],"description":"brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-13149","epss":0.00364,"percentile":0.30245,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-13149","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-13149","cwe":"CWE-407","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}],"fix":{"versions":["1.1.16"],"state":"fixed","available":[{"version":"1.1.16","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.25479999999999997},"relatedVulnerabilities":[{"id":"CVE-2026-13149","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13149","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754","https://www.npmjs.com/package/brace-expansion"],"description":"brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.","cvss":[{"source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-13149","epss":0.00364,"percentile":0.30245,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-13149","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-13149","cwe":"CWE-407","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.14"}},"found":{"vulnerabilityID":"GHSA-3jxr-9vmj-r5cp","versionConstraint":"<1.1.16 (semantic)"},"fix":{"suggestedVersion":"1.1.16"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.14?package-id=fa326f252298de13","name":"brace-expansion","version":"1.1.14","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.14:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.14","upstreams":[]}},{"vulnerability":{"id":"GHSA-3jxr-9vmj-r5cp","dataSource":"https://github.com/advisories/GHSA-3jxr-9vmj-r5cp","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-3jxr-9vmj-r5cp","https://nvd.nist.gov/vuln/detail/CVE-2026-13149","https://github.com/juliangruber/brace-expansion/pull/122","https://github.com/juliangruber/brace-expansion/pull/123","https://github.com/juliangruber/brace-expansion/commit/835d6be91201122d9adffb0c0c8c094189ace265","https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754","https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95","https://github.com/juliangruber/brace-expansion/releases/tag/v1.1.16","https://github.com/juliangruber/brace-expansion/releases/tag/v2.1.2","https://github.com/juliangruber/brace-expansion/releases/tag/v5.0.7","https://www.npmjs.com/package/brace-expansion"],"description":"brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-13149","epss":0.00364,"percentile":0.30245,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-13149","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-13149","cwe":"CWE-407","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}],"fix":{"versions":["2.1.2"],"state":"fixed","available":[{"version":"2.1.2","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.25479999999999997},"relatedVulnerabilities":[{"id":"CVE-2026-13149","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13149","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754","https://www.npmjs.com/package/brace-expansion"],"description":"brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.","cvss":[{"source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-13149","epss":0.00364,"percentile":0.30245,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-13149","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-13149","cwe":"CWE-407","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"2.1.0"}},"found":{"vulnerabilityID":"GHSA-3jxr-9vmj-r5cp","versionConstraint":">=2.0.0,<2.1.2 (semantic)"},"fix":{"suggestedVersion":"2.1.2"}}],"artifact":{"id":"pkg:npm/brace-expansion@2.1.0?package-id=5b11ade77bad45b9","name":"brace-expansion","version":"2.1.0","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:2.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@2.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-gqvv-2mrq-wpjv","dataSource":"https://github.com/advisories/GHSA-gqvv-2mrq-wpjv","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/honojs/hono/security/advisories/GHSA-gqvv-2mrq-wpjv","https://nvd.nist.gov/vuln/detail/CVE-2026-84365","https://github.com/honojs/hono/commit/3a67f7f3997e1437d108f7bcba2dbcee2df69221","https://github.com/honojs/hono/releases/tag/v4.13.5"],"description":"Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84365","epss":0.00437,"percentile":0.38025,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84365","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.13.5"],"state":"fixed","available":[{"version":"4.13.5","date":"2026-09-09","kind":"first-observed"}]},"advisories":[],"risk":0.25127499999999997},"relatedVulnerabilities":[{"id":"CVE-2026-84365","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84365","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/honojs/hono/commit/3a67f7f3997e1437d108f7bcba2dbcee2df69221","https://github.com/honojs/hono/releases/tag/v4.13.5","https://github.com/honojs/hono/security/advisories/GHSA-gqvv-2mrq-wpjv"],"description":"Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.12 until 4.13.5, the fix released for CVE-2026-39408 does not cover every traversal sequence, and toSSG() can still write files outside the configured output directory when a route parameter contains consecutive parent-directory segments. Static site generation builds each output path from the route path and values supplied through ssgParams, then verifies that the result stays inside the output directory using the same normalization routine that built the path. That routine does not fully collapse runs of consecutive parent-directory segments, allowing a path that the check accepts to resolve outside the output directory, and the check also treats output directories that differ in how they are rooted as equivalent. This arises when an application generates a static site from route parameter values it does not fully control, such as slugs from a CMS, API, or user submission. An untrusted ssgParams value can create or overwrite files elsewhere in the build environment and alter generated artifacts or deployment output. The vulnerability affects build-time static site generation only; request-time routing and applications with entirely developer-controlled ssgParams values are not affected. This issue is fixed in version 4.13.5.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84365","epss":0.00437,"percentile":0.38025,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84365","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"hono","version":"4.12.16"}},"found":{"vulnerabilityID":"GHSA-gqvv-2mrq-wpjv","versionConstraint":"<4.13.5 (semantic)"},"fix":{"suggestedVersion":"4.13.5"}}],"artifact":{"id":"pkg:npm/hono@4.12.16?package-id=000f2baa1e593039","name":"hono","version":"4.12.16","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:hono:hono:4.12.16:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/hono@4.12.16","upstreams":[]}},{"vulnerability":{"id":"GHSA-9fr6-4gfg-395g","dataSource":"https://github.com/advisories/GHSA-9fr6-4gfg-395g","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0"],"description":"Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101902","epss":0.00414,"percentile":0.35676,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101902","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.20.0"],"state":"fixed","available":[{"version":"1.20.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.24632999999999994},"relatedVulnerabilities":[{"id":"CVE-2026-101902","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101902","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g"],"description":"Axios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vulnerability in the same process pollutes Object.prototype.method, calls such as axios.request({ url }) and axios({ url }) can send a state-changing HTTP method instead of the expected default GET. Axios does not create the prototype pollution source. This is a read-side gadget in axios request dispatch. This issue is fixed in version 0.34.0 and 1.20.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101902","epss":0.00414,"percentile":0.35676,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101902","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.15.0"}},"found":{"vulnerabilityID":"GHSA-9fr6-4gfg-395g","versionConstraint":">=1.0.0,<1.20.0 (semantic)"},"fix":{"suggestedVersion":"1.20.0"}}],"artifact":{"id":"pkg:npm/axios@1.15.0?package-id=520b8e92ffff8054","name":"axios","version":"1.15.0","type":"npm","locations":[{"path":"/sink/oidc-server/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.15.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.15.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-9fr6-4gfg-395g","dataSource":"https://github.com/advisories/GHSA-9fr6-4gfg-395g","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0"],"description":"Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101902","epss":0.00414,"percentile":0.35676,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101902","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.20.0"],"state":"fixed","available":[{"version":"1.20.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.24632999999999994},"relatedVulnerabilities":[{"id":"CVE-2026-101902","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101902","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g"],"description":"Axios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vulnerability in the same process pollutes Object.prototype.method, calls such as axios.request({ url }) and axios({ url }) can send a state-changing HTTP method instead of the expected default GET. Axios does not create the prototype pollution source. This is a read-side gadget in axios request dispatch. This issue is fixed in version 0.34.0 and 1.20.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101902","epss":0.00414,"percentile":0.35676,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101902","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.16.1"}},"found":{"vulnerabilityID":"GHSA-9fr6-4gfg-395g","versionConstraint":">=1.0.0,<1.20.0 (semantic)"},"fix":{"suggestedVersion":"1.20.0"}}],"artifact":{"id":"pkg:npm/axios@1.16.1?package-id=8545c428c207f9fb","name":"axios","version":"1.16.1","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.16.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.16.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-9fr6-4gfg-395g","dataSource":"https://github.com/advisories/GHSA-9fr6-4gfg-395g","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0"],"description":"Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101902","epss":0.00414,"percentile":0.35676,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101902","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.20.0"],"state":"fixed","available":[{"version":"1.20.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.24632999999999994},"relatedVulnerabilities":[{"id":"CVE-2026-101902","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101902","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g"],"description":"Axios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vulnerability in the same process pollutes Object.prototype.method, calls such as axios.request({ url }) and axios({ url }) can send a state-changing HTTP method instead of the expected default GET. Axios does not create the prototype pollution source. This is a read-side gadget in axios request dispatch. This issue is fixed in version 0.34.0 and 1.20.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101902","epss":0.00414,"percentile":0.35676,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101902","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.18.1"}},"found":{"vulnerabilityID":"GHSA-9fr6-4gfg-395g","versionConstraint":">=1.0.0,<1.20.0 (semantic)"},"fix":{"suggestedVersion":"1.20.0"}}],"artifact":{"id":"pkg:npm/axios@1.18.1?package-id=1350ab3e8bd97544","name":"axios","version":"1.18.1","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.18.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.18.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-cjq9-62q9-8jv4","dataSource":"https://github.com/advisories/GHSA-cjq9-62q9-8jv4","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/vercel/next.js/security/advisories/GHSA-cjq9-62q9-8jv4","https://nvd.nist.gov/vuln/detail/CVE-2026-94483","https://github.com/vercel/next.js/commit/e002ad68bd676bb0ed0c87bb22e3590304763e0b","https://github.com/vercel/next.js/releases/tag/v16.3.8"],"description":"Next.js has Server-Side Request Forgery in Image Optimization","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.3,"impactScore":4.3},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-94483","epss":0.0033,"percentile":0.26164,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-94483","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["16.3.8"],"state":"fixed","available":[{"version":"16.3.8","date":"2026-10-08","kind":"first-observed"}]},"advisories":[],"risk":0.24585},"relatedVulnerabilities":[{"id":"CVE-2026-94483","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94483","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/vercel/next.js/commit/e002ad68bd676bb0ed0c87bb22e3590304763e0b","https://github.com/vercel/next.js/releases/tag/v16.3.8","https://github.com/vercel/next.js/security/advisories/GHSA-cjq9-62q9-8jv4"],"description":"Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow attacker-controlled DNS resolution for a remote URL that matches images.remotePatterns, allowing the optimized image fetch to reach private IP addresses after the URL passes the allow-list check. Applications without images.remotePatterns are not affected. Administrators unable to upgrade should audit allow-listed hosts and avoid entries whose DNS records are not trusted. This issue is fixed in version 16.3.8.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.3,"impactScore":4.3},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-94483","epss":0.0033,"percentile":0.26164,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-94483","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"next","version":"16.1.7"}},"found":{"vulnerabilityID":"GHSA-cjq9-62q9-8jv4","versionConstraint":">=16.0.0,<16.3.8 (semantic)"},"fix":{"suggestedVersion":"16.3.8"}}],"artifact":{"id":"pkg:npm/next@16.1.7?package-id=662de087d22e519d","name":"next","version":"16.1.7","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vercel:next.js:16.1.7:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/next@16.1.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-crvj-82cr-hjcx","dataSource":"https://github.com/advisories/GHSA-crvj-82cr-hjcx","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/honojs/hono/security/advisories/GHSA-crvj-82cr-hjcx","https://nvd.nist.gov/vuln/detail/CVE-2026-84363","https://github.com/honojs/hono/commit/9c28d724c5a7fb086ebaa812fdc1ad6e957c63bc","https://github.com/honojs/hono/releases/tag/v4.13.5"],"description":"Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84363","epss":0.00448,"percentile":0.38985,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84363","cwe":"CWE-444","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.13.5"],"state":"fixed","available":[{"version":"4.13.5","date":"2026-09-09","kind":"first-observed"}]},"advisories":[],"risk":0.24416},"relatedVulnerabilities":[{"id":"CVE-2026-84363","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84363","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/honojs/hono/commit/9c28d724c5a7fb086ebaa812fdc1ad6e957c63bc","https://github.com/honojs/hono/releases/tag/v4.13.5","https://github.com/honojs/hono/security/advisories/GHSA-crvj-82cr-hjcx"],"description":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, Hono's query helpers treat a question mark after a literal hash fragment as the start of a query string, so the application can read request parameters that browsers, new URL(), reverse proxies, filtering rules, parameter allow and deny lists, access logging, request validation, and other middleware do not observe. The Cache Middleware removes the fragment when building its cache key, allowing a response influenced by parameters inside the fragment to be stored under a key that omits those parameters and later served to other users. This can bypass filtering and auditing, poison cached responses, and enable stored cross-site scripting when an affected parameter is reflected into cached HTML without escaping. Exploitation requires a runtime and intermediary path that passes a literal hash character through to the request URL; Cloudflare Workers and intermediaries that strip fragments are not affected. This issue is fixed in version 4.13.5.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84363","epss":0.00448,"percentile":0.38985,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84363","cwe":"CWE-444","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"hono","version":"4.12.16"}},"found":{"vulnerabilityID":"GHSA-crvj-82cr-hjcx","versionConstraint":"<4.13.5 (semantic)"},"fix":{"suggestedVersion":"4.13.5"}}],"artifact":{"id":"pkg:npm/hono@4.12.16?package-id=000f2baa1e593039","name":"hono","version":"4.12.16","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:hono:hono:4.12.16:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/hono@4.12.16","upstreams":[]}},{"vulnerability":{"id":"GHSA-v2v4-37r5-5v8g","dataSource":"https://github.com/advisories/GHSA-v2v4-37r5-5v8g","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-v2v4-37r5-5v8g","https://nvd.nist.gov/vuln/detail/CVE-2026-42338"],"description":"ip-address has XSS in Address6 HTML-emitting methods","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":5.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42338","epss":0.00471,"percentile":0.4074,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42338","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-42338","cwe":"CWE-79","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["10.1.1"],"state":"fixed","available":[{"version":"10.1.1","date":"2026-05-06","kind":"first-observed"}]},"advisories":[],"risk":0.242565},"relatedVulnerabilities":[{"id":"CVE-2026-42338","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42338","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-v2v4-37r5-5v8g","https://access.redhat.com/errata/RHSA-2026:33155","https://access.redhat.com/errata/RHSA-2026:33160","https://access.redhat.com/errata/RHSA-2026:33163","https://access.redhat.com/errata/RHSA-2026:33173","https://access.redhat.com/errata/RHSA-2026:33183","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:34374","https://access.redhat.com/errata/RHSA-2026:35841","https://access.redhat.com/errata/RHSA-2026:35842","https://access.redhat.com/errata/RHSA-2026:35891","https://access.redhat.com/errata/RHSA-2026:35892","https://access.redhat.com/errata/RHSA-2026:36754","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:39246","https://access.redhat.com/errata/RHSA-2026:39868","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41947","https://access.redhat.com/errata/RHSA-2026:44237","https://access.redhat.com/errata/RHSA-2026:44263","https://access.redhat.com/errata/RHSA-2026:44267","https://access.redhat.com/errata/RHSA-2026:51200","https://access.redhat.com/errata/RHSA-2026:52399","https://access.redhat.com/errata/RHSA-2026:56928","https://access.redhat.com/errata/RHSA-2026:57590","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:62335","https://access.redhat.com/errata/RHSA-2026:62336","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-42338","https://bugzilla.redhat.com/show_bug.cgi?id=2476810","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42338.json"],"description":"ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage (emitted by the Address6 constructor for invalid input) can contain unescaped attacker-controlled content in one branch. An application that (1) passes untrusted input to Address6 and (2) renders the output of these methods, or the thrown error's parseMessage, as HTML (e.g. via innerHTML) is vulnerable to cross-site scripting. This vulnerability is fixed in 10.1.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"exploitabilityScore":2.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42338","epss":0.00471,"percentile":0.4074,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42338","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-42338","cwe":"CWE-79","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"ip-address","version":"10.1.0"}},"found":{"vulnerabilityID":"GHSA-v2v4-37r5-5v8g","versionConstraint":"<=10.1.0 (semantic)"},"fix":{"suggestedVersion":"10.1.1"}}],"artifact":{"id":"pkg:npm/ip-address@10.1.0?package-id=d0c928307aa7dbe2","name":"ip-address","version":"10.1.0","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:beaugunderson:ip-address:10.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/ip-address@10.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-2v37-7h3g-55p8","dataSource":"https://github.com/advisories/GHSA-2v37-7h3g-55p8","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-67213","https://github.com/ai/nanoid/commit/cb3626d0f3342fdf179cd425fd9c4fbb92c7d0e7","https://github.com/ai/nanoid/releases/tag/5.1.6","https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-zero-size-in-customalphabet-and-customrandom","https://github.com/ai/nanoid/commit/f9d13f150847d117877adee3460a46eceb0cf49b","https://github.com/ai/nanoid/releases/tag/3.3.17","https://github.com/ai/nanoid/commit/e10f8d40ce9d1ab47f66d65a16b48086432730d0","https://github.com/ai/nanoid/releases/tag/3.3.18"],"description":"nanoid: custom generators can loop indefinitely when size is zero","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67213","epss":0.00331,"percentile":0.26286,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67213","cwe":"CWE-835","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["3.3.18"],"state":"fixed","available":[{"version":"3.3.18","date":"2026-08-13","kind":"first-observed"}]},"advisories":[],"risk":0.24080250000000003},"relatedVulnerabilities":[{"id":"CVE-2026-67213","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-67213","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/ai/nanoid/commit/cb3626d0f3342fdf179cd425fd9c4fbb92c7d0e7","https://github.com/ai/nanoid/releases/tag/5.1.6","https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-zero-size-in-customalphabet-and-customrandom"],"description":"nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An application that passes an unvalidated, attacker-controlled size of 0 to these functions is exposed to a denial-of-service condition.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67213","epss":0.00331,"percentile":0.26286,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67213","cwe":"CWE-835","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"nanoid","version":"3.3.11"}},"found":{"vulnerabilityID":"GHSA-2v37-7h3g-55p8","versionConstraint":"<3.3.18 (semantic)"},"fix":{"suggestedVersion":"3.3.18"}}],"artifact":{"id":"pkg:npm/nanoid@3.3.11?package-id=09857e177282a1da","name":"nanoid","version":"3.3.11","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nanoid_project:nanoid:3.3.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/nanoid@3.3.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-28wg-ghj8-5hjv","dataSource":"https://github.com/advisories/GHSA-28wg-ghj8-5hjv","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-67214","https://github.com/ai/nanoid/commit/6ccc67bbaba71d3d77a21d9b636f4171a268ce49","https://github.com/ai/nanoid/releases/tag/5.1.16","https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-negative-size-in-non-secure-module","https://github.com/ai/nanoid/pull/600","https://github.com/ai/nanoid/pull/601","https://github.com/ai/nanoid/commit/e835c9b71eab832bc6106944bdd26ea96cf2c66d"],"description":"nanoid: non-secure generators can loop indefinitely with negative size","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67214","epss":0.0033,"percentile":0.26154,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67214","cwe":"CWE-835","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["3.3.16"],"state":"fixed","available":[{"version":"3.3.16","date":"2026-08-08","kind":"first-observed"}]},"advisories":[],"risk":0.240075},"relatedVulnerabilities":[{"id":"CVE-2026-67214","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-67214","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/ai/nanoid/commit/6ccc67bbaba71d3d77a21d9b636f4171a268ce49","https://github.com/ai/nanoid/releases/tag/3.3.16","https://github.com/ai/nanoid/releases/tag/5.1.16","https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-negative-size-in-non-secure-module"],"description":"nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67214","epss":0.0033,"percentile":0.26154,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67214","cwe":"CWE-835","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"nanoid","version":"3.3.11"}},"found":{"vulnerabilityID":"GHSA-28wg-ghj8-5hjv","versionConstraint":"<3.3.16 (semantic)"},"fix":{"suggestedVersion":"3.3.16"}}],"artifact":{"id":"pkg:npm/nanoid@3.3.11?package-id=09857e177282a1da","name":"nanoid","version":"3.3.11","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nanoid_project:nanoid:3.3.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/nanoid@3.3.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-28wg-ghj8-5hjv","dataSource":"https://github.com/advisories/GHSA-28wg-ghj8-5hjv","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-67214","https://github.com/ai/nanoid/commit/6ccc67bbaba71d3d77a21d9b636f4171a268ce49","https://github.com/ai/nanoid/releases/tag/5.1.16","https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-negative-size-in-non-secure-module","https://github.com/ai/nanoid/pull/600","https://github.com/ai/nanoid/pull/601","https://github.com/ai/nanoid/commit/e835c9b71eab832bc6106944bdd26ea96cf2c66d"],"description":"nanoid: non-secure generators can loop indefinitely with negative size","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67214","epss":0.0033,"percentile":0.26154,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67214","cwe":"CWE-835","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["5.1.16"],"state":"fixed","available":[{"version":"5.1.16","date":"2026-08-08","kind":"first-observed"}]},"advisories":[],"risk":0.240075},"relatedVulnerabilities":[{"id":"CVE-2026-67214","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-67214","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/ai/nanoid/commit/6ccc67bbaba71d3d77a21d9b636f4171a268ce49","https://github.com/ai/nanoid/releases/tag/3.3.16","https://github.com/ai/nanoid/releases/tag/5.1.16","https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-negative-size-in-non-secure-module"],"description":"nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67214","epss":0.0033,"percentile":0.26154,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67214","cwe":"CWE-835","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"nanoid","version":"5.1.6"}},"found":{"vulnerabilityID":"GHSA-28wg-ghj8-5hjv","versionConstraint":">=4.0.0,<5.1.16 (semantic)"},"fix":{"suggestedVersion":"5.1.16"}}],"artifact":{"id":"pkg:npm/nanoid@5.1.6?package-id=fdbb3bc1f2b319e8","name":"nanoid","version":"5.1.6","type":"npm","locations":[{"path":"/sink/oidc-server/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nanoid_project:nanoid:5.1.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/nanoid@5.1.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-mmx7-hfxf-jppx","dataSource":"https://github.com/advisories/GHSA-mmx7-hfxf-jppx","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-mmx7-hfxf-jppx","https://github.com/axios/axios/pull/11000","https://github.com/axios/axios/pull/11001","https://github.com/axios/axios/commit/1417285c69344bbcc6420a021f67dee0c6fedb2d","https://github.com/axios/axios/commit/32fc489632377d214db55bfa4e2c48486a7d7ce2","https://github.com/axios/axios/releases/tag/v0.33.0","https://github.com/axios/axios/releases/tag/v1.18.0","https://nvd.nist.gov/vuln/detail/CVE-2026-67316","https://nvd.nist.gov/vuln/detail/CVE-2026-68944","https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-bodyless-methods"],"description":"Axios: Prototype pollution gadgets can alter axios request construction","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67316","epss":0.00424,"percentile":0.36738,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67316","cwe":"CWE-1321","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["1.18.0"],"state":"fixed","available":[{"version":"1.18.0","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.23956},"relatedVulnerabilities":[{"id":"CVE-2026-67316","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-67316","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-mmx7-hfxf-jppx","https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-bodyless-methods"],"description":"axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been polluted by a separate vulnerability or dependency. In the bodyless method aliases (axios.get(), axios.delete(), axios.head(), axios.options()), inherited data is read via (config || {}).data before config normalization, causing an attacker-controlled body to be sent on requests that did not set one. Additional low-level paths, only reachable when calling exported adapters/helpers (e.g. lib/adapters/http.js, unsafe/helpers/resolveConfig.js) directly with plain configs and no own proxy or paramsSerializer, can inherit polluted proxy values (routing requests through an attacker-controlled proxy) or paramsSerializer values (attacker-controlled URL serialization). These low-level gadgets do not reproduce through normal high-level axios calls on 1.15.2+. The issue is fixed in axios 1.18.0 and 0.33.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67316","epss":0.00424,"percentile":0.36738,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67316","cwe":"CWE-1321","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.15.0"}},"found":{"vulnerabilityID":"GHSA-mmx7-hfxf-jppx","versionConstraint":">=1.0.0,<1.18.0 (semantic)"},"fix":{"suggestedVersion":"1.18.0"}}],"artifact":{"id":"pkg:npm/axios@1.15.0?package-id=520b8e92ffff8054","name":"axios","version":"1.15.0","type":"npm","locations":[{"path":"/sink/oidc-server/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.15.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.15.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-mmx7-hfxf-jppx","dataSource":"https://github.com/advisories/GHSA-mmx7-hfxf-jppx","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-mmx7-hfxf-jppx","https://github.com/axios/axios/pull/11000","https://github.com/axios/axios/pull/11001","https://github.com/axios/axios/commit/1417285c69344bbcc6420a021f67dee0c6fedb2d","https://github.com/axios/axios/commit/32fc489632377d214db55bfa4e2c48486a7d7ce2","https://github.com/axios/axios/releases/tag/v0.33.0","https://github.com/axios/axios/releases/tag/v1.18.0","https://nvd.nist.gov/vuln/detail/CVE-2026-67316","https://nvd.nist.gov/vuln/detail/CVE-2026-68944","https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-bodyless-methods"],"description":"Axios: Prototype pollution gadgets can alter axios request construction","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67316","epss":0.00424,"percentile":0.36738,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67316","cwe":"CWE-1321","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["1.18.0"],"state":"fixed","available":[{"version":"1.18.0","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.23956},"relatedVulnerabilities":[{"id":"CVE-2026-67316","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-67316","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-mmx7-hfxf-jppx","https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-bodyless-methods"],"description":"axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been polluted by a separate vulnerability or dependency. In the bodyless method aliases (axios.get(), axios.delete(), axios.head(), axios.options()), inherited data is read via (config || {}).data before config normalization, causing an attacker-controlled body to be sent on requests that did not set one. Additional low-level paths, only reachable when calling exported adapters/helpers (e.g. lib/adapters/http.js, unsafe/helpers/resolveConfig.js) directly with plain configs and no own proxy or paramsSerializer, can inherit polluted proxy values (routing requests through an attacker-controlled proxy) or paramsSerializer values (attacker-controlled URL serialization). These low-level gadgets do not reproduce through normal high-level axios calls on 1.15.2+. The issue is fixed in axios 1.18.0 and 0.33.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67316","epss":0.00424,"percentile":0.36738,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67316","cwe":"CWE-1321","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.16.1"}},"found":{"vulnerabilityID":"GHSA-mmx7-hfxf-jppx","versionConstraint":">=1.0.0,<1.18.0 (semantic)"},"fix":{"suggestedVersion":"1.18.0"}}],"artifact":{"id":"pkg:npm/axios@1.16.1?package-id=8545c428c207f9fb","name":"axios","version":"1.16.1","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.16.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.16.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-88fw-hqm2-52qc","dataSource":"https://github.com/advisories/GHSA-88fw-hqm2-52qc","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/honojs/hono/security/advisories/GHSA-88fw-hqm2-52qc","https://nvd.nist.gov/vuln/detail/CVE-2026-54290"],"description":"hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":7.1,"exploitabilityScore":2.9,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-54290","epss":0.00328,"percentile":0.25981,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-54290","cwe":"CWE-942","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.12.25"],"state":"fixed","available":[{"version":"4.12.25","date":"2026-06-16","kind":"first-observed"}]},"advisories":[],"risk":0.23944000000000001},"relatedVulnerabilities":[{"id":"CVE-2026-54290","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54290","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/honojs/hono/security/advisories/GHSA-88fw-hqm2-52qc"],"description":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, with credentials: true and no explicit origin (the default wildcard), the CORS Middleware reflects the request's Origin and sends Access-Control-Allow-Credentials: true. Any site can then make credentialed cross-origin requests and read the responses, exposing cookie-authenticated endpoints to arbitrary origins. This vulnerability is fixed in 4.12.25.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":7.1,"exploitabilityScore":2.9,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-54290","epss":0.00328,"percentile":0.25981,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-54290","cwe":"CWE-942","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"hono","version":"4.12.16"}},"found":{"vulnerabilityID":"GHSA-88fw-hqm2-52qc","versionConstraint":"<4.12.25 (semantic)"},"fix":{"suggestedVersion":"4.12.25"}}],"artifact":{"id":"pkg:npm/hono@4.12.16?package-id=000f2baa1e593039","name":"hono","version":"4.12.16","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:hono:hono:4.12.16:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/hono@4.12.16","upstreams":[]}},{"vulnerability":{"id":"GHSA-pxq6-2prw-chj9","dataSource":"https://github.com/advisories/GHSA-pxq6-2prw-chj9","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/moby/moby/security/advisories/GHSA-pxq6-2prw-chj9","https://github.com/moby/moby/commit/f4d6f25bf0c3fa12d4968320a45685947756a22a","https://docs.docker.com/engine/extend/legacy_plugins","https://github.com/moby/moby/releases/tag/docker-v29.3.1","https://nvd.nist.gov/vuln/detail/CVE-2026-33997"],"description":"Moby has an Off-by-one error in its plugin privilege validation","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"exploitabilityScore":1.7,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33997","epss":0.00402,"percentile":0.34439,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33997","cwe":"CWE-193","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33997","cwe":"CWE-266","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.23717999999999997},"relatedVulnerabilities":[{"id":"CVE-2026-33997","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33997","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/moby/moby/releases/tag/docker-v29.3.1","https://github.com/moby/moby/security/advisories/GHSA-pxq6-2prw-chj9","https://access.redhat.com/errata/RHSA-2026:21769","https://access.redhat.com/errata/RHSA-2026:22347","https://access.redhat.com/errata/RHSA-2026:23345","https://access.redhat.com/security/cve/CVE-2026-33997","https://bugzilla.redhat.com/show_bug.cgi?id=2453277","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33997.json"],"description":"Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows plugins privilege validation to be bypassed during docker plugin install. Due to an error in the daemon's privilege comparison logic, the daemon may incorrectly accept a privilege set that differs from the one approved by the user. Plugins that request exactly one privilege are also affected, because no comparison is performed at all. This issue has been patched in version 29.3.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"exploitabilityScore":2.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.4,"exploitabilityScore":1.7,"impactScore":6.1},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"exploitabilityScore":1.7,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33997","epss":0.00402,"percentile":0.34439,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33997","cwe":"CWE-193","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33997","cwe":"CWE-266","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/docker/docker","version":"v28.5.2+incompatible"}},"found":{"vulnerabilityID":"GHSA-pxq6-2prw-chj9","versionConstraint":"<29.3.1 (go)"}}],"artifact":{"id":"pkg:golang/github.com/docker/docker@v28.5.2%2Bincompatible?package-id=b3f436952f7c2a0e","name":"github.com/docker/docker","version":"v28.5.2+incompatible","type":"go-module","locations":[{"path":"/backend-go/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:docker:docker:v28.5.2\\+incompatible:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/docker/docker@v28.5.2%2Bincompatible","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:DBX0Y0zAjZbSrm1uzOkdr1onVghKaftjlSWt4AFexzM="}}},{"vulnerability":{"id":"GHSA-wwfh-h76j-fc44","dataSource":"https://github.com/advisories/GHSA-wwfh-h76j-fc44","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/honojs/hono/security/advisories/GHSA-wwfh-h76j-fc44","https://nvd.nist.gov/vuln/detail/CVE-2026-54286"],"description":"hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-54286","epss":0.00433,"percentile":0.37619,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-54286","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.12.25"],"state":"fixed","available":[{"version":"4.12.25","date":"2026-06-16","kind":"first-observed"}]},"advisories":[],"risk":0.235985},"relatedVulnerabilities":[{"id":"CVE-2026-54286","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54286","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/honojs/hono/security/advisories/GHSA-wwfh-h76j-fc44"],"description":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on Windows hosts, an encoded backslash (%5C) in the request path decodes to \\, which the Windows path resolver treats as a separator. serve-static then resolves a single URL segment such as admin\\secret.txt into a nested file under the root and serves it, letting an attacker read static files meant to be protected behind prefix-mounted middleware. This vulnerability is fixed in 4.12.25.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-54286","epss":0.00433,"percentile":0.37619,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-54286","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"hono","version":"4.12.16"}},"found":{"vulnerabilityID":"GHSA-wwfh-h76j-fc44","versionConstraint":"<4.12.25 (semantic)"},"fix":{"suggestedVersion":"4.12.25"}}],"artifact":{"id":"pkg:npm/hono@4.12.16?package-id=000f2baa1e593039","name":"hono","version":"4.12.16","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:hono:hono:4.12.16:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/hono@4.12.16","upstreams":[]}},{"vulnerability":{"id":"GHSA-qccp-gfcp-xxvc","dataSource":"https://github.com/advisories/GHSA-qccp-gfcp-xxvc","namespace":"github:language:python","severity":"High","urls":["https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc","https://nvd.nist.gov/vuln/detail/CVE-2026-44431"],"description":"urllib3: Sensitive headers forwarded across origins in proxied low-level redirects","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44431","epss":0.00331,"percentile":0.26333,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44431","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.7.0"],"state":"fixed","available":[{"version":"2.7.0","date":"2026-05-11","kind":"first-observed"}]},"advisories":[],"risk":0.23583750000000003},"relatedVulnerabilities":[{"id":"CVE-2026-44431","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44431","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc","https://lists.debian.org/debian-lts-announce/2026/06/msg00040.html"],"description":"urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. This vulnerability is fixed in 2.7.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44431","epss":0.00331,"percentile":0.26333,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44431","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"urllib3","version":"2.6.3"}},"found":{"vulnerabilityID":"GHSA-qccp-gfcp-xxvc","versionConstraint":">=1.23,<2.7.0 (python)"},"fix":{"suggestedVersion":"2.7.0"}}],"artifact":{"id":"pkg:pypi/urllib3@2.6.3?package-id=0526caf26f90afee","name":"urllib3","version":"2.6.3","type":"python","locations":[{"path":"/backend/bdd/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python:urllib3:2.6.3:*:*:*:*:*:*:*"],"purl":"pkg:pypi/urllib3@2.6.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-jqcg-44mw-7w3h","dataSource":"https://github.com/advisories/GHSA-jqcg-44mw-7w3h","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h","https://nvd.nist.gov/vuln/detail/CVE-2026-90711","https://github.com/jshttp/proxy-addr/commit/780911d84d18e2c5fa008ed0c0d387631ec11965","https://cna.openjsf.org/security-advisories.html","https://github.com/jshttp/proxy-addr/releases/tag/v2.0.8"],"description":"proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-90711","epss":0.0026,"percentile":0.17705,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-90711","cwe":"CWE-290","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-90711","cwe":"CWE-348","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-90711","cwe":"CWE-697","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["2.0.8"],"state":"fixed","available":[{"version":"2.0.8","date":"2026-10-06","kind":"first-observed"}]},"advisories":[],"risk":0.2353},"relatedVulnerabilities":[{"id":"CVE-2026-90711","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-90711","namespace":"nvd:cpe","severity":"Critical","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h"],"description":"proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as ::ffff:10.0.0.0/8 instead of the correct ::ffff:10.0.0.0/104, is accepted without error but trusts every IPv4 address on the internet rather than the block it names. Because the socket peer then becomes trusted at hop 0, any unauthenticated client can supply an arbitrary X-Forwarded-For header and control the address the application reads, which defeats IP-based access control, rate limiting, geolocation, and audit logging. This is a fail-open regression introduced in version 1.1.0. The issue is fixed in proxy-addr 2.0.8, and users should upgrade to 2.0.8 or later. As a workaround, ensure any IPv4-mapped IPv6 trust subnet uses a prefix length of at least 97, or express the range in plain IPv4 notation.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-90711","epss":0.0026,"percentile":0.17705,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-90711","cwe":"CWE-290","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-90711","cwe":"CWE-348","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-90711","cwe":"CWE-697","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"proxy-addr","version":"2.0.7"}},"found":{"vulnerabilityID":"GHSA-jqcg-44mw-7w3h","versionConstraint":">=1.1.0,<2.0.8 (semantic)"},"fix":{"suggestedVersion":"2.0.8"}}],"artifact":{"id":"pkg:npm/proxy-addr@2.0.7?package-id=ba890797b3ebf888","name":"proxy-addr","version":"2.0.7","type":"npm","locations":[{"path":"/sink/oidc-server/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:proxy-addr:proxy-addr:2.0.7:*:*:*:*:*:*:*","cpe:2.3:a:proxy-addr:proxy_addr:2.0.7:*:*:*:*:*:*:*","cpe:2.3:a:proxy_addr:proxy-addr:2.0.7:*:*:*:*:*:*:*","cpe:2.3:a:proxy_addr:proxy_addr:2.0.7:*:*:*:*:*:*:*","cpe:2.3:a:proxy:proxy-addr:2.0.7:*:*:*:*:*:*:*","cpe:2.3:a:proxy:proxy_addr:2.0.7:*:*:*:*:*:*:*"],"purl":"pkg:npm/proxy-addr@2.0.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-jqcg-44mw-7w3h","dataSource":"https://github.com/advisories/GHSA-jqcg-44mw-7w3h","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h","https://nvd.nist.gov/vuln/detail/CVE-2026-90711","https://github.com/jshttp/proxy-addr/commit/780911d84d18e2c5fa008ed0c0d387631ec11965","https://cna.openjsf.org/security-advisories.html","https://github.com/jshttp/proxy-addr/releases/tag/v2.0.8"],"description":"proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-90711","epss":0.0026,"percentile":0.17705,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-90711","cwe":"CWE-290","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-90711","cwe":"CWE-348","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-90711","cwe":"CWE-697","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["2.0.8"],"state":"fixed","available":[{"version":"2.0.8","date":"2026-10-06","kind":"first-observed"}]},"advisories":[],"risk":0.2353},"relatedVulnerabilities":[{"id":"CVE-2026-90711","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-90711","namespace":"nvd:cpe","severity":"Critical","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h"],"description":"proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as ::ffff:10.0.0.0/8 instead of the correct ::ffff:10.0.0.0/104, is accepted without error but trusts every IPv4 address on the internet rather than the block it names. Because the socket peer then becomes trusted at hop 0, any unauthenticated client can supply an arbitrary X-Forwarded-For header and control the address the application reads, which defeats IP-based access control, rate limiting, geolocation, and audit logging. This is a fail-open regression introduced in version 1.1.0. The issue is fixed in proxy-addr 2.0.8, and users should upgrade to 2.0.8 or later. As a workaround, ensure any IPv4-mapped IPv6 trust subnet uses a prefix length of at least 97, or express the range in plain IPv4 notation.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-90711","epss":0.0026,"percentile":0.17705,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-90711","cwe":"CWE-290","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-90711","cwe":"CWE-348","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-90711","cwe":"CWE-697","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"proxy-addr","version":"2.0.7"}},"found":{"vulnerabilityID":"GHSA-jqcg-44mw-7w3h","versionConstraint":">=1.1.0,<2.0.8 (semantic)"},"fix":{"suggestedVersion":"2.0.8"}}],"artifact":{"id":"pkg:npm/proxy-addr@2.0.7?package-id=3225c0bd3e764319","name":"proxy-addr","version":"2.0.7","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:proxy-addr:proxy-addr:2.0.7:*:*:*:*:*:*:*","cpe:2.3:a:proxy-addr:proxy_addr:2.0.7:*:*:*:*:*:*:*","cpe:2.3:a:proxy_addr:proxy-addr:2.0.7:*:*:*:*:*:*:*","cpe:2.3:a:proxy_addr:proxy_addr:2.0.7:*:*:*:*:*:*:*","cpe:2.3:a:proxy:proxy-addr:2.0.7:*:*:*:*:*:*:*","cpe:2.3:a:proxy:proxy_addr:2.0.7:*:*:*:*:*:*:*"],"purl":"pkg:npm/proxy-addr@2.0.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-jqcg-44mw-7w3h","dataSource":"https://github.com/advisories/GHSA-jqcg-44mw-7w3h","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h","https://nvd.nist.gov/vuln/detail/CVE-2026-90711","https://github.com/jshttp/proxy-addr/commit/780911d84d18e2c5fa008ed0c0d387631ec11965","https://cna.openjsf.org/security-advisories.html","https://github.com/jshttp/proxy-addr/releases/tag/v2.0.8"],"description":"proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-90711","epss":0.0026,"percentile":0.17705,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-90711","cwe":"CWE-290","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-90711","cwe":"CWE-348","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-90711","cwe":"CWE-697","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["2.0.8"],"state":"fixed","available":[{"version":"2.0.8","date":"2026-10-06","kind":"first-observed"}]},"advisories":[],"risk":0.2353},"relatedVulnerabilities":[{"id":"CVE-2026-90711","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-90711","namespace":"nvd:cpe","severity":"Critical","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h"],"description":"proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as ::ffff:10.0.0.0/8 instead of the correct ::ffff:10.0.0.0/104, is accepted without error but trusts every IPv4 address on the internet rather than the block it names. Because the socket peer then becomes trusted at hop 0, any unauthenticated client can supply an arbitrary X-Forwarded-For header and control the address the application reads, which defeats IP-based access control, rate limiting, geolocation, and audit logging. This is a fail-open regression introduced in version 1.1.0. The issue is fixed in proxy-addr 2.0.8, and users should upgrade to 2.0.8 or later. As a workaround, ensure any IPv4-mapped IPv6 trust subnet uses a prefix length of at least 97, or express the range in plain IPv4 notation.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-90711","epss":0.0026,"percentile":0.17705,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-90711","cwe":"CWE-290","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-90711","cwe":"CWE-348","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-90711","cwe":"CWE-697","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"proxy-addr","version":"2.0.7"}},"found":{"vulnerabilityID":"GHSA-jqcg-44mw-7w3h","versionConstraint":">=1.1.0,<2.0.8 (semantic)"},"fix":{"suggestedVersion":"2.0.8"}}],"artifact":{"id":"pkg:npm/proxy-addr@2.0.7?package-id=ac537285881d98cc","name":"proxy-addr","version":"2.0.7","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:proxy-addr:proxy-addr:2.0.7:*:*:*:*:*:*:*","cpe:2.3:a:proxy-addr:proxy_addr:2.0.7:*:*:*:*:*:*:*","cpe:2.3:a:proxy_addr:proxy-addr:2.0.7:*:*:*:*:*:*:*","cpe:2.3:a:proxy_addr:proxy_addr:2.0.7:*:*:*:*:*:*:*","cpe:2.3:a:proxy:proxy-addr:2.0.7:*:*:*:*:*:*:*","cpe:2.3:a:proxy:proxy_addr:2.0.7:*:*:*:*:*:*:*"],"purl":"pkg:npm/proxy-addr@2.0.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-698v-4r3x-3vcv","dataSource":"https://github.com/advisories/GHSA-698v-4r3x-3vcv","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/vitejs/launch-editor/security/advisories/GHSA-698v-4r3x-3vcv","https://nvd.nist.gov/vuln/detail/CVE-2026-112943","https://github.com/vitejs/launch-editor/pull/155","https://github.com/vitejs/launch-editor/commit/3c2f9bf2ff8fe63d056a8f9cc52d825b66ca79fc","https://github.com/vitejs/launch-editor/releases/tag/v2.14.2"],"description":"launch-editor: escapeCmdArgs() omits % escaping on Windows","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112943","epss":0.00414,"percentile":0.35746,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112943","cwe":"CWE-78","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.3.7"],"state":"fixed","available":[{"version":"7.3.7","date":"2026-10-21","kind":"first-observed"}]},"advisories":[],"risk":0.23390999999999992},"relatedVulnerabilities":[{"id":"CVE-2026-112943","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112943","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/vitejs/launch-editor/commit/3c2f9bf2ff8fe63d056a8f9cc52d825b66ca79fc","https://github.com/vitejs/launch-editor/pull/155","https://github.com/vitejs/launch-editor/releases/tag/v2.14.2","https://github.com/vitejs/launch-editor/security/advisories/GHSA-698v-4r3x-3vcv"],"description":"launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. This vulnerability is fixed in 2.14.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112943","epss":0.00414,"percentile":0.35746,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112943","cwe":"CWE-78","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"vite","version":"7.3.2"}},"found":{"vulnerabilityID":"GHSA-698v-4r3x-3vcv","versionConstraint":">=7.0.0,<=7.3.6 (semantic)"},"fix":{"suggestedVersion":"7.3.7"}}],"artifact":{"id":"pkg:npm/vite@7.3.2?package-id=5c0ce5d7d525ae42","name":"vite","version":"7.3.2","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vitejs:vite:7.3.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/vite@7.3.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-698v-4r3x-3vcv","dataSource":"https://github.com/advisories/GHSA-698v-4r3x-3vcv","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/vitejs/launch-editor/security/advisories/GHSA-698v-4r3x-3vcv","https://nvd.nist.gov/vuln/detail/CVE-2026-112943","https://github.com/vitejs/launch-editor/pull/155","https://github.com/vitejs/launch-editor/commit/3c2f9bf2ff8fe63d056a8f9cc52d825b66ca79fc","https://github.com/vitejs/launch-editor/releases/tag/v2.14.2"],"description":"launch-editor: escapeCmdArgs() omits % escaping on Windows","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112943","epss":0.00414,"percentile":0.35746,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112943","cwe":"CWE-78","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.3.7"],"state":"fixed","available":[{"version":"7.3.7","date":"2026-10-21","kind":"first-observed"}]},"advisories":[],"risk":0.23390999999999992},"relatedVulnerabilities":[{"id":"CVE-2026-112943","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112943","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/vitejs/launch-editor/commit/3c2f9bf2ff8fe63d056a8f9cc52d825b66ca79fc","https://github.com/vitejs/launch-editor/pull/155","https://github.com/vitejs/launch-editor/releases/tag/v2.14.2","https://github.com/vitejs/launch-editor/security/advisories/GHSA-698v-4r3x-3vcv"],"description":"launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. This vulnerability is fixed in 2.14.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112943","epss":0.00414,"percentile":0.35746,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112943","cwe":"CWE-78","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"vite","version":"7.3.6"}},"found":{"vulnerabilityID":"GHSA-698v-4r3x-3vcv","versionConstraint":">=7.0.0,<=7.3.6 (semantic)"},"fix":{"suggestedVersion":"7.3.7"}}],"artifact":{"id":"pkg:npm/vite@7.3.6?package-id=dcc7b510dec05363","name":"vite","version":"7.3.6","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vitejs:vite:7.3.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/vite@7.3.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-698v-4r3x-3vcv","dataSource":"https://github.com/advisories/GHSA-698v-4r3x-3vcv","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/vitejs/launch-editor/security/advisories/GHSA-698v-4r3x-3vcv","https://nvd.nist.gov/vuln/detail/CVE-2026-112943","https://github.com/vitejs/launch-editor/pull/155","https://github.com/vitejs/launch-editor/commit/3c2f9bf2ff8fe63d056a8f9cc52d825b66ca79fc","https://github.com/vitejs/launch-editor/releases/tag/v2.14.2"],"description":"launch-editor: escapeCmdArgs() omits % escaping on Windows","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112943","epss":0.00414,"percentile":0.35746,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112943","cwe":"CWE-78","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["8.2.4"],"state":"fixed","available":[{"version":"8.2.4","date":"2026-10-21","kind":"first-observed"}]},"advisories":[],"risk":0.23390999999999992},"relatedVulnerabilities":[{"id":"CVE-2026-112943","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112943","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/vitejs/launch-editor/commit/3c2f9bf2ff8fe63d056a8f9cc52d825b66ca79fc","https://github.com/vitejs/launch-editor/pull/155","https://github.com/vitejs/launch-editor/releases/tag/v2.14.2","https://github.com/vitejs/launch-editor/security/advisories/GHSA-698v-4r3x-3vcv"],"description":"launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. This vulnerability is fixed in 2.14.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112943","epss":0.00414,"percentile":0.35746,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112943","cwe":"CWE-78","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"vite","version":"8.2.2"}},"found":{"vulnerabilityID":"GHSA-698v-4r3x-3vcv","versionConstraint":">=8.2.0,<=8.2.3 (semantic)"},"fix":{"suggestedVersion":"8.2.4"}}],"artifact":{"id":"pkg:npm/vite@8.2.2?package-id=ae073bacc7b8ee83","name":"vite","version":"8.2.2","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vitejs:vite:8.2.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/vite@8.2.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-xj6q-8x83-jv6g","dataSource":"https://github.com/advisories/GHSA-xj6q-8x83-jv6g","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-xj6q-8x83-jv6g","https://github.com/axios/axios/pull/11000","https://github.com/axios/axios/commit/32fc489632377d214db55bfa4e2c48486a7d7ce2","https://github.com/axios/axios/releases/tag/v1.18.0","https://nvd.nist.gov/vuln/detail/CVE-2026-67314","https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-auth-subfields"],"description":"Axios: Prototype pollution auth subfields can inject Basic auth","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67314","epss":0.00411,"percentile":0.35394,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67314","cwe":"CWE-1321","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["1.18.0"],"state":"fixed","available":[{"version":"1.18.0","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.23221499999999998},"relatedVulnerabilities":[{"id":"CVE-2026-67314","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-67314","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-xj6q-8x83-jv6g","https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-auth-subfields"],"description":"axios versions >=1.15.2 and <1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling (lib/adapters/http.js and lib/helpers/resolveConfig.js). When an application is already affected by a separate prototype-pollution primitive and makes an axios request with an own auth object that omits the username and/or password properties, axios reads the inherited Object.prototype.username and Object.prototype.password values and uses them to construct an outbound 'Authorization: Basic ...' header. axios itself does not pollute prototypes. The practical impact is outbound request tampering: an attacker who controls the polluted prototype values can inject attacker-chosen Basic auth credentials or replace an existing Authorization header. Credential disclosure is only possible under additional application-specific conditions.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67314","epss":0.00411,"percentile":0.35394,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67314","cwe":"CWE-1321","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.16.1"}},"found":{"vulnerabilityID":"GHSA-xj6q-8x83-jv6g","versionConstraint":">=1.15.2,<1.18.0 (semantic)"},"fix":{"suggestedVersion":"1.18.0"}}],"artifact":{"id":"pkg:npm/axios@1.16.1?package-id=8545c428c207f9fb","name":"axios","version":"1.16.1","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.16.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.16.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-65pc-fj4g-8rjx","dataSource":"https://github.com/advisories/GHSA-65pc-fj4g-8rjx","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/kjd/idna/security/advisories/GHSA-65pc-fj4g-8rjx","https://nvd.nist.gov/vuln/detail/CVE-2026-45409","https://github.com/pypa/advisory-database/tree/main/vulns/idna/PYSEC-2026-215.yaml"],"description":"Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-45409","epss":0.00408,"percentile":0.351,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-45409","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.15"],"state":"fixed","available":[{"version":"3.15","date":"2026-05-19","kind":"first-observed"}]},"advisories":[],"risk":0.22643999999999997},"relatedVulnerabilities":[{"id":"CVE-2026-45409","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45409","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/kjd/idna/security/advisories/GHSA-65pc-fj4g-8rjx"],"description":"Internationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as `\"\\u0660\" * N` or `\"\\u30fb\" * N + \"\\u6f22\"` utilize the `valid_contexto` function prior to length rejection, and for high values of `N` will take a long time to process. This is the same issue as CVE-2024-3651, however the original remediation in 2024 was not a complete fix. A specially crafted argument to the `idna.encode()` function could consume significant resources. This may lead to a denial-of-service. Starting in version 3.14, the function rejects long inputs as soon as practicable prior to any further processing to minimize resource consumption. In version 3.15, this approach was extended to lesser used alternate functions (i.e. per-label conversions and codec support). A workaround is available. Domain names cannot exceed 253 characters in length. If this length limit is enforced prior to passing the domain to the `idna.encode()` function, it should no longer consume significant resources. This is triggered by arbitrarily large inputs that would not occur in normal usage, but may be passed to the library assuming there is no preliminary input validation by the higher-level application.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-45409","epss":0.00408,"percentile":0.351,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-45409","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"idna","version":"3.11"}},"found":{"vulnerabilityID":"GHSA-65pc-fj4g-8rjx","versionConstraint":"<3.15 (python)"},"fix":{"suggestedVersion":"3.15"}}],"artifact":{"id":"pkg:pypi/idna@3.11?package-id=507035f938af05f6","name":"idna","version":"3.11","type":"python","locations":[{"path":"/backend/bdd/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:kjd:internationalized_domain_names_in_applications:3.11:*:*:*:*:python:*:*"],"purl":"pkg:pypi/idna@3.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-4mh8-r7rc-xpvc","dataSource":"https://github.com/advisories/GHSA-4mh8-r7rc-xpvc","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/fastify/fastify/security/advisories/GHSA-4mh8-r7rc-xpvc","https://nvd.nist.gov/vuln/detail/CVE-2026-92081","https://github.com/fastify/fastify/issues/6574","https://github.com/fastify/fastify/commit/ad06a4c3fe8a944a904f38068249b18b8f552e90","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fastify/releases/tag/v5.12.5"],"description":"fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-92081","epss":0.00412,"percentile":0.35501,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-92081","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["5.12.5"],"state":"fixed","available":[{"version":"5.12.5","date":"2026-10-01","kind":"first-observed"}]},"advisories":[],"risk":0.22454000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-92081","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92081","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fastify/security/advisories/GHSA-4mh8-r7rc-xpvc"],"description":"fastify is a fast and low-overhead web framework for Node.js. In versions before 5.12.5, when a route registers a response trailer via reply.trailer() and is served over HTTP/2, fastify unconditionally sets the Transfer-Encoding: chunked header, which is forbidden on HTTP/2, so Node.js throws while serializing the response headers. The exception is not caught and becomes an uncaughtException, so a single unauthenticated HTTP/2 request to any route that uses trailers crashes the server process and drops all in-flight requests, and it can be repeated on every restart. The issue is fixed in fastify 5.12.5, and users should upgrade to 5.12.5 or later. As a workaround, avoid registering response trailers with reply.trailer() on routes served over HTTP/2 until upgrading.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-92081","epss":0.00412,"percentile":0.35501,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-92081","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fastify","version":"5.8.5"}},"found":{"vulnerabilityID":"GHSA-4mh8-r7rc-xpvc","versionConstraint":"<5.12.5 (semantic)"},"fix":{"suggestedVersion":"5.12.5"}}],"artifact":{"id":"pkg:npm/fastify@5.8.5?package-id=72dfb6219c562dcc","name":"fastify","version":"5.8.5","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:fastify:fastify:5.8.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fastify@5.8.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-hpcv-96wg-7vj8","dataSource":"https://github.com/advisories/GHSA-hpcv-96wg-7vj8","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/cure53/DOMPurify/security/advisories/GHSA-hpcv-96wg-7vj8"],"description":"DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-49458","epss":0.00404,"percentile":0.347,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-49458","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-49458","cwe":"CWE-501","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-49458","cwe":"CWE-693","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.4.6"],"state":"fixed","available":[{"version":"3.4.6","date":"2026-06-16","kind":"first-observed"}]},"advisories":[],"risk":0.22421999999999997},"relatedVulnerabilities":[{"id":"CVE-2026-49458","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-49458","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/cure53/DOMPurify/commit/bb7739e5bccec7e1ab3dae3f3e42d02db3acaaae","https://github.com/cure53/DOMPurify/releases/tag/3.4.6","https://github.com/cure53/DOMPurify/security/advisories/GHSA-hpcv-96wg-7vj8"],"description":"DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(node, { IN_PLACE: true }) accepted same-origin foreign-realm DOM nodes while follow-on checks used parent-realm constructors, causing instanceof checks for forms, named node maps, document fragments, and elements to fail and skip clobber, template-content, and shadow-DOM sanitization branches so executable markup could survive. This issue is fixed in version 3.4.6.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-49458","epss":0.00404,"percentile":0.347,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-49458","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-49458","cwe":"CWE-501","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-49458","cwe":"CWE-693","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"dompurify","version":"3.3.3"}},"found":{"vulnerabilityID":"GHSA-hpcv-96wg-7vj8","versionConstraint":"<=3.4.5 (semantic)"},"fix":{"suggestedVersion":"3.4.6"}}],"artifact":{"id":"pkg:npm/dompurify@3.3.3?package-id=5ef50eed3845476c","name":"dompurify","version":"3.3.3","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MPL-2.0 OR Apache-2.0"],"cpes":["cpe:2.3:a:dompurify:dompurify:3.3.3:*:*:*:*:*:*:*"],"purl":"pkg:npm/dompurify@3.3.3","upstreams":[]}},{"vulnerability":{"id":"GO-2026-6180","dataSource":"https://go.dev/issue/80745","namespace":"govulndb:language:go","severity":"High","urls":["https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://go.dev/cl/815000","https://go.dev/cl/815020"],"description":"A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log.\n\nThis attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log.\n\nIn order to determine if you have been affected:\n\nrm -r go.sum go.work.sum vendor/ && go mod tidy","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-56864","epss":0.00298,"percentile":0.22508,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-56864","cwe":"CWE-347","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.40.0"],"state":"fixed","available":[{"version":"0.40.0","date":"2026-08-13","kind":"release"}]},"advisories":[],"risk":0.2235},"relatedVulnerabilities":[{"id":"CVE-2026-56864","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56864","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/815000","https://go.dev/cl/815020","https://go.dev/issue/80745","https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://pkg.go.dev/vuln/GO-2026-6180"],"description":"A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected:   rm -r go.sum go.work.sum vendor/ && go mod tidy","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-56864","epss":0.00298,"percentile":0.22508,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-56864","cwe":"CWE-347","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/mod","version":"v0.37.0"}},"found":{"vulnerabilityID":"GO-2026-6180","versionConstraint":"<0.40.0 (go)"},"fix":{"suggestedVersion":"0.40.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/mod@v0.37.0?package-id=66a79f08c043fa23","name":"golang.org/x/mod","version":"v0.37.0","type":"go-module","locations":[{"path":"/backend-go/go.mod","accessPath":""}],"language":"go","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:golang:x\\/mod:v0.37.0:*:*:*:*:*:*:*"],"purl":"pkg:golang/golang.org/x/mod@v0.37.0","upstreams":[],"metadataType":"GolangSourceMetadata","metadata":{"h1Digest":"h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=","os":"linux","architecture":"amd64","cgoEnabled":true}}},{"vulnerability":{"id":"GHSA-xwg4-73v4-xw9w","dataSource":"https://github.com/advisories/GHSA-xwg4-73v4-xw9w","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w","https://nvd.nist.gov/vuln/detail/CVE-2026-73086","https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4","https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3","https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac","https://github.com/ai/nanoid/releases/tag/3.3.12","https://github.com/ai/nanoid/releases/tag/5.1.11"],"description":"nanoid: Integer Overflow or Wraparound","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73086","epss":0.00296,"percentile":0.22343,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73086","cwe":"CWE-190","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.3.12"],"state":"fixed","available":[{"version":"3.3.12","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.22052},"relatedVulnerabilities":[{"id":"CVE-2026-73086","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-73086","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4","https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3","https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac","https://github.com/ai/nanoid/releases/tag/3.3.12","https://github.com/ai/nanoid/releases/tag/5.1.11","https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w"],"description":"nanoid is a secure, URL-friendly, unique string ID generator for JavaScript. Prior to versions 3.3.12 and 5.1.11, the nanoid(size) function in index.js and index.cjs coerces the user-influenced size parameter to a signed 32-bit integer, allowing a value of 2147483648 to become -2147483648 and corrupt the process-wide CSPRNG poolOffset in fillPool(), which causes subsequent session tokens, CSRF tokens, API keys, and unique identifiers to become the deterministic string \"uuuuuuuuuuuuuuuuuuuuu\" until the process restarts. This issue is fixed in versions 3.3.12 and 5.1.11.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73086","epss":0.00296,"percentile":0.22343,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73086","cwe":"CWE-190","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"nanoid","version":"3.3.11"}},"found":{"vulnerabilityID":"GHSA-xwg4-73v4-xw9w","versionConstraint":"<3.3.12 (semantic)"},"fix":{"suggestedVersion":"3.3.12"}}],"artifact":{"id":"pkg:npm/nanoid@3.3.11?package-id=09857e177282a1da","name":"nanoid","version":"3.3.11","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nanoid_project:nanoid:3.3.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/nanoid@3.3.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-xwg4-73v4-xw9w","dataSource":"https://github.com/advisories/GHSA-xwg4-73v4-xw9w","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w","https://nvd.nist.gov/vuln/detail/CVE-2026-73086","https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4","https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3","https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac","https://github.com/ai/nanoid/releases/tag/3.3.12","https://github.com/ai/nanoid/releases/tag/5.1.11"],"description":"nanoid: Integer Overflow or Wraparound","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73086","epss":0.00296,"percentile":0.22343,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73086","cwe":"CWE-190","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["5.1.11"],"state":"fixed","available":[{"version":"5.1.11","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.22052},"relatedVulnerabilities":[{"id":"CVE-2026-73086","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-73086","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4","https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3","https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac","https://github.com/ai/nanoid/releases/tag/3.3.12","https://github.com/ai/nanoid/releases/tag/5.1.11","https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w"],"description":"nanoid is a secure, URL-friendly, unique string ID generator for JavaScript. Prior to versions 3.3.12 and 5.1.11, the nanoid(size) function in index.js and index.cjs coerces the user-influenced size parameter to a signed 32-bit integer, allowing a value of 2147483648 to become -2147483648 and corrupt the process-wide CSPRNG poolOffset in fillPool(), which causes subsequent session tokens, CSRF tokens, API keys, and unique identifiers to become the deterministic string \"uuuuuuuuuuuuuuuuuuuuu\" until the process restarts. This issue is fixed in versions 3.3.12 and 5.1.11.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73086","epss":0.00296,"percentile":0.22343,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73086","cwe":"CWE-190","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"nanoid","version":"5.1.6"}},"found":{"vulnerabilityID":"GHSA-xwg4-73v4-xw9w","versionConstraint":">=4.0.0,<5.1.11 (semantic)"},"fix":{"suggestedVersion":"5.1.11"}}],"artifact":{"id":"pkg:npm/nanoid@5.1.6?package-id=fdbb3bc1f2b319e8","name":"nanoid","version":"5.1.6","type":"npm","locations":[{"path":"/sink/oidc-server/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nanoid_project:nanoid:5.1.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/nanoid@5.1.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-q2hr-2g5m-vwhr","dataSource":"https://github.com/advisories/GHSA-q2hr-2g5m-vwhr","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr","https://nvd.nist.gov/vuln/detail/CVE-2026-102277","https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e"],"description":"brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102277","epss":0.00428,"percentile":0.37125,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102277","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102277","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.1.21"],"state":"fixed","available":[{"version":"1.1.21","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.22042},"relatedVulnerabilities":[{"id":"CVE-2026-102277","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102277","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-input rescans with linear working-string growth cause quadratic CPU time and memory pressure that can block the Node.js event loop. The process eventually recovers, making the impact a recoverable CPU denial of service. This issue is fixed in versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102277","epss":0.00428,"percentile":0.37125,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102277","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102277","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.14"}},"found":{"vulnerabilityID":"GHSA-q2hr-2g5m-vwhr","versionConstraint":"<1.1.21 (semantic)"},"fix":{"suggestedVersion":"1.1.21"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.14?package-id=e9bc4db499821f08","name":"brace-expansion","version":"1.1.14","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.14:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.14","upstreams":[]}},{"vulnerability":{"id":"GHSA-q2hr-2g5m-vwhr","dataSource":"https://github.com/advisories/GHSA-q2hr-2g5m-vwhr","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr","https://nvd.nist.gov/vuln/detail/CVE-2026-102277","https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e"],"description":"brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102277","epss":0.00428,"percentile":0.37125,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102277","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102277","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.1.21"],"state":"fixed","available":[{"version":"1.1.21","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.22042},"relatedVulnerabilities":[{"id":"CVE-2026-102277","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102277","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-input rescans with linear working-string growth cause quadratic CPU time and memory pressure that can block the Node.js event loop. The process eventually recovers, making the impact a recoverable CPU denial of service. This issue is fixed in versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102277","epss":0.00428,"percentile":0.37125,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102277","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102277","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.14"}},"found":{"vulnerabilityID":"GHSA-q2hr-2g5m-vwhr","versionConstraint":"<1.1.21 (semantic)"},"fix":{"suggestedVersion":"1.1.21"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.14?package-id=fa326f252298de13","name":"brace-expansion","version":"1.1.14","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.14:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.14","upstreams":[]}},{"vulnerability":{"id":"GHSA-q2hr-2g5m-vwhr","dataSource":"https://github.com/advisories/GHSA-q2hr-2g5m-vwhr","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr","https://nvd.nist.gov/vuln/detail/CVE-2026-102277","https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e"],"description":"brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102277","epss":0.00428,"percentile":0.37125,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102277","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102277","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.1.7"],"state":"fixed","available":[{"version":"2.1.7","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.22042},"relatedVulnerabilities":[{"id":"CVE-2026-102277","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102277","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-input rescans with linear working-string growth cause quadratic CPU time and memory pressure that can block the Node.js event loop. The process eventually recovers, making the impact a recoverable CPU denial of service. This issue is fixed in versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102277","epss":0.00428,"percentile":0.37125,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102277","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102277","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"2.1.0"}},"found":{"vulnerabilityID":"GHSA-q2hr-2g5m-vwhr","versionConstraint":">=2.0.0,<2.1.7 (semantic)"},"fix":{"suggestedVersion":"2.1.7"}}],"artifact":{"id":"pkg:npm/brace-expansion@2.1.0?package-id=5b11ade77bad45b9","name":"brace-expansion","version":"2.1.0","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:2.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@2.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-q2hr-2g5m-vwhr","dataSource":"https://github.com/advisories/GHSA-q2hr-2g5m-vwhr","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr","https://nvd.nist.gov/vuln/detail/CVE-2026-102277","https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e"],"description":"brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102277","epss":0.00428,"percentile":0.37125,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102277","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102277","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["5.0.12"],"state":"fixed","available":[{"version":"5.0.12","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.22042},"relatedVulnerabilities":[{"id":"CVE-2026-102277","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102277","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-input rescans with linear working-string growth cause quadratic CPU time and memory pressure that can block the Node.js event loop. The process eventually recovers, making the impact a recoverable CPU denial of service. This issue is fixed in versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102277","epss":0.00428,"percentile":0.37125,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102277","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102277","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"5.0.9"}},"found":{"vulnerabilityID":"GHSA-q2hr-2g5m-vwhr","versionConstraint":">=4.0.0,<5.0.12 (semantic)"},"fix":{"suggestedVersion":"5.0.12"}}],"artifact":{"id":"pkg:npm/brace-expansion@5.0.9?package-id=2a3f60339f328dc4","name":"brace-expansion","version":"5.0.9","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:5.0.9:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@5.0.9","upstreams":[]}},{"vulnerability":{"id":"GHSA-rpw4-54j3-4h4q","dataSource":"https://github.com/advisories/GHSA-rpw4-54j3-4h4q","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rpw4-54j3-4h4q","https://nvd.nist.gov/vuln/detail/CVE-2026-101913","https://github.com/beaugunderson/ip-address/commit/d03e960c7cc3179ef25c8a44b4f94dd499625546","https://github.com/beaugunderson/ip-address/releases/tag/v10.5.1"],"description":"ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101913","epss":0.00386,"percentile":0.32688,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101913","cwe":"CWE-697","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-101913","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["10.5.1"],"state":"fixed","available":[{"version":"10.5.1","date":"2026-09-29","kind":"first-observed"}]},"advisories":[],"risk":0.21809},"relatedVulnerabilities":[{"id":"CVE-2026-101913","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101913","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/beaugunderson/ip-address/commit/d03e960c7cc3179ef25c8a44b4f94dd499625546","https://github.com/beaugunderson/ip-address/releases/tag/v10.5.1","https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rpw4-54j3-4h4q"],"description":"ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.5.1, the Address6 isLinkLocal method in src/ipv6.ts recognizes only fe80::/64 instead of the complete fe80::/10 IPv6 link-local range. An attacker-controlled address elsewhere in fe80::/10 can therefore pass a trust-boundary check that relies on isLinkLocal. The same address is identified as link-local by getType and getScope, exposing the inconsistent classification. A successful bypass can reach an on-link host outside the intended trust boundary. This issue is fixed in version 10.5.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101913","epss":0.00386,"percentile":0.32688,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101913","cwe":"CWE-697","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-101913","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"ip-address","version":"10.1.0"}},"found":{"vulnerabilityID":"GHSA-rpw4-54j3-4h4q","versionConstraint":"<=10.5.0 (semantic)"},"fix":{"suggestedVersion":"10.5.1"}}],"artifact":{"id":"pkg:npm/ip-address@10.1.0?package-id=d0c928307aa7dbe2","name":"ip-address","version":"10.1.0","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:beaugunderson:ip-address:10.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/ip-address@10.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-h3mg-xc3c-68pw","dataSource":"https://github.com/advisories/GHSA-h3mg-xc3c-68pw","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-h3mg-xc3c-68pw","https://nvd.nist.gov/vuln/detail/CVE-2026-101911","https://github.com/beaugunderson/ip-address/commit/469ead1231b4cc059f2150c626e1e0c2895c0134","https://github.com/beaugunderson/ip-address/commit/8b34a21e0839b37c094066816fb2c2c48a2adcf5","https://github.com/beaugunderson/ip-address/releases/tag/v10.7.1"],"description":"ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101911","epss":0.00383,"percentile":0.32363,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101911","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-101911","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["10.7.1"],"state":"fixed","available":[{"version":"10.7.1","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.216395},"relatedVulnerabilities":[{"id":"CVE-2026-101911","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101911","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/beaugunderson/ip-address/commit/469ead1231b4cc059f2150c626e1e0c2895c0134","https://github.com/beaugunderson/ip-address/commit/8b34a21e0839b37c094066816fb2c2c48a2adcf5","https://github.com/beaugunderson/ip-address/releases/tag/v10.7.1","https://github.com/beaugunderson/ip-address/security/advisories/GHSA-h3mg-xc3c-68pw"],"description":"ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the Address6 constructor, Address6.isValid, and parse code in src/ipv6.ts accept unbounded strings and expand invalid characters through RE_BAD_CHARACTERS into large diagnostics. Material impact occurs only when an application accepts a very large attacker-controlled field and passes it to Address6 parsing without an earlier length bound. Common URL and header limits, and common body-parser defaults, generally constrain the effect; common defaults typically exclude 32 MiB fields. Megabyte-scale fields can cause a synchronous stall and high transient memory use, approximately 16 MiB can trigger an invalid string length exception, and process termination occurs at approximately 32 MiB. The affected entry points include Address6.isValid and construction paths that reach parse. This issue is fixed in version 10.7.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101911","epss":0.00383,"percentile":0.32363,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101911","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-101911","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"ip-address","version":"10.1.0"}},"found":{"vulnerabilityID":"GHSA-h3mg-xc3c-68pw","versionConstraint":"<=10.7.0 (semantic)"},"fix":{"suggestedVersion":"10.7.1"}}],"artifact":{"id":"pkg:npm/ip-address@10.1.0?package-id=d0c928307aa7dbe2","name":"ip-address","version":"10.1.0","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:beaugunderson:ip-address:10.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/ip-address@10.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-q8mj-m7cp-5q26","dataSource":"https://github.com/advisories/GHSA-q8mj-m7cp-5q26","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/ljharb/qs/security/advisories/GHSA-q8mj-m7cp-5q26","https://nvd.nist.gov/vuln/detail/CVE-2026-8723","https://github.com/ljharb/qs/commit/21f80b33e5c8b3f7eba1034fff0da4a4a37a1d41"],"description":"qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-8723","epss":0.00399,"percentile":0.34223,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-8723","cwe":"CWE-476","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}],"fix":{"versions":["6.15.2"],"state":"fixed","available":[{"version":"6.15.2","date":"2026-05-23","kind":"first-observed"}]},"advisories":[],"risk":0.21546},"relatedVulnerabilities":[{"id":"CVE-2026-8723","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8723","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/ljharb/qs/commit/21f80b33e5c8b3f7eba1034fff0da4a4a37a1d41","https://github.com/ljharb/qs/security/advisories/GHSA-q8mj-m7cp-5q26"],"description":"### Summary\n\n\n\n`qs.stringify` throws `TypeError` when called with `arrayFormat: 'comma'` and `encodeValuesOnly: true` on an array containing `null` or `undefined`. The throw is synchronous and not handled by any of qs's null-related options (`skipNulls`, `strictNullHandling`).\n\n\n\n### Details\n\n\n\nIn the comma + `encodeValuesOnly` branch, `lib/stringify.js:145` mapped the array through the raw encoder before joining:\n\n\n\n```js\n\n\n\nobj = utils.maybeMap(obj, encoder);\n\n\n\n```\n\n\n\n`utils.encode` (`lib/utils.js:195`) reads `str.length` with no null guard, so a `null` or `undefined` element throws `TypeError`. `skipNulls` and `strictNullHandling` are both checked in the per-element loop below this line and never get a chance to run.\n\n\n\nSame class of bug as the filter-array path fixed in 0c180a4. The vulnerable shape of the comma + `encodeValuesOnly` branch was introduced in 4c4b23d (\"encode comma values more consistently\", PR #463, 2023-01-19), first released in v6.11.1.\n\n\n\n#### PoC\n\n\n\n```js\n\n\n\nconst qs = require('qs');\n\n\n\nqs.stringify({ a: [null, 'b'] },      { arrayFormat: 'comma', encodeValuesOnly: true });\n\n\n\nqs.stringify({ a: [undefined, 'b'] }, { arrayFormat: 'comma', encodeValuesOnly: true });\n\n\n\nqs.stringify({ a: [null] },           { arrayFormat: 'comma', encodeValuesOnly: true });\n\n\n\n// TypeError: Cannot read properties of null (reading 'length')\n\n\n\n//     at encode (lib/utils.js:195:13)\n\n\n\n//     at Object.maybeMap (lib/utils.js:322:37)\n\n\n\n//     at stringify (lib/stringify.js:145:25)\n\n\n\n```\n\n\n\n#### Fix\n\n\n\n`lib/stringify.js:145`, applied in 21f80b3 on `main` and released as v6.15.2:\n\n\n\n```diff\n\n\n\n- obj = utils.maybeMap(obj, encoder);\n\n\n\n+ obj = utils.maybeMap(obj, function (v) {\n\n\n\n+     return v == null ? v : encoder(v);\n\n\n\n+ });\n\n\n\n```\n\n\n\n`null` and `undefined` now pass through `maybeMap` unchanged and reach the `join(',')` step as-is. For `{ a: [null, 'b'] }` this produces `a=,b`, matching the non-`encodeValuesOnly` comma path (which already joins before encoding and produces `a=%2Cb` for the same input). Single-element `[null]` arrays still collapse via the existing `obj.join(',') || null` and remain subject to `skipNulls` / `strictNullHandling` in the main loop.\n\n\n\n### Affected versions\n\n\n\n`>=6.11.1 <6.15.2` — fixed in v6.15.2.\n\n\n\nThe vulnerable code shape was introduced in 4c4b23d and first shipped in v6.11.1. Earlier versions — including all of 6.7.x, 6.8.x, 6.9.x, 6.10.x, and 6.11.0 — implemented the comma + `encodeValuesOnly` path differently (joining before encoding) and are not affected. Empirically verified across released versions.\n\n\n\n### Impact\n\n\n\nApplication code that calls `qs.stringify` with both `arrayFormat: 'comma'` and `encodeValuesOnly: true` (both non-default) on input that may contain a `null` or `undefined` array element will throw synchronously instead of producing a query string. In a typical Node.js HTTP framework (Express, Fastify, Koa, hapi) the sync throw is caught by the framework's error boundary and the affected request returns a 500; the worker process does not exit and subsequent requests are unaffected. The \"kills the worker process\" framing applies only to call sites outside a request-handler error boundary (background jobs, startup paths, stream pipelines) or to deployments with framework error handling explicitly disabled.\n\n\n\nThe vulnerable input is a `null` or `undefined` entry inside an array; this is reachable from JSON request bodies or from application code constructing arrays from user input, but not from standard HTML form submissions (which produce strings or omitted fields, not literal `null`).","cvss":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-8723","epss":0.00399,"percentile":0.34223,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-8723","cwe":"CWE-476","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"qs","version":"6.15.0"}},"found":{"vulnerabilityID":"GHSA-q8mj-m7cp-5q26","versionConstraint":">=6.11.1,<=6.15.1 (semantic)"},"fix":{"suggestedVersion":"6.15.2"}}],"artifact":{"id":"pkg:npm/qs@6.15.0?package-id=09311111c4f6e298","name":"qs","version":"6.15.0","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:qs_project:qs:6.15.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/qs@6.15.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-q8mj-m7cp-5q26","dataSource":"https://github.com/advisories/GHSA-q8mj-m7cp-5q26","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/ljharb/qs/security/advisories/GHSA-q8mj-m7cp-5q26","https://nvd.nist.gov/vuln/detail/CVE-2026-8723","https://github.com/ljharb/qs/commit/21f80b33e5c8b3f7eba1034fff0da4a4a37a1d41"],"description":"qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-8723","epss":0.00399,"percentile":0.34223,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-8723","cwe":"CWE-476","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}],"fix":{"versions":["6.15.2"],"state":"fixed","available":[{"version":"6.15.2","date":"2026-05-23","kind":"first-observed"}]},"advisories":[],"risk":0.21546},"relatedVulnerabilities":[{"id":"CVE-2026-8723","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8723","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/ljharb/qs/commit/21f80b33e5c8b3f7eba1034fff0da4a4a37a1d41","https://github.com/ljharb/qs/security/advisories/GHSA-q8mj-m7cp-5q26"],"description":"### Summary\n\n\n\n`qs.stringify` throws `TypeError` when called with `arrayFormat: 'comma'` and `encodeValuesOnly: true` on an array containing `null` or `undefined`. The throw is synchronous and not handled by any of qs's null-related options (`skipNulls`, `strictNullHandling`).\n\n\n\n### Details\n\n\n\nIn the comma + `encodeValuesOnly` branch, `lib/stringify.js:145` mapped the array through the raw encoder before joining:\n\n\n\n```js\n\n\n\nobj = utils.maybeMap(obj, encoder);\n\n\n\n```\n\n\n\n`utils.encode` (`lib/utils.js:195`) reads `str.length` with no null guard, so a `null` or `undefined` element throws `TypeError`. `skipNulls` and `strictNullHandling` are both checked in the per-element loop below this line and never get a chance to run.\n\n\n\nSame class of bug as the filter-array path fixed in 0c180a4. The vulnerable shape of the comma + `encodeValuesOnly` branch was introduced in 4c4b23d (\"encode comma values more consistently\", PR #463, 2023-01-19), first released in v6.11.1.\n\n\n\n#### PoC\n\n\n\n```js\n\n\n\nconst qs = require('qs');\n\n\n\nqs.stringify({ a: [null, 'b'] },      { arrayFormat: 'comma', encodeValuesOnly: true });\n\n\n\nqs.stringify({ a: [undefined, 'b'] }, { arrayFormat: 'comma', encodeValuesOnly: true });\n\n\n\nqs.stringify({ a: [null] },           { arrayFormat: 'comma', encodeValuesOnly: true });\n\n\n\n// TypeError: Cannot read properties of null (reading 'length')\n\n\n\n//     at encode (lib/utils.js:195:13)\n\n\n\n//     at Object.maybeMap (lib/utils.js:322:37)\n\n\n\n//     at stringify (lib/stringify.js:145:25)\n\n\n\n```\n\n\n\n#### Fix\n\n\n\n`lib/stringify.js:145`, applied in 21f80b3 on `main` and released as v6.15.2:\n\n\n\n```diff\n\n\n\n- obj = utils.maybeMap(obj, encoder);\n\n\n\n+ obj = utils.maybeMap(obj, function (v) {\n\n\n\n+     return v == null ? v : encoder(v);\n\n\n\n+ });\n\n\n\n```\n\n\n\n`null` and `undefined` now pass through `maybeMap` unchanged and reach the `join(',')` step as-is. For `{ a: [null, 'b'] }` this produces `a=,b`, matching the non-`encodeValuesOnly` comma path (which already joins before encoding and produces `a=%2Cb` for the same input). Single-element `[null]` arrays still collapse via the existing `obj.join(',') || null` and remain subject to `skipNulls` / `strictNullHandling` in the main loop.\n\n\n\n### Affected versions\n\n\n\n`>=6.11.1 <6.15.2` — fixed in v6.15.2.\n\n\n\nThe vulnerable code shape was introduced in 4c4b23d and first shipped in v6.11.1. Earlier versions — including all of 6.7.x, 6.8.x, 6.9.x, 6.10.x, and 6.11.0 — implemented the comma + `encodeValuesOnly` path differently (joining before encoding) and are not affected. Empirically verified across released versions.\n\n\n\n### Impact\n\n\n\nApplication code that calls `qs.stringify` with both `arrayFormat: 'comma'` and `encodeValuesOnly: true` (both non-default) on input that may contain a `null` or `undefined` array element will throw synchronously instead of producing a query string. In a typical Node.js HTTP framework (Express, Fastify, Koa, hapi) the sync throw is caught by the framework's error boundary and the affected request returns a 500; the worker process does not exit and subsequent requests are unaffected. The \"kills the worker process\" framing applies only to call sites outside a request-handler error boundary (background jobs, startup paths, stream pipelines) or to deployments with framework error handling explicitly disabled.\n\n\n\nThe vulnerable input is a `null` or `undefined` entry inside an array; this is reachable from JSON request bodies or from application code constructing arrays from user input, but not from standard HTML form submissions (which produce strings or omitted fields, not literal `null`).","cvss":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-8723","epss":0.00399,"percentile":0.34223,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-8723","cwe":"CWE-476","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"qs","version":"6.15.1"}},"found":{"vulnerabilityID":"GHSA-q8mj-m7cp-5q26","versionConstraint":">=6.11.1,<=6.15.1 (semantic)"},"fix":{"suggestedVersion":"6.15.2"}}],"artifact":{"id":"pkg:npm/qs@6.15.1?package-id=fb3e21030488c9a8","name":"qs","version":"6.15.1","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:qs_project:qs:6.15.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/qs@6.15.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-q8mj-m7cp-5q26","dataSource":"https://github.com/advisories/GHSA-q8mj-m7cp-5q26","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/ljharb/qs/security/advisories/GHSA-q8mj-m7cp-5q26","https://nvd.nist.gov/vuln/detail/CVE-2026-8723","https://github.com/ljharb/qs/commit/21f80b33e5c8b3f7eba1034fff0da4a4a37a1d41"],"description":"qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-8723","epss":0.00399,"percentile":0.34223,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-8723","cwe":"CWE-476","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}],"fix":{"versions":["6.15.2"],"state":"fixed","available":[{"version":"6.15.2","date":"2026-05-23","kind":"first-observed"}]},"advisories":[],"risk":0.21546},"relatedVulnerabilities":[{"id":"CVE-2026-8723","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8723","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/ljharb/qs/commit/21f80b33e5c8b3f7eba1034fff0da4a4a37a1d41","https://github.com/ljharb/qs/security/advisories/GHSA-q8mj-m7cp-5q26"],"description":"### Summary\n\n\n\n`qs.stringify` throws `TypeError` when called with `arrayFormat: 'comma'` and `encodeValuesOnly: true` on an array containing `null` or `undefined`. The throw is synchronous and not handled by any of qs's null-related options (`skipNulls`, `strictNullHandling`).\n\n\n\n### Details\n\n\n\nIn the comma + `encodeValuesOnly` branch, `lib/stringify.js:145` mapped the array through the raw encoder before joining:\n\n\n\n```js\n\n\n\nobj = utils.maybeMap(obj, encoder);\n\n\n\n```\n\n\n\n`utils.encode` (`lib/utils.js:195`) reads `str.length` with no null guard, so a `null` or `undefined` element throws `TypeError`. `skipNulls` and `strictNullHandling` are both checked in the per-element loop below this line and never get a chance to run.\n\n\n\nSame class of bug as the filter-array path fixed in 0c180a4. The vulnerable shape of the comma + `encodeValuesOnly` branch was introduced in 4c4b23d (\"encode comma values more consistently\", PR #463, 2023-01-19), first released in v6.11.1.\n\n\n\n#### PoC\n\n\n\n```js\n\n\n\nconst qs = require('qs');\n\n\n\nqs.stringify({ a: [null, 'b'] },      { arrayFormat: 'comma', encodeValuesOnly: true });\n\n\n\nqs.stringify({ a: [undefined, 'b'] }, { arrayFormat: 'comma', encodeValuesOnly: true });\n\n\n\nqs.stringify({ a: [null] },           { arrayFormat: 'comma', encodeValuesOnly: true });\n\n\n\n// TypeError: Cannot read properties of null (reading 'length')\n\n\n\n//     at encode (lib/utils.js:195:13)\n\n\n\n//     at Object.maybeMap (lib/utils.js:322:37)\n\n\n\n//     at stringify (lib/stringify.js:145:25)\n\n\n\n```\n\n\n\n#### Fix\n\n\n\n`lib/stringify.js:145`, applied in 21f80b3 on `main` and released as v6.15.2:\n\n\n\n```diff\n\n\n\n- obj = utils.maybeMap(obj, encoder);\n\n\n\n+ obj = utils.maybeMap(obj, function (v) {\n\n\n\n+     return v == null ? v : encoder(v);\n\n\n\n+ });\n\n\n\n```\n\n\n\n`null` and `undefined` now pass through `maybeMap` unchanged and reach the `join(',')` step as-is. For `{ a: [null, 'b'] }` this produces `a=,b`, matching the non-`encodeValuesOnly` comma path (which already joins before encoding and produces `a=%2Cb` for the same input). Single-element `[null]` arrays still collapse via the existing `obj.join(',') || null` and remain subject to `skipNulls` / `strictNullHandling` in the main loop.\n\n\n\n### Affected versions\n\n\n\n`>=6.11.1 <6.15.2` — fixed in v6.15.2.\n\n\n\nThe vulnerable code shape was introduced in 4c4b23d and first shipped in v6.11.1. Earlier versions — including all of 6.7.x, 6.8.x, 6.9.x, 6.10.x, and 6.11.0 — implemented the comma + `encodeValuesOnly` path differently (joining before encoding) and are not affected. Empirically verified across released versions.\n\n\n\n### Impact\n\n\n\nApplication code that calls `qs.stringify` with both `arrayFormat: 'comma'` and `encodeValuesOnly: true` (both non-default) on input that may contain a `null` or `undefined` array element will throw synchronously instead of producing a query string. In a typical Node.js HTTP framework (Express, Fastify, Koa, hapi) the sync throw is caught by the framework's error boundary and the affected request returns a 500; the worker process does not exit and subsequent requests are unaffected. The \"kills the worker process\" framing applies only to call sites outside a request-handler error boundary (background jobs, startup paths, stream pipelines) or to deployments with framework error handling explicitly disabled.\n\n\n\nThe vulnerable input is a `null` or `undefined` entry inside an array; this is reachable from JSON request bodies or from application code constructing arrays from user input, but not from standard HTML form submissions (which produce strings or omitted fields, not literal `null`).","cvss":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-8723","epss":0.00399,"percentile":0.34223,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-8723","cwe":"CWE-476","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"qs","version":"6.15.1"}},"found":{"vulnerabilityID":"GHSA-q8mj-m7cp-5q26","versionConstraint":">=6.11.1,<=6.15.1 (semantic)"},"fix":{"suggestedVersion":"6.15.2"}}],"artifact":{"id":"pkg:npm/qs@6.15.1?package-id=226c68780f5d5463","name":"qs","version":"6.15.1","type":"npm","locations":[{"path":"/sink/oidc-server/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:qs_project:qs:6.15.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/qs@6.15.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-g6cj-pr64-35w5","dataSource":"https://github.com/advisories/GHSA-g6cj-pr64-35w5","namespace":"github:language:python","severity":"High","urls":["https://github.com/pyca/cryptography/security/advisories/GHSA-g6cj-pr64-35w5","https://github.com/pyca/cryptography/pull/15369","https://github.com/pyca/cryptography/commit/53fccd93413a8d7f07d6d8999681f27b75cffa3f"],"description":"cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69247","epss":0.00274,"percentile":0.19875,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69247","cwe":"CWE-208","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69247","cwe":"CWE-209","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["50.0.0"],"state":"fixed","available":[{"version":"50.0.0","date":"2026-08-04","kind":"first-observed"}]},"advisories":[],"risk":0.21508999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-69247","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-69247","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/pyca/cryptography/commit/53fccd93413a8d7f07d6d8999681f27b75cffa3f","https://github.com/pyca/cryptography/pull/15369","https://github.com/pyca/cryptography/security/advisories/GHSA-g6cj-pr64-35w5"],"description":"cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 44.0.0 until 50.0.0, pkcs7_decrypt_der, pkcs7_decrypt_pem, and pkcs7_decrypt_smime reported the outcome of decrypting a RecipientInfo's encryptedKey in several distinguishable ways, one of which disclosed the exact length recovered from the RSA operation. The same distinction was also observable by timing. An application that decrypts attacker-supplied EnvelopedData and reflects the outcome gives the attacker a Bleichenbacher oracle against the content-encryption key. Decryption ran as RSA PKCS#1 v1.5 decrypt of encryptedKey, build an AES cipher from the result, then AES-CBC decrypt and PKCS#7 unpad. Invalid RSA padding, a valid padding with a bad key length, a correct length with a wrong key, and the real key each failed or succeeded differently. Case 1 is reachable only where the linked library lacks implicit rejection: OpenSSL 3.0 and 3.1, LibreSSL, and BoringSSL. Exploitation requires a service that auto-decrypts untrusted EnvelopedData matching the victim certificate and answers adaptively at high volume, such as an S/MIME gateway or mail filter. This issue is fixed in 50.0.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69247","epss":0.00274,"percentile":0.19875,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69247","cwe":"CWE-208","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69247","cwe":"CWE-209","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"cryptography","version":"46.0.7"}},"found":{"vulnerabilityID":"GHSA-g6cj-pr64-35w5","versionConstraint":">=44.0.0,<50.0.0 (python)"},"fix":{"suggestedVersion":"50.0.0"}}],"artifact":{"id":"pkg:pypi/cryptography@46.0.7?package-id=b8850d2d1ea9f785","name":"cryptography","version":"46.0.7","type":"python","locations":[{"path":"/backend/bdd/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:cryptography.io:cryptography:46.0.7:*:*:*:*:python:*:*","cpe:2.3:a:cryptography.io:cryptography:46.0.7:*:*:*:*:*:*:*"],"purl":"pkg:pypi/cryptography@46.0.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-v6wh-96g9-6wx3","dataSource":"https://github.com/advisories/GHSA-v6wh-96g9-6wx3","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/vitejs/launch-editor/security/advisories/GHSA-v6wh-96g9-6wx3"],"description":"launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H","metrics":{"baseScore":5.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53632","epss":0.00408,"percentile":0.35134,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53632","cwe":"CWE-73","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-53632","cwe":"CWE-522","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.3.5"],"state":"fixed","available":[{"version":"7.3.5","date":"2026-06-15","kind":"first-observed"}]},"advisories":[],"risk":0.21420000000000003},"relatedVulnerabilities":[{"id":"CVE-2026-53632","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53632","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/vitejs/launch-editor/security/advisories/GHSA-v6wh-96g9-6wx3"],"description":"launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.1, the launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automatically attempts NTLM authentication to the remote host, causing the user’s NTLMv2 password hash to be leaked to an attacker-controlled SMB server. This can result in credential compromise through offline hash cracking. This vulnerability is fixed in 2.14.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53632","epss":0.00408,"percentile":0.35134,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53632","cwe":"CWE-73","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-53632","cwe":"CWE-522","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"vite","version":"7.3.2"}},"found":{"vulnerabilityID":"GHSA-v6wh-96g9-6wx3","versionConstraint":">=7.0.0,<=7.3.4 (semantic)"},"fix":{"suggestedVersion":"7.3.5"}}],"artifact":{"id":"pkg:npm/vite@7.3.2?package-id=5c0ce5d7d525ae42","name":"vite","version":"7.3.2","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vitejs:vite:7.3.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/vite@7.3.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-4mjr-xmp4-gh2g","dataSource":"https://github.com/advisories/GHSA-4mjr-xmp4-gh2g","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/ljharb/qs/security/advisories/GHSA-4mjr-xmp4-gh2g","https://nvd.nist.gov/vuln/detail/CVE-2026-82417","https://github.com/ljharb/qs/commit/e83d321ffafb38cf210683ac31714fce6ce1c6c6"],"description":"qs: Denial of Service via Attacker Controlled isBuffer","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-82417","epss":0.00396,"percentile":0.33816,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-82417","cwe":"CWE-248","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-82417","cwe":"CWE-703","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}],"fix":{"versions":["6.16.0"],"state":"fixed","available":[{"version":"6.16.0","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.21384},"relatedVulnerabilities":[{"id":"CVE-2026-82417","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82417","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/ljharb/qs/commit/e83d321ffafb38cf210683ac31714fce6ce1c6c6","https://github.com/ljharb/qs/security/advisories/GHSA-4mjr-xmp4-gh2g"],"description":"### Summary\n\n\n\n`qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member. `utils.isBuffer` duck-types buffers by calling `obj.constructor.isBuffer(obj)` after checking only that the property is truthy, so a value such as `{ constructor: { isBuffer: \"x\" } }` makes the call throw `TypeError: obj.constructor.isBuffer is not a function`.\n\n\n\n### Details\n\n\n\n`lib/stringify.js:127` calls `utils.isBuffer` on every non-primitive value it serializes. `utils.isBuffer` (`lib/utils.js:332`) reads `obj.constructor.isBuffer` and invokes it without verifying that it is a function. `constructor` and `isBuffer` are ordinary property names, so any object carrying them as own properties reaches the unchecked call.\n\n\n\nSuch an object can be built from untrusted input. `qs.parse(\"x[constructor][isBuffer]=y\", { plainObjects: true })` or `{ allowPrototypes: true }` keeps the `constructor` key as an own property (the default parse options drop it), and `JSON.parse(\"{\\\"a\\\":{\\\"constructor\\\":{\\\"isBuffer\\\":\\\"x\\\"}}}\")` produces the same shape with no qs option involved. Express 4 with its default `query parser` setting and body-parser with `extended: true` both call `qs.parse` with `allowPrototypes: true`, so on those stacks `req.query` and `req.body` can carry the shape directly.\n\n\n\n#### PoC\n\n\n\n```js\n\n\n\nvar qs = require(\"qs\");\n\n\n\nqs.stringify(qs.parse(\"x[constructor][isBuffer]=y\", { plainObjects: true }));\n\n\n\nqs.stringify(JSON.parse(\"{\\\"a\\\":{\\\"constructor\\\":{\\\"isBuffer\\\":\\\"x\\\"}}}\"));\n\n\n\n// TypeError: obj.constructor.isBuffer is not a function\n\n\n\n//     at Object.isBuffer (lib/utils.js:332:78)\n\n\n\n//     at stringify (lib/stringify.js:127:45)\n\n\n\n```\n\n\n\n#### Fix\n\n\n\n`lib/utils.js`, applied in e83d321 on `main` and released as v6.16.0:\n\n\n\n```diff\n\n\n\n- return !!(obj.constructor && obj.constructor.isBuffer && obj.constructor.isBuffer(obj));\n\n\n\n+ return !!(obj.constructor && typeof obj.constructor.isBuffer === \"function\" && obj.constructor.isBuffer(obj));\n\n\n\n```\n\n\n\nReal `Buffer`, `safer-buffer`, and browserify `buffer` polyfill instances serialize exactly as before; only the throw is removed.\n\n\n\n### Affected versions\n\n\n\n`>=2.2.5 <6.16.0`, fixed in v6.16.0.\n\n\n\nThe unguarded duck-type was introduced in 3768a75 and first shipped in v2.2.5 (September 2014). v2.2.4 and earlier used `Buffer.isBuffer` and are not affected. Every release from v2.2.5 through v6.15.3 contains the unguarded call.\n\n\n\n### Impact\n\n\n\nAn unauthenticated request can make any code path that re-serializes attacker-influenced data with `qs.stringify` (for example, rebuilding a query string from `req.query` for a redirect or an upstream request, or serializing a parsed JSON body) throw synchronously. In a typical Node.js HTTP framework the throw is caught by the framework error boundary and the affected request returns a 500; the process survives and other requests are unaffected. Where the call runs outside an error boundary, such as an `async` Express 4 handler (where the throw becomes an unhandled promise rejection) or a background job, the process exits, so the impact in that case depends on the application error handling rather than on qs.","cvss":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-82417","epss":0.00396,"percentile":0.33816,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-82417","cwe":"CWE-248","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-82417","cwe":"CWE-703","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"qs","version":"6.15.0"}},"found":{"vulnerabilityID":"GHSA-4mjr-xmp4-gh2g","versionConstraint":">=2.2.5,<6.16.0 (semantic)"},"fix":{"suggestedVersion":"6.16.0"}}],"artifact":{"id":"pkg:npm/qs@6.15.0?package-id=09311111c4f6e298","name":"qs","version":"6.15.0","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:qs_project:qs:6.15.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/qs@6.15.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-4mjr-xmp4-gh2g","dataSource":"https://github.com/advisories/GHSA-4mjr-xmp4-gh2g","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/ljharb/qs/security/advisories/GHSA-4mjr-xmp4-gh2g","https://nvd.nist.gov/vuln/detail/CVE-2026-82417","https://github.com/ljharb/qs/commit/e83d321ffafb38cf210683ac31714fce6ce1c6c6"],"description":"qs: Denial of Service via Attacker Controlled isBuffer","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-82417","epss":0.00396,"percentile":0.33816,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-82417","cwe":"CWE-248","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-82417","cwe":"CWE-703","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}],"fix":{"versions":["6.16.0"],"state":"fixed","available":[{"version":"6.16.0","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.21384},"relatedVulnerabilities":[{"id":"CVE-2026-82417","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82417","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/ljharb/qs/commit/e83d321ffafb38cf210683ac31714fce6ce1c6c6","https://github.com/ljharb/qs/security/advisories/GHSA-4mjr-xmp4-gh2g"],"description":"### Summary\n\n\n\n`qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member. `utils.isBuffer` duck-types buffers by calling `obj.constructor.isBuffer(obj)` after checking only that the property is truthy, so a value such as `{ constructor: { isBuffer: \"x\" } }` makes the call throw `TypeError: obj.constructor.isBuffer is not a function`.\n\n\n\n### Details\n\n\n\n`lib/stringify.js:127` calls `utils.isBuffer` on every non-primitive value it serializes. `utils.isBuffer` (`lib/utils.js:332`) reads `obj.constructor.isBuffer` and invokes it without verifying that it is a function. `constructor` and `isBuffer` are ordinary property names, so any object carrying them as own properties reaches the unchecked call.\n\n\n\nSuch an object can be built from untrusted input. `qs.parse(\"x[constructor][isBuffer]=y\", { plainObjects: true })` or `{ allowPrototypes: true }` keeps the `constructor` key as an own property (the default parse options drop it), and `JSON.parse(\"{\\\"a\\\":{\\\"constructor\\\":{\\\"isBuffer\\\":\\\"x\\\"}}}\")` produces the same shape with no qs option involved. Express 4 with its default `query parser` setting and body-parser with `extended: true` both call `qs.parse` with `allowPrototypes: true`, so on those stacks `req.query` and `req.body` can carry the shape directly.\n\n\n\n#### PoC\n\n\n\n```js\n\n\n\nvar qs = require(\"qs\");\n\n\n\nqs.stringify(qs.parse(\"x[constructor][isBuffer]=y\", { plainObjects: true }));\n\n\n\nqs.stringify(JSON.parse(\"{\\\"a\\\":{\\\"constructor\\\":{\\\"isBuffer\\\":\\\"x\\\"}}}\"));\n\n\n\n// TypeError: obj.constructor.isBuffer is not a function\n\n\n\n//     at Object.isBuffer (lib/utils.js:332:78)\n\n\n\n//     at stringify (lib/stringify.js:127:45)\n\n\n\n```\n\n\n\n#### Fix\n\n\n\n`lib/utils.js`, applied in e83d321 on `main` and released as v6.16.0:\n\n\n\n```diff\n\n\n\n- return !!(obj.constructor && obj.constructor.isBuffer && obj.constructor.isBuffer(obj));\n\n\n\n+ return !!(obj.constructor && typeof obj.constructor.isBuffer === \"function\" && obj.constructor.isBuffer(obj));\n\n\n\n```\n\n\n\nReal `Buffer`, `safer-buffer`, and browserify `buffer` polyfill instances serialize exactly as before; only the throw is removed.\n\n\n\n### Affected versions\n\n\n\n`>=2.2.5 <6.16.0`, fixed in v6.16.0.\n\n\n\nThe unguarded duck-type was introduced in 3768a75 and first shipped in v2.2.5 (September 2014). v2.2.4 and earlier used `Buffer.isBuffer` and are not affected. Every release from v2.2.5 through v6.15.3 contains the unguarded call.\n\n\n\n### Impact\n\n\n\nAn unauthenticated request can make any code path that re-serializes attacker-influenced data with `qs.stringify` (for example, rebuilding a query string from `req.query` for a redirect or an upstream request, or serializing a parsed JSON body) throw synchronously. In a typical Node.js HTTP framework the throw is caught by the framework error boundary and the affected request returns a 500; the process survives and other requests are unaffected. Where the call runs outside an error boundary, such as an `async` Express 4 handler (where the throw becomes an unhandled promise rejection) or a background job, the process exits, so the impact in that case depends on the application error handling rather than on qs.","cvss":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-82417","epss":0.00396,"percentile":0.33816,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-82417","cwe":"CWE-248","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-82417","cwe":"CWE-703","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"qs","version":"6.15.1"}},"found":{"vulnerabilityID":"GHSA-4mjr-xmp4-gh2g","versionConstraint":">=2.2.5,<6.16.0 (semantic)"},"fix":{"suggestedVersion":"6.16.0"}}],"artifact":{"id":"pkg:npm/qs@6.15.1?package-id=226c68780f5d5463","name":"qs","version":"6.15.1","type":"npm","locations":[{"path":"/sink/oidc-server/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:qs_project:qs:6.15.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/qs@6.15.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-4mjr-xmp4-gh2g","dataSource":"https://github.com/advisories/GHSA-4mjr-xmp4-gh2g","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/ljharb/qs/security/advisories/GHSA-4mjr-xmp4-gh2g","https://nvd.nist.gov/vuln/detail/CVE-2026-82417","https://github.com/ljharb/qs/commit/e83d321ffafb38cf210683ac31714fce6ce1c6c6"],"description":"qs: Denial of Service via Attacker Controlled isBuffer","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-82417","epss":0.00396,"percentile":0.33816,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-82417","cwe":"CWE-248","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-82417","cwe":"CWE-703","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}],"fix":{"versions":["6.16.0"],"state":"fixed","available":[{"version":"6.16.0","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.21384},"relatedVulnerabilities":[{"id":"CVE-2026-82417","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82417","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/ljharb/qs/commit/e83d321ffafb38cf210683ac31714fce6ce1c6c6","https://github.com/ljharb/qs/security/advisories/GHSA-4mjr-xmp4-gh2g"],"description":"### Summary\n\n\n\n`qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member. `utils.isBuffer` duck-types buffers by calling `obj.constructor.isBuffer(obj)` after checking only that the property is truthy, so a value such as `{ constructor: { isBuffer: \"x\" } }` makes the call throw `TypeError: obj.constructor.isBuffer is not a function`.\n\n\n\n### Details\n\n\n\n`lib/stringify.js:127` calls `utils.isBuffer` on every non-primitive value it serializes. `utils.isBuffer` (`lib/utils.js:332`) reads `obj.constructor.isBuffer` and invokes it without verifying that it is a function. `constructor` and `isBuffer` are ordinary property names, so any object carrying them as own properties reaches the unchecked call.\n\n\n\nSuch an object can be built from untrusted input. `qs.parse(\"x[constructor][isBuffer]=y\", { plainObjects: true })` or `{ allowPrototypes: true }` keeps the `constructor` key as an own property (the default parse options drop it), and `JSON.parse(\"{\\\"a\\\":{\\\"constructor\\\":{\\\"isBuffer\\\":\\\"x\\\"}}}\")` produces the same shape with no qs option involved. Express 4 with its default `query parser` setting and body-parser with `extended: true` both call `qs.parse` with `allowPrototypes: true`, so on those stacks `req.query` and `req.body` can carry the shape directly.\n\n\n\n#### PoC\n\n\n\n```js\n\n\n\nvar qs = require(\"qs\");\n\n\n\nqs.stringify(qs.parse(\"x[constructor][isBuffer]=y\", { plainObjects: true }));\n\n\n\nqs.stringify(JSON.parse(\"{\\\"a\\\":{\\\"constructor\\\":{\\\"isBuffer\\\":\\\"x\\\"}}}\"));\n\n\n\n// TypeError: obj.constructor.isBuffer is not a function\n\n\n\n//     at Object.isBuffer (lib/utils.js:332:78)\n\n\n\n//     at stringify (lib/stringify.js:127:45)\n\n\n\n```\n\n\n\n#### Fix\n\n\n\n`lib/utils.js`, applied in e83d321 on `main` and released as v6.16.0:\n\n\n\n```diff\n\n\n\n- return !!(obj.constructor && obj.constructor.isBuffer && obj.constructor.isBuffer(obj));\n\n\n\n+ return !!(obj.constructor && typeof obj.constructor.isBuffer === \"function\" && obj.constructor.isBuffer(obj));\n\n\n\n```\n\n\n\nReal `Buffer`, `safer-buffer`, and browserify `buffer` polyfill instances serialize exactly as before; only the throw is removed.\n\n\n\n### Affected versions\n\n\n\n`>=2.2.5 <6.16.0`, fixed in v6.16.0.\n\n\n\nThe unguarded duck-type was introduced in 3768a75 and first shipped in v2.2.5 (September 2014). v2.2.4 and earlier used `Buffer.isBuffer` and are not affected. Every release from v2.2.5 through v6.15.3 contains the unguarded call.\n\n\n\n### Impact\n\n\n\nAn unauthenticated request can make any code path that re-serializes attacker-influenced data with `qs.stringify` (for example, rebuilding a query string from `req.query` for a redirect or an upstream request, or serializing a parsed JSON body) throw synchronously. In a typical Node.js HTTP framework the throw is caught by the framework error boundary and the affected request returns a 500; the process survives and other requests are unaffected. Where the call runs outside an error boundary, such as an `async` Express 4 handler (where the throw becomes an unhandled promise rejection) or a background job, the process exits, so the impact in that case depends on the application error handling rather than on qs.","cvss":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-82417","epss":0.00396,"percentile":0.33816,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-82417","cwe":"CWE-248","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-82417","cwe":"CWE-703","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"qs","version":"6.15.1"}},"found":{"vulnerabilityID":"GHSA-4mjr-xmp4-gh2g","versionConstraint":">=2.2.5,<6.16.0 (semantic)"},"fix":{"suggestedVersion":"6.16.0"}}],"artifact":{"id":"pkg:npm/qs@6.15.1?package-id=fb3e21030488c9a8","name":"qs","version":"6.15.1","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:qs_project:qs:6.15.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/qs@6.15.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-h67p-54hq-rp68","dataSource":"https://github.com/advisories/GHSA-h67p-54hq-rp68","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-h67p-54hq-rp68","https://nvd.nist.gov/vuln/detail/CVE-2026-53550"],"description":"JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53550","epss":0.00415,"percentile":0.35875,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53550","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.2.0"],"state":"fixed","available":[{"version":"4.2.0","date":"2026-06-15","kind":"first-observed"}]},"advisories":[],"risk":0.21372500000000003},"relatedVulnerabilities":[{"id":"CVE-2026-53550","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53550","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-h67p-54hq-rp68"],"description":"js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relatively small payload (tens of KB), resulting in denial of service. The issue is in merge handling inside lib/loader.js. This vulnerability is fixed in 4.2.0 and 3.15.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53550","epss":0.00415,"percentile":0.35875,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53550","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"4.1.1"}},"found":{"vulnerabilityID":"GHSA-h67p-54hq-rp68","versionConstraint":">=4.0.0,<=4.1.1 (semantic)"},"fix":{"suggestedVersion":"4.2.0"}}],"artifact":{"id":"pkg:npm/js-yaml@4.1.1?package-id=b47d2ee1a6cdb382","name":"js-yaml","version":"4.1.1","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodeca:js-yaml:4.1.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@4.1.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-h67p-54hq-rp68","dataSource":"https://github.com/advisories/GHSA-h67p-54hq-rp68","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-h67p-54hq-rp68","https://nvd.nist.gov/vuln/detail/CVE-2026-53550"],"description":"JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53550","epss":0.00415,"percentile":0.35875,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53550","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.2.0"],"state":"fixed","available":[{"version":"4.2.0","date":"2026-06-15","kind":"first-observed"}]},"advisories":[],"risk":0.21372500000000003},"relatedVulnerabilities":[{"id":"CVE-2026-53550","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53550","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-h67p-54hq-rp68"],"description":"js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relatively small payload (tens of KB), resulting in denial of service. The issue is in merge handling inside lib/loader.js. This vulnerability is fixed in 4.2.0 and 3.15.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53550","epss":0.00415,"percentile":0.35875,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53550","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"4.1.1"}},"found":{"vulnerabilityID":"GHSA-h67p-54hq-rp68","versionConstraint":">=4.0.0,<=4.1.1 (semantic)"},"fix":{"suggestedVersion":"4.2.0"}}],"artifact":{"id":"pkg:npm/js-yaml@4.1.1?package-id=15e5564f07e87e23","name":"js-yaml","version":"4.1.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodeca:js-yaml:4.1.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@4.1.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-jwv3-5hgf-82ww","dataSource":"https://github.com/advisories/GHSA-jwv3-5hgf-82ww","namespace":"github:language:python","severity":"High","urls":["https://github.com/pyca/cryptography/security/advisories/GHSA-jwv3-5hgf-82ww","https://github.com/pyca/cryptography/pull/14960","https://github.com/pyca/cryptography/commit/4a12cf49675a184e47f912b00b04f3a629283582","https://nvd.nist.gov/vuln/detail/CVE-2026-69249","https://github.com/pyca/cryptography/commit/3763aa79b","https://github.com/pypa/advisory-database/tree/main/vulns/cryptography/PYSEC-2026-3553.yaml"],"description":"python-cryptography: Duplicate self-signed intermediates can cause exponential path-building","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69249","epss":0.00262,"percentile":0.18004,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69249","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["49.0.0"],"state":"fixed","available":[{"version":"49.0.0","date":"2026-08-04","kind":"first-observed"}]},"advisories":[],"risk":0.21222},"relatedVulnerabilities":[{"id":"CVE-2026-69249","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-69249","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/pyca/cryptography/commit/3763aa79b","https://github.com/pyca/cryptography/commit/4a12cf49675a184e47f912b00b04f3a629283582","https://github.com/pyca/cryptography/pull/14960","https://github.com/pyca/cryptography/security/advisories/GHSA-jwv3-5hgf-82ww","https://github.com/pypa/advisory-database/tree/main/vulns/cryptography/PYSEC-2026-3553.yaml"],"description":"python-cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 42.0.0 through 48.0.0, when resolving invalid certificate chains that include duplicate copies of self-signed certificates, the processing recursively invokes the same candidate, leading to an exponential blowup. Although the limitation that the chain depth cannot exceed a specified maximum depth prevents unbounded recursion and guarantees termination, an attacker-controlled certificate chain can lead the processing to easily take more than 5s to reject in testing. This amplification could form the basis for a resource exhaustion denial of service attack. The core issue arises in the recursive nature of build_chain_inner, which does not de-duplicate against previously analyzed candidates. As the correctness of validation is not affected, the integrity of a system cannot be compromised through this vector, only its availability. This issue is fixed in 49.0.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69249","epss":0.00262,"percentile":0.18004,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69249","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"cryptography","version":"46.0.7"}},"found":{"vulnerabilityID":"GHSA-jwv3-5hgf-82ww","versionConstraint":">=42.0.0,<49.0.0 (python)"},"fix":{"suggestedVersion":"49.0.0"}}],"artifact":{"id":"pkg:pypi/cryptography@46.0.7?package-id=b8850d2d1ea9f785","name":"cryptography","version":"46.0.7","type":"python","locations":[{"path":"/backend/bdd/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:cryptography.io:cryptography:46.0.7:*:*:*:*:python:*:*","cpe:2.3:a:cryptography.io:cryptography:46.0.7:*:*:*:*:*:*:*"],"purl":"pkg:pypi/cryptography@46.0.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-j6r3-76f7-8jcv","dataSource":"https://github.com/advisories/GHSA-j6r3-76f7-8jcv","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-j6r3-76f7-8jcv","https://nvd.nist.gov/vuln/detail/CVE-2026-101912","https://github.com/beaugunderson/ip-address/commit/1343629d57fea413644a5c9d41ff1e59619f3f28","https://github.com/beaugunderson/ip-address/releases/tag/v10.7.1"],"description":"ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101912","epss":0.0037,"percentile":0.30998,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101912","cwe":"CWE-697","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-101912","cwe":"CWE-843","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["10.7.1"],"state":"fixed","available":[{"version":"10.7.1","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.20904999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-101912","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101912","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/beaugunderson/ip-address/commit/1343629d57fea413644a5c9d41ff1e59619f3f28","https://github.com/beaugunderson/ip-address/releases/tag/v10.7.1","https://github.com/beaugunderson/ip-address/security/advisories/GHSA-j6r3-76f7-8jcv"],"description":"ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the isInSubnet and isHostInSubnet methods in src/common.ts compare masked binary strings without validating that both operands use the same IP family. A cross-family containment check whose leading address bits match makes the masked strings compare equal even though IPv4 and IPv6 do not share an address space. An allowlist or denylist decision can therefore classify an address outside the intended range as contained. This issue is fixed in version 10.7.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101912","epss":0.0037,"percentile":0.30998,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101912","cwe":"CWE-697","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-101912","cwe":"CWE-843","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"ip-address","version":"10.1.0"}},"found":{"vulnerabilityID":"GHSA-j6r3-76f7-8jcv","versionConstraint":"<=10.7.0 (semantic)"},"fix":{"suggestedVersion":"10.7.1"}}],"artifact":{"id":"pkg:npm/ip-address@10.1.0?package-id=d0c928307aa7dbe2","name":"ip-address","version":"10.1.0","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:beaugunderson:ip-address:10.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/ip-address@10.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-w5hq-g745-h8pq","dataSource":"https://github.com/advisories/GHSA-w5hq-g745-h8pq","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pq","https://github.com/uuidjs/uuid/commit/3d2c5b0342f0fcb52a5ac681c3d47c13e7444b34","https://github.com/uuidjs/uuid/releases/tag/v14.0.0","https://nvd.nist.gov/vuln/detail/CVE-2026-41907","https://github.com/uuidjs/uuid/commit/32389c887c9e75f90442ee4cc95bbab0c4e8346e","https://github.com/uuidjs/uuid/commit/3d61d6ac1f782cf6b1dd8661c60f11722cd49a0d","https://github.com/uuidjs/uuid/commit/9d27ddf7046ce496ef39569ff84d948eeff9cb2a","https://github.com/uuidjs/uuid/releases/tag/v11.1.1","https://github.com/uuidjs/uuid/releases/tag/v12.0.1","https://github.com/uuidjs/uuid/releases/tag/v13.0.1"],"description":"uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41907","epss":0.0035,"percentile":0.28636,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41907","cwe":"CWE-787","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-41907","cwe":"CWE-823","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["11.1.1"],"state":"fixed","available":[{"version":"11.1.1","date":"2026-05-05","kind":"first-observed"}]},"advisories":[],"risk":0.20825000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-41907","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41907","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pq"],"description":"uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41907","epss":0.0035,"percentile":0.28636,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41907","cwe":"CWE-787","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-41907","cwe":"CWE-823","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"uuid","version":"10.0.0"}},"found":{"vulnerabilityID":"GHSA-w5hq-g745-h8pq","versionConstraint":"<11.1.1 (semantic)"},"fix":{"suggestedVersion":"11.1.1"}}],"artifact":{"id":"pkg:npm/uuid@10.0.0?package-id=b467790ed9d9b910","name":"uuid","version":"10.0.0","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:uuidjs:uuid:10.0.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/uuid@10.0.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-w5hq-g745-h8pq","dataSource":"https://github.com/advisories/GHSA-w5hq-g745-h8pq","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pq","https://github.com/uuidjs/uuid/commit/3d2c5b0342f0fcb52a5ac681c3d47c13e7444b34","https://github.com/uuidjs/uuid/releases/tag/v14.0.0","https://nvd.nist.gov/vuln/detail/CVE-2026-41907","https://github.com/uuidjs/uuid/commit/32389c887c9e75f90442ee4cc95bbab0c4e8346e","https://github.com/uuidjs/uuid/commit/3d61d6ac1f782cf6b1dd8661c60f11722cd49a0d","https://github.com/uuidjs/uuid/commit/9d27ddf7046ce496ef39569ff84d948eeff9cb2a","https://github.com/uuidjs/uuid/releases/tag/v11.1.1","https://github.com/uuidjs/uuid/releases/tag/v12.0.1","https://github.com/uuidjs/uuid/releases/tag/v13.0.1"],"description":"uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41907","epss":0.0035,"percentile":0.28636,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41907","cwe":"CWE-787","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-41907","cwe":"CWE-823","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["11.1.1"],"state":"fixed","available":[{"version":"11.1.1","date":"2026-05-05","kind":"first-observed"}]},"advisories":[],"risk":0.20825000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-41907","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41907","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pq"],"description":"uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41907","epss":0.0035,"percentile":0.28636,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41907","cwe":"CWE-787","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-41907","cwe":"CWE-823","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"uuid","version":"11.1.0"}},"found":{"vulnerabilityID":"GHSA-w5hq-g745-h8pq","versionConstraint":"<11.1.1 (semantic)"},"fix":{"suggestedVersion":"11.1.1"}}],"artifact":{"id":"pkg:npm/uuid@11.1.0?package-id=dbc21e2e9993035e","name":"uuid","version":"11.1.0","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:uuidjs:uuid:11.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/uuid@11.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-w5hq-g745-h8pq","dataSource":"https://github.com/advisories/GHSA-w5hq-g745-h8pq","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pq","https://github.com/uuidjs/uuid/commit/3d2c5b0342f0fcb52a5ac681c3d47c13e7444b34","https://github.com/uuidjs/uuid/releases/tag/v14.0.0","https://nvd.nist.gov/vuln/detail/CVE-2026-41907","https://github.com/uuidjs/uuid/commit/32389c887c9e75f90442ee4cc95bbab0c4e8346e","https://github.com/uuidjs/uuid/commit/3d61d6ac1f782cf6b1dd8661c60f11722cd49a0d","https://github.com/uuidjs/uuid/commit/9d27ddf7046ce496ef39569ff84d948eeff9cb2a","https://github.com/uuidjs/uuid/releases/tag/v11.1.1","https://github.com/uuidjs/uuid/releases/tag/v12.0.1","https://github.com/uuidjs/uuid/releases/tag/v13.0.1"],"description":"uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41907","epss":0.0035,"percentile":0.28636,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41907","cwe":"CWE-787","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-41907","cwe":"CWE-823","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["11.1.1"],"state":"fixed","available":[{"version":"11.1.1","date":"2026-05-05","kind":"first-observed"}]},"advisories":[],"risk":0.20825000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-41907","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41907","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pq"],"description":"uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41907","epss":0.0035,"percentile":0.28636,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41907","cwe":"CWE-787","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-41907","cwe":"CWE-823","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"uuid","version":"3.3.3"}},"found":{"vulnerabilityID":"GHSA-w5hq-g745-h8pq","versionConstraint":"<11.1.1 (semantic)"},"fix":{"suggestedVersion":"11.1.1"}}],"artifact":{"id":"pkg:npm/uuid@3.3.3?package-id=ec98fb54be05adff","name":"uuid","version":"3.3.3","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:uuidjs:uuid:3.3.3:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/uuid@3.3.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-w5hq-g745-h8pq","dataSource":"https://github.com/advisories/GHSA-w5hq-g745-h8pq","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pq","https://github.com/uuidjs/uuid/commit/3d2c5b0342f0fcb52a5ac681c3d47c13e7444b34","https://github.com/uuidjs/uuid/releases/tag/v14.0.0","https://nvd.nist.gov/vuln/detail/CVE-2026-41907","https://github.com/uuidjs/uuid/commit/32389c887c9e75f90442ee4cc95bbab0c4e8346e","https://github.com/uuidjs/uuid/commit/3d61d6ac1f782cf6b1dd8661c60f11722cd49a0d","https://github.com/uuidjs/uuid/commit/9d27ddf7046ce496ef39569ff84d948eeff9cb2a","https://github.com/uuidjs/uuid/releases/tag/v11.1.1","https://github.com/uuidjs/uuid/releases/tag/v12.0.1","https://github.com/uuidjs/uuid/releases/tag/v13.0.1"],"description":"uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41907","epss":0.0035,"percentile":0.28636,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41907","cwe":"CWE-787","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-41907","cwe":"CWE-823","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["11.1.1"],"state":"fixed","available":[{"version":"11.1.1","date":"2026-05-05","kind":"first-observed"}]},"advisories":[],"risk":0.20825000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-41907","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41907","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pq"],"description":"uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41907","epss":0.0035,"percentile":0.28636,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41907","cwe":"CWE-787","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-41907","cwe":"CWE-823","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"uuid","version":"8.3.2"}},"found":{"vulnerabilityID":"GHSA-w5hq-g745-h8pq","versionConstraint":"<11.1.1 (semantic)"},"fix":{"suggestedVersion":"11.1.1"}}],"artifact":{"id":"pkg:npm/uuid@8.3.2?package-id=7ce5c37d1ef5ffe8","name":"uuid","version":"8.3.2","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:uuidjs:uuid:8.3.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/uuid@8.3.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-w5hq-g745-h8pq","dataSource":"https://github.com/advisories/GHSA-w5hq-g745-h8pq","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pq","https://github.com/uuidjs/uuid/commit/3d2c5b0342f0fcb52a5ac681c3d47c13e7444b34","https://github.com/uuidjs/uuid/releases/tag/v14.0.0","https://nvd.nist.gov/vuln/detail/CVE-2026-41907","https://github.com/uuidjs/uuid/commit/32389c887c9e75f90442ee4cc95bbab0c4e8346e","https://github.com/uuidjs/uuid/commit/3d61d6ac1f782cf6b1dd8661c60f11722cd49a0d","https://github.com/uuidjs/uuid/commit/9d27ddf7046ce496ef39569ff84d948eeff9cb2a","https://github.com/uuidjs/uuid/releases/tag/v11.1.1","https://github.com/uuidjs/uuid/releases/tag/v12.0.1","https://github.com/uuidjs/uuid/releases/tag/v13.0.1"],"description":"uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41907","epss":0.0035,"percentile":0.28636,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41907","cwe":"CWE-787","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-41907","cwe":"CWE-823","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["11.1.1"],"state":"fixed","available":[{"version":"11.1.1","date":"2026-05-05","kind":"first-observed"}]},"advisories":[],"risk":0.20825000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-41907","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41907","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pq"],"description":"uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41907","epss":0.0035,"percentile":0.28636,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41907","cwe":"CWE-787","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-41907","cwe":"CWE-823","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"uuid","version":"8.3.2"}},"found":{"vulnerabilityID":"GHSA-w5hq-g745-h8pq","versionConstraint":"<11.1.1 (semantic)"},"fix":{"suggestedVersion":"11.1.1"}}],"artifact":{"id":"pkg:npm/uuid@8.3.2?package-id=3f17b8028ab39637","name":"uuid","version":"8.3.2","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:uuidjs:uuid:8.3.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/uuid@8.3.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-w5hq-g745-h8pq","dataSource":"https://github.com/advisories/GHSA-w5hq-g745-h8pq","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pq","https://github.com/uuidjs/uuid/commit/3d2c5b0342f0fcb52a5ac681c3d47c13e7444b34","https://github.com/uuidjs/uuid/releases/tag/v14.0.0","https://nvd.nist.gov/vuln/detail/CVE-2026-41907","https://github.com/uuidjs/uuid/commit/32389c887c9e75f90442ee4cc95bbab0c4e8346e","https://github.com/uuidjs/uuid/commit/3d61d6ac1f782cf6b1dd8661c60f11722cd49a0d","https://github.com/uuidjs/uuid/commit/9d27ddf7046ce496ef39569ff84d948eeff9cb2a","https://github.com/uuidjs/uuid/releases/tag/v11.1.1","https://github.com/uuidjs/uuid/releases/tag/v12.0.1","https://github.com/uuidjs/uuid/releases/tag/v13.0.1"],"description":"uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41907","epss":0.0035,"percentile":0.28636,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41907","cwe":"CWE-787","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-41907","cwe":"CWE-823","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["11.1.1"],"state":"fixed","available":[{"version":"11.1.1","date":"2026-05-05","kind":"first-observed"}]},"advisories":[],"risk":0.20825000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-41907","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41907","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pq"],"description":"uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41907","epss":0.0035,"percentile":0.28636,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41907","cwe":"CWE-787","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-41907","cwe":"CWE-823","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"uuid","version":"9.0.1"}},"found":{"vulnerabilityID":"GHSA-w5hq-g745-h8pq","versionConstraint":"<11.1.1 (semantic)"},"fix":{"suggestedVersion":"11.1.1"}}],"artifact":{"id":"pkg:npm/uuid@9.0.1?package-id=04f3e85c4bd5e97a","name":"uuid","version":"9.0.1","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:uuidjs:uuid:9.0.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/uuid@9.0.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-f38q-mgvj-vph7","dataSource":"https://github.com/advisories/GHSA-f38q-mgvj-vph7","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-f38q-mgvj-vph7","https://nvd.nist.gov/vuln/detail/CVE-2026-54269"],"description":"protobufjs : Schema-derived names can shadow runtime-significant properties","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-54269","epss":0.00402,"percentile":0.34488,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-54269","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-54269","cwe":"CWE-754","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.6.3"],"state":"fixed","available":[{"version":"7.6.3","date":"2026-06-15","kind":"first-observed"}]},"advisories":[],"risk":0.20703000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-54269","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54269","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-f38q-mgvj-vph7"],"description":"protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 8.6.0 and 7.6.3, protobufjs accepted certain schema-derived names that could collide with properties used by protobufjs runtime helpers. The known affected names are fields named hasOwnProperty, field or oneof names such as $type when loaded through protobufjs JSON/reflection descriptors, and service methods whose generated helper name is rpcCall. When affected message or service types were used, protobufjs could read schema-controlled data where it expected an own-property helper, reflected type metadata, or the base RPC helper. This could cause deterministic exceptions or recursive calls in affected decode post-checks, verification, object conversion, reflected JSON serialization, or protobufjs RPC helper invocation. This vulnerability is fixed in 8.6.0 and 7.6.3.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-54269","epss":0.00402,"percentile":0.34488,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-54269","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-54269","cwe":"CWE-754","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"protobufjs","version":"7.5.6"}},"found":{"vulnerabilityID":"GHSA-f38q-mgvj-vph7","versionConstraint":"<=7.6.2 (semantic)"},"fix":{"suggestedVersion":"7.6.3"}}],"artifact":{"id":"pkg:npm/protobufjs@7.5.6?package-id=7ceb7c776b63b6ac","name":"protobufjs","version":"7.5.6","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:protobufjs_project:protobufjs:7.5.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/protobufjs@7.5.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-8988-4f7v-96qf","dataSource":"https://github.com/advisories/GHSA-8988-4f7v-96qf","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-8988-4f7v-96qf","https://nvd.nist.gov/vuln/detail/CVE-2026-54285"],"description":"OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-54285","epss":0.00402,"percentile":0.34485,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-54285","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.8.0"],"state":"fixed","available":[{"version":"2.8.0","date":"2026-06-16","kind":"first-observed"}]},"advisories":[],"risk":0.20703000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-54285","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54285","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-8988-4f7v-96qf"],"description":"opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 2.8.0, W3CBaggagePropagator.extract() in @opentelemetry/core does not enforce size limits when parsing inbound baggage HTTP headers. The W3C Baggage specification recommends a maximum of 8,192 bytes and 180 entries; these limits were only enforced on the outbound (inject()) path, not on the inbound (extract()) path. Parsing oversized baggage causes memory allocation proportional to the header size without any cap. This vulnerability is fixed in 2.8.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-54285","epss":0.00402,"percentile":0.34485,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-54285","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@opentelemetry/core","version":"2.2.0"}},"found":{"vulnerabilityID":"GHSA-8988-4f7v-96qf","versionConstraint":"<2.8.0 (semantic)"},"fix":{"suggestedVersion":"2.8.0"}}],"artifact":{"id":"pkg:npm/%40opentelemetry/core@2.2.0?package-id=240b75ecb6ce40df","name":"@opentelemetry/core","version":"2.2.0","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["Apache-2.0"],"cpes":["cpe:2.3:a:\\@opentelemetry\\/core:\\@opentelemetry\\/core:2.2.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40opentelemetry/core@2.2.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-8988-4f7v-96qf","dataSource":"https://github.com/advisories/GHSA-8988-4f7v-96qf","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-8988-4f7v-96qf","https://nvd.nist.gov/vuln/detail/CVE-2026-54285"],"description":"OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-54285","epss":0.00402,"percentile":0.34485,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-54285","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.8.0"],"state":"fixed","available":[{"version":"2.8.0","date":"2026-06-16","kind":"first-observed"}]},"advisories":[],"risk":0.20703000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-54285","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54285","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-8988-4f7v-96qf"],"description":"opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 2.8.0, W3CBaggagePropagator.extract() in @opentelemetry/core does not enforce size limits when parsing inbound baggage HTTP headers. The W3C Baggage specification recommends a maximum of 8,192 bytes and 180 entries; these limits were only enforced on the outbound (inject()) path, not on the inbound (extract()) path. Parsing oversized baggage causes memory allocation proportional to the header size without any cap. This vulnerability is fixed in 2.8.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-54285","epss":0.00402,"percentile":0.34485,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-54285","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@opentelemetry/core","version":"2.6.0"}},"found":{"vulnerabilityID":"GHSA-8988-4f7v-96qf","versionConstraint":"<2.8.0 (semantic)"},"fix":{"suggestedVersion":"2.8.0"}}],"artifact":{"id":"pkg:npm/%40opentelemetry/core@2.6.0?package-id=331afa37ebf5e765","name":"@opentelemetry/core","version":"2.6.0","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["Apache-2.0"],"cpes":["cpe:2.3:a:\\@opentelemetry\\/core:\\@opentelemetry\\/core:2.6.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40opentelemetry/core@2.6.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-47p6-69vm-vw6v","dataSource":"https://github.com/advisories/GHSA-47p6-69vm-vw6v","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-9495","https://github.com/koajs/router/issues/202","https://github.com/koajs/router/pull/206","https://github.com/koajs/router/commit/d53e17f284557b1f417946f9807ee52290c3c759","https://security.snyk.io/vuln/SNYK-JS-KOAROUTER-12215044"],"description":"@koa/router has an Access Control Bypass","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"exploitabilityScore":3.9,"impactScore":3.4},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":5.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-9495","epss":0.0036,"percentile":0.29803,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-9495","cwe":"CWE-284","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2026-9495","cwe":"CWE-284","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["15.0.0"],"state":"fixed","available":[{"version":"15.0.0","date":"2026-07-01","kind":"first-observed"}]},"advisories":[],"risk":0.2052},"relatedVulnerabilities":[{"id":"CVE-2026-9495","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9495","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/koajs/router/commit/d53e17f284557b1f417946f9807ee52290c3c759","https://github.com/koajs/router/issues/202","https://github.com/koajs/router/pull/206","https://security.snyk.io/vuln/SNYK-JS-KOAROUTER-12215044"],"description":"Versions of the package @koa/router from 14.0.0 and before 15.0.0 are vulnerable to Access Control Bypass due to the middleware being silently dropped from the execution chain when the router prefix contains path parameters. Depending on what the skipped middleware was supposed to protect, an attacker could bypass authentication and authorization, evade rate limiting or bypass input sanitization.","cvss":[{"source":"report@snyk.io","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.5},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"exploitabilityScore":3.9,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-9495","epss":0.0036,"percentile":0.29803,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-9495","cwe":"CWE-284","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2026-9495","cwe":"CWE-284","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@koa/router","version":"14.0.0"}},"found":{"vulnerabilityID":"GHSA-47p6-69vm-vw6v","versionConstraint":">=14.0.0,<15.0.0 (semantic)"},"fix":{"suggestedVersion":"15.0.0"}}],"artifact":{"id":"pkg:npm/%40koa/router@14.0.0?package-id=ff0b9e908b923994","name":"@koa/router","version":"14.0.0","type":"npm","locations":[{"path":"/sink/oidc-server/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:\\@koa\\/router:\\@koa\\/router:14.0.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40koa/router@14.0.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-rp9w-3fw7-7cwq","dataSource":"https://github.com/advisories/GHSA-rp9w-3fw7-7cwq","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/cure53/DOMPurify/security/advisories/GHSA-rp9w-3fw7-7cwq"],"description":"DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","metrics":{"baseScore":5.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-49978","epss":0.00404,"percentile":0.347,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-49978","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.4.7"],"state":"fixed","available":[{"version":"3.4.7","date":"2026-06-16","kind":"first-observed"}]},"advisories":[],"risk":0.20402000000000003},"relatedVulnerabilities":[{"id":"CVE-2026-49978","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-49978","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/cure53/DOMPurify/commit/ca30f070c360df162a3e3848e80e6fd3c9e74bff","https://github.com/cure53/DOMPurify/releases/tag/3.4.7","https://github.com/cure53/DOMPurify/security/advisories/GHSA-rp9w-3fw7-7cwq"],"description":"DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.7, DOMPurify IN_PLACE sanitization could skip shadow contents attached to an element inside <template>.content, allowing attacker-controlled markup such as event handlers, JavaScript URLs, or scripts to survive and execute when an application cloned and inserted the sanitized template. This issue is fixed in version 3.4.7.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-49978","epss":0.00404,"percentile":0.347,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-49978","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"dompurify","version":"3.3.3"}},"found":{"vulnerabilityID":"GHSA-rp9w-3fw7-7cwq","versionConstraint":"<=3.4.6 (semantic)"},"fix":{"suggestedVersion":"3.4.7"}}],"artifact":{"id":"pkg:npm/dompurify@3.3.3?package-id=5ef50eed3845476c","name":"dompurify","version":"3.3.3","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MPL-2.0 OR Apache-2.0"],"cpes":["cpe:2.3:a:dompurify:dompurify:3.3.3:*:*:*:*:*:*:*"],"purl":"pkg:npm/dompurify@3.3.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-r47g-fvhr-h676","dataSource":"https://github.com/advisories/GHSA-r47g-fvhr-h676","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/cure53/DOMPurify/security/advisories/GHSA-r47g-fvhr-h676"],"description":"DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-49459","epss":0.00365,"percentile":0.30331,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-49459","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-49459","cwe":"CWE-693","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-49459","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.4.6"],"state":"fixed","available":[{"version":"3.4.6","date":"2026-06-16","kind":"first-observed"}]},"advisories":[],"risk":0.20257499999999998},"relatedVulnerabilities":[{"id":"CVE-2026-49459","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-49459","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/cure53/DOMPurify/commit/bb7739e5bccec7e1ab3dae3f3e42d02db3acaaae","https://github.com/cure53/DOMPurify/releases/tag/3.4.6","https://github.com/cure53/DOMPurify/security/advisories/GHSA-r47g-fvhr-h676"],"description":"DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(root, { IN_PLACE: true }) could preserve event-handler attributes on an attacker-controlled <form> root when a descendant name clobbered properties checked by _isClobbered, because _forceRemove no-opped on the parent-less root and _sanitizeAttributes returned early. This issue is fixed in version 3.4.6.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-49459","epss":0.00365,"percentile":0.30331,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-49459","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-49459","cwe":"CWE-693","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-49459","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"dompurify","version":"3.3.3"}},"found":{"vulnerabilityID":"GHSA-r47g-fvhr-h676","versionConstraint":"<=3.4.5 (semantic)"},"fix":{"suggestedVersion":"3.4.6"}}],"artifact":{"id":"pkg:npm/dompurify@3.3.3?package-id=5ef50eed3845476c","name":"dompurify","version":"3.3.3","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MPL-2.0 OR Apache-2.0"],"cpes":["cpe:2.3:a:dompurify:dompurify:3.3.3:*:*:*:*:*:*:*"],"purl":"pkg:npm/dompurify@3.3.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-6pq8-jhm2-2vcw","dataSource":"https://github.com/advisories/GHSA-6pq8-jhm2-2vcw","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw","https://nvd.nist.gov/vuln/detail/CVE-2026-110816","https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727","https://github.com/ljharb/qs/releases/tag/v6.16.1"],"description":"qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110816","epss":0.00368,"percentile":0.30715,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110816","cwe":"CWE-248","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-110816","cwe":"CWE-704","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}],"fix":{"versions":["6.16.1"],"state":"fixed","available":[{"version":"6.16.1","date":"2026-10-27","kind":"first-observed"}]},"advisories":[],"risk":0.19872},"relatedVulnerabilities":[{"id":"CVE-2026-110816","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110816","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727","https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw"],"description":"### Summary\n\n\n\n`qs.stringify` with `arrayFormat: 'comma'` throws `TypeError: Cannot convert object to primitive value` when an array element cannot be coerced to a string, such as an object with an own non-callable `toString` (`{ \"toString\": \"x\" }`) or a null-prototype object. The comma format joins array elements with `Array.prototype.join` and, under `encodeValuesOnly`, first passes each element through `String()` in `utils.encode`; neither guards against an element whose string coercion fails.\n\n\n\n### Details\n\n\n\nIn `lib/stringify.js`, the comma branch collapses the array with `obj.join(',')`. For an element whose own `toString` is not callable, `ToPrimitive` skips it, falls through to `Object.prototype.valueOf` (which returns the object itself), and throws. Under `encodeValuesOnly: true`, the same element first reaches `String(str)` in `utils.encode` (`lib/utils.js`) and throws there. Nested arrays (`{ \"a\": [[{ \"toString\": \"x\" }]] }`) throw the same way, through `Array.prototype.toString`. The `indices`, `brackets`, and `repeat` formats walk into object elements instead of coercing them, and are not affected.\n\n\n\nSuch elements can come from untrusted input. `JSON.parse` produces `{ \"a\": [{ \"toString\": \"x\" }] }` with no qs option involved. `qs.parse(\"a[0][toString]=x\", { allowPrototypes: true })` keeps the `toString` key, and `qs.parse(\"a[][b]=c\", { plainObjects: true })` produces a null-prototype element; the default parse options drop `toString` and produce ordinary objects, which do not throw. Express 4's default `query parser`, Express 5's `extended` query parser, and body-parser's `urlencoded({ extended: true })` all call `qs.parse` with `allowPrototypes: true`.\n\n\n\n#### PoC\n\n\n\n```js\n\n\n\nvar qs = require(\"qs\");\n\n\n\nqs.stringify(JSON.parse(\"{\\\"a\\\":[{\\\"toString\\\":\\\"x\\\"}]}\"), { arrayFormat: \"comma\" });\n\n\n\nqs.stringify(qs.parse(\"a[0][toString]=x\", { allowPrototypes: true }), { arrayFormat: \"comma\" });\n\n\n\nqs.stringify(qs.parse(\"a[][b]=c\", { plainObjects: true }), { arrayFormat: \"comma\", encodeValuesOnly: true });\n\n\n\n// TypeError: Cannot convert object to primitive value\n\n\n\n```\n\n\n\n#### Fix\n\n\n\nApplied in a952e75 on `main` and released as v6.16.1: an element whose string coercion would fail is coerced to its primitive `valueOf`, if any, or else to `Object.prototype.toString`, so it renders as `[object Object]`, the same as any other object element already does under the comma format. Nested arrays are walked the way `join` walks them. Every input that did not previously throw serializes exactly as before, and a `toString` or `valueOf` that itself throws still propagates.\n\n\n\n### Affected versions\n\n\n\n`>=6.7.0 <6.16.1`, fixed in v6.16.1.\n\n\n\nThe `join` path was introduced with the comma format in b84acba and first shipped in v6.7.0; v6.6.x and earlier ignore `arrayFormat: 'comma'` and are not affected. The `encodeValuesOnly` `String()` site was introduced in 4c4b23d (v6.11.1); before that, the same input throws at `join`. Every release from v6.7.0 through v6.16.0 is affected.\n\n\n\n### Impact\n\n\n\nAn unauthenticated request can make any code path that re-serializes attacker-influenced data with `qs.stringify` and `arrayFormat: 'comma'` (for example, rebuilding a query string from `req.query` for a redirect or an upstream request, or serializing a parsed JSON body) throw synchronously. In a typical Node.js HTTP framework the throw is caught by the framework error boundary and the affected request returns a 500; the process survives and other requests are unaffected. Where the call runs outside an error boundary, such as an `async` Express 4 handler (where the throw becomes an unhandled promise rejection) or a bare `http` request handler, the process exits, so the impact in that case depends on the application error handling rather than on qs. The default `arrayFormat` (`indices`) is not affected.","cvss":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110816","epss":0.00368,"percentile":0.30715,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110816","cwe":"CWE-248","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-110816","cwe":"CWE-704","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"qs","version":"6.15.0"}},"found":{"vulnerabilityID":"GHSA-6pq8-jhm2-2vcw","versionConstraint":">=6.7.0,<=6.16.0 (semantic)"},"fix":{"suggestedVersion":"6.16.1"}}],"artifact":{"id":"pkg:npm/qs@6.15.0?package-id=09311111c4f6e298","name":"qs","version":"6.15.0","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:qs_project:qs:6.15.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/qs@6.15.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-6pq8-jhm2-2vcw","dataSource":"https://github.com/advisories/GHSA-6pq8-jhm2-2vcw","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw","https://nvd.nist.gov/vuln/detail/CVE-2026-110816","https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727","https://github.com/ljharb/qs/releases/tag/v6.16.1"],"description":"qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110816","epss":0.00368,"percentile":0.30715,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110816","cwe":"CWE-248","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-110816","cwe":"CWE-704","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}],"fix":{"versions":["6.16.1"],"state":"fixed","available":[{"version":"6.16.1","date":"2026-10-27","kind":"first-observed"}]},"advisories":[],"risk":0.19872},"relatedVulnerabilities":[{"id":"CVE-2026-110816","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110816","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727","https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw"],"description":"### Summary\n\n\n\n`qs.stringify` with `arrayFormat: 'comma'` throws `TypeError: Cannot convert object to primitive value` when an array element cannot be coerced to a string, such as an object with an own non-callable `toString` (`{ \"toString\": \"x\" }`) or a null-prototype object. The comma format joins array elements with `Array.prototype.join` and, under `encodeValuesOnly`, first passes each element through `String()` in `utils.encode`; neither guards against an element whose string coercion fails.\n\n\n\n### Details\n\n\n\nIn `lib/stringify.js`, the comma branch collapses the array with `obj.join(',')`. For an element whose own `toString` is not callable, `ToPrimitive` skips it, falls through to `Object.prototype.valueOf` (which returns the object itself), and throws. Under `encodeValuesOnly: true`, the same element first reaches `String(str)` in `utils.encode` (`lib/utils.js`) and throws there. Nested arrays (`{ \"a\": [[{ \"toString\": \"x\" }]] }`) throw the same way, through `Array.prototype.toString`. The `indices`, `brackets`, and `repeat` formats walk into object elements instead of coercing them, and are not affected.\n\n\n\nSuch elements can come from untrusted input. `JSON.parse` produces `{ \"a\": [{ \"toString\": \"x\" }] }` with no qs option involved. `qs.parse(\"a[0][toString]=x\", { allowPrototypes: true })` keeps the `toString` key, and `qs.parse(\"a[][b]=c\", { plainObjects: true })` produces a null-prototype element; the default parse options drop `toString` and produce ordinary objects, which do not throw. Express 4's default `query parser`, Express 5's `extended` query parser, and body-parser's `urlencoded({ extended: true })` all call `qs.parse` with `allowPrototypes: true`.\n\n\n\n#### PoC\n\n\n\n```js\n\n\n\nvar qs = require(\"qs\");\n\n\n\nqs.stringify(JSON.parse(\"{\\\"a\\\":[{\\\"toString\\\":\\\"x\\\"}]}\"), { arrayFormat: \"comma\" });\n\n\n\nqs.stringify(qs.parse(\"a[0][toString]=x\", { allowPrototypes: true }), { arrayFormat: \"comma\" });\n\n\n\nqs.stringify(qs.parse(\"a[][b]=c\", { plainObjects: true }), { arrayFormat: \"comma\", encodeValuesOnly: true });\n\n\n\n// TypeError: Cannot convert object to primitive value\n\n\n\n```\n\n\n\n#### Fix\n\n\n\nApplied in a952e75 on `main` and released as v6.16.1: an element whose string coercion would fail is coerced to its primitive `valueOf`, if any, or else to `Object.prototype.toString`, so it renders as `[object Object]`, the same as any other object element already does under the comma format. Nested arrays are walked the way `join` walks them. Every input that did not previously throw serializes exactly as before, and a `toString` or `valueOf` that itself throws still propagates.\n\n\n\n### Affected versions\n\n\n\n`>=6.7.0 <6.16.1`, fixed in v6.16.1.\n\n\n\nThe `join` path was introduced with the comma format in b84acba and first shipped in v6.7.0; v6.6.x and earlier ignore `arrayFormat: 'comma'` and are not affected. The `encodeValuesOnly` `String()` site was introduced in 4c4b23d (v6.11.1); before that, the same input throws at `join`. Every release from v6.7.0 through v6.16.0 is affected.\n\n\n\n### Impact\n\n\n\nAn unauthenticated request can make any code path that re-serializes attacker-influenced data with `qs.stringify` and `arrayFormat: 'comma'` (for example, rebuilding a query string from `req.query` for a redirect or an upstream request, or serializing a parsed JSON body) throw synchronously. In a typical Node.js HTTP framework the throw is caught by the framework error boundary and the affected request returns a 500; the process survives and other requests are unaffected. Where the call runs outside an error boundary, such as an `async` Express 4 handler (where the throw becomes an unhandled promise rejection) or a bare `http` request handler, the process exits, so the impact in that case depends on the application error handling rather than on qs. The default `arrayFormat` (`indices`) is not affected.","cvss":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110816","epss":0.00368,"percentile":0.30715,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110816","cwe":"CWE-248","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-110816","cwe":"CWE-704","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"qs","version":"6.15.1"}},"found":{"vulnerabilityID":"GHSA-6pq8-jhm2-2vcw","versionConstraint":">=6.7.0,<=6.16.0 (semantic)"},"fix":{"suggestedVersion":"6.16.1"}}],"artifact":{"id":"pkg:npm/qs@6.15.1?package-id=fb3e21030488c9a8","name":"qs","version":"6.15.1","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:qs_project:qs:6.15.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/qs@6.15.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-6pq8-jhm2-2vcw","dataSource":"https://github.com/advisories/GHSA-6pq8-jhm2-2vcw","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw","https://nvd.nist.gov/vuln/detail/CVE-2026-110816","https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727","https://github.com/ljharb/qs/releases/tag/v6.16.1"],"description":"qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110816","epss":0.00368,"percentile":0.30715,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110816","cwe":"CWE-248","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-110816","cwe":"CWE-704","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}],"fix":{"versions":["6.16.1"],"state":"fixed","available":[{"version":"6.16.1","date":"2026-10-27","kind":"first-observed"}]},"advisories":[],"risk":0.19872},"relatedVulnerabilities":[{"id":"CVE-2026-110816","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110816","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727","https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw"],"description":"### Summary\n\n\n\n`qs.stringify` with `arrayFormat: 'comma'` throws `TypeError: Cannot convert object to primitive value` when an array element cannot be coerced to a string, such as an object with an own non-callable `toString` (`{ \"toString\": \"x\" }`) or a null-prototype object. The comma format joins array elements with `Array.prototype.join` and, under `encodeValuesOnly`, first passes each element through `String()` in `utils.encode`; neither guards against an element whose string coercion fails.\n\n\n\n### Details\n\n\n\nIn `lib/stringify.js`, the comma branch collapses the array with `obj.join(',')`. For an element whose own `toString` is not callable, `ToPrimitive` skips it, falls through to `Object.prototype.valueOf` (which returns the object itself), and throws. Under `encodeValuesOnly: true`, the same element first reaches `String(str)` in `utils.encode` (`lib/utils.js`) and throws there. Nested arrays (`{ \"a\": [[{ \"toString\": \"x\" }]] }`) throw the same way, through `Array.prototype.toString`. The `indices`, `brackets`, and `repeat` formats walk into object elements instead of coercing them, and are not affected.\n\n\n\nSuch elements can come from untrusted input. `JSON.parse` produces `{ \"a\": [{ \"toString\": \"x\" }] }` with no qs option involved. `qs.parse(\"a[0][toString]=x\", { allowPrototypes: true })` keeps the `toString` key, and `qs.parse(\"a[][b]=c\", { plainObjects: true })` produces a null-prototype element; the default parse options drop `toString` and produce ordinary objects, which do not throw. Express 4's default `query parser`, Express 5's `extended` query parser, and body-parser's `urlencoded({ extended: true })` all call `qs.parse` with `allowPrototypes: true`.\n\n\n\n#### PoC\n\n\n\n```js\n\n\n\nvar qs = require(\"qs\");\n\n\n\nqs.stringify(JSON.parse(\"{\\\"a\\\":[{\\\"toString\\\":\\\"x\\\"}]}\"), { arrayFormat: \"comma\" });\n\n\n\nqs.stringify(qs.parse(\"a[0][toString]=x\", { allowPrototypes: true }), { arrayFormat: \"comma\" });\n\n\n\nqs.stringify(qs.parse(\"a[][b]=c\", { plainObjects: true }), { arrayFormat: \"comma\", encodeValuesOnly: true });\n\n\n\n// TypeError: Cannot convert object to primitive value\n\n\n\n```\n\n\n\n#### Fix\n\n\n\nApplied in a952e75 on `main` and released as v6.16.1: an element whose string coercion would fail is coerced to its primitive `valueOf`, if any, or else to `Object.prototype.toString`, so it renders as `[object Object]`, the same as any other object element already does under the comma format. Nested arrays are walked the way `join` walks them. Every input that did not previously throw serializes exactly as before, and a `toString` or `valueOf` that itself throws still propagates.\n\n\n\n### Affected versions\n\n\n\n`>=6.7.0 <6.16.1`, fixed in v6.16.1.\n\n\n\nThe `join` path was introduced with the comma format in b84acba and first shipped in v6.7.0; v6.6.x and earlier ignore `arrayFormat: 'comma'` and are not affected. The `encodeValuesOnly` `String()` site was introduced in 4c4b23d (v6.11.1); before that, the same input throws at `join`. Every release from v6.7.0 through v6.16.0 is affected.\n\n\n\n### Impact\n\n\n\nAn unauthenticated request can make any code path that re-serializes attacker-influenced data with `qs.stringify` and `arrayFormat: 'comma'` (for example, rebuilding a query string from `req.query` for a redirect or an upstream request, or serializing a parsed JSON body) throw synchronously. In a typical Node.js HTTP framework the throw is caught by the framework error boundary and the affected request returns a 500; the process survives and other requests are unaffected. Where the call runs outside an error boundary, such as an `async` Express 4 handler (where the throw becomes an unhandled promise rejection) or a bare `http` request handler, the process exits, so the impact in that case depends on the application error handling rather than on qs. The default `arrayFormat` (`indices`) is not affected.","cvss":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110816","epss":0.00368,"percentile":0.30715,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110816","cwe":"CWE-248","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-110816","cwe":"CWE-704","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"qs","version":"6.15.1"}},"found":{"vulnerabilityID":"GHSA-6pq8-jhm2-2vcw","versionConstraint":">=6.7.0,<=6.16.0 (semantic)"},"fix":{"suggestedVersion":"6.16.1"}}],"artifact":{"id":"pkg:npm/qs@6.15.1?package-id=226c68780f5d5463","name":"qs","version":"6.15.1","type":"npm","locations":[{"path":"/sink/oidc-server/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:qs_project:qs:6.15.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/qs@6.15.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-6pq8-jhm2-2vcw","dataSource":"https://github.com/advisories/GHSA-6pq8-jhm2-2vcw","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw","https://nvd.nist.gov/vuln/detail/CVE-2026-110816","https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727","https://github.com/ljharb/qs/releases/tag/v6.16.1"],"description":"qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110816","epss":0.00368,"percentile":0.30715,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110816","cwe":"CWE-248","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-110816","cwe":"CWE-704","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}],"fix":{"versions":["6.16.1"],"state":"fixed","available":[{"version":"6.16.1","date":"2026-10-27","kind":"first-observed"}]},"advisories":[],"risk":0.19872},"relatedVulnerabilities":[{"id":"CVE-2026-110816","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110816","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727","https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw"],"description":"### Summary\n\n\n\n`qs.stringify` with `arrayFormat: 'comma'` throws `TypeError: Cannot convert object to primitive value` when an array element cannot be coerced to a string, such as an object with an own non-callable `toString` (`{ \"toString\": \"x\" }`) or a null-prototype object. The comma format joins array elements with `Array.prototype.join` and, under `encodeValuesOnly`, first passes each element through `String()` in `utils.encode`; neither guards against an element whose string coercion fails.\n\n\n\n### Details\n\n\n\nIn `lib/stringify.js`, the comma branch collapses the array with `obj.join(',')`. For an element whose own `toString` is not callable, `ToPrimitive` skips it, falls through to `Object.prototype.valueOf` (which returns the object itself), and throws. Under `encodeValuesOnly: true`, the same element first reaches `String(str)` in `utils.encode` (`lib/utils.js`) and throws there. Nested arrays (`{ \"a\": [[{ \"toString\": \"x\" }]] }`) throw the same way, through `Array.prototype.toString`. The `indices`, `brackets`, and `repeat` formats walk into object elements instead of coercing them, and are not affected.\n\n\n\nSuch elements can come from untrusted input. `JSON.parse` produces `{ \"a\": [{ \"toString\": \"x\" }] }` with no qs option involved. `qs.parse(\"a[0][toString]=x\", { allowPrototypes: true })` keeps the `toString` key, and `qs.parse(\"a[][b]=c\", { plainObjects: true })` produces a null-prototype element; the default parse options drop `toString` and produce ordinary objects, which do not throw. Express 4's default `query parser`, Express 5's `extended` query parser, and body-parser's `urlencoded({ extended: true })` all call `qs.parse` with `allowPrototypes: true`.\n\n\n\n#### PoC\n\n\n\n```js\n\n\n\nvar qs = require(\"qs\");\n\n\n\nqs.stringify(JSON.parse(\"{\\\"a\\\":[{\\\"toString\\\":\\\"x\\\"}]}\"), { arrayFormat: \"comma\" });\n\n\n\nqs.stringify(qs.parse(\"a[0][toString]=x\", { allowPrototypes: true }), { arrayFormat: \"comma\" });\n\n\n\nqs.stringify(qs.parse(\"a[][b]=c\", { plainObjects: true }), { arrayFormat: \"comma\", encodeValuesOnly: true });\n\n\n\n// TypeError: Cannot convert object to primitive value\n\n\n\n```\n\n\n\n#### Fix\n\n\n\nApplied in a952e75 on `main` and released as v6.16.1: an element whose string coercion would fail is coerced to its primitive `valueOf`, if any, or else to `Object.prototype.toString`, so it renders as `[object Object]`, the same as any other object element already does under the comma format. Nested arrays are walked the way `join` walks them. Every input that did not previously throw serializes exactly as before, and a `toString` or `valueOf` that itself throws still propagates.\n\n\n\n### Affected versions\n\n\n\n`>=6.7.0 <6.16.1`, fixed in v6.16.1.\n\n\n\nThe `join` path was introduced with the comma format in b84acba and first shipped in v6.7.0; v6.6.x and earlier ignore `arrayFormat: 'comma'` and are not affected. The `encodeValuesOnly` `String()` site was introduced in 4c4b23d (v6.11.1); before that, the same input throws at `join`. Every release from v6.7.0 through v6.16.0 is affected.\n\n\n\n### Impact\n\n\n\nAn unauthenticated request can make any code path that re-serializes attacker-influenced data with `qs.stringify` and `arrayFormat: 'comma'` (for example, rebuilding a query string from `req.query` for a redirect or an upstream request, or serializing a parsed JSON body) throw synchronously. In a typical Node.js HTTP framework the throw is caught by the framework error boundary and the affected request returns a 500; the process survives and other requests are unaffected. Where the call runs outside an error boundary, such as an `async` Express 4 handler (where the throw becomes an unhandled promise rejection) or a bare `http` request handler, the process exits, so the impact in that case depends on the application error handling rather than on qs. The default `arrayFormat` (`indices`) is not affected.","cvss":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110816","epss":0.00368,"percentile":0.30715,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110816","cwe":"CWE-248","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-110816","cwe":"CWE-704","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"qs","version":"6.16.0"}},"found":{"vulnerabilityID":"GHSA-6pq8-jhm2-2vcw","versionConstraint":">=6.7.0,<=6.16.0 (semantic)"},"fix":{"suggestedVersion":"6.16.1"}}],"artifact":{"id":"pkg:npm/qs@6.16.0?package-id=4bacc3e525481036","name":"qs","version":"6.16.0","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:qs_project:qs:6.16.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/qs@6.16.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-3g3m-2fjr-6pw4","dataSource":"https://github.com/advisories/GHSA-3g3m-2fjr-6pw4","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/node-glob/security/advisories/GHSA-3g3m-2fjr-6pw4","https://nvd.nist.gov/vuln/detail/CVE-2026-118773","https://github.com/isaacs/node-glob/commit/4682e8c9babee1b385202ede36389634e12076d7","https://github.com/isaacs/node-glob/releases/tag/v14.0.2"],"description":"Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118773","epss":0.0035,"percentile":0.28709,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118773","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["14.0.2"],"state":"fixed","available":[{"version":"14.0.2","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.19774999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-118773","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118773","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-glob/commit/4682e8c9babee1b385202ede36389634e12076d7","https://github.com/isaacs/node-glob/releases/tag/v14.0.2","https://github.com/isaacs/node-glob/security/advisories/GHSA-3g3m-2fjr-6pw4"],"description":"Glob matches files using patterns the shell uses. From 9.0.0 until 14.0.2, abort branches in src/walker.ts, including GlobUtil.walkCB(), GlobUtil.walkCB2(), GlobUtil.walkCBSync(), and GlobUtil.walkCB2Sync(), invoke the callbacks without returning. After AbortSignal or AbortSignal.timeout() rejects or emits an error, execution can continue into processor.processPatterns(), readdirCB(), and recursive traversal. The issue affects glob() and globStream() when applications expose attacker-influenced patterns or directory trees and rely on cancellation as a traversal budget. Repeated timed-out requests can stack background filesystem operations and CPU work, degrading worker throughput or service availability; no confidentiality or integrity impact was observed. This issue is fixed in 14.0.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118773","epss":0.0035,"percentile":0.28709,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118773","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"glob","version":"10.5.0"}},"found":{"vulnerabilityID":"GHSA-3g3m-2fjr-6pw4","versionConstraint":">=9.0.0,<=14.0.1 (semantic)"},"fix":{"suggestedVersion":"14.0.2"}}],"artifact":{"id":"pkg:npm/glob@10.5.0?package-id=6474bdb035801085","name":"glob","version":"10.5.0","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:isaacs:glob:10.5.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/glob@10.5.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-3g3m-2fjr-6pw4","dataSource":"https://github.com/advisories/GHSA-3g3m-2fjr-6pw4","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/node-glob/security/advisories/GHSA-3g3m-2fjr-6pw4","https://nvd.nist.gov/vuln/detail/CVE-2026-118773","https://github.com/isaacs/node-glob/commit/4682e8c9babee1b385202ede36389634e12076d7","https://github.com/isaacs/node-glob/releases/tag/v14.0.2"],"description":"Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118773","epss":0.0035,"percentile":0.28709,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118773","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["14.0.2"],"state":"fixed","available":[{"version":"14.0.2","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.19774999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-118773","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118773","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-glob/commit/4682e8c9babee1b385202ede36389634e12076d7","https://github.com/isaacs/node-glob/releases/tag/v14.0.2","https://github.com/isaacs/node-glob/security/advisories/GHSA-3g3m-2fjr-6pw4"],"description":"Glob matches files using patterns the shell uses. From 9.0.0 until 14.0.2, abort branches in src/walker.ts, including GlobUtil.walkCB(), GlobUtil.walkCB2(), GlobUtil.walkCBSync(), and GlobUtil.walkCB2Sync(), invoke the callbacks without returning. After AbortSignal or AbortSignal.timeout() rejects or emits an error, execution can continue into processor.processPatterns(), readdirCB(), and recursive traversal. The issue affects glob() and globStream() when applications expose attacker-influenced patterns or directory trees and rely on cancellation as a traversal budget. Repeated timed-out requests can stack background filesystem operations and CPU work, degrading worker throughput or service availability; no confidentiality or integrity impact was observed. This issue is fixed in 14.0.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118773","epss":0.0035,"percentile":0.28709,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118773","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"glob","version":"11.1.0"}},"found":{"vulnerabilityID":"GHSA-3g3m-2fjr-6pw4","versionConstraint":">=9.0.0,<=14.0.1 (semantic)"},"fix":{"suggestedVersion":"14.0.2"}}],"artifact":{"id":"pkg:npm/glob@11.1.0?package-id=1f3b526e6a29ff74","name":"glob","version":"11.1.0","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BlueOak-1.0.0"],"cpes":["cpe:2.3:a:isaacs:glob:11.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/glob@11.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-3g3m-2fjr-6pw4","dataSource":"https://github.com/advisories/GHSA-3g3m-2fjr-6pw4","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/node-glob/security/advisories/GHSA-3g3m-2fjr-6pw4","https://nvd.nist.gov/vuln/detail/CVE-2026-118773","https://github.com/isaacs/node-glob/commit/4682e8c9babee1b385202ede36389634e12076d7","https://github.com/isaacs/node-glob/releases/tag/v14.0.2"],"description":"Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118773","epss":0.0035,"percentile":0.28709,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118773","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["14.0.2"],"state":"fixed","available":[{"version":"14.0.2","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.19774999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-118773","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118773","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-glob/commit/4682e8c9babee1b385202ede36389634e12076d7","https://github.com/isaacs/node-glob/releases/tag/v14.0.2","https://github.com/isaacs/node-glob/security/advisories/GHSA-3g3m-2fjr-6pw4"],"description":"Glob matches files using patterns the shell uses. From 9.0.0 until 14.0.2, abort branches in src/walker.ts, including GlobUtil.walkCB(), GlobUtil.walkCB2(), GlobUtil.walkCBSync(), and GlobUtil.walkCB2Sync(), invoke the callbacks without returning. After AbortSignal or AbortSignal.timeout() rejects or emits an error, execution can continue into processor.processPatterns(), readdirCB(), and recursive traversal. The issue affects glob() and globStream() when applications expose attacker-influenced patterns or directory trees and rely on cancellation as a traversal budget. Repeated timed-out requests can stack background filesystem operations and CPU work, degrading worker throughput or service availability; no confidentiality or integrity impact was observed. This issue is fixed in 14.0.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118773","epss":0.0035,"percentile":0.28709,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118773","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"glob","version":"13.0.6"}},"found":{"vulnerabilityID":"GHSA-3g3m-2fjr-6pw4","versionConstraint":">=9.0.0,<=14.0.1 (semantic)"},"fix":{"suggestedVersion":"14.0.2"}}],"artifact":{"id":"pkg:npm/glob@13.0.6?package-id=08e8c9a8823aa56a","name":"glob","version":"13.0.6","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BlueOak-1.0.0"],"cpes":["cpe:2.3:a:isaacs:glob:13.0.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/glob@13.0.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-76mc-f452-cxcm","dataSource":"https://github.com/advisories/GHSA-76mc-f452-cxcm","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/cure53/DOMPurify/security/advisories/GHSA-76mc-f452-cxcm"],"description":"DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR`","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-65902","epss":0.00355,"percentile":0.29256,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-65902","cwe":"CWE-501","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["3.4.7"],"state":"fixed","available":[{"version":"3.4.7","date":"2026-06-16","kind":"first-observed"}]},"advisories":[],"risk":0.19702499999999998},"relatedVulnerabilities":[{"id":"CVE-2026-65902","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-65902","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/cure53/DOMPurify/commit/7996f1dc78eb8b7922388aed75d94a9f8fad9a36","https://github.com/cure53/DOMPurify/security/advisories/GHSA-76mc-f452-cxcm","https://www.vulncheck.com/advisories/dompurify-before-hook-mutation-pollution-via-allowedtags"],"description":"DOMPurify before 3.4.7 passes direct references to the module-level DEFAULT_ALLOWED_TAGS and DEFAULT_ALLOWED_ATTR sets to the uponSanitizeElement and uponSanitizeAttribute hooks via data.allowedTags / data.allowedAttributes when sanitize is called without an explicit cfg.ALLOWED_TAGS / cfg.ALLOWED_ATTR array. A hook that mutates these fields permanently widens the default allow-lists for the lifetime of the DOMPurify instance, so all subsequent default-config sanitize calls inherit the widened defaults and attacker payloads using the poisoned tag/attribute name survive sanitization. removeAllHooks(), clearConfig(), and passing a fresh cfg do not recover the state; only constructing a new DOMPurify instance does.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-65902","epss":0.00355,"percentile":0.29256,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-65902","cwe":"CWE-501","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"dompurify","version":"3.3.3"}},"found":{"vulnerabilityID":"GHSA-76mc-f452-cxcm","versionConstraint":"<3.4.7 (semantic)"},"fix":{"suggestedVersion":"3.4.7"}}],"artifact":{"id":"pkg:npm/dompurify@3.3.3?package-id=5ef50eed3845476c","name":"dompurify","version":"3.3.3","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MPL-2.0 OR Apache-2.0"],"cpes":["cpe:2.3:a:dompurify:dompurify:3.3.3:*:*:*:*:*:*:*"],"purl":"pkg:npm/dompurify@3.3.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-mrwp-f3q8-3g9p","dataSource":"https://github.com/advisories/GHSA-mrwp-f3q8-3g9p","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-mrwp-f3q8-3g9p","https://nvd.nist.gov/vuln/detail/CVE-2026-116689","https://github.com/follow-redirects/follow-redirects/commit/b0a7751e9cd64cd8eeb6ec67d2f206a9cc88d3f8","https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.2"],"description":"follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-116689","epss":0.00266,"percentile":0.18805,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-116689","cwe":"CWE-201","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.16.2"],"state":"fixed","available":[{"version":"1.16.2","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.193515},"relatedVulnerabilities":[{"id":"CVE-2026-116689","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116689","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/follow-redirects/follow-redirects/commit/b0a7751e9cd64cd8eeb6ec67d2f206a9cc88d3f8","https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.2","https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-mrwp-f3q8-3g9p"],"description":"follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.2, the documented sensitiveHeaders option is checked with value instanceof Array, so an array created in another JavaScript realm is replaced with an empty list even though Array.isArray recognizes it. When a request then follows an attacker-controlled cross-origin redirect, a custom credential header named in that discarded list can be forwarded to the redirect destination. This issue is fixed in version 1.16.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-116689","epss":0.00266,"percentile":0.18805,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-116689","cwe":"CWE-201","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"follow-redirects","version":"1.16.0"}},"found":{"vulnerabilityID":"GHSA-mrwp-f3q8-3g9p","versionConstraint":">=1.16.0,<=1.16.1 (semantic)"},"fix":{"suggestedVersion":"1.16.2"}}],"artifact":{"id":"pkg:npm/follow-redirects@1.16.0?package-id=343e29d6598af447","name":"follow-redirects","version":"1.16.0","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:follow-redirects:follow_redirects:1.16.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/follow-redirects@1.16.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-mrwp-f3q8-3g9p","dataSource":"https://github.com/advisories/GHSA-mrwp-f3q8-3g9p","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-mrwp-f3q8-3g9p","https://nvd.nist.gov/vuln/detail/CVE-2026-116689","https://github.com/follow-redirects/follow-redirects/commit/b0a7751e9cd64cd8eeb6ec67d2f206a9cc88d3f8","https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.2"],"description":"follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-116689","epss":0.00266,"percentile":0.18805,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-116689","cwe":"CWE-201","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.16.2"],"state":"fixed","available":[{"version":"1.16.2","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.193515},"relatedVulnerabilities":[{"id":"CVE-2026-116689","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116689","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/follow-redirects/follow-redirects/commit/b0a7751e9cd64cd8eeb6ec67d2f206a9cc88d3f8","https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.2","https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-mrwp-f3q8-3g9p"],"description":"follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.2, the documented sensitiveHeaders option is checked with value instanceof Array, so an array created in another JavaScript realm is replaced with an empty list even though Array.isArray recognizes it. When a request then follows an attacker-controlled cross-origin redirect, a custom credential header named in that discarded list can be forwarded to the redirect destination. This issue is fixed in version 1.16.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-116689","epss":0.00266,"percentile":0.18805,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-116689","cwe":"CWE-201","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"follow-redirects","version":"1.16.0"}},"found":{"vulnerabilityID":"GHSA-mrwp-f3q8-3g9p","versionConstraint":">=1.16.0,<=1.16.1 (semantic)"},"fix":{"suggestedVersion":"1.16.2"}}],"artifact":{"id":"pkg:npm/follow-redirects@1.16.0?package-id=5844d5fd4e00c830","name":"follow-redirects","version":"1.16.0","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:follow-redirects:follow_redirects:1.16.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/follow-redirects@1.16.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-mrwp-f3q8-3g9p","dataSource":"https://github.com/advisories/GHSA-mrwp-f3q8-3g9p","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-mrwp-f3q8-3g9p","https://nvd.nist.gov/vuln/detail/CVE-2026-116689","https://github.com/follow-redirects/follow-redirects/commit/b0a7751e9cd64cd8eeb6ec67d2f206a9cc88d3f8","https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.2"],"description":"follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-116689","epss":0.00266,"percentile":0.18805,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-116689","cwe":"CWE-201","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.16.2"],"state":"fixed","available":[{"version":"1.16.2","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.193515},"relatedVulnerabilities":[{"id":"CVE-2026-116689","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116689","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/follow-redirects/follow-redirects/commit/b0a7751e9cd64cd8eeb6ec67d2f206a9cc88d3f8","https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.2","https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-mrwp-f3q8-3g9p"],"description":"follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.2, the documented sensitiveHeaders option is checked with value instanceof Array, so an array created in another JavaScript realm is replaced with an empty list even though Array.isArray recognizes it. When a request then follows an attacker-controlled cross-origin redirect, a custom credential header named in that discarded list can be forwarded to the redirect destination. This issue is fixed in version 1.16.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-116689","epss":0.00266,"percentile":0.18805,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-116689","cwe":"CWE-201","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"follow-redirects","version":"1.16.0"}},"found":{"vulnerabilityID":"GHSA-mrwp-f3q8-3g9p","versionConstraint":">=1.16.0,<=1.16.1 (semantic)"},"fix":{"suggestedVersion":"1.16.2"}}],"artifact":{"id":"pkg:npm/follow-redirects@1.16.0?package-id=d07533023657bf9b","name":"follow-redirects","version":"1.16.0","type":"npm","locations":[{"path":"/sink/oidc-server/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:follow-redirects:follow_redirects:1.16.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/follow-redirects@1.16.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-86w9-cpqp-85rv","dataSource":"https://github.com/advisories/GHSA-86w9-cpqp-85rv","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-85393","https://github.com/digitalbazaar/forge/issues/1149","https://github.com/advisories/GHSA-ppp5-5v6c-4jwp","https://github.com/digitalbazaar/forge/blob/v1.4.0/lib/asn1.js","https://github.com/digitalbazaar/forge/blob/v1.4.0/lib/rsa.js","https://www.vulncheck.com/advisories/node-forge-through-1.4.0-rsa-pkcs-1-1.5-signature-forgery-via-nested-digestalgorithm-padding","https://github.com/digitalbazaar/forge/pull/1152"],"description":"node-forge RSA PKCS#1 v1.5 signature verification accepts extra nested DigestAlgorithm elements","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-85393","epss":0.00248,"percentile":0.16158,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-85393","cwe":"CWE-347","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.19344},"relatedVulnerabilities":[{"id":"CVE-2026-85393","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85393","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/advisories/GHSA-ppp5-5v6c-4jwp","https://github.com/digitalbazaar/forge","https://github.com/digitalbazaar/forge/blob/v1.4.0/lib/asn1.js","https://github.com/digitalbazaar/forge/blob/v1.4.0/lib/rsa.js","https://github.com/digitalbazaar/forge/issues/1149","https://www.vulncheck.com/advisories/node-forge-through-1.4.0-rsa-pkcs-1-1.5-signature-forgery-via-nested-digestalgorithm-padding"],"description":"node-forge through 1.4.0 fails to validate element count in nested DigestAlgorithm sequences during RSA PKCS#1 v1.5 signature verification. Attackers can embed garbage bytes inside the DigestAlgorithm sequence to forge valid signatures for arbitrary messages using low-exponent RSA keys. This is an incomplete fix for CVE-2026-33894.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-85393","epss":0.00248,"percentile":0.16158,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-85393","cwe":"CWE-347","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"node-forge","version":"1.4.0"}},"found":{"vulnerabilityID":"GHSA-86w9-cpqp-85rv","versionConstraint":"<=1.4.0 (semantic)"}}],"artifact":{"id":"pkg:npm/node-forge@1.4.0?package-id=1e94284aa936f13c","name":"node-forge","version":"1.4.0","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause OR GPL-2.0"],"cpes":["cpe:2.3:a:digitalbazaar:forge:1.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/node-forge@1.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-86w9-cpqp-85rv","dataSource":"https://github.com/advisories/GHSA-86w9-cpqp-85rv","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-85393","https://github.com/digitalbazaar/forge/issues/1149","https://github.com/advisories/GHSA-ppp5-5v6c-4jwp","https://github.com/digitalbazaar/forge/blob/v1.4.0/lib/asn1.js","https://github.com/digitalbazaar/forge/blob/v1.4.0/lib/rsa.js","https://www.vulncheck.com/advisories/node-forge-through-1.4.0-rsa-pkcs-1-1.5-signature-forgery-via-nested-digestalgorithm-padding","https://github.com/digitalbazaar/forge/pull/1152"],"description":"node-forge RSA PKCS#1 v1.5 signature verification accepts extra nested DigestAlgorithm elements","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-85393","epss":0.00248,"percentile":0.16158,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-85393","cwe":"CWE-347","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.19344},"relatedVulnerabilities":[{"id":"CVE-2026-85393","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85393","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/advisories/GHSA-ppp5-5v6c-4jwp","https://github.com/digitalbazaar/forge","https://github.com/digitalbazaar/forge/blob/v1.4.0/lib/asn1.js","https://github.com/digitalbazaar/forge/blob/v1.4.0/lib/rsa.js","https://github.com/digitalbazaar/forge/issues/1149","https://www.vulncheck.com/advisories/node-forge-through-1.4.0-rsa-pkcs-1-1.5-signature-forgery-via-nested-digestalgorithm-padding"],"description":"node-forge through 1.4.0 fails to validate element count in nested DigestAlgorithm sequences during RSA PKCS#1 v1.5 signature verification. Attackers can embed garbage bytes inside the DigestAlgorithm sequence to forge valid signatures for arbitrary messages using low-exponent RSA keys. This is an incomplete fix for CVE-2026-33894.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-85393","epss":0.00248,"percentile":0.16158,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-85393","cwe":"CWE-347","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"node-forge","version":"1.4.0"}},"found":{"vulnerabilityID":"GHSA-86w9-cpqp-85rv","versionConstraint":"<=1.4.0 (semantic)"}}],"artifact":{"id":"pkg:npm/node-forge@1.4.0?package-id=86ba9cb3dfe9125a","name":"node-forge","version":"1.4.0","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause OR GPL-2.0"],"cpes":["cpe:2.3:a:digitalbazaar:forge:1.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/node-forge@1.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-m7pr-hjqh-92cm","dataSource":"https://github.com/advisories/GHSA-m7pr-hjqh-92cm","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-m7pr-hjqh-92cm","https://nvd.nist.gov/vuln/detail/CVE-2026-42038"],"description":"Axios: no_proxy bypass via IP alias allows SSRF","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","metrics":{"baseScore":6.8,"exploitabilityScore":2.3,"impactScore":4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42038","epss":0.00324,"percentile":0.25441,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42038","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.15.1"],"state":"fixed","available":[{"version":"1.15.1","date":"2026-05-05","kind":"first-observed"}]},"advisories":[],"risk":0.19116},"relatedVulnerabilities":[{"id":"CVE-2026-42038","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42038","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-m7pr-hjqh-92cm"],"description":"Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, he fix for no_proxy hostname normalization bypass is incomplete. When no_proxy=localhost is set, requests to 127.0.0.1 and [::1] still route through the proxy instead of bypassing it. The shouldBypassProxy() function does pure string matching — it does not resolve IP aliases or loopback equivalents. This vulnerability is fixed in 1.15.1 and 0.31.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","metrics":{"baseScore":6.8,"exploitabilityScore":2.3,"impactScore":4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42038","epss":0.00324,"percentile":0.25441,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42038","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.15.0"}},"found":{"vulnerabilityID":"GHSA-m7pr-hjqh-92cm","versionConstraint":">=1.0.0,<1.15.1 (semantic)"},"fix":{"suggestedVersion":"1.15.1"}}],"artifact":{"id":"pkg:npm/axios@1.15.0?package-id=520b8e92ffff8054","name":"axios","version":"1.15.0","type":"npm","locations":[{"path":"/sink/oidc-server/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.15.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.15.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-8pvw-jcv7-9cmj","dataSource":"https://github.com/advisories/GHSA-8pvw-jcv7-9cmj","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/fastify/fastify-static/security/advisories/GHSA-8pvw-jcv7-9cmj","https://nvd.nist.gov/vuln/detail/CVE-2026-7120","https://github.com/fastify/fastify-static/commit/878c72e920fabacf7e37739bf78057044717bf63","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fastify-static/releases/tag/v10.1.2"],"description":"@fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-7120","epss":0.00369,"percentile":0.30808,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-7120","cwe":"CWE-180","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["10.1.2"],"state":"fixed","available":[{"version":"10.1.2","date":"2026-07-25","kind":"first-observed"}]},"advisories":[],"risk":0.190035},"relatedVulnerabilities":[{"id":"CVE-2026-7120","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-7120","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fastify-static/security/advisories/GHSA-8pvw-jcv7-9cmj"],"description":"@fastify/static evaluates the allowedPath callback before normalizing dot segments and duplicate path separators in the pathname used for file resolution. Versions up to and including 10.1.1 are affected. An unauthenticated attacker can bypass allowedPath restrictions by requesting equivalent non-canonical pathnames, causing files that were intended to be denied to be served anyway. The bypass does not allow access outside the configured static root by itself, it defeats path-based filtering only. The issue is patched in @fastify/static 10.1.2.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-7120","epss":0.00369,"percentile":0.30808,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-7120","cwe":"CWE-180","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@fastify/static","version":"9.1.3"}},"found":{"vulnerabilityID":"GHSA-8pvw-jcv7-9cmj","versionConstraint":"<=10.1.1 (semantic)"},"fix":{"suggestedVersion":"10.1.2"}}],"artifact":{"id":"pkg:npm/%40fastify/static@9.1.3?package-id=adbfb80a5767f8c8","name":"@fastify/static","version":"9.1.3","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:\\@fastify\\/static:\\@fastify\\/static:9.1.3:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40fastify/static@9.1.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-j3f2-48v5-ccww","dataSource":"https://github.com/advisories/GHSA-j3f2-48v5-ccww","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-j3f2-48v5-ccww","https://nvd.nist.gov/vuln/detail/CVE-2026-59877","https://github.com/protobufjs/protobuf.js/pull/2352","https://github.com/protobufjs/protobuf.js/commit/10fba6d54815ceecca8a06b9a6db490c8f5d2217","https://github.com/protobufjs/protobuf.js/commit/fa5c73add738ceb471e74da8cc2f3727c3d0a69f","https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.6.5","https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.6.6"],"description":"protobufjs: Denial of Service via infinite loop in .proto option parsing","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59877","epss":0.00365,"percentile":0.30416,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59877","cwe":"CWE-835","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.6.5"],"state":"fixed","available":[{"version":"7.6.5","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.187975},"relatedVulnerabilities":[{"id":"CVE-2026-59877","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59877","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/protobufjs/protobuf.js/commit/10fba6d54815ceecca8a06b9a6db490c8f5d2217","https://github.com/protobufjs/protobuf.js/commit/fa5c73add738ceb471e74da8cc2f3727c3d0a69f","https://github.com/protobufjs/protobuf.js/pull/2352","https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.6.5","https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.6.6","https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-j3f2-48v5-ccww"],"description":"protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.5 and 8.6.6, protobufjs parsed option names by advancing through schema tokens until reaching an = token without checking for end of input, so a crafted .proto schema that opens an option declaration and ends prematurely can cause parse, Root.load, or Root.loadSync to loop indefinitely. This issue is fixed in versions 7.6.5 and 8.6.6.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59877","epss":0.00365,"percentile":0.30416,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59877","cwe":"CWE-835","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"protobufjs","version":"7.5.6"}},"found":{"vulnerabilityID":"GHSA-j3f2-48v5-ccww","versionConstraint":">=7.5.0,<=7.6.4 (semantic)"},"fix":{"suggestedVersion":"7.6.5"}}],"artifact":{"id":"pkg:npm/protobufjs@7.5.6?package-id=7ceb7c776b63b6ac","name":"protobufjs","version":"7.5.6","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:protobufjs_project:protobufjs:7.5.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/protobufjs@7.5.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-68g3-v927-f742","dataSource":"https://github.com/advisories/GHSA-68g3-v927-f742","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742","https://github.com/vercel/next.js/commit/062f66700b52a5d6bba2c0605d55577ab7ad262c","https://github.com/vercel/next.js/commit/73b94872bc343d09494b50394d8c08eb9fc8e56a","https://github.com/vercel/next.js/releases/tag/v15.5.21","https://github.com/vercel/next.js/releases/tag/v16.2.11"],"description":"Next.js: Cache confusion of response bodies for requests with bodies","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-64648","epss":0.00338,"percentile":0.27243,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-64648","cwe":"CWE-524","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["16.2.11"],"state":"fixed","available":[{"version":"16.2.11","date":"2026-07-23","kind":"first-observed"}]},"advisories":[],"risk":0.1859},"relatedVulnerabilities":[{"id":"CVE-2026-64648","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64648","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/vercel/next.js/commit/062f66700b52a5d6bba2c0605d55577ab7ad262c","https://github.com/vercel/next.js/commit/73b94872bc343d09494b50394d8c08eb9fc8e56a","https://github.com/vercel/next.js/releases/tag/v15.5.21","https://github.com/vercel/next.js/releases/tag/v16.2.11","https://github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742"],"description":"Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a  server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the POST's response body would then leak to unauthorized requests. Though the request itself will not be deduped. This only applies to fetch calls with a request that has a different init than the one passed to fetch. A safe request would be: fetch(new Request(init), init). An unsafe request would be: fetch(new Request(init), aDifferentInit). This issue has been fixed in versions 15.5.21 and 16.2.11.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"exploitabilityScore":2.9,"impactScore":2.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-64648","epss":0.00338,"percentile":0.27243,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-64648","cwe":"CWE-524","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"next","version":"16.1.7"}},"found":{"vulnerabilityID":"GHSA-68g3-v927-f742","versionConstraint":">=16.0.0,<16.2.11 (semantic)"},"fix":{"suggestedVersion":"16.2.11"}}],"artifact":{"id":"pkg:npm/next@16.1.7?package-id=662de087d22e519d","name":"next","version":"16.1.7","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vercel:next.js:16.1.7:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/next@16.1.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-5x38-2vff-x55p","dataSource":"https://github.com/advisories/GHSA-5x38-2vff-x55p","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/digitalbazaar/forge/security/advisories/GHSA-5x38-2vff-x55p","https://nvd.nist.gov/vuln/detail/CVE-2026-119190","https://github.com/digitalbazaar/forge/commit/58c06bc251856b409c30ecb35a93f5f6c9bbc84a","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1"],"description":"Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119190","epss":0.00246,"percentile":0.15897,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119190","cwe":"CWE-295","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-119190","cwe":"CWE-436","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.4.1"],"state":"fixed","available":[{"version":"1.4.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.18327000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-119190","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119190","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/digitalbazaar/forge/commit/58c06bc251856b409c30ecb35a93f5f6c9bbc84a","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","https://github.com/digitalbazaar/forge/security/advisories/GHSA-5x38-2vff-x55p"],"description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge parsed deprecated extension OIDs 2.5.29.10 and 2.5.29.13 as basicConstraints, and pki.verifyCertificateChain() used the first extension with that name. Exploitation requires a CA trusted by the application to issue a certificate carrying an attacker-supplied deprecated-OID extension, commonly because the CA copies extensions from a certificate signing request. By placing a permissive deprecated extension before the genuine 2.5.29.19 basicConstraints extension, the certificate holder could have the certificate accepted as a CA and issue certificates for arbitrary names, enabling server or client impersonation. If the issuing CA adds a keyUsage extension without keyCertSign, node-forge rejects the chain. This issue is fixed in version 1.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119190","epss":0.00246,"percentile":0.15897,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119190","cwe":"CWE-295","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-119190","cwe":"CWE-436","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"node-forge","version":"1.4.0"}},"found":{"vulnerabilityID":"GHSA-5x38-2vff-x55p","versionConstraint":"<=1.4.0 (semantic)"},"fix":{"suggestedVersion":"1.4.1"}}],"artifact":{"id":"pkg:npm/node-forge@1.4.0?package-id=86ba9cb3dfe9125a","name":"node-forge","version":"1.4.0","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause OR GPL-2.0"],"cpes":["cpe:2.3:a:digitalbazaar:forge:1.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/node-forge@1.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-5x38-2vff-x55p","dataSource":"https://github.com/advisories/GHSA-5x38-2vff-x55p","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/digitalbazaar/forge/security/advisories/GHSA-5x38-2vff-x55p","https://nvd.nist.gov/vuln/detail/CVE-2026-119190","https://github.com/digitalbazaar/forge/commit/58c06bc251856b409c30ecb35a93f5f6c9bbc84a","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1"],"description":"Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119190","epss":0.00246,"percentile":0.15897,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119190","cwe":"CWE-295","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-119190","cwe":"CWE-436","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.4.1"],"state":"fixed","available":[{"version":"1.4.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.18327000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-119190","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119190","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/digitalbazaar/forge/commit/58c06bc251856b409c30ecb35a93f5f6c9bbc84a","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","https://github.com/digitalbazaar/forge/security/advisories/GHSA-5x38-2vff-x55p"],"description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge parsed deprecated extension OIDs 2.5.29.10 and 2.5.29.13 as basicConstraints, and pki.verifyCertificateChain() used the first extension with that name. Exploitation requires a CA trusted by the application to issue a certificate carrying an attacker-supplied deprecated-OID extension, commonly because the CA copies extensions from a certificate signing request. By placing a permissive deprecated extension before the genuine 2.5.29.19 basicConstraints extension, the certificate holder could have the certificate accepted as a CA and issue certificates for arbitrary names, enabling server or client impersonation. If the issuing CA adds a keyUsage extension without keyCertSign, node-forge rejects the chain. This issue is fixed in version 1.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119190","epss":0.00246,"percentile":0.15897,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119190","cwe":"CWE-295","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-119190","cwe":"CWE-436","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"node-forge","version":"1.4.0"}},"found":{"vulnerabilityID":"GHSA-5x38-2vff-x55p","versionConstraint":"<=1.4.0 (semantic)"},"fix":{"suggestedVersion":"1.4.1"}}],"artifact":{"id":"pkg:npm/node-forge@1.4.0?package-id=1e94284aa936f13c","name":"node-forge","version":"1.4.0","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause OR GPL-2.0"],"cpes":["cpe:2.3:a:digitalbazaar:forge:1.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/node-forge@1.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-gvwx-54wh-qm9j","dataSource":"https://github.com/advisories/GHSA-gvwx-54wh-qm9j","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-gvwx-54wh-qm9j","https://nvd.nist.gov/vuln/detail/CVE-2026-59875","https://github.com/isaacs/node-tar/commit/7a635c29f5edbf083557374d43984273ecfed5b3","https://github.com/isaacs/node-tar/releases/tag/v7.5.17"],"description":"node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59875","epss":0.00354,"percentile":0.29162,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59875","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.5.17"],"state":"fixed","available":[{"version":"7.5.17","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.18231000000000003},"relatedVulnerabilities":[{"id":"CVE-2026-59875","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59875","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-tar/commit/7a635c29f5edbf083557374d43984273ecfed5b3","https://github.com/isaacs/node-tar/releases/tag/v7.5.17","https://github.com/isaacs/node-tar/security/advisories/GHSA-gvwx-54wh-qm9j"],"description":"node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL bytes from PAX path and linkpath records in src/pax.ts, allowing a crafted archive with values to reach fs.lstat or fs.open and terminate the process with an uncaught exception. This issue is fixed in version 7.5.17.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59875","epss":0.00354,"percentile":0.29162,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59875","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"7.5.13"}},"found":{"vulnerabilityID":"GHSA-gvwx-54wh-qm9j","versionConstraint":"<=7.5.16 (semantic)"},"fix":{"suggestedVersion":"7.5.17"}}],"artifact":{"id":"pkg:npm/tar@7.5.13?package-id=c08fe2f2d0b796ea","name":"tar","version":"7.5.13","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BlueOak-1.0.0"],"cpes":["cpe:2.3:a:tar_project:tar:7.5.13:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:7.5.13:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:7.5.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@7.5.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-rmxm-3fg6-px4f","dataSource":"https://github.com/advisories/GHSA-rmxm-3fg6-px4f","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/honojs/node-server/security/advisories/GHSA-rmxm-3fg6-px4f","https://github.com/honojs/node-server/commit/982179278529d5673812116b042829f27794966f","https://github.com/honojs/node-server/releases/tag/v2.1.3"],"description":"@hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118663","epss":0.00353,"percentile":0.28982,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118663","cwe":"CWE-174","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.1.3"],"state":"fixed","available":[{"version":"2.1.3","date":"2026-10-29","kind":"first-observed"}]},"advisories":[],"risk":0.181795},"relatedVulnerabilities":[{"id":"CVE-2026-118663","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118663","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/honojs/node-server/commit/982179278529d5673812116b042829f27794966f","https://github.com/honojs/node-server/releases/tag/v2.1.3","https://github.com/honojs/node-server/security/advisories/GHSA-rmxm-3fg6-px4f"],"description":"@hono/node-server allows running the Hono application on Node.js. From 1.19.10 until 2.1.3, serveStatic decodes a request path a second time after Hono has already decoded it for routing, so a malformed percent-encoded sequence can make route middleware evaluate an encoded path while static file resolution uses a different directory. An unauthenticated attacker can bypass middleware mounted on a protected static prefix and read a file inside the configured static root, although the flaw does not permit traversal outside that root. This issue is fixed in version 2.1.3.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118663","epss":0.00353,"percentile":0.28982,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118663","cwe":"CWE-174","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@hono/node-server","version":"1.19.14"}},"found":{"vulnerabilityID":"GHSA-rmxm-3fg6-px4f","versionConstraint":">=1.19.10,<2.1.3 (semantic)"},"fix":{"suggestedVersion":"2.1.3"}}],"artifact":{"id":"pkg:npm/%40hono/node-server@1.19.14?package-id=e2a24eeea3066caa","name":"@hono/node-server","version":"1.19.14","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:\\@hono\\/node-server:\\@hono\\/node-server:1.19.14:*:*:*:*:*:*:*","cpe:2.3:a:\\@hono\\/node-server:\\@hono\\/node_server:1.19.14:*:*:*:*:*:*:*","cpe:2.3:a:\\@hono\\/node_server:\\@hono\\/node-server:1.19.14:*:*:*:*:*:*:*","cpe:2.3:a:\\@hono\\/node_server:\\@hono\\/node_server:1.19.14:*:*:*:*:*:*:*","cpe:2.3:a:\\@hono\\/node:\\@hono\\/node-server:1.19.14:*:*:*:*:*:*:*","cpe:2.3:a:\\@hono\\/node:\\@hono\\/node_server:1.19.14:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40hono/node-server@1.19.14","upstreams":[]}},{"vulnerability":{"id":"GHSA-w62v-xxxg-mg59","dataSource":"https://github.com/advisories/GHSA-w62v-xxxg-mg59","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/honojs/hono/security/advisories/GHSA-w62v-xxxg-mg59","https://nvd.nist.gov/vuln/detail/CVE-2026-59895","https://github.com/honojs/hono/commit/cd3f6f7194f0e5c9d4b26ae0cf232018d0f388fc","https://github.com/honojs/hono/releases/tag/v4.12.27"],"description":"Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59895","epss":0.00327,"percentile":0.25812,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59895","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-59895","cwe":"CWE-116","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.12.27"],"state":"fixed","available":[{"version":"4.12.27","date":"2026-07-22","kind":"first-observed"}]},"advisories":[],"risk":0.18148499999999998},"relatedVulnerabilities":[{"id":"CVE-2026-59895","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59895","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/honojs/hono/commit/cd3f6f7194f0e5c9d4b26ae0cf232018d0f388fc","https://github.com/honojs/hono/releases/tag/v4.12.27","https://github.com/honojs/hono/security/advisories/GHSA-w62v-xxxg-mg59"],"description":"Hono is a Web application framework that provides support for any JavaScript runtime. From 4.0.0 before 4.12.27, cx() in hono/css composes class names from plain strings but marks the result as already escaped without HTML-escaping the input, allowing untrusted className values used in a JSX class attribute during server-side rendering to break out of the attribute and inject arbitrary markup. This issue is fixed in version 4.12.27.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59895","epss":0.00327,"percentile":0.25812,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59895","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-59895","cwe":"CWE-116","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"hono","version":"4.12.16"}},"found":{"vulnerabilityID":"GHSA-w62v-xxxg-mg59","versionConstraint":">=4.0.0,<4.12.27 (semantic)"},"fix":{"suggestedVersion":"4.12.27"}}],"artifact":{"id":"pkg:npm/hono@4.12.16?package-id=000f2baa1e593039","name":"hono","version":"4.12.16","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:hono:hono:4.12.16:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/hono@4.12.16","upstreams":[]}},{"vulnerability":{"id":"GHSA-q89c-q3h5-w34g","dataSource":"https://github.com/advisories/GHSA-q89c-q3h5-w34g","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-q89c-q3h5-w34g","https://nvd.nist.gov/vuln/detail/CVE-2026-41691","https://github.com/i18next/i18next-http-backend/commit/4cee84f229c637b9c182366d3156f726d407a621"],"description":"i18next-http-backend has Path Traversal & URL Injection via Unsanitised lng/ns","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41691","epss":0.00313,"percentile":0.24297,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41691","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-41691","cwe":"CWE-74","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.0.5"],"state":"fixed","available":[{"version":"3.0.5","date":"2026-04-23","kind":"first-observed"}]},"advisories":[],"risk":0.179975},"relatedVulnerabilities":[{"id":"CVE-2026-41691","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41691","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/i18next/i18next-http-backend/commit/4cee84f229c637b9c182366d3156f726d407a621","https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-q89c-q3h5-w34g"],"description":"Copilot said: i18nextify is a JavaScript library that adds\ni18nextify is a JavaScript library that adds website internationalization via a script tag, without source code changes. Versions prior to 3.0.5 interpolate the lng and ns values directly into the configured loadPath / addPath URL template without any encoding, validation, or path sanitisation. When an application exposes the language-code selection to user-controlled input (the default — i18next-browser-languagedetector reads ?lng= query params, cookies, localStorage, and request headers), an attacker can inject characters that change the structure of the outgoing request URL. This is a single URL-injection vulnerability. The attacker-controlled value is neutralised before it is used as part of an output URL string; the attack shape covers both path traversal and broader URL-structure injection — both are closed by the one interpolateUrl sanitisation fix. This issue has been fixed in version 3.0.5. If users cannot upgrade immediately, they can work around the issue by sanitising lng / ns before they reach i18next (strip .., /, \\, ?, #, %, whitespace, and control characters; cap the length).","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41691","epss":0.00313,"percentile":0.24297,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41691","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-41691","cwe":"CWE-74","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"i18next-http-backend","version":"3.0.1"}},"found":{"vulnerabilityID":"GHSA-q89c-q3h5-w34g","versionConstraint":"<3.0.5 (semantic)"},"fix":{"suggestedVersion":"3.0.5"}}],"artifact":{"id":"pkg:npm/i18next-http-backend@3.0.1?package-id=05b13842ffa31e89","name":"i18next-http-backend","version":"3.0.1","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:i18next:i18next-http-backend:3.0.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/i18next-http-backend@3.0.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-gcqx-w48m-w2h4","dataSource":"https://github.com/advisories/GHSA-gcqx-w48m-w2h4","namespace":"github:language:javascript","severity":"Low","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-93753","https://github.com/TehShrike/deepmerge/issues/273","https://github.com/TehShrike/deepmerge/blob/5b87756a5671635679001cbac72aa42f23472c81/index.js#L39-L60","https://www.vulncheck.com/advisories/deepmerge-through-4.3.1-prototype-poisoning-via-mergeobject"],"description":"deepmerge mergeObject() allows prototype poisoning of returned objects","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U","metrics":{"baseScore":2.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-93753","epss":0.00514,"percentile":0.43823,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-93753","cwe":"CWE-1321","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.17989999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-93753","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93753","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/TehShrike/deepmerge","https://github.com/TehShrike/deepmerge/blob/5b87756a5671635679001cbac72aa42f23472c81/index.js#L39-L60","https://github.com/TehShrike/deepmerge/issues/273","https://www.vulncheck.com/advisories/deepmerge-through-4.3.1-prototype-poisoning-via-mergeobject"],"description":"deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject() function that fails to properly validate keys being written to target objects. Attackers can supply malicious source objects in merge operations to inject attacker-controlled properties into the returned object's prototype, causing applications to inherit unintended values when accessing properties without own-property checks.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-93753","epss":0.00514,"percentile":0.43823,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-93753","cwe":"CWE-1321","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"deepmerge","version":"4.3.1"}},"found":{"vulnerabilityID":"GHSA-gcqx-w48m-w2h4","versionConstraint":">=4.2.0,<=4.3.1 (semantic)"}}],"artifact":{"id":"pkg:npm/deepmerge@4.3.1?package-id=48e2b33c47bb50bc","name":"deepmerge","version":"4.3.1","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:deepmerge:deepmerge:4.3.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/deepmerge@4.3.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-7q8q-rj6j-mhjq","dataSource":"https://github.com/advisories/GHSA-7q8q-rj6j-mhjq","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-7q8q-rj6j-mhjq","https://github.com/axios/axios/pull/11000","https://github.com/axios/axios/pull/11001","https://github.com/axios/axios/commit/1417285c69344bbcc6420a021f67dee0c6fedb2d","https://github.com/axios/axios/commit/32fc489632377d214db55bfa4e2c48486a7d7ce2","https://github.com/axios/axios/releases/tag/v0.33.0","https://github.com/axios/axios/releases/tag/v1.18.0","https://nvd.nist.gov/vuln/detail/CVE-2026-67319","https://nvd.nist.gov/vuln/detail/CVE-2026-69123","https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-nested-option-objects"],"description":"Axios: Nested axios option objects can consume polluted prototype values","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67319","epss":0.00318,"percentile":0.24744,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67319","cwe":"CWE-1321","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["1.18.0"],"state":"fixed","available":[{"version":"1.18.0","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.17966999999999997},"relatedVulnerabilities":[{"id":"CVE-2026-67319","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-67319","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/axios/axios/security/advisories/GHSA-7q8q-rj6j-mhjq","https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-nested-option-objects"],"description":"axios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option objects when the JavaScript process's Object.prototype has already been polluted by another component. While the top-level merged config uses a null prototype, nested plain objects such as auth and paramsSerializer are cloned into ordinary objects and read without own-property checks. When an application passes placeholder nested objects such as auth: {} or paramsSerializer: {}, inherited username/password values can cause silent injection of an Authorization: Basic header, and inherited encode/serialize values can alter query-string serialization (full serializer replacement requires a function-valued pollution primitive). This is exploitable only in the presence of pre-existing prototype pollution.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67319","epss":0.00318,"percentile":0.24744,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67319","cwe":"CWE-1321","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.15.0"}},"found":{"vulnerabilityID":"GHSA-7q8q-rj6j-mhjq","versionConstraint":">=1.0.0,<1.18.0 (semantic)"},"fix":{"suggestedVersion":"1.18.0"}}],"artifact":{"id":"pkg:npm/axios@1.15.0?package-id=520b8e92ffff8054","name":"axios","version":"1.15.0","type":"npm","locations":[{"path":"/sink/oidc-server/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.15.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.15.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-7q8q-rj6j-mhjq","dataSource":"https://github.com/advisories/GHSA-7q8q-rj6j-mhjq","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-7q8q-rj6j-mhjq","https://github.com/axios/axios/pull/11000","https://github.com/axios/axios/pull/11001","https://github.com/axios/axios/commit/1417285c69344bbcc6420a021f67dee0c6fedb2d","https://github.com/axios/axios/commit/32fc489632377d214db55bfa4e2c48486a7d7ce2","https://github.com/axios/axios/releases/tag/v0.33.0","https://github.com/axios/axios/releases/tag/v1.18.0","https://nvd.nist.gov/vuln/detail/CVE-2026-67319","https://nvd.nist.gov/vuln/detail/CVE-2026-69123","https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-nested-option-objects"],"description":"Axios: Nested axios option objects can consume polluted prototype values","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67319","epss":0.00318,"percentile":0.24744,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67319","cwe":"CWE-1321","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["1.18.0"],"state":"fixed","available":[{"version":"1.18.0","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.17966999999999997},"relatedVulnerabilities":[{"id":"CVE-2026-67319","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-67319","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/axios/axios/security/advisories/GHSA-7q8q-rj6j-mhjq","https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-nested-option-objects"],"description":"axios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option objects when the JavaScript process's Object.prototype has already been polluted by another component. While the top-level merged config uses a null prototype, nested plain objects such as auth and paramsSerializer are cloned into ordinary objects and read without own-property checks. When an application passes placeholder nested objects such as auth: {} or paramsSerializer: {}, inherited username/password values can cause silent injection of an Authorization: Basic header, and inherited encode/serialize values can alter query-string serialization (full serializer replacement requires a function-valued pollution primitive). This is exploitable only in the presence of pre-existing prototype pollution.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67319","epss":0.00318,"percentile":0.24744,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67319","cwe":"CWE-1321","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.16.1"}},"found":{"vulnerabilityID":"GHSA-7q8q-rj6j-mhjq","versionConstraint":">=1.0.0,<1.18.0 (semantic)"},"fix":{"suggestedVersion":"1.18.0"}}],"artifact":{"id":"pkg:npm/axios@1.16.1?package-id=8545c428c207f9fb","name":"axios","version":"1.16.1","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.16.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.16.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-qw65-cvwx-89v3","dataSource":"https://github.com/advisories/GHSA-qw65-cvwx-89v3","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3","https://nvd.nist.gov/vuln/detail/CVE-2026-84292","https://github.com/fastify/fast-uri/commit/820e8478dd7da3d09f187bfaf35d50b71f67b8b4","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v2.4.6","https://github.com/fastify/fast-uri/releases/tag/v3.1.7","https://github.com/fastify/fast-uri/releases/tag/v4.1.4"],"description":"fast-uri vulnerable to authority injection via an unvalidated port in serialize","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84292","epss":0.00239,"percentile":0.15045,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84292","cwe":"CWE-116","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["3.1.7"],"state":"fixed","available":[{"version":"3.1.7","date":"2026-09-29","kind":"first-observed"}]},"advisories":[],"risk":0.17925000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-84292","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84292","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3"],"description":"fast-uri serializes the port component of a URI without validating it. When recomposing the authority, the userinfo and host components are escaped but the port is concatenated verbatim, so a port value that is not a sequence of digits can inject authority delimiters, demoting the intended host to userinfo and pointing the authority at an attacker-controlled host. Both fast-uri and Node's URL read the result back as the attacker's host with no error, so re-validating the built URI does not catch it. This affects applications that build URIs from parts and assign untrusted data to the port component through the serialize, normalize, or equal functions in their object forms. The issue affects fast-uri versions before 2.4.6, from 3.0.0 before 3.1.7, and from 4.0.0 before 4.1.4. It is fixed in 2.4.6, 3.1.7, and 4.1.4, where recomposeAuthority rejects any port that is not a digit sequence per RFC 3986.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84292","epss":0.00239,"percentile":0.15045,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84292","cwe":"CWE-116","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"3.1.0"}},"found":{"vulnerabilityID":"GHSA-qw65-cvwx-89v3","versionConstraint":">=3.0.0,<3.1.7 (semantic)"},"fix":{"suggestedVersion":"3.1.7"}}],"artifact":{"id":"pkg:npm/fast-uri@3.1.0?package-id=a87bf2e2258cda95","name":"fast-uri","version":"3.1.0","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:openjsf:fast-uri:3.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@3.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-4633-3j49-mh5q","dataSource":"https://github.com/advisories/GHSA-4633-3j49-mh5q","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q","https://github.com/vercel/next.js/pull/96008","https://github.com/vercel/next.js/commit/025bf4a5f7b47fb7758c4ebf1c931a61c451c082","https://github.com/vercel/next.js/releases/tag/v15.5.21","https://github.com/vercel/next.js/releases/tag/v16.2.11"],"description":"Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-64647","epss":0.00317,"percentile":0.24681,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-64647","cwe":"CWE-116","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["16.2.11"],"state":"fixed","available":[{"version":"16.2.11","date":"2026-07-23","kind":"first-observed"}]},"advisories":[],"risk":0.179105},"relatedVulnerabilities":[{"id":"CVE-2026-64647","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64647","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/vercel/next.js/commit/025bf4a5f7b47fb7758c4ebf1c931a61c451c082","https://github.com/vercel/next.js/pull/96008","https://github.com/vercel/next.js/releases/tag/v15.5.21","https://github.com/vercel/next.js/releases/tag/v16.2.11","https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q"],"description":"Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the POST's response body would then leak to unauthorized requests. Though the request itself will not be deduped. This is only an issue when receiving request bodies with a content type charset other than UTF-8. For example, the UTF-16 byte sequences for 삃삃 and 섄섄 in the request body would share the same cache. This issue has been fixed in versions 15.5.21 and 16.2.11.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"exploitabilityScore":2.9,"impactScore":2.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-64647","epss":0.00317,"percentile":0.24681,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-64647","cwe":"CWE-116","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"next","version":"16.1.7"}},"found":{"vulnerabilityID":"GHSA-4633-3j49-mh5q","versionConstraint":">=16.0.0,<16.2.11 (semantic)"},"fix":{"suggestedVersion":"16.2.11"}}],"artifact":{"id":"pkg:npm/next@16.1.7?package-id=662de087d22e519d","name":"next","version":"16.1.7","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vercel:next.js:16.1.7:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/next@16.1.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-rxp7-6hxx-x8q5","dataSource":"https://github.com/advisories/GHSA-rxp7-6hxx-x8q5","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rxp7-6hxx-x8q5","https://nvd.nist.gov/vuln/detail/CVE-2026-111997","https://github.com/beaugunderson/ip-address/commit/ec80fcd5d7b97defecfd39717d782a9f9f8b89dd","https://github.com/beaugunderson/ip-address/releases/tag/v10.7.4"],"description":"ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111997","epss":0.00315,"percentile":0.24412,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111997","cwe":"CWE-1333","source":"cve@mitre.org","type":"Secondary"}],"fix":{"versions":["10.7.4"],"state":"fixed","available":[{"version":"10.7.4","date":"2026-10-22","kind":"first-observed"}]},"advisories":[],"risk":0.177975},"relatedVulnerabilities":[{"id":"CVE-2026-111997","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111997","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rxp7-6hxx-x8q5"],"description":"ip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall) via many % characters in input reaching a function call that uses the Address6 constructor.","cvss":[{"source":"cve@mitre.org","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111997","epss":0.00315,"percentile":0.24412,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111997","cwe":"CWE-1333","source":"cve@mitre.org","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"ip-address","version":"10.1.0"}},"found":{"vulnerabilityID":"GHSA-rxp7-6hxx-x8q5","versionConstraint":"<=10.7.3 (semantic)"},"fix":{"suggestedVersion":"10.7.4"}}],"artifact":{"id":"pkg:npm/ip-address@10.1.0?package-id=d0c928307aa7dbe2","name":"ip-address","version":"10.1.0","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:beaugunderson:ip-address:10.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/ip-address@10.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-gxm5-99cw-xjw9","dataSource":"https://github.com/advisories/GHSA-gxm5-99cw-xjw9","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/fastify/busboy/security/advisories/GHSA-gxm5-99cw-xjw9","https://nvd.nist.gov/vuln/detail/CVE-2026-74866","https://github.com/fastify/busboy/commit/cc7da17c5c88d79c314a9e149a79e5a00a6c23be","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/busboy/releases/tag/v3.2.2"],"description":"@fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","metrics":{"baseScore":5.8,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-74866","epss":0.00326,"percentile":0.25728,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-74866","cwe":"CWE-93","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["3.2.2"],"state":"fixed","available":[{"version":"3.2.2","date":"2026-10-06","kind":"first-observed"}]},"advisories":[],"risk":0.17604},"relatedVulnerabilities":[{"id":"CVE-2026-74866","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-74866","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/busboy/security/advisories/GHSA-gxm5-99cw-xjw9"],"description":"@fastify/busboy is a multipart form-data parser for Node.js. Its multipart part-header parser splits header lines only on the two-byte carriage-return line-feed sequence, so a lone carriage return or line feed embedded in a part header is not treated as a line break and is carried verbatim into the parsed Content-Disposition filename and field name handed to the application. An attacker who uploads a file whose filename or field name contains a bare carriage return or line feed can inject control characters into consumers that trust the parser to return clean values, enabling filesystem filename pollution, log forging, or header injection when the value is forwarded to a carriage-return-sensitive sink. All versions of @fastify/busboy up to and including 3.2.1 are affected. The issue is fixed in version 3.2.2, which rejects any header line that still contains a bare carriage return or line feed. Users should upgrade to 3.2.2, and consumers such as @fastify/multipart should bump their @fastify/busboy dependency to pull in the fix.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","metrics":{"baseScore":5.8,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-74866","epss":0.00326,"percentile":0.25728,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-74866","cwe":"CWE-93","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@fastify/busboy","version":"3.1.1"}},"found":{"vulnerabilityID":"GHSA-gxm5-99cw-xjw9","versionConstraint":"<3.2.2 (semantic)"},"fix":{"suggestedVersion":"3.2.2"}}],"artifact":{"id":"pkg:npm/%40fastify/busboy@3.1.1?package-id=fc5e1f1a506dbd6b","name":"@fastify/busboy","version":"3.1.1","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:fastify:fastify\\/busyboy:3.1.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/%40fastify/busboy@3.1.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-4qv8-2p9j-2685","dataSource":"https://github.com/advisories/GHSA-4qv8-2p9j-2685","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/nodejs/undici/security/advisories/GHSA-4qv8-2p9j-2685","https://nvd.nist.gov/vuln/detail/CVE-2026-109924","https://github.com/nodejs/undici/commit/299162740d5f39120092277e70efacb4d151c1c6","https://github.com/nodejs/undici/commit/789ef26461c648480433846607154f52d74ec9ab","https://github.com/nodejs/undici/commit/c43b23fdc6b37e1283d4347408bb16800f867d9e","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v6.29.1","https://github.com/nodejs/undici/releases/tag/v7.30.1","https://github.com/nodejs/undici/releases/tag/v8.12.2"],"description":"undici vulnerable to Denial of Service via unbounded memory in the EventSource parser","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-109924","epss":0.00321,"percentile":0.2513,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-109924","cwe":"CWE-770","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["7.30.1"],"state":"fixed","available":[{"version":"7.30.1","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.17494500000000002},"relatedVulnerabilities":[{"id":"CVE-2026-109924","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109924","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-4qv8-2p9j-2685"],"description":"undici is an HTTP client library for Node.js. In versions 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its EventSource client can be driven to exhaust process memory by a malicious or compromised Server-Sent Events peer. By sending millions of tiny completed data fields with no blank event separator, or a single unfinished line split across many chunks, the parser retains a growing amount of per-field and per-chunk state that the byte-based maxEventSize and maxResponseSize limits do not bound, and because maxResponseSize is enforced on the compressed body before decompression, a small compressed response can expand into enough retained memory to terminate the process. An application only needs to maintain an EventSource connection to an untrusted peer, which controls only the response, and availability is the only impact. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, which bound the retained parser state independently of the byte limits, and users should upgrade to one of those versions or later. There is no workaround.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-109924","epss":0.00321,"percentile":0.2513,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-109924","cwe":"CWE-770","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"undici","version":"7.30.0"}},"found":{"vulnerabilityID":"GHSA-4qv8-2p9j-2685","versionConstraint":">=7.0.0,<7.30.1 (semantic)"},"fix":{"suggestedVersion":"7.30.1"}}],"artifact":{"id":"pkg:npm/undici@7.30.0?package-id=2e4d483351b6bc03","name":"undici","version":"7.30.0","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodejs:undici:7.30.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/undici@7.30.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-9fm3-97px-rjf6","dataSource":"https://github.com/advisories/GHSA-9fm3-97px-rjf6","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/nodejs/undici/security/advisories/GHSA-9fm3-97px-rjf6","https://nvd.nist.gov/vuln/detail/CVE-2026-109932","https://github.com/nodejs/undici/commit/39f93e142df03e559fe7c3d1fc7fba9beee2c185","https://github.com/nodejs/undici/commit/53944624462b6797560288c55dbd8c66857bb495","https://github.com/nodejs/undici/commit/b217373bb024cd93f85eb5b3ffd25684855f60f8","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v6.29.1","https://github.com/nodejs/undici/releases/tag/v7.30.1","https://github.com/nodejs/undici/releases/tag/v8.12.2"],"description":"undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-109932","epss":0.00321,"percentile":0.2513,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-109932","cwe":"CWE-400","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-109932","cwe":"CWE-405","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-109932","cwe":"CWE-770","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["7.30.1"],"state":"fixed","available":[{"version":"7.30.1","date":"2026-10-28","kind":"first-observed"}]},"advisories":[],"risk":0.17494500000000002},"relatedVulnerabilities":[{"id":"CVE-2026-109932","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109932","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-9fm3-97px-rjf6"],"description":"undici is an HTTP client library for Node.js. In versions 5.15.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its WebSocket client, including the bundled WebSocket exposed by Node.js, can be driven to exhaust process memory by a malicious or compromised WebSocket server. For every PING frame received, the client automatically writes a PONG response and ignores the backpressure signal from the socket write, so a server that streams small PING frames while never reading the client's PONGs makes the outbound write queue and heap grow without bound until the Node.js process runs out of memory and terminates. The attack is remote and unauthenticated, needs only a normal WebSocket connection, and is asymmetric, since small inbound PINGs produce a much larger retained outbound queue, with availability the only impact. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, which pause WebSocket frame parsing when the automatic PONG response hits socket backpressure and resume on drain, bounding the outbound queue, and users should upgrade to one of those versions or later. There is no workaround.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-109932","epss":0.00321,"percentile":0.2513,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-109932","cwe":"CWE-400","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-109932","cwe":"CWE-405","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-109932","cwe":"CWE-770","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"undici","version":"7.30.0"}},"found":{"vulnerabilityID":"GHSA-9fm3-97px-rjf6","versionConstraint":">=7.0.0,<7.30.1 (semantic)"},"fix":{"suggestedVersion":"7.30.1"}}],"artifact":{"id":"pkg:npm/undici@7.30.0?package-id=2e4d483351b6bc03","name":"undici","version":"7.30.0","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodejs:undici:7.30.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/undici@7.30.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-jqff-g426-hqxp","dataSource":"https://github.com/advisories/GHSA-jqff-g426-hqxp","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-jqff-g426-hqxp","https://nvd.nist.gov/vuln/detail/CVE-2026-76172","https://github.com/fastify/fast-uri/commit/37f3417c82994279656854f83ce938acd81c3862","https://github.com/fastify/fast-uri/commit/a941e626411f576f8d90883231e57b6c9d0ff98b","https://github.com/fastify/fast-uri/commit/c6a74bfd9d8c6b0df5362b3c7ae88d8021cb1e39","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v2.4.5","https://github.com/fastify/fast-uri/releases/tag/v3.1.6","https://github.com/fastify/fast-uri/releases/tag/v4.1.3"],"description":"fast-uri vulnerable to host confusion via percent-encoded scheme normalization","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-76172","epss":0.00232,"percentile":0.14137,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-76172","cwe":"CWE-177","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["3.1.6"],"state":"fixed","available":[{"version":"3.1.6","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.174},"relatedVulnerabilities":[{"id":"CVE-2026-76172","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76172","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-jqff-g426-hqxp"],"description":"fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and serialization writes the scheme back out verbatim, unlike the host component which is re-escaped. As a result an input whose scheme carries percent-encoded slashes parses as a scheme with no authority, so the parsed host and error are both undefined, yet resolving or normalizing that same input emits a network-path reference whose authority is attacker-chosen and re-parses to that host. An application that allowlists on the parsed host, or treats a reference with no authority as safe to resolve against its base, gets the opposite of what it checked, giving an off-site redirect, server-side request forgery, or address-policy bypass. The legacy decoder also expands non-standard escape forms, widening the issue past upstream filters, and control characters in the scheme can reach the output as raw carriage return and line feed. The affected versions are 2.3.1 up to but not including 2.4.5, 3.0.0 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which reject a scheme that is not valid after decoding. Users should upgrade to a patched version.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-76172","epss":0.00232,"percentile":0.14137,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-76172","cwe":"CWE-177","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"3.1.0"}},"found":{"vulnerabilityID":"GHSA-jqff-g426-hqxp","versionConstraint":">=3.0.0,<3.1.6 (semantic)"},"fix":{"suggestedVersion":"3.1.6"}}],"artifact":{"id":"pkg:npm/fast-uri@3.1.0?package-id=a87bf2e2258cda95","name":"fast-uri","version":"3.1.0","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:openjsf:fast-uri:3.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@3.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-866g-f22w-33x8","dataSource":"https://github.com/advisories/GHSA-866g-f22w-33x8","namespace":"github:language:javascript","severity":"Low","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-8769","https://gist.github.com/YLChen-007/fb1096bc8428bed9a428f764d9d103bb","https://vuldb.com/submit/811406","https://vuldb.com/vuln/364394","https://vuldb.com/vuln/364394/cti","https://github.com/vercel/ai/pull/16374","https://github.com/vercel/ai/commit/6a436e31d247d678ddaedfc6f61e73ac0595e4b4","https://github.com/vercel/ai/commit/b30e43ac3fae2432a40b4f4f27f844f3d78b119e","https://github.com/vercel/ai/commit/b85c4fbc603b8173cf50a9790823397aada908a9","https://github.com/vercel/ai/blob/main/packages/provider-utils/CHANGELOG.md#501","https://github.com/vercel/ai/releases/tag/@ai-sdk/provider-utils@3.0.28","https://github.com/vercel/ai/releases/tag/@ai-sdk/provider-utils@4.0.33","https://github.com/vercel/ai/releases/tag/@ai-sdk/provider-utils@5.0.1"],"description":"@ai-sdk/provider-utils has an Uncontrolled Resource Consumption issue","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"exploitabilityScore":2.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":2.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-8769","epss":0.00561,"percentile":0.46661,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-8769","cwe":"CWE-400","source":"cna@vuldb.com","type":"Secondary"},{"cve":"CVE-2026-8769","cwe":"CWE-404","source":"cna@vuldb.com","type":"Secondary"}],"fix":{"versions":["4.0.33"],"state":"fixed","available":[{"version":"4.0.33","date":"2026-09-08","kind":"first-observed"}]},"advisories":[],"risk":0.17391},"relatedVulnerabilities":[{"id":"CVE-2026-8769","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8769","namespace":"nvd:cpe","severity":"Medium","urls":["https://gist.github.com/YLChen-007/fb1096bc8428bed9a428f764d9d103bb","https://vuldb.com/submit/811406","https://vuldb.com/vuln/364394","https://vuldb.com/vuln/364394/cti"],"description":"A vulnerability was determined in vercel ai up to 3.0.97. The impacted element is the function createJsonResponseHandler/createJsonErrorResponseHandler of the file packages/provider-utils/src/response-handler.ts of the component provider-utils. This manipulation causes resource consumption. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"cna@vuldb.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"vendorMetadata":{}},{"source":"cna@vuldb.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"exploitabilityScore":2.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"cna@vuldb.com","type":"Secondary","version":"2.0","vector":"AV:N/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":4,"exploitabilityScore":8,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-8769","epss":0.00561,"percentile":0.46661,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-8769","cwe":"CWE-400","source":"cna@vuldb.com","type":"Secondary"},{"cve":"CVE-2026-8769","cwe":"CWE-404","source":"cna@vuldb.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@ai-sdk/provider-utils","version":"4.0.23"}},"found":{"vulnerabilityID":"GHSA-866g-f22w-33x8","versionConstraint":">=4.0.0-beta.10,<4.0.33 (semantic)"},"fix":{"suggestedVersion":"4.0.33"}}],"artifact":{"id":"pkg:npm/%40ai-sdk/provider-utils@4.0.23?package-id=070a3c9d75f195f5","name":"@ai-sdk/provider-utils","version":"4.0.23","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["Apache-2.0"],"cpes":["cpe:2.3:a:\\@ai-sdk\\/provider-utils:\\@ai-sdk\\/provider-utils:4.0.23:*:*:*:*:*:*:*","cpe:2.3:a:\\@ai-sdk\\/provider-utils:\\@ai_sdk\\/provider_utils:4.0.23:*:*:*:*:*:*:*","cpe:2.3:a:\\@ai_sdk\\/provider_utils:\\@ai-sdk\\/provider-utils:4.0.23:*:*:*:*:*:*:*","cpe:2.3:a:\\@ai_sdk\\/provider_utils:\\@ai_sdk\\/provider_utils:4.0.23:*:*:*:*:*:*:*","cpe:2.3:a:\\@ai-sdk\\/provider:\\@ai-sdk\\/provider-utils:4.0.23:*:*:*:*:*:*:*","cpe:2.3:a:\\@ai-sdk\\/provider:\\@ai_sdk\\/provider_utils:4.0.23:*:*:*:*:*:*:*","cpe:2.3:a:\\@ai_sdk\\/provider:\\@ai-sdk\\/provider-utils:4.0.23:*:*:*:*:*:*:*","cpe:2.3:a:\\@ai_sdk\\/provider:\\@ai_sdk\\/provider_utils:4.0.23:*:*:*:*:*:*:*","cpe:2.3:a:\\@ai:\\@ai-sdk\\/provider-utils:4.0.23:*:*:*:*:*:*:*","cpe:2.3:a:\\@ai:\\@ai_sdk\\/provider_utils:4.0.23:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40ai-sdk/provider-utils@4.0.23","upstreams":[]}},{"vulnerability":{"id":"GHSA-gh4c-6fx4-qh6g","dataSource":"https://github.com/advisories/GHSA-gh4c-6fx4-qh6g","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g","https://nvd.nist.gov/vuln/detail/CVE-2026-97688","https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f","https://github.com/urllib3/urllib3/releases/tag/2.8.0"],"description":"urllib3: Chunked Deflate streaming can enter an infinite loop","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-97688","epss":0.00292,"percentile":0.21778,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-97688","cwe":"CWE-835","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["2.8.0"],"state":"fixed","available":[{"version":"2.8.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.17373999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-97688","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97688","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f","https://github.com/urllib3/urllib3/releases/tag/2.8.0","https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g"],"description":"urllib3 is an HTTP client library for Python. From 2.6.2 until 2.8.0, HTTPResponse.stream and HTTPResponse.read_chunked can enter an infinite loop because the Deflate decoder retains trailing bytes as unconsumed input after reaching end-of-stream and repeatedly decodes them without progress. The issue occurs when an untrusted server sends a chunked Deflate response whose decoded body exceeds a positive finite chunk size and whose encoded body has trailing bytes, specifically a response with Transfer-Encoding: chunked and Content-Encoding: deflate, content decoding enabled, and the positive finite amt=N streaming chunk size. The attack mechanism is that a malicious server returns a compressed chunked response with trailing bytes after the Deflate stream. The impact is excessive CPU usage and a request that does not complete, and network read timeouts do not interrupt the loop because no further socket read occurs. This issue is fixed in version 2.8.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-97688","epss":0.00292,"percentile":0.21778,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-97688","cwe":"CWE-835","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"urllib3","version":"2.6.3"}},"found":{"vulnerabilityID":"GHSA-gh4c-6fx4-qh6g","versionConstraint":">=2.6.2,<2.8.0 (python)"},"fix":{"suggestedVersion":"2.8.0"}}],"artifact":{"id":"pkg:pypi/urllib3@2.6.3?package-id=0526caf26f90afee","name":"urllib3","version":"2.6.3","type":"python","locations":[{"path":"/backend/bdd/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python:urllib3:2.6.3:*:*:*:*:*:*:*"],"purl":"pkg:pypi/urllib3@2.6.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-g3hv-75wg-m249","dataSource":"https://github.com/advisories/GHSA-g3hv-75wg-m249","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249","https://nvd.nist.gov/vuln/detail/CVE-2026-118764","https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1"],"description":"minimatch has potential denial of service via globparts amplification","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["11.0.1"],"state":"fixed","available":[{"version":"11.0.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.173145},"relatedVulnerabilities":[{"id":"CVE-2026-118764","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118764","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1","https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"10.2.5"}},"found":{"vulnerabilityID":"GHSA-g3hv-75wg-m249","versionConstraint":"<11.0.1 (semantic)"},"fix":{"suggestedVersion":"11.0.1"}}],"artifact":{"id":"pkg:npm/minimatch@10.2.5?package-id=f715d4f687cba874","name":"minimatch","version":"10.2.5","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BlueOak-1.0.0"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:10.2.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@10.2.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-g3hv-75wg-m249","dataSource":"https://github.com/advisories/GHSA-g3hv-75wg-m249","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249","https://nvd.nist.gov/vuln/detail/CVE-2026-118764","https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1"],"description":"minimatch has potential denial of service via globparts amplification","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["11.0.1"],"state":"fixed","available":[{"version":"11.0.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.173145},"relatedVulnerabilities":[{"id":"CVE-2026-118764","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118764","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1","https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"10.2.6"}},"found":{"vulnerabilityID":"GHSA-g3hv-75wg-m249","versionConstraint":"<11.0.1 (semantic)"},"fix":{"suggestedVersion":"11.0.1"}}],"artifact":{"id":"pkg:npm/minimatch@10.2.6?package-id=3c3340815d3a55d9","name":"minimatch","version":"10.2.6","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BlueOak-1.0.0"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:10.2.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@10.2.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-g3hv-75wg-m249","dataSource":"https://github.com/advisories/GHSA-g3hv-75wg-m249","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249","https://nvd.nist.gov/vuln/detail/CVE-2026-118764","https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1"],"description":"minimatch has potential denial of service via globparts amplification","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["11.0.1"],"state":"fixed","available":[{"version":"11.0.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.173145},"relatedVulnerabilities":[{"id":"CVE-2026-118764","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118764","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1","https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"10.2.6"}},"found":{"vulnerabilityID":"GHSA-g3hv-75wg-m249","versionConstraint":"<11.0.1 (semantic)"},"fix":{"suggestedVersion":"11.0.1"}}],"artifact":{"id":"pkg:npm/minimatch@10.2.6?package-id=de012be7199c81df","name":"minimatch","version":"10.2.6","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BlueOak-1.0.0"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:10.2.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@10.2.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-g3hv-75wg-m249","dataSource":"https://github.com/advisories/GHSA-g3hv-75wg-m249","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249","https://nvd.nist.gov/vuln/detail/CVE-2026-118764","https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1"],"description":"minimatch has potential denial of service via globparts amplification","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["11.0.1"],"state":"fixed","available":[{"version":"11.0.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.173145},"relatedVulnerabilities":[{"id":"CVE-2026-118764","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118764","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1","https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.5"}},"found":{"vulnerabilityID":"GHSA-g3hv-75wg-m249","versionConstraint":"<11.0.1 (semantic)"},"fix":{"suggestedVersion":"11.0.1"}}],"artifact":{"id":"pkg:npm/minimatch@3.1.5?package-id=9514b69da6a9a890","name":"minimatch","version":"3.1.5","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-g3hv-75wg-m249","dataSource":"https://github.com/advisories/GHSA-g3hv-75wg-m249","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249","https://nvd.nist.gov/vuln/detail/CVE-2026-118764","https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1"],"description":"minimatch has potential denial of service via globparts amplification","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["11.0.1"],"state":"fixed","available":[{"version":"11.0.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.173145},"relatedVulnerabilities":[{"id":"CVE-2026-118764","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118764","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1","https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.5"}},"found":{"vulnerabilityID":"GHSA-g3hv-75wg-m249","versionConstraint":"<11.0.1 (semantic)"},"fix":{"suggestedVersion":"11.0.1"}}],"artifact":{"id":"pkg:npm/minimatch@3.1.5?package-id=d620d2946d8629bc","name":"minimatch","version":"3.1.5","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-g3hv-75wg-m249","dataSource":"https://github.com/advisories/GHSA-g3hv-75wg-m249","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249","https://nvd.nist.gov/vuln/detail/CVE-2026-118764","https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1"],"description":"minimatch has potential denial of service via globparts amplification","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["11.0.1"],"state":"fixed","available":[{"version":"11.0.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.173145},"relatedVulnerabilities":[{"id":"CVE-2026-118764","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118764","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1","https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.5"}},"found":{"vulnerabilityID":"GHSA-g3hv-75wg-m249","versionConstraint":"<11.0.1 (semantic)"},"fix":{"suggestedVersion":"11.0.1"}}],"artifact":{"id":"pkg:npm/minimatch@3.1.5?package-id=0dedab5575392ec3","name":"minimatch","version":"3.1.5","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-g3hv-75wg-m249","dataSource":"https://github.com/advisories/GHSA-g3hv-75wg-m249","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249","https://nvd.nist.gov/vuln/detail/CVE-2026-118764","https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1"],"description":"minimatch has potential denial of service via globparts amplification","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["11.0.1"],"state":"fixed","available":[{"version":"11.0.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.173145},"relatedVulnerabilities":[{"id":"CVE-2026-118764","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118764","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1","https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"9.0.9"}},"found":{"vulnerabilityID":"GHSA-g3hv-75wg-m249","versionConstraint":"<11.0.1 (semantic)"},"fix":{"suggestedVersion":"11.0.1"}}],"artifact":{"id":"pkg:npm/minimatch@9.0.9?package-id=07d85220de9974cd","name":"minimatch","version":"9.0.9","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:9.0.9:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@9.0.9","upstreams":[]}},{"vulnerability":{"id":"GHSA-g3hv-75wg-m249","dataSource":"https://github.com/advisories/GHSA-g3hv-75wg-m249","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249","https://nvd.nist.gov/vuln/detail/CVE-2026-118764","https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1"],"description":"minimatch has potential denial of service via globparts amplification","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["11.0.1"],"state":"fixed","available":[{"version":"11.0.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.173145},"relatedVulnerabilities":[{"id":"CVE-2026-118764","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118764","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1","https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"9.0.9"}},"found":{"vulnerabilityID":"GHSA-g3hv-75wg-m249","versionConstraint":"<11.0.1 (semantic)"},"fix":{"suggestedVersion":"11.0.1"}}],"artifact":{"id":"pkg:npm/minimatch@9.0.9?package-id=8f57dd6b1835e6d6","name":"minimatch","version":"9.0.9","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:9.0.9:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@9.0.9","upstreams":[]}},{"vulnerability":{"id":"GHSA-477h-4r7f-fvrx","dataSource":"https://github.com/advisories/GHSA-477h-4r7f-fvrx","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/browserify/pbkdf2/security/advisories/GHSA-477h-4r7f-fvrx","https://nvd.nist.gov/vuln/detail/CVE-2026-102414","https://github.com/browserify/pbkdf2/issues/82","https://github.com/browserify/pbkdf2/commit/493d8d8ff437f680338bf7397398fda884ad462e"],"description":"pbkdf2 rehashes long passwords on every iteration, enabling denial of service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102414","epss":0.00345,"percentile":0.28053,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102414","cwe":"CWE-400","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}],"fix":{"versions":["3.1.7"],"state":"fixed","available":[{"version":"3.1.7","date":"2026-10-06","kind":"first-observed"}]},"advisories":[],"risk":0.1725},"relatedVulnerabilities":[{"id":"CVE-2026-102414","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102414","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/browserify/pbkdf2/commit/493d8d8","https://github.com/browserify/pbkdf2/issues/82","https://github.com/browserify/pbkdf2/security/advisories/GHSA-477h-4r7f-fvrx"],"description":"pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback (lib/sync.js). A password longer than the block size (64 bytes, or 128 bytes for sha384 and sha512) is passed to HMAC as the key on every iteration, and HMAC hashes such keys in full each time. Cost is therefore O(iterations × password length), and a long password can block the event loop. The fallback is used by pbkdf2Sync and pbkdf2 on Node.js before 0.12, on Bun (1.0.0 through 1.1.34, and 1.2.6 and later), and on Deno 2.9.0 and later, because their native pbkdf2Sync fails the library's feature check. It is also used when lib/sync.js is imported directly. Node.js 0.12 and later, and browser builds (which use lib/sync-browser.js), are not affected. Applications that enforce a reasonable maximum password length are not meaningfully affected.","cvss":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102414","epss":0.00345,"percentile":0.28053,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102414","cwe":"CWE-400","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"pbkdf2","version":"3.1.5"}},"found":{"vulnerabilityID":"GHSA-477h-4r7f-fvrx","versionConstraint":"<=3.1.6 (semantic)"},"fix":{"suggestedVersion":"3.1.7"}}],"artifact":{"id":"pkg:npm/pbkdf2@3.1.5?package-id=e6f24b0c5d45b682","name":"pbkdf2","version":"3.1.5","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:pbkdf2:pbkdf2:3.1.5:*:*:*:*:*:*:*"],"purl":"pkg:npm/pbkdf2@3.1.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-h7mw-gpvr-xq4m","dataSource":"https://github.com/advisories/GHSA-h7mw-gpvr-xq4m","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/cure53/DOMPurify/security/advisories/GHSA-h7mw-gpvr-xq4m","https://github.com/cure53/DOMPurify/releases/tag/3.4.0","https://nvd.nist.gov/vuln/detail/CVE-2026-41240","https://github.com/cure53/DOMPurify/commit/c361baa18dbdcb3344a41110f4c48ad85bf48f80"],"description":"DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41240","epss":0.00313,"percentile":0.24222,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41240","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-41240","cwe":"CWE-183","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.4.0"],"state":"fixed","available":[{"version":"3.4.0","date":"2026-04-23","kind":"first-observed"}]},"advisories":[],"risk":0.17215000000000003},"relatedVulnerabilities":[{"id":"CVE-2026-41240","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41240","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/cure53/DOMPurify/commit/c361baa18dbdcb3344a41110f4c48ad85bf48f80","https://github.com/cure53/DOMPurify/releases/tag/3.4.0","https://github.com/cure53/DOMPurify/security/advisories/GHSA-h7mw-gpvr-xq4m"],"description":"DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions prior to 3.4.0 have an inconsistency between FORBID_TAGS and FORBID_ATTR handling when function-based ADD_TAGS is used. Commit c361baa added an early exit for FORBID_ATTR at line 1214. The same fix was not applied to FORBID_TAGS. At line 1118-1123, when EXTRA_ELEMENT_HANDLING.tagCheck returns true, the short-circuit evaluation skips the FORBID_TAGS check entirely. This allows forbidden elements to survive sanitization with their attributes intact. Version 3.4.0 patches the issue.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41240","epss":0.00313,"percentile":0.24222,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41240","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-41240","cwe":"CWE-183","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"dompurify","version":"3.3.3"}},"found":{"vulnerabilityID":"GHSA-h7mw-gpvr-xq4m","versionConstraint":"<3.4.0 (semantic)"},"fix":{"suggestedVersion":"3.4.0"}}],"artifact":{"id":"pkg:npm/dompurify@3.3.3?package-id=5ef50eed3845476c","name":"dompurify","version":"3.3.3","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MPL-2.0 OR Apache-2.0"],"cpes":["cpe:2.3:a:dompurify:dompurify:3.3.3:*:*:*:*:*:*:*"],"purl":"pkg:npm/dompurify@3.3.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-hvrm-45r6-mjfj","dataSource":"https://github.com/advisories/GHSA-hvrm-45r6-mjfj","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/honojs/hono/security/advisories/GHSA-hvrm-45r6-mjfj","https://nvd.nist.gov/vuln/detail/CVE-2026-59896","https://github.com/honojs/hono/commit/fab3b13639339cbd5ba1166a5b23d9ac30c5f64f","https://github.com/honojs/hono/releases/tag/v4.12.27"],"description":"hono/jsx does not isolate context per request, leading to cross-request data disclosure","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.3,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59896","epss":0.00299,"percentile":0.22611,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59896","cwe":"CWE-362","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.12.27"],"state":"fixed","available":[{"version":"4.12.27","date":"2026-07-22","kind":"first-observed"}]},"advisories":[],"risk":0.171925},"relatedVulnerabilities":[{"id":"CVE-2026-59896","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59896","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/honojs/hono/commit/fab3b13639339cbd5ba1166a5b23d9ac30c5f64f","https://github.com/honojs/hono/releases/tag/v4.12.27","https://github.com/honojs/hono/security/advisories/GHSA-hvrm-45r6-mjfj"],"description":"Hono is a Web application framework that provides support for any JavaScript runtime. From 4.11.8 before 4.12.27, hono/jsx did not isolate context values per request during server-side rendering, allowing createContext, useContext, jsxRenderer, or useRequestContext data from a different in-flight request to be used after an await in an async component. This issue is fixed in version 4.12.27.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.3,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59896","epss":0.00299,"percentile":0.22611,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59896","cwe":"CWE-362","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"hono","version":"4.12.16"}},"found":{"vulnerabilityID":"GHSA-hvrm-45r6-mjfj","versionConstraint":">=4.11.8,<4.12.27 (semantic)"},"fix":{"suggestedVersion":"4.12.27"}}],"artifact":{"id":"pkg:npm/hono@4.12.16?package-id=000f2baa1e593039","name":"hono","version":"4.12.16","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:hono:hono:4.12.16:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/hono@4.12.16","upstreams":[]}},{"vulnerability":{"id":"GHSA-9jrq-w75r-8gcw","dataSource":"https://github.com/advisories/GHSA-9jrq-w75r-8gcw","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/vitejs/vite/security/advisories/GHSA-9jrq-w75r-8gcw","https://nvd.nist.gov/vuln/detail/CVE-2026-112945","https://github.com/vitejs/vite/pull/23653","https://github.com/vitejs/vite/commit/7dafd8e56f152403a3230608fa4005273c2e9e17"],"description":"Vite: Cross origin script execution through Vite custom middleware","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":2.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112945","epss":0.00672,"percentile":0.52077,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112945","cwe":"CWE-80","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.3.7"],"state":"fixed","available":[{"version":"7.3.7","date":"2026-10-22","kind":"first-observed"}]},"advisories":[],"risk":0.17136},"relatedVulnerabilities":[{"id":"CVE-2026-112945","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112945","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/vitejs/vite/commit/7dafd8e56f152403a3230608fa4005273c2e9e17","https://github.com/vitejs/vite/pull/23653","https://github.com/vitejs/vite/security/advisories/GHSA-9jrq-w75r-8gcw"],"description":"Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, applications using custom middleware are vulnerable when they pass an unchanged browser request URL to server.transformIndexHtml. getHtmlFilename uses the query-bearing request URL to resolve an existing local file while preserving attacker-supplied leading slashes in the generated proxy module URL. If the transformed HTML contains an inline module script and a victim browser loads the crafted development-server page, the leading double slash makes the browser fetch and execute an attacker-controlled module in the Vite-served page. This execution can expose sensitive page data or permit critical actions available to the affected application. This issue is fixed in versions 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112945","epss":0.00672,"percentile":0.52077,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112945","cwe":"CWE-80","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"vite","version":"7.3.2"}},"found":{"vulnerabilityID":"GHSA-9jrq-w75r-8gcw","versionConstraint":">=7.0.0,<=7.3.6 (semantic)"},"fix":{"suggestedVersion":"7.3.7"}}],"artifact":{"id":"pkg:npm/vite@7.3.2?package-id=5c0ce5d7d525ae42","name":"vite","version":"7.3.2","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vitejs:vite:7.3.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/vite@7.3.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-9jrq-w75r-8gcw","dataSource":"https://github.com/advisories/GHSA-9jrq-w75r-8gcw","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/vitejs/vite/security/advisories/GHSA-9jrq-w75r-8gcw","https://nvd.nist.gov/vuln/detail/CVE-2026-112945","https://github.com/vitejs/vite/pull/23653","https://github.com/vitejs/vite/commit/7dafd8e56f152403a3230608fa4005273c2e9e17"],"description":"Vite: Cross origin script execution through Vite custom middleware","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":2.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112945","epss":0.00672,"percentile":0.52077,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112945","cwe":"CWE-80","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.3.7"],"state":"fixed","available":[{"version":"7.3.7","date":"2026-10-22","kind":"first-observed"}]},"advisories":[],"risk":0.17136},"relatedVulnerabilities":[{"id":"CVE-2026-112945","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112945","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/vitejs/vite/commit/7dafd8e56f152403a3230608fa4005273c2e9e17","https://github.com/vitejs/vite/pull/23653","https://github.com/vitejs/vite/security/advisories/GHSA-9jrq-w75r-8gcw"],"description":"Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, applications using custom middleware are vulnerable when they pass an unchanged browser request URL to server.transformIndexHtml. getHtmlFilename uses the query-bearing request URL to resolve an existing local file while preserving attacker-supplied leading slashes in the generated proxy module URL. If the transformed HTML contains an inline module script and a victim browser loads the crafted development-server page, the leading double slash makes the browser fetch and execute an attacker-controlled module in the Vite-served page. This execution can expose sensitive page data or permit critical actions available to the affected application. This issue is fixed in versions 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112945","epss":0.00672,"percentile":0.52077,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112945","cwe":"CWE-80","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"vite","version":"7.3.6"}},"found":{"vulnerabilityID":"GHSA-9jrq-w75r-8gcw","versionConstraint":">=7.0.0,<=7.3.6 (semantic)"},"fix":{"suggestedVersion":"7.3.7"}}],"artifact":{"id":"pkg:npm/vite@7.3.6?package-id=dcc7b510dec05363","name":"vite","version":"7.3.6","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vitejs:vite:7.3.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/vite@7.3.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-9jrq-w75r-8gcw","dataSource":"https://github.com/advisories/GHSA-9jrq-w75r-8gcw","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/vitejs/vite/security/advisories/GHSA-9jrq-w75r-8gcw","https://nvd.nist.gov/vuln/detail/CVE-2026-112945","https://github.com/vitejs/vite/pull/23653","https://github.com/vitejs/vite/commit/7dafd8e56f152403a3230608fa4005273c2e9e17"],"description":"Vite: Cross origin script execution through Vite custom middleware","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":2.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112945","epss":0.00672,"percentile":0.52077,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112945","cwe":"CWE-80","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["8.2.4"],"state":"fixed","available":[{"version":"8.2.4","date":"2026-10-22","kind":"first-observed"}]},"advisories":[],"risk":0.17136},"relatedVulnerabilities":[{"id":"CVE-2026-112945","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112945","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/vitejs/vite/commit/7dafd8e56f152403a3230608fa4005273c2e9e17","https://github.com/vitejs/vite/pull/23653","https://github.com/vitejs/vite/security/advisories/GHSA-9jrq-w75r-8gcw"],"description":"Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, applications using custom middleware are vulnerable when they pass an unchanged browser request URL to server.transformIndexHtml. getHtmlFilename uses the query-bearing request URL to resolve an existing local file while preserving attacker-supplied leading slashes in the generated proxy module URL. If the transformed HTML contains an inline module script and a victim browser loads the crafted development-server page, the leading double slash makes the browser fetch and execute an attacker-controlled module in the Vite-served page. This execution can expose sensitive page data or permit critical actions available to the affected application. This issue is fixed in versions 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112945","epss":0.00672,"percentile":0.52077,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112945","cwe":"CWE-80","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"vite","version":"8.2.2"}},"found":{"vulnerabilityID":"GHSA-9jrq-w75r-8gcw","versionConstraint":">=8.2.0,<=8.2.3 (semantic)"},"fix":{"suggestedVersion":"8.2.4"}}],"artifact":{"id":"pkg:npm/vite@8.2.2?package-id=ae073bacc7b8ee83","name":"vite","version":"8.2.2","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vitejs:vite:8.2.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/vite@8.2.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-6qxp-vccf-f47h","dataSource":"https://github.com/advisories/GHSA-6qxp-vccf-f47h","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-6qxp-vccf-f47h","https://github.com/modelcontextprotocol/typescript-sdk/pull/2887","https://github.com/modelcontextprotocol/typescript-sdk/commit/edd12e282620ebf770d67316f19cf91d4112a1bd","https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.2.0"],"description":"MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-104850","epss":0.00226,"percentile":0.13295,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-104850","cwe":"CWE-345","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-104850","cwe":"CWE-522","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["1.31.0"],"state":"fixed","available":[{"version":"1.31.0","date":"2026-10-06","kind":"first-observed"}]},"advisories":[],"risk":0.16949999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-104850","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-104850","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/modelcontextprotocol/typescript-sdk/commit/edd12e282620ebf770d67316f19cf91d4112a1bd","https://github.com/modelcontextprotocol/typescript-sdk/pull/2887","https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.2.0","https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-6qxp-vccf-f47h"],"description":"MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Starting in version 1.12.0 and prior to versions 1.31.0 and 2.2.0, the SDK's OAuth client support let the MCP server a client connected to decide which authorization server received the client's OAuth credentials. Stored and pre-provisioned credentials were not bound to the authorization server they belong to. A malicious or compromised MCP server could name its own authorization server in its protected resource metadata. Without any user interaction, the client would send that server the `refresh_token` and `client_secret` stored from an earlier sign-in (1.x), or the configured `client_secret` or signed assertion of a bundled non-interactive provider (1.x and 2.x). Only those applications that use the SDK as an MCP client over HTTP with an `authProvider`: your own `OAuthClientProvider`, or the bundled `ClientCredentialsProvider`, `PrivateKeyJwtProvider`, `StaticPrivateKeyJwtProvider` or (2.x) `CrossAppAccessProvider` and that may connect to an MCP server the owners does not fully trust while holding credentials for a legitimate authorization server are affected. `@modelcontextprotocol/sdk` 1.31.0 (1.x) and `@modelcontextprotocol/client` 2.2.0 (2.x) patch the issue. A workaround for those who cannot upgrade is available. 2.0.0 and 2.1.0 already accept `expectedIssuer`. On 1.x, the only workaround is to connect OAuth-enabled clients only to MCP servers you trust.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-104850","epss":0.00226,"percentile":0.13295,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-104850","cwe":"CWE-345","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-104850","cwe":"CWE-522","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@modelcontextprotocol/sdk","version":"1.29.0"}},"found":{"vulnerabilityID":"GHSA-6qxp-vccf-f47h","versionConstraint":">=1.12.0,<1.31.0 (semantic)"},"fix":{"suggestedVersion":"1.31.0"}}],"artifact":{"id":"pkg:npm/%40modelcontextprotocol/sdk@1.29.0?package-id=0c66cca13b59eb9b","name":"@modelcontextprotocol/sdk","version":"1.29.0","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:\\@modelcontextprotocol\\/sdk:\\@modelcontextprotocol\\/sdk:1.29.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40modelcontextprotocol/sdk@1.29.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-5c9x-8gcm-mpgx","dataSource":"https://github.com/advisories/GHSA-5c9x-8gcm-mpgx","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-5c9x-8gcm-mpgx","https://nvd.nist.gov/vuln/detail/CVE-2026-42034"],"description":"Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42034","epss":0.00327,"percentile":0.25853,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42034","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.15.1"],"state":"fixed","available":[{"version":"1.15.1","date":"2026-05-05","kind":"first-observed"}]},"advisories":[],"risk":0.168405},"relatedVulnerabilities":[{"id":"CVE-2026-42034","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42034","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-5c9x-8gcm-mpgx"],"description":"Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, for stream request bodies, maxBodyLength is bypassed when maxRedirects is set to 0 (native http/https transport path). Oversized streamed uploads are sent fully even when the caller sets strict body limits. This vulnerability is fixed in 1.15.1 and 0.31.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42034","epss":0.00327,"percentile":0.25853,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42034","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.15.0"}},"found":{"vulnerabilityID":"GHSA-5c9x-8gcm-mpgx","versionConstraint":">=1.0.0,<1.15.1 (semantic)"},"fix":{"suggestedVersion":"1.15.1"}}],"artifact":{"id":"pkg:npm/axios@1.15.0?package-id=520b8e92ffff8054","name":"axios","version":"1.15.0","type":"npm","locations":[{"path":"/sink/oidc-server/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.15.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.15.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-vf2m-468p-8v99","dataSource":"https://github.com/advisories/GHSA-vf2m-468p-8v99","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-vf2m-468p-8v99","https://nvd.nist.gov/vuln/detail/CVE-2026-42036"],"description":"Axios: HTTP adapter streamed responses bypass maxContentLength","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42036","epss":0.00327,"percentile":0.25853,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42036","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.15.1"],"state":"fixed","available":[{"version":"1.15.1","date":"2026-05-05","kind":"first-observed"}]},"advisories":[],"risk":0.168405},"relatedVulnerabilities":[{"id":"CVE-2026-42036","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42036","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-vf2m-468p-8v99"],"description":"Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when responseType: 'stream' is used, Axios returns the response stream without enforcing maxContentLength. This bypasses configured response-size limits and allows unbounded downstream consumption. This vulnerability is fixed in 1.15.1 and 0.31.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42036","epss":0.00327,"percentile":0.25853,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42036","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.15.0"}},"found":{"vulnerabilityID":"GHSA-vf2m-468p-8v99","versionConstraint":">=1.0.0,<1.15.1 (semantic)"},"fix":{"suggestedVersion":"1.15.1"}}],"artifact":{"id":"pkg:npm/axios@1.15.0?package-id=520b8e92ffff8054","name":"axios","version":"1.15.0","type":"npm","locations":[{"path":"/sink/oidc-server/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.15.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.15.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-px8p-9vwx-vf98","dataSource":"https://github.com/advisories/GHSA-px8p-9vwx-vf98","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-45820","https://github.com/101arrowz/fflate/blob/f7873560ad229c22c4b23b06c6a3806ffde77569/src/index.ts#L2714","https://github.com/101arrowz/fflate/commit/e6d5e6e1076892f72770ac732d83c81da9f3316e","https://github.com/101arrowz/fflate/releases/tag/v0.8.3"],"description":"fflate unzipSync can enter an infinite loop when parsing malformed ZIP64 archives","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","metrics":{"baseScore":6.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-45820","epss":0.00279,"percentile":0.20375,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-45820","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-45820","cwe":"CWE-835","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}],"fix":{"versions":["0.4.9"],"state":"fixed","available":[{"version":"0.4.9","date":"2026-09-03","kind":"first-observed"}]},"advisories":[],"risk":0.1680975},"relatedVulnerabilities":[{"id":"CVE-2026-45820","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45820","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/101arrowz/fflate/blob/f7873560ad229c22c4b23b06c6a3806ffde77569/src/index.ts#L2714","https://www.npmjs.com/package/fflate"],"description":"fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with a central directory entry declaring compressed_size=0xFFFFFFFF (ZIP64 sentinel) but missing the required ZIP64 extra field tag 0x0001 causes z64e() to loop indefinitely due to out-of-bounds reads returning undefined, which coerces to 0, keeping the loop condition permanently true.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","metrics":{"baseScore":6.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-45820","epss":0.00279,"percentile":0.20375,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-45820","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-45820","cwe":"CWE-835","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fflate","version":"0.4.8"}},"found":{"vulnerabilityID":"GHSA-px8p-9vwx-vf98","versionConstraint":">=0.4.5,<0.4.9 (semantic)"},"fix":{"suggestedVersion":"0.4.9"}}],"artifact":{"id":"pkg:npm/fflate@0.4.8?package-id=a779e5fac12fe90a","name":"fflate","version":"0.4.8","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:101arrowz:fflate:0.4.8:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fflate@0.4.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-39q2-94rc-95cp","dataSource":"https://github.com/advisories/GHSA-39q2-94rc-95cp","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/cure53/DOMPurify/security/advisories/GHSA-39q2-94rc-95cp"],"description":"DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":5.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-65903","epss":0.00325,"percentile":0.25571,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-65903","cwe":"CWE-697","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["3.4.0"],"state":"fixed","available":[{"version":"3.4.0","date":"2026-04-16","kind":"first-observed"}]},"advisories":[],"risk":0.167375},"relatedVulnerabilities":[{"id":"CVE-2026-65903","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-65903","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/cure53/DOMPurify/security/advisories/GHSA-39q2-94rc-95cp","https://www.vulncheck.com/advisories/dompurify-before-add-tags-function-bypasses-forbid-tags"],"description":"DOMPurify before 3.4.0 contains a logic error in the ADD_TAGS function where short-circuit evaluation allows forbidden tags to bypass FORBID_TAGS restrictions. Attackers can craft input containing tags listed in FORBID_TAGS that are also added via ADD_TAGS function, causing them to be retained in sanitized output.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.1},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-65903","epss":0.00325,"percentile":0.25571,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-65903","cwe":"CWE-697","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"dompurify","version":"3.3.3"}},"found":{"vulnerabilityID":"GHSA-39q2-94rc-95cp","versionConstraint":"<=3.3.3 (semantic)"},"fix":{"suggestedVersion":"3.4.0"}}],"artifact":{"id":"pkg:npm/dompurify@3.3.3?package-id=5ef50eed3845476c","name":"dompurify","version":"3.3.3","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MPL-2.0 OR Apache-2.0"],"cpes":["cpe:2.3:a:dompurify:dompurify:3.3.3:*:*:*:*:*:*:*"],"purl":"pkg:npm/dompurify@3.3.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-f65p-4m7j-42xc","dataSource":"https://github.com/advisories/GHSA-f65p-4m7j-42xc","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-f65p-4m7j-42xc","https://nvd.nist.gov/vuln/detail/CVE-2026-75975","https://github.com/fastify/fast-uri/commit/3728465caacef4b16bc84b7d14760f1c8fe41595","https://github.com/fastify/fast-uri/commit/607bfbe953f28a14c2e06ae64aff38c81ca2937f","https://github.com/fastify/fast-uri/commit/9161eded1ff55fad9d9714c6ad6c0f0283547799","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v2.4.5","https://github.com/fastify/fast-uri/releases/tag/v3.1.6","https://github.com/fastify/fast-uri/releases/tag/v4.1.3"],"description":"fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-75975","epss":0.0022,"percentile":0.12579,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-75975","cwe":"CWE-20","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-75975","cwe":"CWE-918","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["3.1.6"],"state":"fixed","available":[{"version":"3.1.6","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.165},"relatedVulnerabilities":[{"id":"CVE-2026-75975","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75975","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-f65p-4m7j-42xc"],"description":"fast-uri is a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not validate the complete IPv6 grammar, so invalid trailing text in an authority can be silently discarded and a malformed attacker-controlled host is turned into a different valid IPv6 destination. For example, a bracketed literal with invalid trailing characters is normalized to the unspecified address, which a Node HTTP client then connects to a local service over loopback, and other malformed literals collapse to private-range addresses. No error is set on the parsed result, so an application checking the error field cannot detect the rewrite. An application that normalizes untrusted URLs before outbound requests, redirects, proxy routing, or address-policy enforcement can be redirected to a local or private IPv6 target, giving a server-side request forgery and address-policy bypass primitive. The affected versions are 2.3.1 up to but not including 2.4.5, 3.0.0 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which validate bracketed IP literals against the full grammar and mark malformed literals as authority errors. Users should upgrade to a patched version.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-75975","epss":0.0022,"percentile":0.12579,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-75975","cwe":"CWE-20","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-75975","cwe":"CWE-918","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"3.1.0"}},"found":{"vulnerabilityID":"GHSA-f65p-4m7j-42xc","versionConstraint":">=3.0.0,<3.1.6 (semantic)"},"fix":{"suggestedVersion":"3.1.6"}}],"artifact":{"id":"pkg:npm/fast-uri@3.1.0?package-id=a87bf2e2258cda95","name":"fast-uri","version":"3.1.0","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:openjsf:fast-uri:3.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@3.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-qxg6-89mg-rqv8","dataSource":"https://github.com/advisories/GHSA-qxg6-89mg-rqv8","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/vitest-dev/vitest/security/advisories/GHSA-qxg6-89mg-rqv8","https://nvd.nist.gov/vuln/detail/CVE-2026-112949","https://github.com/vitest-dev/vitest/commit/15cc006aa9f8683dc5f7e895d011fa7dc751ce35","https://github.com/vitest-dev/vitest/commit/b825313243dc55757e8d7c0f9e7a792135e13473","https://github.com/vitest-dev/vitest/releases/tag/v4.1.12","https://github.com/vitest-dev/vitest/releases/tag/v5.0.3"],"description":"Vitest: Code injection via unauthenticated manual mock registration","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":1.7,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112949","epss":0.00336,"percentile":0.27047,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112949","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-112949","cwe":"CWE-116","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-112949","cwe":"CWE-306","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.1.12"],"state":"fixed","available":[{"version":"4.1.12","date":"2026-10-22","kind":"first-observed"}]},"advisories":[],"risk":0.16296},"relatedVulnerabilities":[{"id":"CVE-2026-112949","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112949","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/vitest-dev/vitest/commit/15cc006aa9f8683dc5f7e895d011fa7dc751ce35","https://github.com/vitest-dev/vitest/commit/b825313243dc55757e8d7c0f9e7a792135e13473","https://github.com/vitest-dev/vitest/releases/tag/v4.1.12","https://github.com/vitest-dev/vitest/releases/tag/v5.0.3","https://github.com/vitest-dev/vitest/security/advisories/GHSA-qxg6-89mg-rqv8"],"description":"Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 2.1.0-beta.7 until 4.1.12 and 5.0.3, an unauthenticated non-browser WebSocket client that can reach a development server using interceptorPlugin can register a manual mock whose attacker-controlled url createManualModuleSource inserts unescaped into generated module source. When the developer browser loads the affected module, attacker-controlled JavaScript executes on the development-server origin. This issue is fixed in versions 4.1.12 and 5.0.3.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":1.7,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112949","epss":0.00336,"percentile":0.27047,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112949","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-112949","cwe":"CWE-116","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-112949","cwe":"CWE-306","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@vitest/mocker","version":"3.2.4"}},"found":{"vulnerabilityID":"GHSA-qxg6-89mg-rqv8","versionConstraint":">=2.1.0-beta.7,<4.1.12 (semantic)"},"fix":{"suggestedVersion":"4.1.12"}}],"artifact":{"id":"pkg:npm/%40vitest/mocker@3.2.4?package-id=6912e5a1f712edf6","name":"@vitest/mocker","version":"3.2.4","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:\\@vitest\\/mocker:\\@vitest\\/mocker:3.2.4:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40vitest/mocker@3.2.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-qxg6-89mg-rqv8","dataSource":"https://github.com/advisories/GHSA-qxg6-89mg-rqv8","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/vitest-dev/vitest/security/advisories/GHSA-qxg6-89mg-rqv8","https://nvd.nist.gov/vuln/detail/CVE-2026-112949","https://github.com/vitest-dev/vitest/commit/15cc006aa9f8683dc5f7e895d011fa7dc751ce35","https://github.com/vitest-dev/vitest/commit/b825313243dc55757e8d7c0f9e7a792135e13473","https://github.com/vitest-dev/vitest/releases/tag/v4.1.12","https://github.com/vitest-dev/vitest/releases/tag/v5.0.3"],"description":"Vitest: Code injection via unauthenticated manual mock registration","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":1.7,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112949","epss":0.00336,"percentile":0.27047,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112949","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-112949","cwe":"CWE-116","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-112949","cwe":"CWE-306","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.1.12"],"state":"fixed","available":[{"version":"4.1.12","date":"2026-10-22","kind":"first-observed"}]},"advisories":[],"risk":0.16296},"relatedVulnerabilities":[{"id":"CVE-2026-112949","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112949","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/vitest-dev/vitest/commit/15cc006aa9f8683dc5f7e895d011fa7dc751ce35","https://github.com/vitest-dev/vitest/commit/b825313243dc55757e8d7c0f9e7a792135e13473","https://github.com/vitest-dev/vitest/releases/tag/v4.1.12","https://github.com/vitest-dev/vitest/releases/tag/v5.0.3","https://github.com/vitest-dev/vitest/security/advisories/GHSA-qxg6-89mg-rqv8"],"description":"Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 2.1.0-beta.7 until 4.1.12 and 5.0.3, an unauthenticated non-browser WebSocket client that can reach a development server using interceptorPlugin can register a manual mock whose attacker-controlled url createManualModuleSource inserts unescaped into generated module source. When the developer browser loads the affected module, attacker-controlled JavaScript executes on the development-server origin. This issue is fixed in versions 4.1.12 and 5.0.3.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":1.7,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112949","epss":0.00336,"percentile":0.27047,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112949","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-112949","cwe":"CWE-116","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-112949","cwe":"CWE-306","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@vitest/mocker","version":"3.2.7"}},"found":{"vulnerabilityID":"GHSA-qxg6-89mg-rqv8","versionConstraint":">=2.1.0-beta.7,<4.1.12 (semantic)"},"fix":{"suggestedVersion":"4.1.12"}}],"artifact":{"id":"pkg:npm/%40vitest/mocker@3.2.7?package-id=23876eef3f02174f","name":"@vitest/mocker","version":"3.2.7","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:\\@vitest\\/mocker:\\@vitest\\/mocker:3.2.7:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40vitest/mocker@3.2.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-qxg6-89mg-rqv8","dataSource":"https://github.com/advisories/GHSA-qxg6-89mg-rqv8","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/vitest-dev/vitest/security/advisories/GHSA-qxg6-89mg-rqv8","https://nvd.nist.gov/vuln/detail/CVE-2026-112949","https://github.com/vitest-dev/vitest/commit/15cc006aa9f8683dc5f7e895d011fa7dc751ce35","https://github.com/vitest-dev/vitest/commit/b825313243dc55757e8d7c0f9e7a792135e13473","https://github.com/vitest-dev/vitest/releases/tag/v4.1.12","https://github.com/vitest-dev/vitest/releases/tag/v5.0.3"],"description":"Vitest: Code injection via unauthenticated manual mock registration","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":1.7,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112949","epss":0.00336,"percentile":0.27047,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112949","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-112949","cwe":"CWE-116","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-112949","cwe":"CWE-306","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.1.12"],"state":"fixed","available":[{"version":"4.1.12","date":"2026-10-22","kind":"first-observed"}]},"advisories":[],"risk":0.16296},"relatedVulnerabilities":[{"id":"CVE-2026-112949","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112949","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/vitest-dev/vitest/commit/15cc006aa9f8683dc5f7e895d011fa7dc751ce35","https://github.com/vitest-dev/vitest/commit/b825313243dc55757e8d7c0f9e7a792135e13473","https://github.com/vitest-dev/vitest/releases/tag/v4.1.12","https://github.com/vitest-dev/vitest/releases/tag/v5.0.3","https://github.com/vitest-dev/vitest/security/advisories/GHSA-qxg6-89mg-rqv8"],"description":"Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 2.1.0-beta.7 until 4.1.12 and 5.0.3, an unauthenticated non-browser WebSocket client that can reach a development server using interceptorPlugin can register a manual mock whose attacker-controlled url createManualModuleSource inserts unescaped into generated module source. When the developer browser loads the affected module, attacker-controlled JavaScript executes on the development-server origin. This issue is fixed in versions 4.1.12 and 5.0.3.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":1.7,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112949","epss":0.00336,"percentile":0.27047,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112949","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-112949","cwe":"CWE-116","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-112949","cwe":"CWE-306","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@vitest/mocker","version":"4.1.11"}},"found":{"vulnerabilityID":"GHSA-qxg6-89mg-rqv8","versionConstraint":">=2.1.0-beta.7,<4.1.12 (semantic)"},"fix":{"suggestedVersion":"4.1.12"}}],"artifact":{"id":"pkg:npm/%40vitest/mocker@4.1.11?package-id=0432182f39ed4750","name":"@vitest/mocker","version":"4.1.11","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:\\@vitest\\/mocker:\\@vitest\\/mocker:4.1.11:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40vitest/mocker@4.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-898c-q2cr-xwhg","dataSource":"https://github.com/advisories/GHSA-898c-q2cr-xwhg","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-898c-q2cr-xwhg","https://nvd.nist.gov/vuln/detail/CVE-2018-16487","https://nvd.nist.gov/vuln/detail/CVE-2026-44490"],"description":"axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44490","epss":0.00332,"percentile":0.26477,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44490","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.16.0"],"state":"fixed","available":[{"version":"1.16.0","date":"2026-05-29","kind":"first-observed"}]},"advisories":[],"risk":0.16268000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-44490","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44490","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-898c-q2cr-xwhg"],"description":"Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, axios exposes two read-side prototype-pollution gadgets. When Object.prototype is polluted by an upstream dependency in the same process (e.g. lodash _.merge / CVE-2018-16487), axios silently picks up the polluted values. (1) lib/utils.js line 406 builds merge()'s accumulator as result = {}, so result[targetKey] (line 414) walks Object.prototype and the polluted bucket's own keys are copied into the merged headers and ride out on the wire. (2) lib/core/mergeConfig.js line 26 builds the hasOwnProperty descriptor as a plain-object literal. Object.defineProperty reads descriptor.get/descriptor.set via the prototype chain, so a polluted Object.prototype.get or Object.prototype.set makes the call throw TypeError synchronously on every axios request. This vulnerability is fixed in 0.32.0 and 1.16.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"exploitabilityScore":3.9,"impactScore":4.3},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44490","epss":0.00332,"percentile":0.26477,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44490","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.15.0"}},"found":{"vulnerabilityID":"GHSA-898c-q2cr-xwhg","versionConstraint":">=1.0.0,<1.16.0 (semantic)"},"fix":{"suggestedVersion":"1.16.0"}}],"artifact":{"id":"pkg:npm/axios@1.15.0?package-id=520b8e92ffff8054","name":"axios","version":"1.15.0","type":"npm","locations":[{"path":"/sink/oidc-server/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.15.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.15.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-v9jr-rg53-9pgp","dataSource":"https://github.com/advisories/GHSA-v9jr-rg53-9pgp","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/cure53/DOMPurify/security/advisories/GHSA-v9jr-rg53-9pgp","https://github.com/cure53/DOMPurify/releases/tag/3.4.0","https://nvd.nist.gov/vuln/detail/CVE-2026-41238"],"description":"DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N","metrics":{"baseScore":6.9,"exploitabilityScore":1.7,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41238","epss":0.0027,"percentile":0.19204,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41238","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-41238","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.4.0"],"state":"fixed","available":[{"version":"3.4.0","date":"2026-04-23","kind":"first-observed"}]},"advisories":[],"risk":0.16065000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-41238","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41238","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/cure53/DOMPurify/releases/tag/3.4.0","https://github.com/cure53/DOMPurify/security/advisories/GHSA-v9jr-rg53-9pgp"],"description":"DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions 3.0.1 through 3.3.3 are vulnerable to a prototype pollution-based XSS bypass. When an application uses `DOMPurify.sanitize()` with the default configuration (no `CUSTOM_ELEMENT_HANDLING` option), a prior prototype pollution gadget can inject permissive `tagNameCheck` and `attributeNameCheck` regex values into `Object.prototype`, causing DOMPurify to allow arbitrary custom elements with arbitrary attributes — including event handlers — through sanitization. Version 3.4.0 fixes the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N","metrics":{"baseScore":6.9,"exploitabilityScore":1.7,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41238","epss":0.0027,"percentile":0.19204,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41238","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-41238","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"dompurify","version":"3.3.3"}},"found":{"vulnerabilityID":"GHSA-v9jr-rg53-9pgp","versionConstraint":">=3.0.1,<3.4.0 (semantic)"},"fix":{"suggestedVersion":"3.4.0"}}],"artifact":{"id":"pkg:npm/dompurify@3.3.3?package-id=5ef50eed3845476c","name":"dompurify","version":"3.3.3","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MPL-2.0 OR Apache-2.0"],"cpes":["cpe:2.3:a:dompurify:dompurify:3.3.3:*:*:*:*:*:*:*"],"purl":"pkg:npm/dompurify@3.3.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-j6c9-x7qj-28xf","dataSource":"https://github.com/advisories/GHSA-j6c9-x7qj-28xf","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/honojs/hono/security/advisories/GHSA-j6c9-x7qj-28xf","https://nvd.nist.gov/vuln/detail/CVE-2026-54287"],"description":"hono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and Lattice","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-54287","epss":0.0031,"percentile":0.23922,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-54287","cwe":"CWE-116","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.12.25"],"state":"fixed","available":[{"version":"4.12.25","date":"2026-06-16","kind":"first-observed"}]},"advisories":[],"risk":0.15965000000000001},"relatedVulnerabilities":[{"id":"CVE-2026-54287","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54287","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/honojs/hono/security/advisories/GHSA-j6c9-x7qj-28xf"],"description":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on AWS Lambda, the ALB single-header response and the VPC Lattice v2 response join multiple Set-Cookie headers into one comma-separated value. Because commas also appear inside cookie attributes (for example Expires dates), clients cannot split the value back into individual cookies and silently drop or misparse them. This vulnerability is fixed in 4.12.25.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-54287","epss":0.0031,"percentile":0.23922,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-54287","cwe":"CWE-116","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"hono","version":"4.12.16"}},"found":{"vulnerabilityID":"GHSA-j6c9-x7qj-28xf","versionConstraint":"<4.12.25 (semantic)"},"fix":{"suggestedVersion":"4.12.25"}}],"artifact":{"id":"pkg:npm/hono@4.12.16?package-id=000f2baa1e593039","name":"hono","version":"4.12.16","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:hono:hono:4.12.16:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/hono@4.12.16","upstreams":[]}},{"vulnerability":{"id":"GHSA-5r4p-p66f-jhc7","dataSource":"https://github.com/advisories/GHSA-5r4p-p66f-jhc7","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/honojs/hono/security/advisories/GHSA-5r4p-p66f-jhc7","https://nvd.nist.gov/vuln/detail/CVE-2026-111757","https://github.com/honojs/hono/commit/8b05c774ef1555c70f5ba5e2991b7e77cc3635cc","https://github.com/honojs/hono/releases/tag/v4.13.11"],"description":"Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111757","epss":0.0031,"percentile":0.23888,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111757","cwe":"CWE-174","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.13.11"],"state":"fixed","available":[{"version":"4.13.11","date":"2026-10-20","kind":"first-observed"}]},"advisories":[],"risk":0.15965000000000001},"relatedVulnerabilities":[{"id":"CVE-2026-111757","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111757","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/honojs/hono/commit/8b05c774ef1555c70f5ba5e2991b7e77cc3635cc","https://github.com/honojs/hono/security/advisories/GHSA-5r4p-p66f-jhc7"],"description":"Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.4 until 4.13.11, serveStatic can interpret a malformed percent-encoded path differently from upstream routing middleware and bypass protection for a static prefix. The root cause is serveStatic decodes a routed request path a second time before filesystem lookup. The attack mechanism is malformed percent encoding survives the first routing interpretation and becomes a protected path only during the later static-file decode. The affected component is serveStatic. The trigger conditions are an application protects a static prefix with upstream middleware and serveStatic receives an attacker-controlled malformed percent-encoded path. The impact is unauthorized disclosure of a static file that upstream middleware was intended to protect. The issue does not permit traversal outside the configured static root. This issue is fixed in version 4.13.11.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111757","epss":0.0031,"percentile":0.23888,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111757","cwe":"CWE-174","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"hono","version":"4.12.16"}},"found":{"vulnerabilityID":"GHSA-5r4p-p66f-jhc7","versionConstraint":">=4.12.4,<4.13.11 (semantic)"},"fix":{"suggestedVersion":"4.13.11"}}],"artifact":{"id":"pkg:npm/hono@4.12.16?package-id=000f2baa1e593039","name":"hono","version":"4.12.16","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:hono:hono:4.12.16:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/hono@4.12.16","upstreams":[]}},{"vulnerability":{"id":"GHSA-8988-9cw3-xx77","dataSource":"https://github.com/advisories/GHSA-8988-9cw3-xx77","namespace":"github:language:python","severity":"High","urls":["https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77","https://nvd.nist.gov/vuln/detail/CVE-2026-97687","https://github.com/urllib3/urllib3/pull/5093","https://github.com/urllib3/urllib3/commit/07408cec79d1856d81bb42c74a904a24fdb9e465","https://github.com/urllib3/urllib3/commit/b6447295fff7b38fdffc67e0df9712d60cef3cc3","https://github.com/urllib3/urllib3/releases/tag/2.8.0"],"description":"urllib3: HTTPS proxy TLS configuration may be ignored or overridden","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":7.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-97687","epss":0.00206,"percentile":0.10662,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-97687","cwe":"CWE-295","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-97687","cwe":"CWE-440","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.8.0"],"state":"fixed","available":[{"version":"2.8.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.15553},"relatedVulnerabilities":[{"id":"CVE-2026-97687","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97687","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/urllib3/urllib3/commit/07408cec79d1856d81bb42c74a904a24fdb9e465","https://github.com/urllib3/urllib3/commit/b6447295fff7b38fdffc67e0df9712d60cef3cc3","https://github.com/urllib3/urllib3/pull/5093","https://github.com/urllib3/urllib3/releases/tag/2.8.0","https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77"],"description":"urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mode, use_forwarding_for_https=True, and CERT_NONE configuration paths fail to remain separated because target-server TLS settings are incorrectly applied to the HTTPS proxy connection. The trigger is that an application uses an HTTPS proxy and configures target-server TLS settings that must remain separate from the proxy TLS handshake, including HTTPS forwarding with target-specific identity or credentials. Applying cert_reqs=CERT_NONE can overwrite proxy_ssl_context.verify_mode in place, and the mutation persists so later connections reusing the same context may connect to the HTTPS proxy without certificate verification. The attack mechanism is that an attacker intercepts and impersonates the HTTPS proxy after the effective proxy policy accepts the attacker's certificate. The impact is that the attacker can observe or modify forwarded traffic or receive a target TLS client certificate, while CONNECT tunneling still preserves the separate end-to-end target TLS connection. This issue is fixed in version 2.8.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"exploitabilityScore":2.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-97687","epss":0.00206,"percentile":0.10662,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-97687","cwe":"CWE-295","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-97687","cwe":"CWE-440","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"urllib3","version":"2.6.3"}},"found":{"vulnerabilityID":"GHSA-8988-9cw3-xx77","versionConstraint":">=1.26.0,<2.8.0 (python)"},"fix":{"suggestedVersion":"2.8.0"}}],"artifact":{"id":"pkg:pypi/urllib3@2.6.3?package-id=0526caf26f90afee","name":"urllib3","version":"2.6.3","type":"python","locations":[{"path":"/backend/bdd/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python:urllib3:2.6.3:*:*:*:*:*:*:*"],"purl":"pkg:pypi/urllib3@2.6.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-wfc6-r584-vfw7","dataSource":"https://github.com/advisories/GHSA-wfc6-r584-vfw7","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/vercel/next.js/security/advisories/GHSA-wfc6-r584-vfw7","https://github.com/vercel/next.js/releases/tag/v15.5.16","https://github.com/vercel/next.js/releases/tag/v16.2.5","https://nvd.nist.gov/vuln/detail/CVE-2026-44576"],"description":"Next.js vulnerable to cache poisoning in React Server Component responses","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L","metrics":{"baseScore":5.4,"exploitabilityScore":2.3,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44576","epss":0.00295,"percentile":0.22132,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44576","cwe":"CWE-436","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["16.2.5"],"state":"fixed","available":[{"version":"16.2.5","date":"2026-05-11","kind":"first-observed"}]},"advisories":[],"risk":0.1534},"relatedVulnerabilities":[{"id":"CVE-2026-44576","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44576","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/vercel/next.js/security/advisories/GHSA-wfc6-r584-vfw7"],"description":"Next.js is a React framework for building full-stack web applications. From 14.2.0 to before 15.5.16 and 16.2.5, applications using React Server Components can be vulnerable to cache poisoning when shared caches do not correctly partition response variants. Under affected conditions, an attacker can cause an RSC response to be served from the original URL and poison shared cache entries so later visitors receive component payloads instead of the expected HTML. This vulnerability is fixed in 15.5.16 and 16.2.5.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L","metrics":{"baseScore":5.4,"exploitabilityScore":2.3,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44576","epss":0.00295,"percentile":0.22132,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44576","cwe":"CWE-436","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"next","version":"16.1.7"}},"found":{"vulnerabilityID":"GHSA-wfc6-r584-vfw7","versionConstraint":">=16.0.0,<16.2.5 (semantic)"},"fix":{"suggestedVersion":"16.2.5"}}],"artifact":{"id":"pkg:npm/next@16.1.7?package-id=662de087d22e519d","name":"next","version":"16.1.7","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vercel:next.js:16.1.7:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/next@16.1.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-445q-vr5w-6q77","dataSource":"https://github.com/advisories/GHSA-445q-vr5w-6q77","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-445q-vr5w-6q77","https://nvd.nist.gov/vuln/detail/CVE-2026-42037"],"description":"Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42037","epss":0.00294,"percentile":0.22116,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42037","cwe":"CWE-93","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.15.1"],"state":"fixed","available":[{"version":"1.15.1","date":"2026-05-05","kind":"first-observed"}]},"advisories":[],"risk":0.15141},"relatedVulnerabilities":[{"id":"CVE-2026-42037","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42037","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-445q-vr5w-6q77"],"description":"Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.1, the FormDataPart constructor in lib/helpers/formDataToStream.js interpolates value.type directly into the Content-Type header of each multipart part without sanitizing CRLF (\\r\\n) sequences. An attacker who controls the .type property of a Blob/File-like object (e.g., via a user-uploaded file in a Node.js proxy service) can inject arbitrary MIME part headers into the multipart form-data body. This bypasses Node.js v18+ built-in header protections because the injection targets the multipart body structure, not HTTP request headers. This vulnerability is fixed in 1.15.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42037","epss":0.00294,"percentile":0.22116,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42037","cwe":"CWE-93","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.15.0"}},"found":{"vulnerabilityID":"GHSA-445q-vr5w-6q77","versionConstraint":">=1.0.0,<1.15.1 (semantic)"},"fix":{"suggestedVersion":"1.15.1"}}],"artifact":{"id":"pkg:npm/axios@1.15.0?package-id=520b8e92ffff8054","name":"axios","version":"1.15.0","type":"npm","locations":[{"path":"/sink/oidc-server/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.15.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.15.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-crv5-9vww-q3g8","dataSource":"https://github.com/advisories/GHSA-crv5-9vww-q3g8","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/cure53/DOMPurify/security/advisories/GHSA-crv5-9vww-q3g8","https://github.com/cure53/DOMPurify/releases/tag/3.4.0","https://nvd.nist.gov/vuln/detail/CVE-2026-41239"],"description":"DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"exploitabilityScore":1.7,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41239","epss":0.00248,"percentile":0.16186,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41239","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-41239","cwe":"CWE-1289","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.4.0"],"state":"fixed","available":[{"version":"3.4.0","date":"2026-04-23","kind":"first-observed"}]},"advisories":[],"risk":0.14632},"relatedVulnerabilities":[{"id":"CVE-2026-41239","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41239","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/cure53/DOMPurify/releases/tag/3.4.0","https://github.com/cure53/DOMPurify/security/advisories/GHSA-crv5-9vww-q3g8"],"description":"DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Starting in version 1.0.10 and prior to version 3.4.0, `SAFE_FOR_TEMPLATES` strips `{{...}}` expressions from untrusted HTML. This works in string mode but not with `RETURN_DOM` or `RETURN_DOM_FRAGMENT`, allowing XSS via template-evaluating frameworks like Vue 2. Version 3.4.0 patches the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"exploitabilityScore":1.7,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41239","epss":0.00248,"percentile":0.16186,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41239","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-41239","cwe":"CWE-1289","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"dompurify","version":"3.3.3"}},"found":{"vulnerabilityID":"GHSA-crv5-9vww-q3g8","versionConstraint":">=1.0.10,<3.4.0 (semantic)"},"fix":{"suggestedVersion":"3.4.0"}}],"artifact":{"id":"pkg:npm/dompurify@3.3.3?package-id=5ef50eed3845476c","name":"dompurify","version":"3.3.3","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MPL-2.0 OR Apache-2.0"],"cpes":["cpe:2.3:a:dompurify:dompurify:3.3.3:*:*:*:*:*:*:*"],"purl":"pkg:npm/dompurify@3.3.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-mf9w-mj56-hr94","dataSource":"https://github.com/advisories/GHSA-mf9w-mj56-hr94","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/theskumar/python-dotenv/security/advisories/GHSA-mf9w-mj56-hr94","https://nvd.nist.gov/vuln/detail/CVE-2026-28684","https://github.com/theskumar/python-dotenv/commit/790c5c02991100aa1bf41ee5330aca75edc51311","https://github.com/theskumar/python-dotenv/commit/790c5c02991100aa1bf41ee5330aca75edc51311.patch","https://github.com/theskumar/python-dotenv/releases/tag/v1.2.2"],"description":"python-dotenv: Symlink following in set_key allows arbitrary file overwrite via cross-device rename fallback","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":6.6,"exploitabilityScore":1.4,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-28684","epss":0.00252,"percentile":0.16774,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-28684","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-28684","cwe":"CWE-61","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.2.2"],"state":"fixed","available":[{"version":"1.2.2","date":"2026-04-21","kind":"first-observed"}]},"advisories":[],"risk":0.14615999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-28684","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28684","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/theskumar/python-dotenv/commit/790c5c02991100aa1bf41ee5330aca75edc51311","https://github.com/theskumar/python-dotenv/releases/tag/v1.2.2","https://github.com/theskumar/python-dotenv/security/advisories/GHSA-mf9w-mj56-hr94"],"description":"python-dotenv reads key-value pairs from a .env file and can set them as environment variables. Prior to version 1.2.2, `set_key()` and `unset_key()` in python-dotenv follow symbolic links when rewriting `.env` files, allowing a local attacker to overwrite arbitrary files via a crafted symlink when a cross-device rename fallback is triggered. Users should upgrade to v.1.2.2 or, as a workaround, apply the patch manually.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":6.6,"exploitabilityScore":1.4,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-28684","epss":0.00252,"percentile":0.16774,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-28684","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-28684","cwe":"CWE-61","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"python-dotenv","version":"1.2.1"}},"found":{"vulnerabilityID":"GHSA-mf9w-mj56-hr94","versionConstraint":"<1.2.2 (python)"},"fix":{"suggestedVersion":"1.2.2"}}],"artifact":{"id":"pkg:pypi/python-dotenv@1.2.1?package-id=d7638903b1c68203","name":"python-dotenv","version":"1.2.1","type":"python","locations":[{"path":"/backend/bdd/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:saurabh-kumar:python-dotenv:1.2.1:*:*:*:*:python:*:*"],"purl":"pkg:pypi/python-dotenv@1.2.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-w2qp-rph6-63g4","dataSource":"https://github.com/advisories/GHSA-w2qp-rph6-63g4","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/fastify/fastify/security/advisories/GHSA-w2qp-rph6-63g4","https://nvd.nist.gov/vuln/detail/CVE-2026-18504","https://github.com/fastify/fastify/commit/1ef8a60c87e94f42f666aa15ad68957772a83655","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fastify/releases/tag/v5.12.1"],"description":"fastify vulnerable to schema validation bypass via root primitive coercion mismatch","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"exploitabilityScore":2.9,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-18504","epss":0.0028,"percentile":0.20544,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-18504","cwe":"CWE-20","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["5.12.1"],"state":"fixed","available":[{"version":"5.12.1","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.1456},"relatedVulnerabilities":[{"id":"CVE-2026-18504","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18504","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fastify/security/advisories/GHSA-w2qp-rph6-63g4"],"description":"fastify is a fast and low overhead web framework for Node.js. Versions of fastify before 5.12.1 are affected by a schema validation bypass when a request body schema targets a root primitive value. When the schema validates a top-level primitive such as an integer, Ajv can coerce a JSON string into the expected type during validation, but Fastify does not replace the root request body with the coerced value, so the route handler receives the original unvalidated string. As a result, a request that should have failed validation can reach application logic with a value that does not satisfy the schema, which can undermine integrity and access-control checks that rely on the validated type. Users should upgrade to fastify 5.12.1, which fixes the mismatch. No known workarounds are available.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"exploitabilityScore":2.9,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-18504","epss":0.0028,"percentile":0.20544,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-18504","cwe":"CWE-20","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fastify","version":"5.8.5"}},"found":{"vulnerabilityID":"GHSA-w2qp-rph6-63g4","versionConstraint":"<5.12.1 (semantic)"},"fix":{"suggestedVersion":"5.12.1"}}],"artifact":{"id":"pkg:npm/fastify@5.8.5?package-id=72dfb6219c562dcc","name":"fastify","version":"5.8.5","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:fastify:fastify:5.8.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fastify@5.8.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-m2h6-j472-rp4c","dataSource":"https://github.com/advisories/GHSA-m2h6-j472-rp4c","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/pyca/cryptography/security/advisories/GHSA-m2h6-j472-rp4c","https://github.com/pyca/cryptography/pull/14888","https://github.com/pyca/cryptography/commit/4d035a4225965edeffd312079a510ef25fcfdcb2","https://nvd.nist.gov/vuln/detail/CVE-2026-69248","https://github.com/pyca/cryptography/commit/286c89128","https://github.com/pypa/advisory-database/tree/main/vulns/cryptography/PYSEC-2026-3554.yaml"],"description":"python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69248","epss":0.00244,"percentile":0.1562,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69248","cwe":"CWE-295","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["49.0.0"],"state":"fixed","available":[{"version":"49.0.0","date":"2026-08-04","kind":"first-observed"}]},"advisories":[],"risk":0.14517999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-69248","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-69248","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/pyca/cryptography/commit/4d035a4225965edeffd312079a510ef25fcfdcb2","https://github.com/pyca/cryptography/pull/14888","https://github.com/pyca/cryptography/security/advisories/GHSA-m2h6-j472-rp4c"],"description":"cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 45.0.0 through 48.0.0, if an intermediate constrained CA permits the DNS name foo.example.com, and the leaf certificate has a wildcard in its DNS SAN of *.example.com, python-cryptography's verifier accepts which allows escaping outside of the permitted names. The core issue is in DNSConstraint::matches, where a wildcard pattern was treated as matching a more-specific permitted constraint even though *.example.com can expand to sibling names such as bar.example.com outside foo.example.com. This allows acceptance of an invalid certificate chain. This issue is fixed in 49.0.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69248","epss":0.00244,"percentile":0.1562,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69248","cwe":"CWE-295","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"cryptography","version":"46.0.7"}},"found":{"vulnerabilityID":"GHSA-m2h6-j472-rp4c","versionConstraint":">=45.0.0,<49.0.0 (python)"},"fix":{"suggestedVersion":"49.0.0"}}],"artifact":{"id":"pkg:pypi/cryptography@46.0.7?package-id=b8850d2d1ea9f785","name":"cryptography","version":"46.0.7","type":"python","locations":[{"path":"/backend/bdd/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:cryptography.io:cryptography:46.0.7:*:*:*:*:python:*:*","cpe:2.3:a:cryptography.io:cryptography:46.0.7:*:*:*:*:*:*:*"],"purl":"pkg:pypi/cryptography@46.0.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-55wc-3pg8-jfw6","dataSource":"https://github.com/advisories/GHSA-55wc-3pg8-jfw6","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/nodejs/undici/security/advisories/GHSA-55wc-3pg8-jfw6","https://nvd.nist.gov/vuln/detail/CVE-2026-87029","https://github.com/nodejs/undici/commit/63cba7712ca012b2603c6aeeb4c72d8692332cd0","https://github.com/nodejs/undici/commit/f851f315db1f2acce0ea668f88d9d0fa61c8420c","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v7.30.1","https://github.com/nodejs/undici/releases/tag/v8.12.2"],"description":"undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-87029","epss":0.0026,"percentile":0.17806,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-87029","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["7.30.1"],"state":"fixed","available":[{"version":"7.30.1","date":"2026-10-28","kind":"first-observed"}]},"advisories":[],"risk":0.14170000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-87029","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87029","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-55wc-3pg8-jfw6"],"description":"undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its decompress interceptor forwards decompressed response data to the downstream handler from zlib stream event callbacks without catching exceptions those callbacks may throw, and while undici's engine converts a synchronous throw from a downstream handler into a per-request failure, that protection is absent when the throw happens asynchronously from a zlib callback. As a result, a downstream handler that throws by design, such as the built-in dump interceptor which throws when a response exceeds its configured maximum size, escapes as an uncaught exception that terminates the Node.js process. A malicious or compromised HTTP server can crash any client that composes the decompress interceptor with such a handler by returning a small compressed body that decompresses to more than the configured limit, so only the decompressed size matters and the bytes on the wire stay tiny. The issue is fixed in undici 7.30.1 and 8.12.2, and users should upgrade to one of those versions or later. As a workaround, avoid composing the decompress interceptor with a response handler that throws during response processing until upgrading.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-87029","epss":0.0026,"percentile":0.17806,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-87029","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"undici","version":"7.30.0"}},"found":{"vulnerabilityID":"GHSA-55wc-3pg8-jfw6","versionConstraint":">=7.15.0,<7.30.1 (semantic)"},"fix":{"suggestedVersion":"7.30.1"}}],"artifact":{"id":"pkg:npm/undici@7.30.0?package-id=2e4d483351b6bc03","name":"undici","version":"7.30.0","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodejs:undici:7.30.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/undici@7.30.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-qrxm-fqhp-jwvm","dataSource":"https://github.com/advisories/GHSA-qrxm-fqhp-jwvm","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nodejs/undici/security/advisories/GHSA-qrxm-fqhp-jwvm","https://nvd.nist.gov/vuln/detail/CVE-2026-87018","https://github.com/nodejs/undici/commit/12cfd96c3f430897656e3edc1c5e02be8c1cd309","https://github.com/nodejs/undici/commit/b40fbfc0651703cf9fa9f6ced68b679f28d8bb28","https://github.com/nodejs/undici/commit/e257e9f8fb42eedd50727b9cf65e548c8925e4a8","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v6.29.1","https://github.com/nodejs/undici/releases/tag/v7.30.1","https://github.com/nodejs/undici/releases/tag/v8.12.2"],"description":"undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-87018","epss":0.00187,"percentile":0.08364,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-87018","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-87018","cwe":"CWE-617","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["7.30.1"],"state":"fixed","available":[{"version":"7.30.1","date":"2026-10-28","kind":"first-observed"}]},"advisories":[],"risk":0.14024999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-87018","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87018","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-qrxm-fqhp-jwvm"],"description":"undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trusted certificate whose hostname does not match the requested host. Node.js re-runs hostname verification on the renegotiated handshake and destroys the socket with a certificate-altname error, but undici's established-socket error handler asserted that this error code could never occur, so the peer-controlled error became an uncaught assertion that terminates the Node.js process, affecting both the HTTP/1.1 and HTTP/2 paths. A malicious or compromised HTTPS endpoint reached through undici or the global fetch() can crash the client with a single server-initiated renegotiation, taking down all in-flight requests and background work in the process, and exploitation needs no CA compromise because the attacker controls the endpoint and can present two ordinary valid certificates. Only TLS 1.2 is affected, since TLS 1.3 does not support renegotiation. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, and users should upgrade to one of those versions or later. As a workaround, restrict outbound connections to TLS 1.3 so renegotiation cannot occur, when the target endpoints support it.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-87018","epss":0.00187,"percentile":0.08364,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-87018","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-87018","cwe":"CWE-617","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"undici","version":"7.30.0"}},"found":{"vulnerabilityID":"GHSA-qrxm-fqhp-jwvm","versionConstraint":">=7.0.0,<7.30.1 (semantic)"},"fix":{"suggestedVersion":"7.30.1"}}],"artifact":{"id":"pkg:npm/undici@7.30.0?package-id=2e4d483351b6bc03","name":"undici","version":"7.30.0","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodejs:undici:7.30.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/undici@7.30.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-w74x-v6f9-j3xg","dataSource":"https://github.com/advisories/GHSA-w74x-v6f9-j3xg","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-w74x-v6f9-j3xg","https://nvd.nist.gov/vuln/detail/CVE-2026-110306","https://github.com/fastify/fast-uri/commit/39933a1f1422986f14e2d844f552238feb40f5d4","https://github.com/fastify/fast-uri/commit/597f254c86d151568511eeb9a1df761fd12520b3","https://github.com/fastify/fast-uri/commit/e60e716f41d1d73717e2d803d20b68d2c6d20a0f","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v2.4.8","https://github.com/fastify/fast-uri/releases/tag/v3.1.9","https://github.com/fastify/fast-uri/releases/tag/v4.2.3"],"description":"fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110306","epss":0.0025,"percentile":0.16356,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110306","cwe":"CWE-172","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-110306","cwe":"CWE-180","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["3.1.9"],"state":"fixed","available":[{"version":"3.1.9","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.13874999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-110306","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110306","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-w74x-v6f9-j3xg"],"description":"fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, fast-uri percent-decodes the scheme component with the legacy global unescape() function before validating it, so an input whose decoded scheme is a dangerous token is emitted as a live scheme even though RFC 3986 does not allow percent-encoding in a scheme and no other parser accepts it. An application that screens dangerous schemes on the raw input and then stores or renders the normalized or resolved result can turn an inert string into an executable javascript, data, or vbscript URL, producing a stored or reflected cross-site scripting vector, and the equal() comparison treats an encoded and a plain scheme as the same, which can bypass equality-based allowlists. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to one of these versions or later. As a workaround, reject input whose scheme part contains a percent sign, or check the parsed scheme against an allowlist after normalization and use that same parsed result rather than the raw string.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110306","epss":0.0025,"percentile":0.16356,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110306","cwe":"CWE-172","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-110306","cwe":"CWE-180","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"3.1.0"}},"found":{"vulnerabilityID":"GHSA-w74x-v6f9-j3xg","versionConstraint":">=3.0.0,<3.1.9 (semantic)"},"fix":{"suggestedVersion":"3.1.9"}}],"artifact":{"id":"pkg:npm/fast-uri@3.1.0?package-id=a87bf2e2258cda95","name":"fast-uri","version":"3.1.0","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:openjsf:fast-uri:3.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@3.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-w74x-v6f9-j3xg","dataSource":"https://github.com/advisories/GHSA-w74x-v6f9-j3xg","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-w74x-v6f9-j3xg","https://nvd.nist.gov/vuln/detail/CVE-2026-110306","https://github.com/fastify/fast-uri/commit/39933a1f1422986f14e2d844f552238feb40f5d4","https://github.com/fastify/fast-uri/commit/597f254c86d151568511eeb9a1df761fd12520b3","https://github.com/fastify/fast-uri/commit/e60e716f41d1d73717e2d803d20b68d2c6d20a0f","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v2.4.8","https://github.com/fastify/fast-uri/releases/tag/v3.1.9","https://github.com/fastify/fast-uri/releases/tag/v4.2.3"],"description":"fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110306","epss":0.0025,"percentile":0.16356,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110306","cwe":"CWE-172","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-110306","cwe":"CWE-180","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["3.1.9"],"state":"fixed","available":[{"version":"3.1.9","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.13874999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-110306","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110306","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-w74x-v6f9-j3xg"],"description":"fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, fast-uri percent-decodes the scheme component with the legacy global unescape() function before validating it, so an input whose decoded scheme is a dangerous token is emitted as a live scheme even though RFC 3986 does not allow percent-encoding in a scheme and no other parser accepts it. An application that screens dangerous schemes on the raw input and then stores or renders the normalized or resolved result can turn an inert string into an executable javascript, data, or vbscript URL, producing a stored or reflected cross-site scripting vector, and the equal() comparison treats an encoded and a plain scheme as the same, which can bypass equality-based allowlists. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to one of these versions or later. As a workaround, reject input whose scheme part contains a percent sign, or check the parsed scheme against an allowlist after normalization and use that same parsed result rather than the raw string.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110306","epss":0.0025,"percentile":0.16356,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110306","cwe":"CWE-172","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-110306","cwe":"CWE-180","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"3.1.8"}},"found":{"vulnerabilityID":"GHSA-w74x-v6f9-j3xg","versionConstraint":">=3.0.0,<3.1.9 (semantic)"},"fix":{"suggestedVersion":"3.1.9"}}],"artifact":{"id":"pkg:npm/fast-uri@3.1.8?package-id=5f1672bb3cdc5ac8","name":"fast-uri","version":"3.1.8","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:openjsf:fast-uri:3.1.8:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@3.1.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-v422-hmwv-36x6","dataSource":"https://github.com/advisories/GHSA-v422-hmwv-36x6","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/expressjs/body-parser/security/advisories/GHSA-v422-hmwv-36x6","https://nvd.nist.gov/vuln/detail/CVE-2026-12590","https://github.com/expressjs/body-parser/pull/698","https://github.com/expressjs/body-parser/pull/741","https://github.com/expressjs/body-parser/commit/2322e111cc321413ec2b7b76d01be533d3de9d7d","https://github.com/expressjs/body-parser/commit/3492672eee593d5c158f239b6e9115498a5dbeac","https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/body-parser/releases/tag/1.20.6","https://github.com/expressjs/body-parser/releases/tag/v2.3.0"],"description":"body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-12590","epss":0.00412,"percentile":0.355,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-12590","cwe":"CWE-770","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["1.20.6"],"state":"fixed","available":[{"version":"1.20.6","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.13802},"relatedVulnerabilities":[{"id":"CVE-2026-12590","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12590","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/body-parser/security/advisories/GHSA-v422-hmwv-36x6"],"description":"Impact: In body-parser versions prior to 1.20.6 (1.x line) and 2.3.0 (2.x line), when the parser is configured with an invalid limit option value such as an unparseable string or NaN, bytes.parse returns null and the request body size check is silently skipped. Applications that rely on limit as their primary safeguard against oversized request bodies will accept arbitrarily large payloads, leading to excessive memory and CPU usage and denial of service. Patches: This issue is fixed in body-parser 1.20.6 and 2.3.0. After the fix, invalid limit values throw a clear error at parser construction time instead of silently disabling enforcement, while null and undefined continue to fall back to the default limit of 100kb. Workarounds: Validate the limit value before passing it to body-parser. For example, parse the value at startup and reject any configuration where the result is null or a non-finite number.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-12590","epss":0.00412,"percentile":0.355,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-12590","cwe":"CWE-770","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"body-parser","version":"1.20.3"}},"found":{"vulnerabilityID":"GHSA-v422-hmwv-36x6","versionConstraint":"<1.20.6 (semantic)"},"fix":{"suggestedVersion":"1.20.6"}}],"artifact":{"id":"pkg:npm/body-parser@1.20.3?package-id=0026492c8e052563","name":"body-parser","version":"1.20.3","type":"npm","locations":[{"path":"/sink/oidc-server/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:openjsf:body-parser:1.20.3:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/body-parser@1.20.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-v422-hmwv-36x6","dataSource":"https://github.com/advisories/GHSA-v422-hmwv-36x6","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/expressjs/body-parser/security/advisories/GHSA-v422-hmwv-36x6","https://nvd.nist.gov/vuln/detail/CVE-2026-12590","https://github.com/expressjs/body-parser/pull/698","https://github.com/expressjs/body-parser/pull/741","https://github.com/expressjs/body-parser/commit/2322e111cc321413ec2b7b76d01be533d3de9d7d","https://github.com/expressjs/body-parser/commit/3492672eee593d5c158f239b6e9115498a5dbeac","https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/body-parser/releases/tag/1.20.6","https://github.com/expressjs/body-parser/releases/tag/v2.3.0"],"description":"body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-12590","epss":0.00412,"percentile":0.355,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-12590","cwe":"CWE-770","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["2.3.0"],"state":"fixed","available":[{"version":"2.3.0","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.13802},"relatedVulnerabilities":[{"id":"CVE-2026-12590","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12590","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/body-parser/security/advisories/GHSA-v422-hmwv-36x6"],"description":"Impact: In body-parser versions prior to 1.20.6 (1.x line) and 2.3.0 (2.x line), when the parser is configured with an invalid limit option value such as an unparseable string or NaN, bytes.parse returns null and the request body size check is silently skipped. Applications that rely on limit as their primary safeguard against oversized request bodies will accept arbitrarily large payloads, leading to excessive memory and CPU usage and denial of service. Patches: This issue is fixed in body-parser 1.20.6 and 2.3.0. After the fix, invalid limit values throw a clear error at parser construction time instead of silently disabling enforcement, while null and undefined continue to fall back to the default limit of 100kb. Workarounds: Validate the limit value before passing it to body-parser. For example, parse the value at startup and reject any configuration where the result is null or a non-finite number.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-12590","epss":0.00412,"percentile":0.355,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-12590","cwe":"CWE-770","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"body-parser","version":"2.2.2"}},"found":{"vulnerabilityID":"GHSA-v422-hmwv-36x6","versionConstraint":">=2.0.0,<2.3.0 (semantic)"},"fix":{"suggestedVersion":"2.3.0"}}],"artifact":{"id":"pkg:npm/body-parser@2.2.2?package-id=d62d872155de6806","name":"body-parser","version":"2.2.2","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:openjsf:body-parser:2.2.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/body-parser@2.2.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-f72v-6w45-q472","dataSource":"https://github.com/advisories/GHSA-f72v-6w45-q472","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/nodejs/undici/security/advisories/GHSA-f72v-6w45-q472","https://nvd.nist.gov/vuln/detail/CVE-2026-109841","https://github.com/nodejs/undici/commit/18bc8a1e09d15bc45815154a289dcf6fd5254d00","https://github.com/nodejs/undici/commit/4f7ef6806e532ab9e29ccd6229b1b9d241e1b1f0","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v7.30.1","https://github.com/nodejs/undici/releases/tag/v8.12.2"],"description":"undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-109841","epss":0.00252,"percentile":0.16692,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-109841","cwe":"CWE-178","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["7.30.1"],"state":"fixed","available":[{"version":"7.30.1","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.13734000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-109841","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109841","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-f72v-6w45-q472"],"description":"undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch() implementation verifies Subresource Integrity metadata by matching the algorithm token against a lowercase-only set, even though the SRI specification defines the token by its ASCII-lowercase form, so a valid but non-lowercase token such as an uppercase or mixed-case SHA256 is treated as unknown and skipped. When no recognized algorithm remains, undici treats the integrity list as empty and accepts the response, so a server returning a body that does not match the pinned digest passes the check. An attacker who controls only the response body can therefore deliver attacker-controlled bytes to an application that pinned a valid uppercase or mixed-case SRI token, with no integrity error, affecting response integrity only. The issue is fixed in undici 7.30.1 and 8.12.2, which normalize the algorithm token to ASCII lowercase before validation, and users should upgrade to one of those versions or later. As a workaround, use lowercase algorithm tokens such as sha256, sha384, or sha512 in integrity metadata.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-109841","epss":0.00252,"percentile":0.16692,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-109841","cwe":"CWE-178","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"undici","version":"7.30.0"}},"found":{"vulnerabilityID":"GHSA-f72v-6w45-q472","versionConstraint":">=7.15.0,<7.30.1 (semantic)"},"fix":{"suggestedVersion":"7.30.1"}}],"artifact":{"id":"pkg:npm/undici@7.30.0?package-id=2e4d483351b6bc03","name":"undici","version":"7.30.0","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodejs:undici:7.30.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/undici@7.30.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-2m5v-pch6-74hx","dataSource":"https://github.com/advisories/GHSA-2m5v-pch6-74hx","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nodejs/undici/security/advisories/GHSA-2m5v-pch6-74hx","https://nvd.nist.gov/vuln/detail/CVE-2026-109383","https://github.com/nodejs/undici/commit/04cb74b1db131ff8f5b4557dce811cbf5f4664b4","https://github.com/nodejs/undici/commit/8c59f6b302898cb2e9b0f7962cd7212b6e597c9f","https://github.com/nodejs/undici/commit/f75eac00ac177f7b2e6c8bfbd52d4113164286e6","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v6.29.1","https://github.com/nodejs/undici/releases/tag/v7.30.1","https://github.com/nodejs/undici/releases/tag/v8.12.2"],"description":"undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-109383","epss":0.00184,"percentile":0.08023,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-109383","cwe":"CWE-295","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["7.30.1"],"state":"fixed","available":[{"version":"7.30.1","date":"2026-10-28","kind":"first-observed"}]},"advisories":[],"risk":0.13707999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-109383","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109383","namespace":"nvd:cpe","severity":"Critical","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-2m5v-pch6-74hx"],"description":"undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before forwarding them to each per-origin pool, and because JSON cannot represent functions, a caller-supplied tls option containing a checkServerIdentity callback is silently dropped before it reaches the TLS layer. As a result, a TLS peer whose certificate a custom checkServerIdentity was written to reject, but which passes Node's default hostname and chain checks, is silently accepted. Because Agent is the default dispatcher behind request, fetch, and setGlobalDispatcher, this affects the path most applications use, and EnvHttpProxyAgent is affected on its direct and no-proxy routes as well, while only applications that pass a function-valued tls option such as a custom checkServerIdentity for certificate or public-key pinning are at risk. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, which preserve the tls option outside the JSON clone so custom verification callbacks are forwarded unchanged, and users should upgrade to one of those versions or later. As a workaround, pass the TLS options through connect instead of tls, or for proxied destinations use requestTls and proxyTls.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-109383","epss":0.00184,"percentile":0.08023,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-109383","cwe":"CWE-295","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"undici","version":"7.30.0"}},"found":{"vulnerabilityID":"GHSA-2m5v-pch6-74hx","versionConstraint":">=7.0.0,<7.30.1 (semantic)"},"fix":{"suggestedVersion":"7.30.1"}}],"artifact":{"id":"pkg:npm/undici@7.30.0?package-id=2e4d483351b6bc03","name":"undici","version":"7.30.0","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodejs:undici:7.30.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/undici@7.30.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-jggg-4jg4-v7c6","dataSource":"https://github.com/advisories/GHSA-jggg-4jg4-v7c6","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-jggg-4jg4-v7c6","https://nvd.nist.gov/vuln/detail/CVE-2026-45740"],"description":"protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-45740","epss":0.00263,"percentile":0.18171,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-45740","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.5.8"],"state":"fixed","available":[{"version":"7.5.8","date":"2026-05-19","kind":"first-observed"}]},"advisories":[],"risk":0.135445},"relatedVulnerabilities":[{"id":"CVE-2026-45740","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45740","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-jggg-4jg4-v7c6"],"description":"protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.8 and 8.2.0, protobufjs could recurse without a depth limit while expanding nested JSON descriptors through Root.fromJSON() and Namespace.addJSON(). A crafted JSON descriptor with deeply nested namespace definitions could cause the JavaScript call stack to be exhausted during descriptor loading. This vulnerability is fixed in 7.5.8 and 8.2.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-45740","epss":0.00263,"percentile":0.18171,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-45740","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"protobufjs","version":"7.5.6"}},"found":{"vulnerabilityID":"GHSA-jggg-4jg4-v7c6","versionConstraint":"<=7.5.7 (semantic)"},"fix":{"suggestedVersion":"7.5.8"}}],"artifact":{"id":"pkg:npm/protobufjs@7.5.6?package-id=7ceb7c776b63b6ac","name":"protobufjs","version":"7.5.6","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:protobufjs_project:protobufjs:7.5.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/protobufjs@7.5.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-2gcr-mfcq-wcc3","dataSource":"https://github.com/advisories/GHSA-2gcr-mfcq-wcc3","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/honojs/hono/security/advisories/GHSA-2gcr-mfcq-wcc3","https://nvd.nist.gov/vuln/detail/CVE-2026-47676","https://github.com/honojs/hono/commit/6cbb025ff87fca1a3d00d0ccca0eaf3a6385c3f1","https://github.com/honojs/hono/releases/tag/v4.12.21"],"description":"Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-47676","epss":0.0026,"percentile":0.17703,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-47676","cwe":"CWE-444","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-47676","cwe":"CWE-693","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.12.21"],"state":"fixed","available":[{"version":"4.12.21","date":"2026-06-05","kind":"first-observed"}]},"advisories":[],"risk":0.1339},"relatedVulnerabilities":[{"id":"CVE-2026-47676","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47676","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/honojs/hono/security/advisories/GHSA-2gcr-mfcq-wcc3"],"description":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, app.mount() strips the mount prefix from the incoming request path using the raw URL pathname, while route matching is performed against the percent-decoded path. This inconsistency causes the prefix to be stripped at the wrong position when the path contains percent-encoded multi-byte characters, resulting in the mounted sub-application receiving an incorrect path. This vulnerability is fixed in 4.12.21.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-47676","epss":0.0026,"percentile":0.17703,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-47676","cwe":"CWE-444","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-47676","cwe":"CWE-693","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"hono","version":"4.12.16"}},"found":{"vulnerabilityID":"GHSA-2gcr-mfcq-wcc3","versionConstraint":"<4.12.21 (semantic)"},"fix":{"suggestedVersion":"4.12.21"}}],"artifact":{"id":"pkg:npm/hono@4.12.16?package-id=000f2baa1e593039","name":"hono","version":"4.12.16","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:hono:hono:4.12.16:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/hono@4.12.16","upstreams":[]}},{"vulnerability":{"id":"GHSA-f23p-vx2j-j53r","dataSource":"https://github.com/advisories/GHSA-f23p-vx2j-j53r","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/honojs/hono/security/advisories/GHSA-f23p-vx2j-j53r","https://github.com/honojs/hono/commit/0c45036d6b0ddf42ab2fa44639dc8710825d5c0f","https://github.com/honojs/hono/releases/tag/v4.12.34"],"description":"Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.8,"exploitabilityScore":1.2,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-71850","epss":0.00267,"percentile":0.18887,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-71850","cwe":"CWE-488","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.12.34"],"state":"fixed","available":[{"version":"4.12.34","date":"2026-08-08","kind":"first-observed"}]},"advisories":[],"risk":0.13083},"relatedVulnerabilities":[{"id":"CVE-2026-71850","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-71850","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/honojs/hono/security/advisories/GHSA-f23p-vx2j-j53r"],"description":"Hono is a Web application framework that provides support for any JavaScript runtime. From 3.8.0 to 4.12.33, memo() from hono/jsx retains the result of a server side render and reuses it for later renders with comparator equal props, and request scoped values read inside the component take no part in that comparison, so a response can contain HTML rendered for another user's request. Components wrapped with memo() are compared by props alone; values read implicitly during rendering, such as JSX Context through createContext() and useContext(), useRequestContext() from hono/jsx-renderer, and getContext() from hono/context-storage, do not participate, and the retained result lives as long as the wrapped component, so it outlives the request that produced it. A user may receive a response containing HTML rendered for another user when both render the same memoized component with comparator equal props on the same warm instance, which may disclose another user's account or profile data, disclose request scoped secrets embedded in HTML such as CSRF tokens, or expose role specific content to users who should not receive it. This issue is fixed in version 4.12.34.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.8,"exploitabilityScore":1.2,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-71850","epss":0.00267,"percentile":0.18887,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-71850","cwe":"CWE-488","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"hono","version":"4.12.16"}},"found":{"vulnerabilityID":"GHSA-f23p-vx2j-j53r","versionConstraint":">=3.8.0,<4.12.34 (semantic)"},"fix":{"suggestedVersion":"4.12.34"}}],"artifact":{"id":"pkg:npm/hono@4.12.16?package-id=000f2baa1e593039","name":"hono","version":"4.12.16","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:hono:hono:4.12.16:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/hono@4.12.16","upstreams":[]}},{"vulnerability":{"id":"GHSA-mcj8-r9mp-w47p","dataSource":"https://github.com/advisories/GHSA-mcj8-r9mp-w47p","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/vercel/next.js/security/advisories/GHSA-mcj8-r9mp-w47p","https://nvd.nist.gov/vuln/detail/CVE-2026-94484","https://github.com/vercel/next.js/commit/52c94abdd2ea5f416f5e8353ea8a2edd3fe311b8","https://github.com/vercel/next.js/commit/719e4c67d6e92df60246f95e1d96e2dd60789a52","https://github.com/vercel/next.js/releases/tag/v15.5.27","https://github.com/vercel/next.js/releases/tag/v16.3.8"],"description":"Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-94484","epss":0.00244,"percentile":0.15713,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-94484","cwe":"CWE-524","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["16.3.8"],"state":"fixed","available":[{"version":"16.3.8","date":"2026-10-08","kind":"first-observed"}]},"advisories":[],"risk":0.12871},"relatedVulnerabilities":[{"id":"CVE-2026-94484","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94484","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/vercel/next.js/commit/52c94abdd2ea5f416f5e8353ea8a2edd3fe311b8","https://github.com/vercel/next.js/commit/719e4c67d6e92df60246f95e1d96e2dd60789a52","https://github.com/vercel/next.js/releases/tag/v15.5.27","https://github.com/vercel/next.js/releases/tag/v16.3.8","https://github.com/vercel/next.js/security/advisories/GHSA-mcj8-r9mp-w47p"],"description":"Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, applications with a root-level catch-all page and statically generated or Incremental Static Regeneration routes can use a shared response cache key that is insufficiently scoped to the source route. A single unauthenticated crafted request can poison that cache, causing cross-user content substitution or persistent denial of service until the poisoned entry is revalidated or replaced. This issue is fixed in versions 15.5.27 and 16.3.8.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-94484","epss":0.00244,"percentile":0.15713,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-94484","cwe":"CWE-524","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"next","version":"16.1.7"}},"found":{"vulnerabilityID":"GHSA-mcj8-r9mp-w47p","versionConstraint":">=16.0.0,<16.3.8 (semantic)"},"fix":{"suggestedVersion":"16.3.8"}}],"artifact":{"id":"pkg:npm/next@16.1.7?package-id=662de087d22e519d","name":"next","version":"16.1.7","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vercel:next.js:16.1.7:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/next@16.1.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-xrhx-7g5j-rcj5","dataSource":"https://github.com/advisories/GHSA-xrhx-7g5j-rcj5","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/honojs/hono/security/advisories/GHSA-xrhx-7g5j-rcj5","https://nvd.nist.gov/vuln/detail/CVE-2026-47674","https://github.com/honojs/hono/commit/c831020fb1fa2e929d222f6c84e1abfe013e512b","https://github.com/honojs/hono/releases/tag/v4.12.21"],"description":"Hono: IP Restriction bypasses static deny rules for non-canonical IPv6","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-47674","epss":0.00244,"percentile":0.1566,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-47674","cwe":"CWE-185","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-47674","cwe":"CWE-1289","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.12.21"],"state":"fixed","available":[{"version":"4.12.21","date":"2026-06-05","kind":"first-observed"}]},"advisories":[],"risk":0.12566},"relatedVulnerabilities":[{"id":"CVE-2026-47674","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47674","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/honojs/hono/security/advisories/GHSA-xrhx-7g5j-rcj5"],"description":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the ip-restriction middleware (hono/ip-restriction) compares incoming IP addresses against configured deny and allow rules using string equality after partial normalization. Non-canonical IPv6 representations of an address already listed in a static rule — such as compressed forms, explicit-zero forms, or hex-notation IPv4-mapped addresses — do not match the normalized rule entry, causing the rule to be silently skipped. This vulnerability is fixed in 4.12.21.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-47674","epss":0.00244,"percentile":0.1566,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-47674","cwe":"CWE-185","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-47674","cwe":"CWE-1289","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"hono","version":"4.12.16"}},"found":{"vulnerabilityID":"GHSA-xrhx-7g5j-rcj5","versionConstraint":"<4.12.21 (semantic)"},"fix":{"suggestedVersion":"4.12.21"}}],"artifact":{"id":"pkg:npm/hono@4.12.16?package-id=000f2baa1e593039","name":"hono","version":"4.12.16","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:hono:hono:4.12.16:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/hono@4.12.16","upstreams":[]}},{"vulnerability":{"id":"GHSA-6wvx-3r32-xmcg","dataSource":"https://github.com/advisories/GHSA-6wvx-3r32-xmcg","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/digitalbazaar/forge/security/advisories/GHSA-6wvx-3r32-xmcg","https://nvd.nist.gov/vuln/detail/CVE-2026-118777","https://github.com/digitalbazaar/forge/commit/797c3f816a22748a96fceebb34eb3a6716853991","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1"],"description":"Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118777","epss":0.00255,"percentile":0.17162,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118777","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.4.1"],"state":"fixed","available":[{"version":"1.4.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.12494999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-118777","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118777","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/digitalbazaar/forge/commit/797c3f816a22748a96fceebb34eb3a6716853991","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","https://github.com/digitalbazaar/forge/security/advisories/GHSA-6wvx-3r32-xmcg"],"description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the forge.http client stored cookie names and paths from Set-Cookie response headers in ordinary JavaScript objects. A malicious server could use the cookie name __proto__ so that the attacker-controlled cookie path was written as a property on Object.prototype, or use inherited names such as constructor to modify Object. An empty cookie value could use the removal path to delete an inherited Object.prototype property. Applications using forge.http directly or through forge.xhr are affected; applications that do not use forge.http are unaffected. This issue is fixed in version 1.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118777","epss":0.00255,"percentile":0.17162,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118777","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"node-forge","version":"1.4.0"}},"found":{"vulnerabilityID":"GHSA-6wvx-3r32-xmcg","versionConstraint":"<=1.4.0 (semantic)"},"fix":{"suggestedVersion":"1.4.1"}}],"artifact":{"id":"pkg:npm/node-forge@1.4.0?package-id=86ba9cb3dfe9125a","name":"node-forge","version":"1.4.0","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause OR GPL-2.0"],"cpes":["cpe:2.3:a:digitalbazaar:forge:1.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/node-forge@1.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-6wvx-3r32-xmcg","dataSource":"https://github.com/advisories/GHSA-6wvx-3r32-xmcg","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/digitalbazaar/forge/security/advisories/GHSA-6wvx-3r32-xmcg","https://nvd.nist.gov/vuln/detail/CVE-2026-118777","https://github.com/digitalbazaar/forge/commit/797c3f816a22748a96fceebb34eb3a6716853991","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1"],"description":"Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118777","epss":0.00255,"percentile":0.17162,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118777","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.4.1"],"state":"fixed","available":[{"version":"1.4.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.12494999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-118777","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118777","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/digitalbazaar/forge/commit/797c3f816a22748a96fceebb34eb3a6716853991","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","https://github.com/digitalbazaar/forge/security/advisories/GHSA-6wvx-3r32-xmcg"],"description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the forge.http client stored cookie names and paths from Set-Cookie response headers in ordinary JavaScript objects. A malicious server could use the cookie name __proto__ so that the attacker-controlled cookie path was written as a property on Object.prototype, or use inherited names such as constructor to modify Object. An empty cookie value could use the removal path to delete an inherited Object.prototype property. Applications using forge.http directly or through forge.xhr are affected; applications that do not use forge.http are unaffected. This issue is fixed in version 1.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118777","epss":0.00255,"percentile":0.17162,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118777","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"node-forge","version":"1.4.0"}},"found":{"vulnerabilityID":"GHSA-6wvx-3r32-xmcg","versionConstraint":"<=1.4.0 (semantic)"},"fix":{"suggestedVersion":"1.4.1"}}],"artifact":{"id":"pkg:npm/node-forge@1.4.0?package-id=1e94284aa936f13c","name":"node-forge","version":"1.4.0","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause OR GPL-2.0"],"cpes":["cpe:2.3:a:digitalbazaar:forge:1.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/node-forge@1.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-wjr9-j795-jxcr","dataSource":"https://github.com/advisories/GHSA-wjr9-j795-jxcr","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-wjr9-j795-jxcr","https://nvd.nist.gov/vuln/detail/CVE-2026-110180","https://github.com/fastify/fast-uri/commit/58c183d0b168ad87f98773266444ce1f6375803a","https://github.com/fastify/fast-uri/commit/ddfc6a51122dfce0365655f04479fc3adb7f6b3c","https://github.com/fastify/fast-uri/commit/f6d46dfeab025d0c440485f4ae29fa4f14707646","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v2.4.8","https://github.com/fastify/fast-uri/releases/tag/v3.1.9","https://github.com/fastify/fast-uri/releases/tag/v4.2.3"],"description":"fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110180","epss":0.00255,"percentile":0.17126,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110180","cwe":"CWE-20","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-110180","cwe":"CWE-436","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["3.1.9"],"state":"fixed","available":[{"version":"3.1.9","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.12494999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-110180","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110180","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-wjr9-j795-jxcr"],"description":"fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions from 2.4.2 through 2.4.7, from 3.1.3 through 3.1.8, and from 4.0.1 through 4.2.2, for HTTP-family schemes the canonicalizeHost() function passes the parsed host to the WHATWG URL parser and adopts its hostname without checking that the parser consumed the entire input as a host, so the authority can be silently rewritten: data before an at-sign is dropped and tab, carriage-return, and line-feed characters are stripped, with no error reported. An application that enforces host-based policy such as denylists, loopback filtering, redirect validation, or outbound proxy routing on one representation can then see the canonical host diverge from what it checked, allowing traffic to be steered to an unintended destination. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to one of these versions or later. As a workaround, reject an authority that contains more than one at-sign or any tab, carriage-return, or line-feed before calling fast-uri, or treat any non-empty parse error as fatal and compare hosts only from the same parse result.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110180","epss":0.00255,"percentile":0.17126,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110180","cwe":"CWE-20","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-110180","cwe":"CWE-436","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"3.1.8"}},"found":{"vulnerabilityID":"GHSA-wjr9-j795-jxcr","versionConstraint":">=3.1.3,<3.1.9 (semantic)"},"fix":{"suggestedVersion":"3.1.9"}}],"artifact":{"id":"pkg:npm/fast-uri@3.1.8?package-id=5f1672bb3cdc5ac8","name":"fast-uri","version":"3.1.8","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:openjsf:fast-uri:3.1.8:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@3.1.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-hrr3-gc8f-f4qj","dataSource":"https://github.com/advisories/GHSA-hrr3-gc8f-f4qj","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-hrr3-gc8f-f4qj","https://nvd.nist.gov/vuln/detail/CVE-2026-86472","https://github.com/fastify/fast-uri/commit/5dabb86732aa2a7655e258719970e61e12b6b4d1","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v2.4.7","https://github.com/fastify/fast-uri/releases/tag/v3.1.8","https://github.com/fastify/fast-uri/releases/tag/v4.1.5"],"description":"fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-86472","epss":0.00253,"percentile":0.16802,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-86472","cwe":"CWE-178","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["3.1.8"],"state":"fixed","available":[{"version":"3.1.8","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.12397000000000001},"relatedVulnerabilities":[{"id":"CVE-2026-86472","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86472","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-hrr3-gc8f-f4qj"],"description":"fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv. In versions before 2.4.7, from 3.0.0 through 3.1.7, and from 4.0.0 through 4.1.4, fast-uri folds the host to lowercase before it percent-decodes the host, so a percent-encoded uppercase octet such as %41 decodes to a literal A that is never folded. For a scheme-relative reference such as //host there is no scheme, so the host canonicalization that would normally repair this does not run, and parse, normalize, and equal then disagree on the same host. An application that makes a case-sensitive host decision on fast-uri output, for example a host allowlist or denylist that compares the parsed host or uses equal, can be steered past the check with a percent-encoded uppercase octet, and because hostnames are case-insensitive in DNS and HTTP the evading spelling still reaches the host the check meant to gate. The issue is fixed in fast-uri 2.4.7, 3.1.8, and 4.1.5, and users should upgrade to one of those versions or later. As a workaround, compare hosts case-insensitively by lowercasing the parsed host before any allowlist or denylist decision.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-86472","epss":0.00253,"percentile":0.16802,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-86472","cwe":"CWE-178","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"3.1.0"}},"found":{"vulnerabilityID":"GHSA-hrr3-gc8f-f4qj","versionConstraint":">=3.0.0,<3.1.8 (semantic)"},"fix":{"suggestedVersion":"3.1.8"}}],"artifact":{"id":"pkg:npm/fast-uri@3.1.0?package-id=a87bf2e2258cda95","name":"fast-uri","version":"3.1.0","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:openjsf:fast-uri:3.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@3.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-79qm-7rj5-m7r9","dataSource":"https://github.com/advisories/GHSA-79qm-7rj5-m7r9","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/honojs/hono/security/advisories/GHSA-79qm-7rj5-m7r9","https://github.com/honojs/hono/commit/720b566290793d4358bf39843adcb7cf4da4548f","https://github.com/honojs/hono/releases/tag/v4.12.34"],"description":"Hono: Proxy Helper does not remove response headers listed in the `Connection` header","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-71849","epss":0.00355,"percentile":0.29203,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-71849","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.12.34"],"state":"fixed","available":[{"version":"4.12.34","date":"2026-08-08","kind":"first-observed"}]},"advisories":[],"risk":0.118925},"relatedVulnerabilities":[{"id":"CVE-2026-71849","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-71849","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/honojs/hono/commit/720b566290793d4358bf39843adcb7cf4da4548f","https://github.com/honojs/hono/releases/tag/v4.12.34","https://github.com/honojs/hono/security/advisories/GHSA-79qm-7rj5-m7r9"],"description":"Hono is a Web application framework that provides support for any JavaScript runtime. From 4.7.0 to 4.12.33, the Proxy Helper proxy() function in hono/proxy does not remove response headers named by the origin's Connection header. Per RFC 9110 Section 7.6.1, an intermediary must remove the header fields listed in a message's Connection header field before forwarding the message, in addition to the well known hop by hop headers, but the proxy() function only removed the well known hop by hop headers, including Connection itself, from origin responses. A client may therefore receive response headers that the origin intended only for its immediate peer, disclosing connection scoped or internal metadata contained in such headers, when an application proxies responses from an origin that declares additional, non standard headers as hop by hop via the Connection response header. This issue is fixed in version 4.12.34.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-71849","epss":0.00355,"percentile":0.29203,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-71849","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"hono","version":"4.12.16"}},"found":{"vulnerabilityID":"GHSA-79qm-7rj5-m7r9","versionConstraint":">=4.7.0,<4.12.34 (semantic)"},"fix":{"suggestedVersion":"4.12.34"}}],"artifact":{"id":"pkg:npm/hono@4.12.16?package-id=000f2baa1e593039","name":"hono","version":"4.12.16","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:hono:hono:4.12.16:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/hono@4.12.16","upstreams":[]}},{"vulnerability":{"id":"GHSA-x86f-5xw2-fm2r","dataSource":"https://github.com/advisories/GHSA-x86f-5xw2-fm2r","namespace":"github:language:go","severity":"High","urls":["https://github.com/moby/moby/security/advisories/GHSA-x86f-5xw2-fm2r","https://nvd.nist.gov/vuln/detail/CVE-2026-41567"],"description":"Docker: `PUT /containers/{id}/archive` executes container binary on the host","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N","metrics":{"baseScore":7.2,"exploitabilityScore":0.9,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41567","epss":0.00155,"percentile":0.04597,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41567","cwe":"CWE-427","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-41567","cwe":"CWE-427","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.11392499999999998},"relatedVulnerabilities":[{"id":"CVE-2026-41567","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41567","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/moby/moby/security/advisories/GHSA-x86f-5xw2-fm2r","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:41030","https://access.redhat.com/errata/RHSA-2026:42852","https://access.redhat.com/errata/RHSA-2026:44622","https://access.redhat.com/errata/RHSA-2026:51057","https://access.redhat.com/security/cve/CVE-2026-41567","https://bugzilla.redhat.com/show_bug.cgi?id=2485356","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41567.json"],"description":"Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or piped through `docker cp -`, the daemon resolves decompression binaries (such as `xz` or `unpigz`) from the container's filesystem rather than the host's due to incorrect ordering of operations. A malicious container image containing a trojanized decompression binary can achieve arbitrary code execution with full daemon privileges, including host root UID and unrestricted capabilities, when a user uploads a compressed (xz or gzip) archive into that container. This issue is fixed in Docker Engine 29.5.1 and moby/moby v2.0.0-beta.14. Workarounds include only running containers from trusted images, using authorization plugins to restrict access to the `PUT /containers/{id}/archive` endpoint, and avoiding piping compressed archives into containers created from untrusted images","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":0.9,"impactScore":6.1},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N","metrics":{"baseScore":7.2,"exploitabilityScore":0.9,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41567","epss":0.00155,"percentile":0.04597,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41567","cwe":"CWE-427","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-41567","cwe":"CWE-427","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/docker/docker","version":"v28.5.2+incompatible"}},"found":{"vulnerabilityID":"GHSA-x86f-5xw2-fm2r","versionConstraint":"<=28.5.2 (go)"}}],"artifact":{"id":"pkg:golang/github.com/docker/docker@v28.5.2%2Bincompatible?package-id=b3f436952f7c2a0e","name":"github.com/docker/docker","version":"v28.5.2+incompatible","type":"go-module","locations":[{"path":"/backend-go/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:docker:docker:v28.5.2\\+incompatible:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/docker/docker@v28.5.2%2Bincompatible","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:DBX0Y0zAjZbSrm1uzOkdr1onVghKaftjlSWt4AFexzM="}}},{"vulnerability":{"id":"GHSA-gx5p-jg67-6x7h","dataSource":"https://github.com/advisories/GHSA-gx5p-jg67-6x7h","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/vercel/next.js/security/advisories/GHSA-gx5p-jg67-6x7h","https://github.com/vercel/next.js/releases/tag/v15.5.16","https://github.com/vercel/next.js/releases/tag/v16.2.5","https://nvd.nist.gov/vuln/detail/CVE-2026-44580"],"description":"Next.js has cross-site scripting in beforeInteractive scripts with untrusted input","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44580","epss":0.00205,"percentile":0.10485,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44580","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["16.2.5"],"state":"fixed","available":[{"version":"16.2.5","date":"2026-05-11","kind":"first-observed"}]},"advisories":[],"risk":0.11377499999999999},"relatedVulnerabilities":[{"id":"CVE-2026-44580","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44580","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/vercel/next.js/security/advisories/GHSA-gx5p-jg67-6x7h"],"description":"Next.js is a React framework for building full-stack web applications. From 13.0.0 to before 15.5.16 and 16.2.5, applications that use beforeInteractive scripts together with untrusted content can be vulnerable to cross-site scripting. In affected versions, serialized script content was not escaped safely before being embedded into the document, which could allow attacker-controlled input to break out of the intended script context and execute arbitrary JavaScript in a visitor's browser. This vulnerability is fixed in 15.5.16 and 16.2.5.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44580","epss":0.00205,"percentile":0.10485,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44580","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"next","version":"16.1.7"}},"found":{"vulnerabilityID":"GHSA-gx5p-jg67-6x7h","versionConstraint":">=16.0.0,<16.2.5 (semantic)"},"fix":{"suggestedVersion":"16.2.5"}}],"artifact":{"id":"pkg:npm/next@16.1.7?package-id=662de087d22e519d","name":"next","version":"16.1.7","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vercel:next.js:16.1.7:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/next@16.1.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-qx2v-qp2m-jg93","dataSource":"https://github.com/advisories/GHSA-qx2v-qp2m-jg93","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/postcss/postcss/security/advisories/GHSA-qx2v-qp2m-jg93","https://nvd.nist.gov/vuln/detail/CVE-2026-41305","https://github.com/postcss/postcss/releases/tag/8.5.10"],"description":"PostCSS has XSS via Unescaped </style> in its CSS Stringify Output","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41305","epss":0.00205,"percentile":0.10481,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41305","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["8.5.10"],"state":"fixed","available":[{"version":"8.5.10","date":"2026-04-24","kind":"first-observed"}]},"advisories":[],"risk":0.11377499999999999},"relatedVulnerabilities":[{"id":"CVE-2026-41305","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41305","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/postcss/postcss/releases/tag/8.5.10","https://github.com/postcss/postcss/security/advisories/GHSA-qx2v-qp2m-jg93"],"description":"PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape `</style>` sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for embedding in HTML `<style>` tags, `</style>` in CSS values breaks out of the style context, enabling XSS. Version 8.5.10 fixes the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41305","epss":0.00205,"percentile":0.10481,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41305","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"postcss","version":"8.4.31"}},"found":{"vulnerabilityID":"GHSA-qx2v-qp2m-jg93","versionConstraint":"<8.5.10 (semantic)"},"fix":{"suggestedVersion":"8.5.10"}}],"artifact":{"id":"pkg:npm/postcss@8.4.31?package-id=5e383ddf2a230a67","name":"postcss","version":"8.4.31","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:postcss:postcss:8.4.31:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/postcss@8.4.31","upstreams":[]}},{"vulnerability":{"id":"GHSA-qx2v-qp2m-jg93","dataSource":"https://github.com/advisories/GHSA-qx2v-qp2m-jg93","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/postcss/postcss/security/advisories/GHSA-qx2v-qp2m-jg93","https://nvd.nist.gov/vuln/detail/CVE-2026-41305","https://github.com/postcss/postcss/releases/tag/8.5.10"],"description":"PostCSS has XSS via Unescaped </style> in its CSS Stringify Output","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41305","epss":0.00205,"percentile":0.10481,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41305","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["8.5.10"],"state":"fixed","available":[{"version":"8.5.10","date":"2026-04-24","kind":"first-observed"}]},"advisories":[],"risk":0.11377499999999999},"relatedVulnerabilities":[{"id":"CVE-2026-41305","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41305","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/postcss/postcss/releases/tag/8.5.10","https://github.com/postcss/postcss/security/advisories/GHSA-qx2v-qp2m-jg93"],"description":"PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape `</style>` sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for embedding in HTML `<style>` tags, `</style>` in CSS values breaks out of the style context, enabling XSS. Version 8.5.10 fixes the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41305","epss":0.00205,"percentile":0.10481,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41305","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"postcss","version":"8.5.6"}},"found":{"vulnerabilityID":"GHSA-qx2v-qp2m-jg93","versionConstraint":"<8.5.10 (semantic)"},"fix":{"suggestedVersion":"8.5.10"}}],"artifact":{"id":"pkg:npm/postcss@8.5.6?package-id=ff850f5fca433458","name":"postcss","version":"8.5.6","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:postcss:postcss:8.5.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/postcss@8.5.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-5cwg-6vw7-rj6p","dataSource":"https://github.com/advisories/GHSA-5cwg-6vw7-rj6p","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/digitalbazaar/forge/security/advisories/GHSA-5cwg-6vw7-rj6p","https://nvd.nist.gov/vuln/detail/CVE-2026-119186","https://github.com/digitalbazaar/forge/commit/236845d96c71207259f91638d0138bba8e2fd624","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1"],"description":"Forge: AES-GCM authentication bypass via unvalidated tagLength option","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119186","epss":0.00206,"percentile":0.10693,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119186","cwe":"CWE-354","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-119186","cwe":"CWE-1284","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.4.1"],"state":"fixed","available":[{"version":"1.4.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.11227000000000001},"relatedVulnerabilities":[{"id":"CVE-2026-119186","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119186","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/digitalbazaar/forge/commit/236845d96c71207259f91638d0138bba8e2fd624","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","https://github.com/digitalbazaar/forge/security/advisories/GHSA-5cwg-6vw7-rj6p"],"description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge did not validate the AES-GCM tagLength option passed to start() during decryption through forge.cipher.createDecipher(). When an application derived tagLength from received data or used an unset or zero-like configuration value, a value that converted to zero together with an empty or missing authentication tag caused the calculated and supplied tags to compare as empty, so decipher.finish() accepted unauthenticated ciphertext. Applications that omit tagLength to use the 128-bit default or pass a fixed valid tag length are unaffected. This issue is fixed in version 1.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119186","epss":0.00206,"percentile":0.10693,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119186","cwe":"CWE-354","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-119186","cwe":"CWE-1284","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"node-forge","version":"1.4.0"}},"found":{"vulnerabilityID":"GHSA-5cwg-6vw7-rj6p","versionConstraint":"<=1.4.0 (semantic)"},"fix":{"suggestedVersion":"1.4.1"}}],"artifact":{"id":"pkg:npm/node-forge@1.4.0?package-id=1e94284aa936f13c","name":"node-forge","version":"1.4.0","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause OR GPL-2.0"],"cpes":["cpe:2.3:a:digitalbazaar:forge:1.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/node-forge@1.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-5cwg-6vw7-rj6p","dataSource":"https://github.com/advisories/GHSA-5cwg-6vw7-rj6p","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/digitalbazaar/forge/security/advisories/GHSA-5cwg-6vw7-rj6p","https://nvd.nist.gov/vuln/detail/CVE-2026-119186","https://github.com/digitalbazaar/forge/commit/236845d96c71207259f91638d0138bba8e2fd624","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1"],"description":"Forge: AES-GCM authentication bypass via unvalidated tagLength option","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119186","epss":0.00206,"percentile":0.10693,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119186","cwe":"CWE-354","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-119186","cwe":"CWE-1284","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.4.1"],"state":"fixed","available":[{"version":"1.4.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.11227000000000001},"relatedVulnerabilities":[{"id":"CVE-2026-119186","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119186","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/digitalbazaar/forge/commit/236845d96c71207259f91638d0138bba8e2fd624","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","https://github.com/digitalbazaar/forge/security/advisories/GHSA-5cwg-6vw7-rj6p"],"description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge did not validate the AES-GCM tagLength option passed to start() during decryption through forge.cipher.createDecipher(). When an application derived tagLength from received data or used an unset or zero-like configuration value, a value that converted to zero together with an empty or missing authentication tag caused the calculated and supplied tags to compare as empty, so decipher.finish() accepted unauthenticated ciphertext. Applications that omit tagLength to use the 128-bit default or pass a fixed valid tag length are unaffected. This issue is fixed in version 1.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119186","epss":0.00206,"percentile":0.10693,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119186","cwe":"CWE-354","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-119186","cwe":"CWE-1284","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"node-forge","version":"1.4.0"}},"found":{"vulnerabilityID":"GHSA-5cwg-6vw7-rj6p","versionConstraint":"<=1.4.0 (semantic)"},"fix":{"suggestedVersion":"1.4.1"}}],"artifact":{"id":"pkg:npm/node-forge@1.4.0?package-id=86ba9cb3dfe9125a","name":"node-forge","version":"1.4.0","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause OR GPL-2.0"],"cpes":["cpe:2.3:a:digitalbazaar:forge:1.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/node-forge@1.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-525v-9gp9-w22h","dataSource":"https://github.com/advisories/GHSA-525v-9gp9-w22h","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/digitalbazaar/forge/security/advisories/GHSA-525v-9gp9-w22h","https://nvd.nist.gov/vuln/detail/CVE-2026-118778","https://github.com/digitalbazaar/forge/commit/7be9fbd40df2e2f15f29fea2846b1c87d58f6888","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1"],"description":"Forge: TLS client crash when the server sends no certificate","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118778","epss":0.00204,"percentile":0.10367,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118778","cwe":"CWE-476","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["1.4.1"],"state":"fixed","available":[{"version":"1.4.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.11118000000000003},"relatedVulnerabilities":[{"id":"CVE-2026-118778","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118778","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/digitalbazaar/forge/commit/7be9fbd40df2e2f15f29fea2846b1c87d58f6888","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","https://github.com/digitalbazaar/forge/security/advisories/GHSA-525v-9gp9-w22h"],"description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection(), c.session.serverCertificate, RSA key exchange to process the relevant input or security decision. node-forge's TLS client checked the wrong property when deciding whether a server certificate was missing. A malicious TLS server or on-path peer could omit the Certificate message and reach code that dereferenced the absent certificate, causing an uncaught exception and terminating the connection or process. This issue is fixed in version 1.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118778","epss":0.00204,"percentile":0.10367,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118778","cwe":"CWE-476","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"node-forge","version":"1.4.0"}},"found":{"vulnerabilityID":"GHSA-525v-9gp9-w22h","versionConstraint":"<=1.4.0 (semantic)"},"fix":{"suggestedVersion":"1.4.1"}}],"artifact":{"id":"pkg:npm/node-forge@1.4.0?package-id=1e94284aa936f13c","name":"node-forge","version":"1.4.0","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause OR GPL-2.0"],"cpes":["cpe:2.3:a:digitalbazaar:forge:1.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/node-forge@1.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-525v-9gp9-w22h","dataSource":"https://github.com/advisories/GHSA-525v-9gp9-w22h","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/digitalbazaar/forge/security/advisories/GHSA-525v-9gp9-w22h","https://nvd.nist.gov/vuln/detail/CVE-2026-118778","https://github.com/digitalbazaar/forge/commit/7be9fbd40df2e2f15f29fea2846b1c87d58f6888","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1"],"description":"Forge: TLS client crash when the server sends no certificate","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118778","epss":0.00204,"percentile":0.10367,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118778","cwe":"CWE-476","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["1.4.1"],"state":"fixed","available":[{"version":"1.4.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.11118000000000003},"relatedVulnerabilities":[{"id":"CVE-2026-118778","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118778","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/digitalbazaar/forge/commit/7be9fbd40df2e2f15f29fea2846b1c87d58f6888","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","https://github.com/digitalbazaar/forge/security/advisories/GHSA-525v-9gp9-w22h"],"description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection(), c.session.serverCertificate, RSA key exchange to process the relevant input or security decision. node-forge's TLS client checked the wrong property when deciding whether a server certificate was missing. A malicious TLS server or on-path peer could omit the Certificate message and reach code that dereferenced the absent certificate, causing an uncaught exception and terminating the connection or process. This issue is fixed in version 1.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118778","epss":0.00204,"percentile":0.10367,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118778","cwe":"CWE-476","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"node-forge","version":"1.4.0"}},"found":{"vulnerabilityID":"GHSA-525v-9gp9-w22h","versionConstraint":"<=1.4.0 (semantic)"},"fix":{"suggestedVersion":"1.4.1"}}],"artifact":{"id":"pkg:npm/node-forge@1.4.0?package-id=86ba9cb3dfe9125a","name":"node-forge","version":"1.4.0","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause OR GPL-2.0"],"cpes":["cpe:2.3:a:digitalbazaar:forge:1.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/node-forge@1.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-4w7w-5xrc-9h26","dataSource":"https://github.com/advisories/GHSA-4w7w-5xrc-9h26","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nodejs/undici/security/advisories/GHSA-4w7w-5xrc-9h26","https://nvd.nist.gov/vuln/detail/CVE-2026-109829","https://github.com/nodejs/undici/commit/26c2bfb3def0b67241ce878e80657ed5d6c3efa8","https://github.com/nodejs/undici/commit/b20b82ad80a405a12b6ce1f341bcd418de390aa0","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v7.30.1","https://github.com/nodejs/undici/releases/tag/v8.12.2"],"description":"undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-109829","epss":0.00149,"percentile":0.0406,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-109829","cwe":"CWE-346","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-109829","cwe":"CWE-524","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["7.30.1"],"state":"fixed","available":[{"version":"7.30.1","date":"2026-10-28","kind":"first-observed"}]},"advisories":[],"risk":0.111005},"relatedVulnerabilities":[{"id":"CVE-2026-109829","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109829","namespace":"nvd:cpe","severity":"Critical","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-4w7w-5xrc-9h26"],"description":"undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a shared cache store, the cache builds its key from the original request URL before the redirect handler changes the origin, so a response produced after a cross-origin redirect is stored under the original key. An attacker who controls the target of a redirect from a trusted URL can have their response cached under that trusted URL and served to later callers, allowing persistent cache poisoning, and the same key confusion lets a private, non-stored redirect response to a user-specific resource be stored under the original URL and served to a later unauthenticated caller, disclosing private data. Applications are affected only when an originless Agent, a shared cache store, and the redirect-then-cache composition are all used. The issue is fixed in undici 7.30.1 and 8.12.2, which verify the producing origin still matches the cache key and preserve each redirect hop's cache-control policy before storing, and users should upgrade to one of those versions or later. As a workaround, compose the cache interceptor before the redirect interceptor, use per-origin dispatchers and cache stores, or disable shared caching on redirect-capable requests.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-109829","epss":0.00149,"percentile":0.0406,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-109829","cwe":"CWE-346","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-109829","cwe":"CWE-524","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"undici","version":"7.30.0"}},"found":{"vulnerabilityID":"GHSA-4w7w-5xrc-9h26","versionConstraint":">=7.0.0,<7.30.1 (semantic)"},"fix":{"suggestedVersion":"7.30.1"}}],"artifact":{"id":"pkg:npm/undici@7.30.0?package-id=2e4d483351b6bc03","name":"undici","version":"7.30.0","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodejs:undici:7.30.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/undici@7.30.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-hxh3-vqpv-xpqv","dataSource":"https://github.com/advisories/GHSA-hxh3-vqpv-xpqv","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/honojs/hono/security/advisories/GHSA-hxh3-vqpv-xpqv","https://nvd.nist.gov/vuln/detail/CVE-2026-93981","https://github.com/honojs/hono/commit/2b8ed402cdab6dfc5e829b480806dcd8db94161e","https://github.com/honojs/hono/releases/tag/v4.13.7","https://www.vulncheck.com/advisories/hono-jsx-before-4.13.7-cross-site-scripting-via-unescaped-strings"],"description":"hono/jsx renders plain strings unescaped in boundary components, leading to XSS","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":1.7,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-93981","epss":0.00227,"percentile":0.13536,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-93981","cwe":"CWE-79","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["4.13.7"],"state":"fixed","available":[{"version":"4.13.7","date":"2026-10-01","kind":"first-observed"}]},"advisories":[],"risk":0.11009499999999998},"relatedVulnerabilities":[{"id":"CVE-2026-93981","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93981","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/honojs/hono/security/advisories/GHSA-hxh3-vqpv-xpqv","https://www.vulncheck.com/advisories/hono-jsx-before-4.13.7-cross-site-scripting-via-unescaped-strings"],"description":"hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root value passed to renderToString() or renderToReadableStream() from hono/jsx/dom/server. These paths stringify their input and treat the result as already-escaped markup, so an attacker who controls such a string during server-side rendering can inject arbitrary HTML and execute script under the application's origin.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.3},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":1.7,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-93981","epss":0.00227,"percentile":0.13536,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-93981","cwe":"CWE-79","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"hono","version":"4.12.16"}},"found":{"vulnerabilityID":"GHSA-hxh3-vqpv-xpqv","versionConstraint":"<4.13.7 (semantic)"},"fix":{"suggestedVersion":"4.13.7"}}],"artifact":{"id":"pkg:npm/hono@4.12.16?package-id=000f2baa1e593039","name":"hono","version":"4.12.16","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:hono:hono:4.12.16:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/hono@4.12.16","upstreams":[]}},{"vulnerability":{"id":"GHSA-xx6v-rp6x-q39c","dataSource":"https://github.com/advisories/GHSA-xx6v-rp6x-q39c","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-xx6v-rp6x-q39c","https://nvd.nist.gov/vuln/detail/CVE-2026-42042"],"description":"Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"exploitabilityScore":2.9,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42042","epss":0.0021,"percentile":0.11182,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42042","cwe":"CWE-183","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-42042","cwe":"CWE-201","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.15.1"],"state":"fixed","available":[{"version":"1.15.1","date":"2026-05-05","kind":"first-observed"}]},"advisories":[],"risk":0.10919999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-42042","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42042","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-xx6v-rp6x-q39c"],"description":"Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library's XSRF token protection logic uses JavaScript truthy/falsy semantics instead of strict boolean comparison for the withXSRFToken config property. When this property is set to any truthy non-boolean value (via prototype pollution or misconfiguration), the same-origin check (isURLSameOrigin) is short-circuited, causing XSRF tokens to be sent to all request targets including cross-origin servers controlled by an attacker. This vulnerability is fixed in 1.15.1 and 0.31.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"exploitabilityScore":2.9,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42042","epss":0.0021,"percentile":0.11182,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42042","cwe":"CWE-183","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-42042","cwe":"CWE-201","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.15.0"}},"found":{"vulnerabilityID":"GHSA-xx6v-rp6x-q39c","versionConstraint":">=1.0.0,<1.15.1 (semantic)"},"fix":{"suggestedVersion":"1.15.1"}}],"artifact":{"id":"pkg:npm/axios@1.15.0?package-id=520b8e92ffff8054","name":"axios","version":"1.15.0","type":"npm","locations":[{"path":"/sink/oidc-server/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.15.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.15.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-ffhc-5mcf-pf4q","dataSource":"https://github.com/advisories/GHSA-ffhc-5mcf-pf4q","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/vercel/next.js/security/advisories/GHSA-ffhc-5mcf-pf4q","https://github.com/vercel/next.js/releases/tag/v15.5.16","https://github.com/vercel/next.js/releases/tag/v16.2.5","https://nvd.nist.gov/vuln/detail/CVE-2026-44581"],"description":"Next.js vulnerable to cross-site scripting in App Router applications using CSP nonces","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":1.7,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44581","epss":0.00222,"percentile":0.12889,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44581","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["16.2.5"],"state":"fixed","available":[{"version":"16.2.5","date":"2026-05-11","kind":"first-observed"}]},"advisories":[],"risk":0.10767000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-44581","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44581","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/vercel/next.js/security/advisories/GHSA-ffhc-5mcf-pf4q"],"description":"Next.js is a React framework for building full-stack web applications. From 13.4.0 to before 15.5.16 and 16.2.5, App Router applications that rely on CSP nonces can be vulnerable to stored cross-site scripting when deployed behind shared caches. In affected versions, malformed nonce values derived from request headers could be reflected into rendered HTML in an unsafe way, allowing an attacker to poison cached responses and cause script execution for later visitors. This vulnerability is fixed in 15.5.16 and 16.2.5.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":1.7,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44581","epss":0.00222,"percentile":0.12889,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44581","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"next","version":"16.1.7"}},"found":{"vulnerabilityID":"GHSA-ffhc-5mcf-pf4q","versionConstraint":">=16.0.0,<16.2.5 (semantic)"},"fix":{"suggestedVersion":"16.2.5"}}],"artifact":{"id":"pkg:npm/next@16.1.7?package-id=662de087d22e519d","name":"next","version":"16.1.7","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vercel:next.js:16.1.7:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/next@16.1.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-cmwh-pvxp-8882","dataSource":"https://github.com/advisories/GHSA-cmwh-pvxp-8882","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/cure53/DOMPurify/security/advisories/GHSA-cmwh-pvxp-8882","https://github.com/cure53/DOMPurify/pull/1482","https://github.com/cure53/DOMPurify/commit/011bc3b2fcc4be17aa76f9030e8668207717acb9","https://github.com/cure53/DOMPurify/releases/tag/3.4.11"],"description":"DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","metrics":{"baseScore":5.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-65898","epss":0.00212,"percentile":0.11533,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-65898","cwe":"CWE-79","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["3.4.11"],"state":"fixed","available":[{"version":"3.4.11","date":"2026-06-19","kind":"first-observed"}]},"advisories":[],"risk":0.10705999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-65898","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-65898","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/cure53/DOMPurify/security/advisories/GHSA-cmwh-pvxp-8882","https://www.vulncheck.com/advisories/dompurify-before-permanent-attribute-allowlist-pollution-via-setconfig"],"description":"DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist. Attackers can register a hook that conditionally allows dangerous attributes like onerror for trusted elements, then submit untrusted content that inherits the polluted allowlist and executes event handlers as stored XSS.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.1},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":7.2,"exploitabilityScore":3.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-65898","epss":0.00212,"percentile":0.11533,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-65898","cwe":"CWE-79","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"dompurify","version":"3.3.3"}},"found":{"vulnerabilityID":"GHSA-cmwh-pvxp-8882","versionConstraint":"<=3.4.10 (semantic)"},"fix":{"suggestedVersion":"3.4.11"}}],"artifact":{"id":"pkg:npm/dompurify@3.3.3?package-id=5ef50eed3845476c","name":"dompurify","version":"3.3.3","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MPL-2.0 OR Apache-2.0"],"cpes":["cpe:2.3:a:dompurify:dompurify:3.3.3:*:*:*:*:*:*:*"],"purl":"pkg:npm/dompurify@3.3.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-vxr8-fq34-vvx9","dataSource":"https://github.com/advisories/GHSA-vxr8-fq34-vvx9","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/cure53/DOMPurify/security/advisories/GHSA-vxr8-fq34-vvx9"],"description":"DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later `RETURN_TRUSTED_TYPE` output","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","metrics":{"baseScore":2.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-65899","epss":0.00413,"percentile":0.35562,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-65899","cwe":"CWE-693","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["3.4.9"],"state":"fixed","available":[{"version":"3.4.9","date":"2026-06-16","kind":"first-observed"}]},"advisories":[],"risk":0.105315},"relatedVulnerabilities":[{"id":"CVE-2026-65899","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-65899","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/cure53/DOMPurify/commit/825e617753ac1169306a542d3174a77f717a0cf6","https://github.com/cure53/DOMPurify/security/advisories/GHSA-vxr8-fq34-vvx9","https://www.vulncheck.com/advisories/dompurify-before-trusted-types-policy-state-contamination"],"description":"DOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types policy when clearConfig() is called, so a DOMPurify instance reused across trust boundaries stays bound to a previously supplied TRUSTED_TYPES_POLICY. A later caller that requests RETURN_TRUSTED_TYPE output receives a TrustedHTML object created by the old (potentially unsafe) policy rather than a clean default, which can lead to script execution at a Trusted Types sink. Passing TRUSTED_TYPES_POLICY: null on the later call also does not clear the retained policy.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.1},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-65899","epss":0.00413,"percentile":0.35562,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-65899","cwe":"CWE-693","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"dompurify","version":"3.3.3"}},"found":{"vulnerabilityID":"GHSA-vxr8-fq34-vvx9","versionConstraint":"<3.4.9 (semantic)"},"fix":{"suggestedVersion":"3.4.9"}}],"artifact":{"id":"pkg:npm/dompurify@3.3.3?package-id=5ef50eed3845476c","name":"dompurify","version":"3.3.3","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MPL-2.0 OR Apache-2.0"],"cpes":["cpe:2.3:a:dompurify:dompurify:3.3.3:*:*:*:*:*:*:*"],"purl":"pkg:npm/dompurify@3.3.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-4642-5mcj-2rqw","dataSource":"https://github.com/advisories/GHSA-4642-5mcj-2rqw","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/digitalbazaar/forge/security/advisories/GHSA-4642-5mcj-2rqw","https://nvd.nist.gov/vuln/detail/CVE-2026-118775","https://github.com/digitalbazaar/forge/commit/e56a3dde8e4e63bae566bb32546eeaf92f515e1e","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1"],"description":"Forge: ASN.1 OID first arc truncation in asn1.oidToDer","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118775","epss":0.00313,"percentile":0.24276,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118775","cwe":"CWE-190","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.4.1"],"state":"fixed","available":[{"version":"1.4.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.10485499999999999},"relatedVulnerabilities":[{"id":"CVE-2026-118775","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118775","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/digitalbazaar/forge/commit/e56a3dde8e4e63bae566bb32546eeaf92f515e1e","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","https://github.com/digitalbazaar/forge/security/advisories/GHSA-4642-5mcj-2rqw"],"description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, asn1.oidToDer() in lib/asn1.js did not range-check the first two arcs of an OID. An application that accepted an untrusted OID string, checked or authorized that string, and then encoded it with asn1.oidToDer() could emit DER representing a different, trusted OID from the one that was checked. DER parsing is not affected. This issue is fixed in version 1.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118775","epss":0.00313,"percentile":0.24276,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118775","cwe":"CWE-190","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"node-forge","version":"1.4.0"}},"found":{"vulnerabilityID":"GHSA-4642-5mcj-2rqw","versionConstraint":"<=1.4.0 (semantic)"},"fix":{"suggestedVersion":"1.4.1"}}],"artifact":{"id":"pkg:npm/node-forge@1.4.0?package-id=1e94284aa936f13c","name":"node-forge","version":"1.4.0","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause OR GPL-2.0"],"cpes":["cpe:2.3:a:digitalbazaar:forge:1.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/node-forge@1.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-4642-5mcj-2rqw","dataSource":"https://github.com/advisories/GHSA-4642-5mcj-2rqw","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/digitalbazaar/forge/security/advisories/GHSA-4642-5mcj-2rqw","https://nvd.nist.gov/vuln/detail/CVE-2026-118775","https://github.com/digitalbazaar/forge/commit/e56a3dde8e4e63bae566bb32546eeaf92f515e1e","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1"],"description":"Forge: ASN.1 OID first arc truncation in asn1.oidToDer","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118775","epss":0.00313,"percentile":0.24276,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118775","cwe":"CWE-190","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.4.1"],"state":"fixed","available":[{"version":"1.4.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.10485499999999999},"relatedVulnerabilities":[{"id":"CVE-2026-118775","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118775","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/digitalbazaar/forge/commit/e56a3dde8e4e63bae566bb32546eeaf92f515e1e","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","https://github.com/digitalbazaar/forge/security/advisories/GHSA-4642-5mcj-2rqw"],"description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, asn1.oidToDer() in lib/asn1.js did not range-check the first two arcs of an OID. An application that accepted an untrusted OID string, checked or authorized that string, and then encoded it with asn1.oidToDer() could emit DER representing a different, trusted OID from the one that was checked. DER parsing is not affected. This issue is fixed in version 1.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118775","epss":0.00313,"percentile":0.24276,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118775","cwe":"CWE-190","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"node-forge","version":"1.4.0"}},"found":{"vulnerabilityID":"GHSA-4642-5mcj-2rqw","versionConstraint":"<=1.4.0 (semantic)"},"fix":{"suggestedVersion":"1.4.1"}}],"artifact":{"id":"pkg:npm/node-forge@1.4.0?package-id=86ba9cb3dfe9125a","name":"node-forge","version":"1.4.0","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause OR GPL-2.0"],"cpes":["cpe:2.3:a:digitalbazaar:forge:1.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/node-forge@1.4.0","upstreams":[]}},{"vulnerability":{"id":"GO-2026-6179","dataSource":"https://go.dev/issue/80744","namespace":"govulndb:language:go","severity":"High","urls":["https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://go.dev/cl/814960","https://go.dev/cl/815020"],"description":"A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache.\n\nThis attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log.\n\nAll tiles are now correctly verified against their parents.\n\nIn order to determine if you have been affected:\n\nrm -r go.sum go.work.sum vendor/ && go mod tidy","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"exploitabilityScore":2.6,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-56865","epss":0.00129,"percentile":0.02529,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-56865","cwe":"CWE-347","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.40.0"],"state":"fixed","available":[{"version":"0.40.0","date":"2026-08-13","kind":"release"}]},"advisories":[],"risk":0.10255500000000001},"relatedVulnerabilities":[{"id":"CVE-2026-56865","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56865","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/814960","https://go.dev/cl/815020","https://go.dev/issue/80744","https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://pkg.go.dev/vuln/GO-2026-6179"],"description":"A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log. All tiles are now correctly verified against their parents. In order to determine if you have been affected:   rm -r go.sum go.work.sum vendor/ && go mod tidy","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"exploitabilityScore":2.6,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-56865","epss":0.00129,"percentile":0.02529,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-56865","cwe":"CWE-347","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/mod","version":"v0.37.0"}},"found":{"vulnerabilityID":"GO-2026-6179","versionConstraint":"<0.40.0 (go)"},"fix":{"suggestedVersion":"0.40.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/mod@v0.37.0?package-id=66a79f08c043fa23","name":"golang.org/x/mod","version":"v0.37.0","type":"go-module","locations":[{"path":"/backend-go/go.mod","accessPath":""}],"language":"go","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:golang:x\\/mod:v0.37.0:*:*:*:*:*:*:*"],"purl":"pkg:golang/golang.org/x/mod@v0.37.0","upstreams":[],"metadataType":"GolangSourceMetadata","metadata":{"h1Digest":"h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=","os":"linux","architecture":"amd64","cgoEnabled":true}}},{"vulnerability":{"id":"GHSA-p77w-8qqv-26rm","dataSource":"https://github.com/advisories/GHSA-p77w-8qqv-26rm","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/honojs/hono/security/advisories/GHSA-p77w-8qqv-26rm","https://nvd.nist.gov/vuln/detail/CVE-2026-44457"],"description":"Hono's Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44457","epss":0.00198,"percentile":0.09543,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44457","cwe":"CWE-524","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.12.18"],"state":"fixed","available":[{"version":"4.12.18","date":"2026-05-09","kind":"first-observed"}]},"advisories":[],"risk":0.10197},"relatedVulnerabilities":[{"id":"CVE-2026-44457","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44457","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/honojs/hono/security/advisories/GHSA-p77w-8qqv-26rm"],"description":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, Cache Middleware does not skip caching for responses that declare per-user variance via Vary: Authorization or Vary: Cookie. As a result, a response cached for one authenticated user may be served to subsequent requests from different users. This vulnerability is fixed in 4.12.18.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44457","epss":0.00198,"percentile":0.09543,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44457","cwe":"CWE-524","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"hono","version":"4.12.16"}},"found":{"vulnerabilityID":"GHSA-p77w-8qqv-26rm","versionConstraint":"<4.12.18 (semantic)"},"fix":{"suggestedVersion":"4.12.18"}}],"artifact":{"id":"pkg:npm/hono@4.12.16?package-id=000f2baa1e593039","name":"hono","version":"4.12.16","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:hono:hono:4.12.16:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/hono@4.12.16","upstreams":[]}},{"vulnerability":{"id":"GHSA-333x-w4r6-6crp","dataSource":"https://github.com/advisories/GHSA-333x-w4r6-6crp","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-333x-w4r6-6crp","https://nvd.nist.gov/vuln/detail/CVE-2026-110725","https://github.com/fastify/fast-uri/commit/39e6493c1356f30a0084171627eb266786e1620e","https://github.com/fastify/fast-uri/commit/a9b8d67353630aab053cd727cf629023dd018d2b","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v2.4.8","https://github.com/fastify/fast-uri/releases/tag/v3.1.9","https://github.com/fastify/fast-uri/releases/tag/v4.2.3"],"description":"fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110725","epss":0.00302,"percentile":0.23001,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110725","cwe":"CWE-41","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-110725","cwe":"CWE-116","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["3.1.9"],"state":"fixed","available":[{"version":"3.1.9","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.10117},"relatedVulnerabilities":[{"id":"CVE-2026-110725","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110725","namespace":"nvd:cpe","severity":"Low","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-333x-w4r6-6crp"],"description":"fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, when serialize(), normalize(), or resolve() are called with the non-default option reference set to suffix on a reference that has no authority, the emitted relative reference can contain a bare colon in its first path segment without escaping it, even though RFC 3986 forbids that because it makes the string reparse as an absolute URI with a scheme. An application that serializes or normalizes a relative reference with the suffix option and then treats the result as a URI can turn inert input into a live javascript, data, or vbscript URL, a cross-site scripting vector, and the equal() comparison can conflate a scheme-bearing reference with a relative one. Exposure is limited to applications using the non-default suffix reference option. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to one of these versions or later. As a workaround, avoid the suffix reference option on untrusted input, or percent-encode a colon in the first path segment of the result before treating it as a URI.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110725","epss":0.00302,"percentile":0.23001,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110725","cwe":"CWE-41","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-110725","cwe":"CWE-116","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"3.1.0"}},"found":{"vulnerabilityID":"GHSA-333x-w4r6-6crp","versionConstraint":">=3.0.0,<3.1.9 (semantic)"},"fix":{"suggestedVersion":"3.1.9"}}],"artifact":{"id":"pkg:npm/fast-uri@3.1.0?package-id=a87bf2e2258cda95","name":"fast-uri","version":"3.1.0","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:openjsf:fast-uri:3.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@3.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-333x-w4r6-6crp","dataSource":"https://github.com/advisories/GHSA-333x-w4r6-6crp","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-333x-w4r6-6crp","https://nvd.nist.gov/vuln/detail/CVE-2026-110725","https://github.com/fastify/fast-uri/commit/39e6493c1356f30a0084171627eb266786e1620e","https://github.com/fastify/fast-uri/commit/a9b8d67353630aab053cd727cf629023dd018d2b","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v2.4.8","https://github.com/fastify/fast-uri/releases/tag/v3.1.9","https://github.com/fastify/fast-uri/releases/tag/v4.2.3"],"description":"fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110725","epss":0.00302,"percentile":0.23001,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110725","cwe":"CWE-41","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-110725","cwe":"CWE-116","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["3.1.9"],"state":"fixed","available":[{"version":"3.1.9","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.10117},"relatedVulnerabilities":[{"id":"CVE-2026-110725","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110725","namespace":"nvd:cpe","severity":"Low","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-333x-w4r6-6crp"],"description":"fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, when serialize(), normalize(), or resolve() are called with the non-default option reference set to suffix on a reference that has no authority, the emitted relative reference can contain a bare colon in its first path segment without escaping it, even though RFC 3986 forbids that because it makes the string reparse as an absolute URI with a scheme. An application that serializes or normalizes a relative reference with the suffix option and then treats the result as a URI can turn inert input into a live javascript, data, or vbscript URL, a cross-site scripting vector, and the equal() comparison can conflate a scheme-bearing reference with a relative one. Exposure is limited to applications using the non-default suffix reference option. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to one of these versions or later. As a workaround, avoid the suffix reference option on untrusted input, or percent-encode a colon in the first path segment of the result before treating it as a URI.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110725","epss":0.00302,"percentile":0.23001,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110725","cwe":"CWE-41","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-110725","cwe":"CWE-116","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"3.1.8"}},"found":{"vulnerabilityID":"GHSA-333x-w4r6-6crp","versionConstraint":">=3.0.0,<3.1.9 (semantic)"},"fix":{"suggestedVersion":"3.1.9"}}],"artifact":{"id":"pkg:npm/fast-uri@3.1.8?package-id=5f1672bb3cdc5ac8","name":"fast-uri","version":"3.1.8","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:openjsf:fast-uri:3.1.8:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@3.1.8","upstreams":[]}},{"vulnerability":{"id":"GO-2026-6866","dataSource":"https://go.dev/cl/855121","namespace":"govulndb:language:go","severity":"Unknown","urls":["https://go.dev/issue/82622","https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs"],"description":"In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as <mglyph> or <malignmark> fostered under <mtext>), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output.\n\nContinue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text.","cvss":[],"epss":[{"cve":"CVE-2026-97045","epss":0.00202,"percentile":0.10121,"date":"2026-10-31"}],"fix":{"versions":["0.62.0"],"state":"fixed","available":[{"version":"0.62.0","date":"2026-10-27","kind":"release"}]},"advisories":[],"risk":0.101},"relatedVulnerabilities":[{"id":"CVE-2026-97045","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97045","namespace":"nvd:cpe","severity":"Unknown","urls":["https://go.dev/cl/855121","https://go.dev/issue/82622","https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs","https://pkg.go.dev/vuln/GO-2026-6866"],"description":"In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as <mglyph> or <malignmark> fostered under <mtext>), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output. Continue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text.","cvss":[],"epss":[{"cve":"CVE-2026-97045","epss":0.00202,"percentile":0.10121,"date":"2026-10-31"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.56.0"}},"found":{"vulnerabilityID":"GO-2026-6866","versionConstraint":"<0.62.0 (go)"},"fix":{"suggestedVersion":"0.62.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.56.0?package-id=ab49808757d6d4dc","name":"golang.org/x/net","version":"v0.56.0","type":"go-module","locations":[{"path":"/backend-go/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.56.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.56.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.56.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o="}}},{"vulnerability":{"id":"GHSA-3hrh-pfw6-9m5x","dataSource":"https://github.com/advisories/GHSA-3hrh-pfw6-9m5x","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/honojs/hono/security/advisories/GHSA-3hrh-pfw6-9m5x","https://nvd.nist.gov/vuln/detail/CVE-2026-47675","https://github.com/honojs/hono/commit/905aedbc20661e0e2fa378783a7ec44a5c3df43d","https://github.com/honojs/hono/releases/tag/v4.12.21"],"description":"Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"exploitabilityScore":2.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-47675","epss":0.00216,"percentile":0.1206,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-47675","cwe":"CWE-113","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-47675","cwe":"CWE-1287","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.12.21"],"state":"fixed","available":[{"version":"4.12.21","date":"2026-06-05","kind":"first-observed"}]},"advisories":[],"risk":0.10043999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-47675","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47675","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/honojs/hono/security/advisories/GHSA-3hrh-pfw6-9m5x"],"description":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the serialize() function in hono/cookie validates domain and path options against characters that corrupt Set-Cookie header syntax (;, \\r, \\n), but does not apply the same validation to sameSite and priority. An application that passes user-controlled input into either option may produce a Set-Cookie response header containing attacker-chosen additional attributes. This vulnerability is fixed in 4.12.21.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"exploitabilityScore":2.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-47675","epss":0.00216,"percentile":0.1206,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-47675","cwe":"CWE-113","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-47675","cwe":"CWE-1287","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"hono","version":"4.12.16"}},"found":{"vulnerabilityID":"GHSA-3hrh-pfw6-9m5x","versionConstraint":"<4.12.21 (semantic)"},"fix":{"suggestedVersion":"4.12.21"}}],"artifact":{"id":"pkg:npm/hono@4.12.16?package-id=000f2baa1e593039","name":"hono","version":"4.12.16","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:hono:hono:4.12.16:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/hono@4.12.16","upstreams":[]}},{"vulnerability":{"id":"GHSA-f577-qrjj-4474","dataSource":"https://github.com/advisories/GHSA-f577-qrjj-4474","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/honojs/hono/security/advisories/GHSA-f577-qrjj-4474","https://nvd.nist.gov/vuln/detail/CVE-2026-47673","https://github.com/honojs/hono/commit/5463db2735476959b8af67756f4e513f4fe19115","https://github.com/honojs/hono/releases/tag/v4.12.21"],"description":"Hono: JWT middleware accepts any Authorization scheme, not only Bearer","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-47673","epss":0.00199,"percentile":0.09708,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-47673","cwe":"CWE-285","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.12.21"],"state":"fixed","available":[{"version":"4.12.21","date":"2026-06-05","kind":"first-observed"}]},"advisories":[],"risk":0.09751},"relatedVulnerabilities":[{"id":"CVE-2026-47673","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47673","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/honojs/hono/security/advisories/GHSA-f577-qrjj-4474"],"description":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the jwt and jwk middlewares do not verify that the Authorization header value uses theBearer scheme. Any two-part header value — regardless of the scheme name in the first position — proceeds to JWT verification. A request presenting a valid JWT under a non-Bearer scheme identifier (such as Basic or Token) is authenticated identically to a correctly formed Bearer request. This vulnerability is fixed in 4.12.21.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-47673","epss":0.00199,"percentile":0.09708,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-47673","cwe":"CWE-285","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"hono","version":"4.12.16"}},"found":{"vulnerabilityID":"GHSA-f577-qrjj-4474","versionConstraint":"<4.12.21 (semantic)"},"fix":{"suggestedVersion":"4.12.21"}}],"artifact":{"id":"pkg:npm/hono@4.12.16?package-id=000f2baa1e593039","name":"hono","version":"4.12.16","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:hono:hono:4.12.16:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/hono@4.12.16","upstreams":[]}},{"vulnerability":{"id":"GHSA-9jhj-wvmw-cfx5","dataSource":"https://github.com/advisories/GHSA-9jhj-wvmw-cfx5","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-9jhj-wvmw-cfx5","https://nvd.nist.gov/vuln/detail/CVE-2026-115730","https://github.com/i18next/i18next-http-backend/commit/042c3d4e4e9d73b2ae3aa76b22cb45d48f1e35b7","https://www.vulncheck.com/advisories/i18next-http-backend-4.0.2-protocol-relative-url-injection-via-namespace-in-interpolateurl"],"description":"i18next-http-backend: Namespace value starting with / forms a protocol-relative URL when loadPath/addPath places {{ns}} right after a / (bypass of the // check added for GHSA-xvq9-wjp8-hwqf)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.1,"exploitabilityScore":1.7,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-115730","epss":0.00318,"percentile":0.2482,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-115730","cwe":"CWE-74","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["4.0.3"],"state":"fixed","available":[{"version":"4.0.3","date":"2026-10-29","kind":"first-observed"}]},"advisories":[],"risk":0.09698999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-115730","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115730","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/i18next/i18next-http-backend/commit/042c3d4e4e9d73b2ae3aa76b22cb45d48f1e35b7","https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-9jhj-wvmw-cfx5","https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-xvq9-wjp8-hwqf","https://www.vulncheck.com/advisories/i18next-http-backend-4.0.2-protocol-relative-url-injection-via-namespace-in-interpolateurl"],"description":"i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that allows attackers to redirect translation requests by supplying an ns value starting with a slash. Attackers controlling the namespace value can form a protocol-relative URL in loadPath or addPath templates to load attacker-hosted translations, enabling UI content injection and cross-site scripting.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.3},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.1,"exploitabilityScore":1.7,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-115730","epss":0.00318,"percentile":0.2482,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-115730","cwe":"CWE-74","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"i18next-http-backend","version":"3.0.1"}},"found":{"vulnerabilityID":"GHSA-9jhj-wvmw-cfx5","versionConstraint":"<4.0.3 (semantic)"},"fix":{"suggestedVersion":"4.0.3"}}],"artifact":{"id":"pkg:npm/i18next-http-backend@3.0.1?package-id=05b13842ffa31e89","name":"i18next-http-backend","version":"3.0.1","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:i18next:i18next-http-backend:3.0.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/i18next-http-backend@3.0.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-xhq7-xmqj-769h","dataSource":"https://github.com/advisories/GHSA-xhq7-xmqj-769h","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-xhq7-xmqj-769h","https://nvd.nist.gov/vuln/detail/CVE-2026-110095","https://github.com/fastify/fast-uri/commit/048bbd0a252971be86d6579f0dfc87f8de5b9c47","https://github.com/fastify/fast-uri/commit/52774a5c35df36b0bbe439cd4c12c3dc0e50e3b9","https://github.com/fastify/fast-uri/commit/7c19f8b97ec51f1f20b4e3d9d5820cb8d5176058","https://github.com/fastify/fast-uri/commit/9eb8759a9825c046f57f7f695f1944bc39b88abd","https://github.com/fastify/fast-uri/commit/acc5c5d60c4209571789496e1732468911c7e12a","https://github.com/fastify/fast-uri/commit/b110a3571c37dfcf9d1c72ce2e2e178c78d1a424","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v2.4.8","https://github.com/fastify/fast-uri/releases/tag/v3.1.9","https://github.com/fastify/fast-uri/releases/tag/v4.2.3"],"description":"fast-uri vulnerable to improper path equivalence in relative reference normalization","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110095","epss":0.00289,"percentile":0.21549,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110095","cwe":"CWE-41","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["3.1.9"],"state":"fixed","available":[{"version":"3.1.9","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.096815},"relatedVulnerabilities":[{"id":"CVE-2026-110095","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110095","namespace":"nvd:cpe","severity":"Low","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-xhq7-xmqj-769h"],"description":"fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, the normalize() and serialize() functions apply RFC 3986 dot-segment removal to the path of a relative-path reference, even though that algorithm is defined only for the merged target path during resolution, so a leading parent-directory segment can be dropped and a document-relative reference can become root-relative. An application that normalizes an attacker-supplied or user-supplied relative reference and then resolves it, or uses it as a cache, deduplication, or authorization key, can have the reference escape its intended directory and point at a different resource. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to one of these versions or later. As a workaround, resolve a relative reference against its absolute base first and normalize the absolute result instead of normalizing the reference beforehand.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110095","epss":0.00289,"percentile":0.21549,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110095","cwe":"CWE-41","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"3.1.0"}},"found":{"vulnerabilityID":"GHSA-xhq7-xmqj-769h","versionConstraint":">=3.0.0,<3.1.9 (semantic)"},"fix":{"suggestedVersion":"3.1.9"}}],"artifact":{"id":"pkg:npm/fast-uri@3.1.0?package-id=a87bf2e2258cda95","name":"fast-uri","version":"3.1.0","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:openjsf:fast-uri:3.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@3.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-xhq7-xmqj-769h","dataSource":"https://github.com/advisories/GHSA-xhq7-xmqj-769h","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-xhq7-xmqj-769h","https://nvd.nist.gov/vuln/detail/CVE-2026-110095","https://github.com/fastify/fast-uri/commit/048bbd0a252971be86d6579f0dfc87f8de5b9c47","https://github.com/fastify/fast-uri/commit/52774a5c35df36b0bbe439cd4c12c3dc0e50e3b9","https://github.com/fastify/fast-uri/commit/7c19f8b97ec51f1f20b4e3d9d5820cb8d5176058","https://github.com/fastify/fast-uri/commit/9eb8759a9825c046f57f7f695f1944bc39b88abd","https://github.com/fastify/fast-uri/commit/acc5c5d60c4209571789496e1732468911c7e12a","https://github.com/fastify/fast-uri/commit/b110a3571c37dfcf9d1c72ce2e2e178c78d1a424","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v2.4.8","https://github.com/fastify/fast-uri/releases/tag/v3.1.9","https://github.com/fastify/fast-uri/releases/tag/v4.2.3"],"description":"fast-uri vulnerable to improper path equivalence in relative reference normalization","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110095","epss":0.00289,"percentile":0.21549,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110095","cwe":"CWE-41","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["3.1.9"],"state":"fixed","available":[{"version":"3.1.9","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.096815},"relatedVulnerabilities":[{"id":"CVE-2026-110095","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110095","namespace":"nvd:cpe","severity":"Low","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-xhq7-xmqj-769h"],"description":"fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, the normalize() and serialize() functions apply RFC 3986 dot-segment removal to the path of a relative-path reference, even though that algorithm is defined only for the merged target path during resolution, so a leading parent-directory segment can be dropped and a document-relative reference can become root-relative. An application that normalizes an attacker-supplied or user-supplied relative reference and then resolves it, or uses it as a cache, deduplication, or authorization key, can have the reference escape its intended directory and point at a different resource. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to one of these versions or later. As a workaround, resolve a relative reference against its absolute base first and normalize the absolute result instead of normalizing the reference beforehand.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110095","epss":0.00289,"percentile":0.21549,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110095","cwe":"CWE-41","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"3.1.8"}},"found":{"vulnerabilityID":"GHSA-xhq7-xmqj-769h","versionConstraint":">=3.0.0,<3.1.9 (semantic)"},"fix":{"suggestedVersion":"3.1.9"}}],"artifact":{"id":"pkg:npm/fast-uri@3.1.8?package-id=5f1672bb3cdc5ac8","name":"fast-uri","version":"3.1.8","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:openjsf:fast-uri:3.1.8:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@3.1.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-xvq9-wjp8-hwqf","dataSource":"https://github.com/advisories/GHSA-xvq9-wjp8-hwqf","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-xvq9-wjp8-hwqf","https://nvd.nist.gov/vuln/detail/CVE-2026-105800","https://github.com/i18next/i18next-http-backend/commit/07e028862b25d0b9251bf3cafb92be2d35285f85","https://github.com/i18next/i18next-http-backend/releases/tag/v4.0.2"],"description":"i18next-http-backend incomplete URL validation permits SSRF","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-105800","epss":0.00289,"percentile":0.21504,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-105800","cwe":"CWE-74","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-105800","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.0.2"],"state":"fixed","available":[{"version":"4.0.2","date":"2026-10-06","kind":"first-observed"}]},"advisories":[],"risk":0.096815},"relatedVulnerabilities":[{"id":"CVE-2026-105800","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-105800","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/i18next/i18next-http-backend/commit/07e028862b25d0b9251bf3cafb92be2d35285f85","https://github.com/i18next/i18next-http-backend/releases/tag/v4.0.2","https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-xvq9-wjp8-hwqf"],"description":"i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with {{lng}} or {{ns}} can make colon-based input become an absolute URL or, in browsers, make a double-slash namespace become a protocol-relative URL. The resulting request can leave the intended origin and cause URL injection or server-side request forgery. The default /locales/{{lng}}/{{ns}}.json template and templates with a leading path or origin are not affected because the placeholder does not occupy the URL's structural beginning. This issue is fixed in version 4.0.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-105800","epss":0.00289,"percentile":0.21504,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-105800","cwe":"CWE-74","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-105800","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"i18next-http-backend","version":"3.0.1"}},"found":{"vulnerabilityID":"GHSA-xvq9-wjp8-hwqf","versionConstraint":"<4.0.2 (semantic)"},"fix":{"suggestedVersion":"4.0.2"}}],"artifact":{"id":"pkg:npm/i18next-http-backend@3.0.1?package-id=05b13842ffa31e89","name":"i18next-http-backend","version":"3.0.1","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:i18next:i18next-http-backend:3.0.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/i18next-http-backend@3.0.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-3g8h-86w9-wvmq","dataSource":"https://github.com/advisories/GHSA-3g8h-86w9-wvmq","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/vercel/next.js/security/advisories/GHSA-3g8h-86w9-wvmq","https://github.com/vercel/next.js/releases/tag/v15.5.16","https://github.com/vercel/next.js/releases/tag/v16.2.5","https://nvd.nist.gov/vuln/detail/CVE-2026-44572"],"description":"Next.js's Middleware / Proxy redirects can be cache-poisoned","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44572","epss":0.00284,"percentile":0.20931,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44572","cwe":"CWE-349","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["16.2.5"],"state":"fixed","available":[{"version":"16.2.5","date":"2026-05-11","kind":"first-observed"}]},"advisories":[],"risk":0.09513999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-44572","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44572","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/vercel/next.js/security/advisories/GHSA-3g8h-86w9-wvmq"],"description":"Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, an external client could send a x-nextjs-data header on a normal request to a path handled by middleware that returns a redirect. When that happened, the middleware/proxy could treat the request as a data request and replace the standard Location redirect header with the internal x-nextjs-redirect header. Browsers do not follow x-nextjs-redirect, so the response became an unusable redirect for normal clients. If the application was deployed behind a CDN or reverse proxy that caches 3xx responses without varying on this header, a single attacker request could poison the cached redirect response for the affected path. Subsequent visitors could then receive a cached redirect response without a Location header, causing a denial of service for that redirect path until the cache entry expired or was purged. This vulnerability is fixed in 15.5.16 and 16.2.5.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44572","epss":0.00284,"percentile":0.20931,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44572","cwe":"CWE-349","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"next","version":"16.1.7"}},"found":{"vulnerabilityID":"GHSA-3g8h-86w9-wvmq","versionConstraint":">=16.0.0,<16.2.5 (semantic)"},"fix":{"suggestedVersion":"16.2.5"}}],"artifact":{"id":"pkg:npm/next@16.1.7?package-id=662de087d22e519d","name":"next","version":"16.1.7","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vercel:next.js:16.1.7:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/next@16.1.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-3cmx-xjww-583x","dataSource":"https://github.com/advisories/GHSA-3cmx-xjww-583x","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-3cmx-xjww-583x","https://github.com/i18next/i18next-http-backend/commit/b0eef9efd425055c554787cef7f878de33bbf510","https://github.com/i18next/i18next-http-backend/releases/tag/v4.0.4"],"description":"i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118258","epss":0.0028,"percentile":0.20572,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118258","cwe":"CWE-74","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["4.0.4"],"state":"fixed","available":[{"version":"4.0.4","date":"2026-10-29","kind":"first-observed"}]},"advisories":[],"risk":0.0938},"relatedVulnerabilities":[{"id":"CVE-2026-118258","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118258","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/i18next/i18next-http-backend/commit/b0eef9efd425055c554787cef7f878de33bbf510","https://github.com/i18next/i18next-http-backend/releases/tag/v4.0.4","https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-3cmx-xjww-583x"],"description":"i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.4, interpolateUrl inserts unencoded language and namespace values into loadPath or addPath templates without rejecting ampersand (&), equals (=), or semicolon (;) query separators. When a template places lng or ns in the query string and an attacker controls that value, the attacker can add or override parameters on browser or server-side translation requests, potentially exposing other namespaces or tenants or changing backend behavior through the application's network position and credentials. This vulnerability is the result of an incomplete fix for CVE-2026-41691. This issue is fixed in version 4.0.4.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118258","epss":0.0028,"percentile":0.20572,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118258","cwe":"CWE-74","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"i18next-http-backend","version":"3.0.1"}},"found":{"vulnerabilityID":"GHSA-3cmx-xjww-583x","versionConstraint":"<4.0.4 (semantic)"},"fix":{"suggestedVersion":"4.0.4"}}],"artifact":{"id":"pkg:npm/i18next-http-backend@3.0.1?package-id=05b13842ffa31e89","name":"i18next-http-backend","version":"3.0.1","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:i18next:i18next-http-backend:3.0.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/i18next-http-backend@3.0.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-jc66-7q78-782g","dataSource":"https://github.com/advisories/GHSA-jc66-7q78-782g","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/digitalbazaar/forge/security/advisories/GHSA-jc66-7q78-782g","https://nvd.nist.gov/vuln/detail/CVE-2026-118782","https://github.com/digitalbazaar/forge/commit/d9584aa56824972858366d5187b3d29e46bf3656","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1"],"description":"Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118782","epss":0.00125,"percentile":0.02194,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118782","cwe":"CWE-354","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-118782","cwe":"CWE-1284","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["1.4.1"],"state":"fixed","available":[{"version":"1.4.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.09375},"relatedVulnerabilities":[{"id":"CVE-2026-118782","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118782","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/digitalbazaar/forge/commit/d9584aa56824972858366d5187b3d29e46bf3656","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","https://github.com/digitalbazaar/forge/security/advisories/GHSA-jc66-7q78-782g"],"description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge accepted a PKCS#12 MAC or PKCS#12 password-based encryption iteration count of zero or less. pki.pbe.generatePkcs12Key() then returned a constant key independent of the password and salt, allowing crafted PKCS#12 input processed by forge.pkcs12.pkcs12FromAsn1() to bypass password-based integrity checks. Predictable encryption keys and IVs also affected PKCS#12 PBE using pbeWithSHAAnd3-KeyTripleDES-CBC or pbewithSHAAnd40BitRC2-CBC, including shrouded key bags, encrypted SafeContents, and PKCS#8 ENCRYPTED PRIVATE KEY input processed independently by forge.pki.decryptPrivateKeyInfo(). PBES2/PBKDF2-encrypted content is unaffected. This issue is fixed in version 1.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118782","epss":0.00125,"percentile":0.02194,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118782","cwe":"CWE-354","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-118782","cwe":"CWE-1284","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"node-forge","version":"1.4.0"}},"found":{"vulnerabilityID":"GHSA-jc66-7q78-782g","versionConstraint":"<=1.4.0 (semantic)"},"fix":{"suggestedVersion":"1.4.1"}}],"artifact":{"id":"pkg:npm/node-forge@1.4.0?package-id=1e94284aa936f13c","name":"node-forge","version":"1.4.0","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause OR GPL-2.0"],"cpes":["cpe:2.3:a:digitalbazaar:forge:1.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/node-forge@1.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-jc66-7q78-782g","dataSource":"https://github.com/advisories/GHSA-jc66-7q78-782g","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/digitalbazaar/forge/security/advisories/GHSA-jc66-7q78-782g","https://nvd.nist.gov/vuln/detail/CVE-2026-118782","https://github.com/digitalbazaar/forge/commit/d9584aa56824972858366d5187b3d29e46bf3656","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1"],"description":"Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118782","epss":0.00125,"percentile":0.02194,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118782","cwe":"CWE-354","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-118782","cwe":"CWE-1284","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["1.4.1"],"state":"fixed","available":[{"version":"1.4.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.09375},"relatedVulnerabilities":[{"id":"CVE-2026-118782","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118782","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/digitalbazaar/forge/commit/d9584aa56824972858366d5187b3d29e46bf3656","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","https://github.com/digitalbazaar/forge/security/advisories/GHSA-jc66-7q78-782g"],"description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge accepted a PKCS#12 MAC or PKCS#12 password-based encryption iteration count of zero or less. pki.pbe.generatePkcs12Key() then returned a constant key independent of the password and salt, allowing crafted PKCS#12 input processed by forge.pkcs12.pkcs12FromAsn1() to bypass password-based integrity checks. Predictable encryption keys and IVs also affected PKCS#12 PBE using pbeWithSHAAnd3-KeyTripleDES-CBC or pbewithSHAAnd40BitRC2-CBC, including shrouded key bags, encrypted SafeContents, and PKCS#8 ENCRYPTED PRIVATE KEY input processed independently by forge.pki.decryptPrivateKeyInfo(). PBES2/PBKDF2-encrypted content is unaffected. This issue is fixed in version 1.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118782","epss":0.00125,"percentile":0.02194,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118782","cwe":"CWE-354","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-118782","cwe":"CWE-1284","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"node-forge","version":"1.4.0"}},"found":{"vulnerabilityID":"GHSA-jc66-7q78-782g","versionConstraint":"<=1.4.0 (semantic)"},"fix":{"suggestedVersion":"1.4.1"}}],"artifact":{"id":"pkg:npm/node-forge@1.4.0?package-id=86ba9cb3dfe9125a","name":"node-forge","version":"1.4.0","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause OR GPL-2.0"],"cpes":["cpe:2.3:a:digitalbazaar:forge:1.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/node-forge@1.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-f87g-xv8r-7p7x","dataSource":"https://github.com/advisories/GHSA-f87g-xv8r-7p7x","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/vercel/next.js/security/advisories/GHSA-f87g-xv8r-7p7x","https://nvd.nist.gov/vuln/detail/CVE-2026-94485","https://github.com/vercel/next.js/commit/2d9f50a409312696145b82b3157aadb6b1fef476","https://github.com/vercel/next.js/releases/tag/v16.3.8"],"description":"Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-94485","epss":0.00173,"percentile":0.06695,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-94485","cwe":"CWE-346","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["16.3.8"],"state":"fixed","available":[{"version":"16.3.8","date":"2026-10-08","kind":"first-observed"}]},"advisories":[],"risk":0.09342},"relatedVulnerabilities":[{"id":"CVE-2026-94485","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94485","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/vercel/next.js/commit/2d9f50a409312696145b82b3157aadb6b1fef476","https://github.com/vercel/next.js/releases/tag/v16.3.8","https://github.com/vercel/next.js/security/advisories/GHSA-f87g-xv8r-7p7x"],"description":"Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the `next dev` development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read the project's disk location, source code snippets from error reports, route inventory, and development logs. Production deployments do not serve this endpoint. This issue is fixed in version 16.3.8.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-94485","epss":0.00173,"percentile":0.06695,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-94485","cwe":"CWE-346","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"next","version":"16.1.7"}},"found":{"vulnerabilityID":"GHSA-f87g-xv8r-7p7x","versionConstraint":">=16.0.0,<16.3.8 (semantic)"},"fix":{"suggestedVersion":"16.3.8"}}],"artifact":{"id":"pkg:npm/next@16.1.7?package-id=662de087d22e519d","name":"next","version":"16.1.7","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vercel:next.js:16.1.7:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/next@16.1.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-vmf3-w455-68vh","dataSource":"https://github.com/advisories/GHSA-vmf3-w455-68vh","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-vmf3-w455-68vh"],"description":"node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53655","epss":0.00156,"percentile":0.04757,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53655","cwe":"CWE-436","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.5.16"],"state":"fixed","available":[{"version":"7.5.16","date":"2026-06-15","kind":"first-observed"}]},"advisories":[],"risk":0.09281999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-53655","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53655","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-vmf3-w455-68vh"],"description":"node-tar is a full-featured Tar for Node.js. Prior to 7.5.16, tar (node-tar) applies a PAX extended header's size= record (and other PAX overrides) to the next header entry of any type, including intermediary metadata headers such as a GNU long-name (L) or long-link (K) entry. Per POSIX pax, a PAX extended header (x) describes the next file entry, not the intermediary extension headers that may sit between the x header and the file it annotates. Because node-tar lets the PAX size override the byte length of an intervening L/K/x header, an attacker can desynchronize node-tar's stream cursor relative to every other mainstream tar implementation (GNU tar, libarchive/bsdtar, Python tarfile, and the now-fixed tar-rs / astral-tokio-tar). The result is a tar parser interpretation differential (CWE-436): a single crafted archive yields a different set of members under node-tar than under the reference tar tools. An attacker can use this to hide a member from one parser while it is visible to another, which defeats security tooling whose scanner and extractor disagree on archive contents (e.g. a malware/secret scanner that lists entries with one library while a downstream step extracts with another) This vulnerability is fixed in 7.5.16.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.5,"exploitabilityScore":1.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53655","epss":0.00156,"percentile":0.04757,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53655","cwe":"CWE-436","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"7.5.13"}},"found":{"vulnerabilityID":"GHSA-vmf3-w455-68vh","versionConstraint":"<=7.5.15 (semantic)"},"fix":{"suggestedVersion":"7.5.16"}}],"artifact":{"id":"pkg:npm/tar@7.5.13?package-id=c08fe2f2d0b796ea","name":"tar","version":"7.5.13","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BlueOak-1.0.0"],"cpes":["cpe:2.3:a:tar_project:tar:7.5.13:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:7.5.13:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:7.5.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@7.5.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-5p39-cfhj-2xmp","dataSource":"https://github.com/advisories/GHSA-5p39-cfhj-2xmp","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/agronholm/anyio/security/advisories/GHSA-5p39-cfhj-2xmp","https://github.com/agronholm/anyio/pull/1207","https://github.com/agronholm/anyio/commit/f1b7301c8264b0d2e8d24a5788fd29e93dea4040","https://github.com/agronholm/anyio/releases/tag/4.14.2"],"description":"AnyIO process-pool workers can block indefinitely on undrained stderr","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":6.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-64847","epss":0.00157,"percentile":0.04782,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-64847","cwe":"CWE-770","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["4.14.2"],"state":"fixed","available":[{"version":"4.14.2","date":"2026-09-19","kind":"first-observed"}]},"advisories":[],"risk":0.09262999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-64847","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64847","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/agronholm/anyio/commit/f1b7301c8264b0d2e8d24a5788fd29e93dea4040","https://github.com/agronholm/anyio/pull/1207","https://github.com/agronholm/anyio/releases/tag/4.14.2","https://github.com/agronholm/anyio/security/advisories/GHSA-5p39-cfhj-2xmp"],"description":"AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, AnyIO starts process-pool workers with standard error connected to a pipe that the parent never drains, even though the documented behavior redirects all three standard streams. Worker code that writes enough attacker-influenced data to sys.stderr can fill the pipe and block before returning the standard-output protocol response, causing the awaiting process-pool call to remain blocked indefinitely. Applications that run untrusted or faulty worker code capable of producing substantial standard-error output are affected. This issue is fixed in version 4.14.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-64847","epss":0.00157,"percentile":0.04782,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-64847","cwe":"CWE-770","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"anyio","version":"4.11.0"}},"found":{"vulnerabilityID":"GHSA-5p39-cfhj-2xmp","versionConstraint":"<4.14.2 (python)"},"fix":{"suggestedVersion":"4.14.2"}}],"artifact":{"id":"pkg:pypi/anyio@4.11.0?package-id=db69f8163af3e835","name":"anyio","version":"4.11.0","type":"python","locations":[{"path":"/backend/bdd/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-anyio:python-anyio:4.11.0:*:*:*:*:*:*:*","cpe:2.3:a:python-anyio:python_anyio:4.11.0:*:*:*:*:*:*:*","cpe:2.3:a:python_anyio:python-anyio:4.11.0:*:*:*:*:*:*:*","cpe:2.3:a:python_anyio:python_anyio:4.11.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-anyio:4.11.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_anyio:4.11.0:*:*:*:*:*:*:*","cpe:2.3:a:anyio:python-anyio:4.11.0:*:*:*:*:*:*:*","cpe:2.3:a:anyio:python_anyio:4.11.0:*:*:*:*:*:*:*","cpe:2.3:a:python-anyio:anyio:4.11.0:*:*:*:*:*:*:*","cpe:2.3:a:python_anyio:anyio:4.11.0:*:*:*:*:*:*:*","cpe:2.3:a:python:anyio:4.11.0:*:*:*:*:*:*:*","cpe:2.3:a:anyio:anyio:4.11.0:*:*:*:*:*:*:*"],"purl":"pkg:pypi/anyio@4.11.0","upstreams":[]}},{"vulnerability":{"id":"GO-2026-6860","dataSource":"https://go.dev/cl/849365","namespace":"govulndb:language:go","severity":"Unknown","urls":["https://go.dev/issue/82224","https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs"],"description":"When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as \"a</x>\") caused O(n^2) allocations and byte copies.\n\nAccumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.","cvss":[],"epss":[{"cve":"CVE-2026-78661","epss":0.00185,"percentile":0.08066,"date":"2026-10-31"}],"fix":{"versions":["0.62.0"],"state":"fixed","available":[{"version":"0.62.0","date":"2026-10-27","kind":"release"}]},"advisories":[],"risk":0.0925},"relatedVulnerabilities":[{"id":"CVE-2026-78661","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78661","namespace":"nvd:cpe","severity":"Unknown","urls":["https://go.dev/cl/849365","https://go.dev/issue/82224","https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs","https://pkg.go.dev/vuln/GO-2026-6860"],"description":"When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as \"a</x>\") caused O(n^2) allocations and byte copies. Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.","cvss":[],"epss":[{"cve":"CVE-2026-78661","epss":0.00185,"percentile":0.08066,"date":"2026-10-31"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.56.0"}},"found":{"vulnerabilityID":"GO-2026-6860","versionConstraint":"<0.62.0 (go)"},"fix":{"suggestedVersion":"0.62.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.56.0?package-id=ab49808757d6d4dc","name":"golang.org/x/net","version":"v0.56.0","type":"go-module","locations":[{"path":"/backend-go/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.56.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.56.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.56.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o="}}},{"vulnerability":{"id":"GHSA-qp7p-654g-cw7p","dataSource":"https://github.com/advisories/GHSA-qp7p-654g-cw7p","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/honojs/hono/security/advisories/GHSA-qp7p-654g-cw7p"],"description":"Hono has CSS Declaration Injection via Style Object Values in JSX SSR","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"exploitabilityScore":2.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44458","epss":0.00197,"percentile":0.09503,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44458","cwe":"CWE-74","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-44458","cwe":"CWE-116","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.12.18"],"state":"fixed","available":[{"version":"4.12.18","date":"2026-05-09","kind":"first-observed"}]},"advisories":[],"risk":0.09160499999999999},"relatedVulnerabilities":[{"id":"CVE-2026-44458","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44458","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/honojs/hono/security/advisories/GHSA-qp7p-654g-cw7p"],"description":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, the JSX renderer escapes style attribute object values for HTML but not for CSS. Untrusted input in a style object value or property name can therefore inject additional CSS declarations into the rendered style attribute. The impact is limited to CSS and does not allow JavaScript execution or HTML attribute breakout. This vulnerability is fixed in 4.12.18.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"exploitabilityScore":2.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44458","epss":0.00197,"percentile":0.09503,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44458","cwe":"CWE-74","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-44458","cwe":"CWE-116","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"hono","version":"4.12.16"}},"found":{"vulnerabilityID":"GHSA-qp7p-654g-cw7p","versionConstraint":"<4.12.18 (semantic)"},"fix":{"suggestedVersion":"4.12.18"}}],"artifact":{"id":"pkg:npm/hono@4.12.16?package-id=000f2baa1e593039","name":"hono","version":"4.12.16","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:hono:hono:4.12.16:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/hono@4.12.16","upstreams":[]}},{"vulnerability":{"id":"GHSA-xgm2-5f3f-mvvc","dataSource":"https://github.com/advisories/GHSA-xgm2-5f3f-mvvc","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/honojs/hono/security/advisories/GHSA-xgm2-5f3f-mvvc","https://nvd.nist.gov/vuln/detail/CVE-2026-59897","https://github.com/honojs/hono/commit/aa921770d09bc35970362d5a2630a878f6d982fd","https://github.com/honojs/hono/releases/tag/v4.12.27"],"description":"Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59897","epss":0.0018,"percentile":0.07537,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59897","cwe":"CWE-348","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.12.27"],"state":"fixed","available":[{"version":"4.12.27","date":"2026-07-22","kind":"first-observed"}]},"advisories":[],"risk":0.0882},"relatedVulnerabilities":[{"id":"CVE-2026-59897","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59897","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/honojs/hono/commit/aa921770d09bc35970362d5a2630a878f6d982fd","https://github.com/honojs/hono/releases/tag/v4.12.27","https://github.com/honojs/hono/security/advisories/GHSA-xgm2-5f3f-mvvc"],"description":"Hono is a Web application framework that provides support for any JavaScript runtime. From 4.3.3 before 4.12.27, the AWS API Gateway v1 adapter can drop a distinct repeated request header value because it de-duplicates values using a substring comparison instead of an exact match, so middleware or application logic that depends on the complete X-Forwarded-For chain, rate limiting, audit logging, or proxy-chain validation can receive incomplete data. This issue is fixed in version 4.12.27.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59897","epss":0.0018,"percentile":0.07537,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59897","cwe":"CWE-348","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"hono","version":"4.12.16"}},"found":{"vulnerabilityID":"GHSA-xgm2-5f3f-mvvc","versionConstraint":">=4.3.3,<4.12.27 (semantic)"},"fix":{"suggestedVersion":"4.12.27"}}],"artifact":{"id":"pkg:npm/hono@4.12.16?package-id=000f2baa1e593039","name":"hono","version":"4.12.16","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:hono:hono:4.12.16:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/hono@4.12.16","upstreams":[]}},{"vulnerability":{"id":"GHSA-3m5p-2c4r-xxw2","dataSource":"https://github.com/advisories/GHSA-3m5p-2c4r-xxw2","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/fastify/fastify/security/advisories/GHSA-3m5p-2c4r-xxw2","https://nvd.nist.gov/vuln/detail/CVE-2026-16732","https://github.com/fastify/fastify/commit/8acfea7eada05383a7357e3eb21c2628416df280","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fastify/releases/tag/v5.12.1"],"description":"fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":1.7,"impactScore":4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-16732","epss":0.00158,"percentile":0.04903,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-16732","cwe":"CWE-348","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["5.12.1"],"state":"fixed","available":[{"version":"5.12.1","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.08768999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-16732","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16732","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fastify/security/advisories/GHSA-3m5p-2c4r-xxw2"],"description":"fastify is a fast and low overhead web framework for Node.js. Impact: the fix for CVE-2026-3635 added a guard on the forwarded-header reads used to derive the request host, protocol, hostname, ip, and ips values, checking the connecting address. That guard closes the IP, CIDR, and custom-function forms of trustProxy correctly, because those forms compile to predicates that inspect the connecting address. The hop-count form, where trustProxy is set to a number, compiles to a predicate that structurally ignores the address, so the guard is always satisfied for any hop count of one or more. Applications configured with a numeric trustProxy value, such as trustProxy set to 1 for a single reverse proxy, remain vulnerable: an attacker who can reach the Fastify origin directly, bypassing the front-facing proxy, can spoof the forwarded request fields exactly as in the unpatched version. The impact class matches the parent CVE-2026-3635, including host injection in generated URLs, HTTPS-enforcement bypass, secure-cookie and CSRF-origin bypass, and host-based routing and cache poisoning. Affected versions are fastify from 5.8.3 up to but not including 5.12.1. Patches: patched in fastify 5.12.1, where the numeric form of trustProxy is disabled at runtime and removed from the TypeScript type union. Workarounds: migrate to an IP, CIDR, or custom-function trustProxy value that validates the connecting address, and ensure the Fastify origin is only reachable through the trusted proxy chain.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":1.7,"impactScore":4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-16732","epss":0.00158,"percentile":0.04903,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-16732","cwe":"CWE-348","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fastify","version":"5.8.5"}},"found":{"vulnerabilityID":"GHSA-3m5p-2c4r-xxw2","versionConstraint":">=5.8.3,<5.12.1 (semantic)"},"fix":{"suggestedVersion":"5.12.1"}}],"artifact":{"id":"pkg:npm/fastify@5.8.5?package-id=72dfb6219c562dcc","name":"fastify","version":"5.8.5","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:fastify:fastify:5.8.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fastify@5.8.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-wgpf-jwqj-8h8p","dataSource":"https://github.com/advisories/GHSA-wgpf-jwqj-8h8p","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/honojs/hono/security/advisories/GHSA-wgpf-jwqj-8h8p","https://nvd.nist.gov/vuln/detail/CVE-2026-54289"],"description":"hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-54289","epss":0.00178,"percentile":0.07424,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-54289","cwe":"CWE-348","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.12.25"],"state":"fixed","available":[{"version":"4.12.25","date":"2026-06-16","kind":"first-observed"}]},"advisories":[],"risk":0.08721999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-54289","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54289","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/honojs/hono/security/advisories/GHSA-wgpf-jwqj-8h8p"],"description":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on AWS Lambda@Edge, CloudFront delivers a request header that appears more than once as several separate entries. The adapter writes each value with Headers.set instead of Headers.append, so every value overwrites the previous one and only the last reaches the application. Repeated request headers such as X-Forwarded-For, Forwarded, and Via are silently truncated to a single value. Request middleware sees only the last value of a repeated header instead of the full chain. For applications that base access control on the X-Forwarded-For chain, this can weaken or alter that decision; for auditing, hop history is lost. This vulnerability is fixed in 4.12.25.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-54289","epss":0.00178,"percentile":0.07424,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-54289","cwe":"CWE-348","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"hono","version":"4.12.16"}},"found":{"vulnerabilityID":"GHSA-wgpf-jwqj-8h8p","versionConstraint":"<4.12.25 (semantic)"},"fix":{"suggestedVersion":"4.12.25"}}],"artifact":{"id":"pkg:npm/hono@4.12.16?package-id=000f2baa1e593039","name":"hono","version":"4.12.16","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:hono:hono:4.12.16:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/hono@4.12.16","upstreams":[]}},{"vulnerability":{"id":"GHSA-x4vx-rjvf-j5p4","dataSource":"https://github.com/advisories/GHSA-x4vx-rjvf-j5p4","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/cure53/DOMPurify/security/advisories/GHSA-x4vx-rjvf-j5p4"],"description":"DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objects","cvss":[],"epss":[{"cve":"CVE-2026-65901","epss":0.00285,"percentile":0.21115,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-65901","cwe":"CWE-79","source":"disclosure@vulncheck.com","type":"Primary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.08549999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-65901","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-65901","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/cure53/DOMPurify/security/advisories/GHSA-x4vx-rjvf-j5p4","https://www.vulncheck.com/advisories/dompurify-cross-site-scripting-via-in-place-nodename"],"description":"DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects with real script children whose observable nodeName is clobbered to appear as allowed elements, causing scripts to execute when the sanitized tree is inserted into a live document.","cvss":[{"source":"disclosure@vulncheck.com","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-65901","epss":0.00285,"percentile":0.21115,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-65901","cwe":"CWE-79","source":"disclosure@vulncheck.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"dompurify","version":"3.3.3"}},"found":{"vulnerabilityID":"GHSA-x4vx-rjvf-j5p4","versionConstraint":"<=3.4.6 (semantic)"}}],"artifact":{"id":"pkg:npm/dompurify@3.3.3?package-id=5ef50eed3845476c","name":"dompurify","version":"3.3.3","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MPL-2.0 OR Apache-2.0"],"cpes":["cpe:2.3:a:dompurify:dompurify:3.3.3:*:*:*:*:*:*:*"],"purl":"pkg:npm/dompurify@3.3.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-rv63-4mwf-qqc2","dataSource":"https://github.com/advisories/GHSA-rv63-4mwf-qqc2","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/honojs/hono/security/advisories/GHSA-rv63-4mwf-qqc2","https://nvd.nist.gov/vuln/detail/CVE-2026-54288"],"description":"hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length`","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-54288","epss":0.00147,"percentile":0.03903,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-54288","cwe":"CWE-345","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.12.25"],"state":"fixed","available":[{"version":"4.12.25","date":"2026-06-16","kind":"first-observed"}]},"advisories":[],"risk":0.08452499999999999},"relatedVulnerabilities":[{"id":"CVE-2026-54288","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54288","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/honojs/hono/security/advisories/GHSA-rv63-4mwf-qqc2"],"description":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, the Body Limit Middleware trusts the request's Content-Length header to decide whether a body is within the limit. On AWS Lambda (API Gateway v1/v2, ALB, VPC Lattice, and Lambda@Edge) the body is delivered fully buffered and the adapter builds the request with the client-declared Content-Length, which need not match the actual payload. A client can declare a tiny Content-Length while sending a much larger body, slipping past the limit. This vulnerability is fixed in 4.12.25.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-54288","epss":0.00147,"percentile":0.03903,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-54288","cwe":"CWE-345","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"hono","version":"4.12.16"}},"found":{"vulnerabilityID":"GHSA-rv63-4mwf-qqc2","versionConstraint":"<4.12.25 (semantic)"},"fix":{"suggestedVersion":"4.12.25"}}],"artifact":{"id":"pkg:npm/hono@4.12.16?package-id=000f2baa1e593039","name":"hono","version":"4.12.16","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:hono:hono:4.12.16:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/hono@4.12.16","upstreams":[]}},{"vulnerability":{"id":"GHSA-gvmj-g25r-r7wr","dataSource":"https://github.com/advisories/GHSA-gvmj-g25r-r7wr","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/cure53/DOMPurify/security/advisories/GHSA-gvmj-g25r-r7wr"],"description":"DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside <template> content when using DOM output modes","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P","metrics":{"baseScore":2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-65900","epss":0.0031,"percentile":0.23869,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-65900","cwe":"CWE-79","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["3.4.8"],"state":"fixed","available":[{"version":"3.4.8","date":"2026-06-16","kind":"first-observed"}]},"advisories":[],"risk":0.0775},"relatedVulnerabilities":[{"id":"CVE-2026-65900","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-65900","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/cure53/DOMPurify/security/advisories/GHSA-gvmj-g25r-r7wr","https://www.vulncheck.com/advisories/dompurify-before-template-expression-injection-via-return-dom"],"description":"DOMPurify versions >=3.0.0 and before 3.4.8, when configured with SAFE_FOR_TEMPLATES together with a DOM output mode (RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE), fail to strip template expressions (e.g. ${evil}, {{evil}}, <%evil%>) inside <template> element content. The final normalization/scrub pass (_scrubTemplateExpressions) uses a NodeIterator and node.normalize() that do not descend into template.content, so expressions that only form after adjacent text nodes merge survive sanitization. This bypasses SAFE_FOR_TEMPLATES and can allow a downstream template engine to evaluate attacker-supplied expressions. The string output path is not affected.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.1},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-65900","epss":0.0031,"percentile":0.23869,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-65900","cwe":"CWE-79","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"dompurify","version":"3.3.3"}},"found":{"vulnerabilityID":"GHSA-gvmj-g25r-r7wr","versionConstraint":">=3.0.0,<=3.4.7 (semantic)"},"fix":{"suggestedVersion":"3.4.8"}}],"artifact":{"id":"pkg:npm/dompurify@3.3.3?package-id=5ef50eed3845476c","name":"dompurify","version":"3.3.3","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MPL-2.0 OR Apache-2.0"],"cpes":["cpe:2.3:a:dompurify:dompurify:3.3.3:*:*:*:*:*:*:*"],"purl":"pkg:npm/dompurify@3.3.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-rg2x-37c3-w2rh","dataSource":"https://github.com/advisories/GHSA-rg2x-37c3-w2rh","namespace":"github:language:go","severity":"High","urls":["https://github.com/moby/moby/security/advisories/GHSA-rg2x-37c3-w2rh","https://nvd.nist.gov/vuln/detail/CVE-2026-42306"],"description":"Docker: Race condition in docker cp allows bind mount redirection to host path","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.2,"exploitabilityScore":0.9,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42306","epss":0.00104,"percentile":0.01019,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42306","cwe":"CWE-61","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-42306","cwe":"CWE-367","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.07644},"relatedVulnerabilities":[{"id":"CVE-2026-42306","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42306","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/moby/moby/security/advisories/GHSA-rg2x-37c3-w2rh"],"description":"Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Moby Daemon version 2.0.0-beta.14.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.2,"exploitabilityScore":0.9,"impactScore":5.8},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.2,"exploitabilityScore":0.9,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42306","epss":0.00104,"percentile":0.01019,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42306","cwe":"CWE-61","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-42306","cwe":"CWE-367","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/docker/docker","version":"v28.5.2+incompatible"}},"found":{"vulnerabilityID":"GHSA-rg2x-37c3-w2rh","versionConstraint":"<=28.5.2 (go)"}}],"artifact":{"id":"pkg:golang/github.com/docker/docker@v28.5.2%2Bincompatible?package-id=b3f436952f7c2a0e","name":"github.com/docker/docker","version":"v28.5.2+incompatible","type":"go-module","locations":[{"path":"/backend-go/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:docker:docker:v28.5.2\\+incompatible:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/docker/docker@v28.5.2%2Bincompatible","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:DBX0Y0zAjZbSrm1uzOkdr1onVghKaftjlSWt4AFexzM="}}},{"vulnerability":{"id":"GHSA-hm8q-7f3q-5f36","dataSource":"https://github.com/advisories/GHSA-hm8q-7f3q-5f36","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/honojs/hono/security/advisories/GHSA-hm8q-7f3q-5f36","https://nvd.nist.gov/vuln/detail/CVE-2026-44459"],"description":"Hono has improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.8,"exploitabilityScore":1.3,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44459","epss":0.00216,"percentile":0.12065,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44459","cwe":"CWE-1284","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.12.18"],"state":"fixed","available":[{"version":"4.12.18","date":"2026-05-09","kind":"first-observed"}]},"advisories":[],"risk":0.07343999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-44459","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44459","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/honojs/hono/security/advisories/GHSA-hm8q-7f3q-5f36"],"description":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, improper validation of the JWT NumericDate claims exp, nbf, and iat in hono/utils/jwt allows tokens with non-spec-compliant claim values to silently bypass time-based checks. This issue is not exploitable by an anonymous attacker; it only manifests when a malformed claim value reaches verify() — typically when the application itself issues such tokens, or when the signing key is otherwise under attacker control. This vulnerability is fixed in 4.12.18.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.8,"exploitabilityScore":1.3,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44459","epss":0.00216,"percentile":0.12065,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44459","cwe":"CWE-1284","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"hono","version":"4.12.16"}},"found":{"vulnerabilityID":"GHSA-hm8q-7f3q-5f36","versionConstraint":"<4.12.18 (semantic)"},"fix":{"suggestedVersion":"4.12.18"}}],"artifact":{"id":"pkg:npm/hono@4.12.16?package-id=000f2baa1e593039","name":"hono","version":"4.12.16","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:hono:hono:4.12.16:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/hono@4.12.16","upstreams":[]}},{"vulnerability":{"id":"GHSA-xhjh-pmcv-23jw","dataSource":"https://github.com/advisories/GHSA-xhjh-pmcv-23jw","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/axios/axios/security/advisories/GHSA-xhjh-pmcv-23jw","https://nvd.nist.gov/vuln/detail/CVE-2026-42040"],"description":"Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42040","epss":0.00217,"percentile":0.12188,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42040","cwe":"CWE-116","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-42040","cwe":"CWE-626","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.15.1"],"state":"fixed","available":[{"version":"1.15.1","date":"2026-05-05","kind":"first-observed"}]},"advisories":[],"risk":0.072695},"relatedVulnerabilities":[{"id":"CVE-2026-42040","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42040","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/axios/axios/security/advisories/GHSA-xhjh-pmcv-23jw"],"description":"Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the encode() function in lib/helpers/AxiosURLSearchParams.js contains a character mapping (charMap) at line 21 that reverses the safe percent-encoding of null bytes. After encodeURIComponent('\\x00') correctly produces the safe sequence %00, the charMap entry '%00': '\\x00' converts it back to a raw null byte. Primary impact is limited because the standard axios request flow is not affected. This vulnerability is fixed in 1.15.1 and 0.31.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42040","epss":0.00217,"percentile":0.12188,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42040","cwe":"CWE-116","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-42040","cwe":"CWE-626","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.15.0"}},"found":{"vulnerabilityID":"GHSA-xhjh-pmcv-23jw","versionConstraint":">=1.0.0,<1.15.1 (semantic)"},"fix":{"suggestedVersion":"1.15.1"}}],"artifact":{"id":"pkg:npm/axios@1.15.0?package-id=520b8e92ffff8054","name":"axios","version":"1.15.0","type":"npm","locations":[{"path":"/sink/oidc-server/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.15.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.15.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-vfv6-92ff-j949","dataSource":"https://github.com/advisories/GHSA-vfv6-92ff-j949","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/vercel/next.js/security/advisories/GHSA-vfv6-92ff-j949","https://github.com/vercel/next.js/releases/tag/v15.5.16","https://github.com/vercel/next.js/releases/tag/v16.2.5","https://nvd.nist.gov/vuln/detail/CVE-2026-44582"],"description":"Next.js vulnerable to cache poisoning via collisions in React Server Component cache-busting","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44582","epss":0.00215,"percentile":0.11898,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44582","cwe":"CWE-328","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["16.2.5"],"state":"fixed","available":[{"version":"16.2.5","date":"2026-05-11","kind":"first-observed"}]},"advisories":[],"risk":0.07202499999999999},"relatedVulnerabilities":[{"id":"CVE-2026-44582","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44582","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/vercel/next.js/security/advisories/GHSA-vfv6-92ff-j949"],"description":"Next.js is a React framework for building full-stack web applications. From 13.4.6 to before 15.5.16 and 16.2.5, React Server Component responses can be vulnerable to cache poisoning in deployments that rely on shared caches with insufficient response partitioning. In affected conditions, collisions in the _rsc cache-busting value can allow an attacker to poison cache entries so users receive the wrong response variant for a given URL. This vulnerability is fixed in 15.5.16 and 16.2.5.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44582","epss":0.00215,"percentile":0.11898,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44582","cwe":"CWE-328","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"next","version":"16.1.7"}},"found":{"vulnerabilityID":"GHSA-vfv6-92ff-j949","versionConstraint":">=16.0.0,<16.2.5 (semantic)"},"fix":{"suggestedVersion":"16.2.5"}}],"artifact":{"id":"pkg:npm/next@16.1.7?package-id=662de087d22e519d","name":"next","version":"16.1.7","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vercel:next.js:16.1.7:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/next@16.1.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-8wmf-6v46-5gfg","dataSource":"https://github.com/advisories/GHSA-8wmf-6v46-5gfg","namespace":"github:language:go","severity":"Low","urls":["https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg","https://nvd.nist.gov/vuln/detail/CVE-2026-81870","https://github.com/open-telemetry/opentelemetry-go/pull/8438","https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38","https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0"],"description":"OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-81870","epss":0.00266,"percentile":0.1856,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-81870","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-81870","cwe":"CWE-532","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.45.0"],"state":"fixed","available":[{"version":"1.45.0","date":"2026-09-18","kind":"first-observed"}]},"advisories":[],"risk":0.0665},"relatedVulnerabilities":[{"id":"CVE-2026-81870","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-81870","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38","https://github.com/open-telemetry/opentelemetry-go/pull/8438","https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg"],"description":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.5.0 to 1.44.0, sdk/trace.NewTracerProvider emits a TracerProvider created internal Info-level diagnostic event whose MarshalLog implementations recursively include span processor, exporter, and client configuration. Applications that call otel.SetLogger to enable OpenTelemetry internal Info logging can therefore record OTLP gRPC and HTTP collector endpoints, the OTLP HTTP Insecure flag, and complete Zipkin collector URLs. A person or system with access to those logs can learn internal collector topology and can recover credentials or tokens embedded in Zipkin URL user information or query strings. The default OpenTelemetry logger does not emit the event, and this path does not log OTLP authentication headers, TLS key material, or span payloads. This issue is fixed in version 1.45.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-81870","epss":0.00266,"percentile":0.1856,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-81870","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-81870","cwe":"CWE-532","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"go.opentelemetry.io/otel/exporters/otlp/otlptrace","version":"v1.41.0"}},"found":{"vulnerabilityID":"GHSA-8wmf-6v46-5gfg","versionConstraint":">=1.5.0,<=1.44.0 (go)"},"fix":{"suggestedVersion":"1.45.0"}}],"artifact":{"id":"pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace@v1.41.0?package-id=1d5a482ed2297b64","name":"go.opentelemetry.io/otel/exporters/otlp/otlptrace","version":"v1.41.0","type":"go-module","locations":[{"path":"/backend-go/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:otel:exporters\\/otlp\\/otlptrace:v1.41.0:*:*:*:*:*:*:*"],"purl":"pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace@v1.41.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:ao6Oe+wSebTlQ1OEht7jlYTzQKE+pnx/iNywFvTbuuI="}}},{"vulnerability":{"id":"GHSA-848j-6mx2-7j84","dataSource":"https://github.com/advisories/GHSA-848j-6mx2-7j84","namespace":"github:language:javascript","severity":"Low","urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-14505","https://github.com/indutny/elliptic/issues/321","https://www.herodevs.com/vulnerability-directory/cve-2025-14505"],"description":"Elliptic Uses a Cryptographic Primitive with a Risky Implementation","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"exploitabilityScore":2.3,"impactScore":3.4},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-14505","epss":0.0018,"percentile":0.07581,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-14505","cwe":"CWE-1240","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.06525},"relatedVulnerabilities":[{"id":"CVE-2025-14505","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-14505","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/indutny/elliptic/issues/321","https://www.herodevs.com/vulnerability-directory/cve-2025-14505"],"description":"The ECDSA implementation of the Elliptic package generates incorrect signatures if an interim value of 'k' (as computed based on step 3.2 of  RFC 6979 https://datatracker.ietf.org/doc/html/rfc6979 ) has leading zeros and is susceptible to cryptanalysis, which can lead to secret key exposure. This happens, because the byte-length of 'k' is incorrectly computed, resulting in its getting truncated during the computation. Legitimate transactions or communications will be broken as a result. Furthermore, due to the nature of the fault, attackers could–under certain conditions–derive the secret key, if they could get their hands on both a faulty signature generated by a vulnerable version of Elliptic and a correct signature for the same inputs.\n\nThis issue affects all known versions of Elliptic (at the time of writing, versions less than or equal to 6.6.1).","cvss":[{"source":"36c7be3b-2937-45df-85ea-ca7133ea542c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"exploitabilityScore":2.3,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-14505","epss":0.0018,"percentile":0.07581,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-14505","cwe":"CWE-1240","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"elliptic","version":"6.6.1"}},"found":{"vulnerabilityID":"GHSA-848j-6mx2-7j84","versionConstraint":"<=6.6.1 (semantic)"}}],"artifact":{"id":"pkg:npm/elliptic@6.6.1?package-id=dd1804b78bf4fab1","name":"elliptic","version":"6.6.1","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:indutny:elliptic:6.6.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/elliptic@6.6.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-j6qf-3m9c-vwj3","dataSource":"https://github.com/advisories/GHSA-j6qf-3m9c-vwj3","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/go-chi/chi/security/advisories/GHSA-j6qf-3m9c-vwj3","https://nvd.nist.gov/vuln/detail/CVE-2026-114437","https://github.com/go-chi/chi/pull/1214","https://github.com/go-chi/chi/commit/7f9b7448f51d28804fac98c0a17bc2a7cec1079f","https://github.com/go-chi/chi/releases/tag/v5.4.0","https://www.tenable.com/security/research/tra-2026-66"],"description":"chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-114437","epss":0.00129,"percentile":0.02558,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-114437","cwe":"CWE-348","source":"vulnreport@tenable.com","type":"Secondary"}],"fix":{"versions":["5.4.0"],"state":"fixed","available":[{"version":"5.4.0","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.06320999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-114437","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114437","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/go-chi/chi/security/advisories/GHSA-j6qf-3m9c-vwj3","https://www.tenable.com/security/research/tra-2026-66"],"description":"In the Golang Chi web framework, the ClientIPFromXFF middleware skips any X-Forwarded-For entry in a configured trusted CIDR but never verifies that the direct TCP peer in http.Request.RemoteAddr belongs to that CIDR. A client that can reach the Go server directly can therefore append a trusted-looking proxy address and choose the client IP returned by middleware.GetClientIP.\n\nThis issue affects chi before 5.4.0.","cvss":[{"source":"vulnreport@tenable.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}},{"source":"vulnreport@tenable.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-114437","epss":0.00129,"percentile":0.02558,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-114437","cwe":"CWE-348","source":"vulnreport@tenable.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/go-chi/chi/v5","version":"v5.2.4"}},"found":{"vulnerabilityID":"GHSA-j6qf-3m9c-vwj3","versionConstraint":"<=5.3.2 (go)"},"fix":{"suggestedVersion":"5.4.0"}}],"artifact":{"id":"pkg:golang/github.com/go-chi/chi/v5@v5.2.4?package-id=0f221d8b2d1bd0be","name":"github.com/go-chi/chi/v5","version":"v5.2.4","type":"go-module","locations":[{"path":"/backend-go/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:go-chi:chi\\/v5:v5.2.4:*:*:*:*:*:*:*","cpe:2.3:a:go_chi:chi\\/v5:v5.2.4:*:*:*:*:*:*:*","cpe:2.3:a:go:chi\\/v5:v5.2.4:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/go-chi/chi/v5@v5.2.4","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:WtFKPHwlywe8Srng8j2BhOD9312j9cGUxG1SP4V2cR4="}}},{"vulnerability":{"id":"GHSA-mjcv-p78q-w5fw","dataSource":"https://github.com/advisories/GHSA-mjcv-p78q-w5fw","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/moby/sys/security/advisories/GHSA-mjcv-p78q-w5fw","https://github.com/moby/sys/pull/221","https://github.com/moby/sys/commit/85a71bbe1faa36c552a960e6a5f3d0cfb632fbbe"],"description":"github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"exploitabilityScore":1.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-61801","epss":0.00117,"percentile":0.01635,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-61801","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.4.1"],"state":"fixed","available":[{"version":"0.4.1","date":"2026-10-08","kind":"first-observed"}]},"advisories":[],"risk":0.061425},"relatedVulnerabilities":[{"id":"CVE-2026-61801","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61801","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/moby/sys/commit/85a71bbe1faa36c552a960e6a5f3d0cfb632fbbe","https://github.com/moby/sys/pull/221","https://github.com/moby/sys/security/advisories/GHSA-mjcv-p78q-w5fw"],"description":"The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing `/etc/passwd`- or `/etc/group`-style files, allowing an attacker who can supply a specially crafted file to cause excessive memory consumption and potentially terminate the affected process due to an out-of-memory condition. This issue is patched in version 0.4.1. As a workaround, avoid parsing attacker-controlled user or group database files, or validate and limit untrusted input before parsing it.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"exploitabilityScore":1.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-61801","epss":0.00117,"percentile":0.01635,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-61801","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/moby/sys/user","version":"v0.4.0"}},"found":{"vulnerabilityID":"GHSA-mjcv-p78q-w5fw","versionConstraint":"<=0.4.0 (go)"},"fix":{"suggestedVersion":"0.4.1"}}],"artifact":{"id":"pkg:golang/github.com/moby/sys/user@v0.4.0?package-id=10d52a7228450a9f","name":"github.com/moby/sys/user","version":"v0.4.0","type":"go-module","locations":[{"path":"/backend-go/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:moby:sys\\/user:v0.4.0:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/moby/sys/user@v0.4.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:jhcMKit7SA80hivmFJcbB1vqmw//wU61Zdui2eQXuMs="}}},{"vulnerability":{"id":"GHSA-vp62-88p7-qqf5","dataSource":"https://github.com/advisories/GHSA-vp62-88p7-qqf5","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/moby/moby/security/advisories/GHSA-vp62-88p7-qqf5","https://nvd.nist.gov/vuln/detail/CVE-2026-41568"],"description":"Docker: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:H","metrics":{"baseScore":6.1,"exploitabilityScore":0.9,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41568","epss":0.00108,"percentile":0.0119,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41568","cwe":"CWE-81","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-41568","cwe":"CWE-367","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.05993999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-41568","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41568","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/moby/moby/security/advisories/GHSA-vp62-88p7-qqf5"],"description":"Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to create empty files or directories at arbitrary absolute paths on the host filesystem. This issue has been patched in Docker Engine version 29.5.1 and Moby Daemon version 2.0.0-beta.14.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:H","metrics":{"baseScore":6.1,"exploitabilityScore":0.9,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41568","epss":0.00108,"percentile":0.0119,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41568","cwe":"CWE-81","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-41568","cwe":"CWE-367","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/docker/docker","version":"v28.5.2+incompatible"}},"found":{"vulnerabilityID":"GHSA-vp62-88p7-qqf5","versionConstraint":"<=28.5.2 (go)"}}],"artifact":{"id":"pkg:golang/github.com/docker/docker@v28.5.2%2Bincompatible?package-id=b3f436952f7c2a0e","name":"github.com/docker/docker","version":"v28.5.2+incompatible","type":"go-module","locations":[{"path":"/backend-go/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:docker:docker:v28.5.2\\+incompatible:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/docker/docker@v28.5.2%2Bincompatible","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:DBX0Y0zAjZbSrm1uzOkdr1onVghKaftjlSWt4AFexzM="}}},{"vulnerability":{"id":"GHSA-4487-j8r4-4g2f","dataSource":"https://github.com/advisories/GHSA-4487-j8r4-4g2f","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/digitalbazaar/forge/security/advisories/GHSA-4487-j8r4-4g2f","https://nvd.nist.gov/vuln/detail/CVE-2026-118780","https://github.com/digitalbazaar/forge/commit/f6555609bd30f442fbfacd543155928ceccf98d0","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1"],"description":"Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118780","epss":0.00172,"percentile":0.06586,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118780","cwe":"CWE-295","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-118780","cwe":"CWE-471","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["1.4.1"],"state":"fixed","available":[{"version":"1.4.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.05761999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-118780","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118780","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/digitalbazaar/forge/commit/f6555609bd30f442fbfacd543155928ceccf98d0","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","https://github.com/digitalbazaar/forge/security/advisories/GHSA-4487-j8r4-4g2f"],"description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used pki.verifyCertificateChain(), pki.createCaStore(), duplicate subject names to process the relevant input or security decision. node-forge modified the CA store while trying certificates that shared a subject name during pki.verifyCertificateChain(). A failed chain verification could permanently remove trusted CA certificates from the store, causing later valid chains to fail and creating a persistent availability impact for applications that reused the store. This issue is fixed in version 1.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118780","epss":0.00172,"percentile":0.06586,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118780","cwe":"CWE-295","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-118780","cwe":"CWE-471","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"node-forge","version":"1.4.0"}},"found":{"vulnerabilityID":"GHSA-4487-j8r4-4g2f","versionConstraint":"<=1.4.0 (semantic)"},"fix":{"suggestedVersion":"1.4.1"}}],"artifact":{"id":"pkg:npm/node-forge@1.4.0?package-id=86ba9cb3dfe9125a","name":"node-forge","version":"1.4.0","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause OR GPL-2.0"],"cpes":["cpe:2.3:a:digitalbazaar:forge:1.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/node-forge@1.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-4487-j8r4-4g2f","dataSource":"https://github.com/advisories/GHSA-4487-j8r4-4g2f","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/digitalbazaar/forge/security/advisories/GHSA-4487-j8r4-4g2f","https://nvd.nist.gov/vuln/detail/CVE-2026-118780","https://github.com/digitalbazaar/forge/commit/f6555609bd30f442fbfacd543155928ceccf98d0","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1"],"description":"Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118780","epss":0.00172,"percentile":0.06586,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118780","cwe":"CWE-295","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-118780","cwe":"CWE-471","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["1.4.1"],"state":"fixed","available":[{"version":"1.4.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.05761999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-118780","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118780","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/digitalbazaar/forge/commit/f6555609bd30f442fbfacd543155928ceccf98d0","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","https://github.com/digitalbazaar/forge/security/advisories/GHSA-4487-j8r4-4g2f"],"description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used pki.verifyCertificateChain(), pki.createCaStore(), duplicate subject names to process the relevant input or security decision. node-forge modified the CA store while trying certificates that shared a subject name during pki.verifyCertificateChain(). A failed chain verification could permanently remove trusted CA certificates from the store, causing later valid chains to fail and creating a persistent availability impact for applications that reused the store. This issue is fixed in version 1.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118780","epss":0.00172,"percentile":0.06586,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118780","cwe":"CWE-295","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-118780","cwe":"CWE-471","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"node-forge","version":"1.4.0"}},"found":{"vulnerabilityID":"GHSA-4487-j8r4-4g2f","versionConstraint":"<=1.4.0 (semantic)"},"fix":{"suggestedVersion":"1.4.1"}}],"artifact":{"id":"pkg:npm/node-forge@1.4.0?package-id=1e94284aa936f13c","name":"node-forge","version":"1.4.0","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause OR GPL-2.0"],"cpes":["cpe:2.3:a:digitalbazaar:forge:1.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/node-forge@1.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-c2j3-45gr-mqc4","dataSource":"https://github.com/advisories/GHSA-c2j3-45gr-mqc4","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/cure53/DOMPurify/security/advisories/GHSA-c2j3-45gr-mqc4","https://github.com/cure53/DOMPurify/pull/1537","https://github.com/cure53/DOMPurify/commit/a9ca1e537422319a557a9a2aa61f003b23b4a197","https://github.com/cure53/DOMPurify/releases/tag/3.4.12","https://nvd.nist.gov/vuln/detail/CVE-2026-66010","https://www.vulncheck.com/advisories/dompurify-before-hook-bypass-via-custom-element-handling"],"description":"DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","metrics":{"baseScore":2.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-66010","epss":0.00215,"percentile":0.1197,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-66010","cwe":"CWE-79","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["3.4.12"],"state":"fixed","available":[{"version":"3.4.12","date":"2026-07-22","kind":"first-observed"}]},"advisories":[],"risk":0.054825},"relatedVulnerabilities":[{"id":"CVE-2026-66010","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66010","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/cure53/DOMPurify/security/advisories/GHSA-c2j3-45gr-mqc4","https://www.vulncheck.com/advisories/dompurify-before-hook-bypass-via-custom-element-handling"],"description":"DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOM_ELEMENT_HANDLING.tagNameCheck, allowing attributes to bypass application security policies. Attackers can preserve sensitive attributes on custom elements that later re-inject them into innerHTML sinks, creating second-order XSS gadgets.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.1},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-66010","epss":0.00215,"percentile":0.1197,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-66010","cwe":"CWE-79","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"dompurify","version":"3.3.3"}},"found":{"vulnerabilityID":"GHSA-c2j3-45gr-mqc4","versionConstraint":"<=3.4.11 (semantic)"},"fix":{"suggestedVersion":"3.4.12"}}],"artifact":{"id":"pkg:npm/dompurify@3.3.3?package-id=5ef50eed3845476c","name":"dompurify","version":"3.3.3","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MPL-2.0 OR Apache-2.0"],"cpes":["cpe:2.3:a:dompurify:dompurify:3.3.3:*:*:*:*:*:*:*"],"purl":"pkg:npm/dompurify@3.3.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-4x5r-pxfx-6jf8","dataSource":"https://github.com/advisories/GHSA-4x5r-pxfx-6jf8","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/babel/babel/security/advisories/GHSA-4x5r-pxfx-6jf8","https://babeljs.io/docs/options#inputsourcemap","https://nvd.nist.gov/vuln/detail/CVE-2026-49356"],"description":"@babel/core: Arbitrary File Read via sourceMappingURL Comment","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","metrics":{"baseScore":3.2,"exploitabilityScore":1.5,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-49356","epss":0.00152,"percentile":0.04306,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-49356","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-49356","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.29.6"],"state":"fixed","available":[{"version":"7.29.6","date":"2026-06-15","kind":"first-observed"}]},"advisories":[],"risk":0.04712},"relatedVulnerabilities":[{"id":"CVE-2026-49356","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-49356","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/babel/babel/security/advisories/GHSA-4x5r-pxfx-6jf8"],"description":"Babel is a compiler for writing next generation JavaScript. Prior to 8.0.0-rc.6 and 7.29.6, @babel/core affected by an arbitrary file read via a sourceMappingURL comment. Using @babel/core to compile maliciously crafted code can allow an attacker to read any source map from the system that is running Babel, if the attacker controls the input source code, can read the output source code, and knows the path of the source map file that they want to read. This vulnerability is fixed in 8.0.0-rc.6 and 7.29.6.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","metrics":{"baseScore":3.6,"exploitabilityScore":1.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","metrics":{"baseScore":3.2,"exploitabilityScore":1.5,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-49356","epss":0.00152,"percentile":0.04306,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-49356","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-49356","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@babel/core","version":"7.28.4"}},"found":{"vulnerabilityID":"GHSA-4x5r-pxfx-6jf8","versionConstraint":"<=7.29.0 (semantic)"},"fix":{"suggestedVersion":"7.29.6"}}],"artifact":{"id":"pkg:npm/%40babel/core@7.28.4?package-id=3979c2e4bb7442f6","name":"@babel/core","version":"7.28.4","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:\\@babel\\/core:\\@babel\\/core:7.28.4:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40babel/core@7.28.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-39w2-rjm5-chcv","dataSource":"https://github.com/advisories/GHSA-39w2-rjm5-chcv","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/vercel/next.js/security/advisories/GHSA-39w2-rjm5-chcv","https://nvd.nist.gov/vuln/detail/CVE-2026-94486","https://github.com/vercel/next.js/commit/2d9f50a409312696145b82b3157aadb6b1fef476","https://github.com/vercel/next.js/releases/tag/v16.3.8"],"description":"Next.js has information disclosure in development server's Model Context Protocol endpoint","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"exploitabilityScore":2.9,"impactScore":2.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":2.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-94486","epss":0.00114,"percentile":0.01436,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-94486","cwe":"CWE-346","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["16.3.8"],"state":"fixed","available":[{"version":"16.3.8","date":"2026-10-08","kind":"first-observed"}]},"advisories":[],"risk":0.039045},"relatedVulnerabilities":[{"id":"CVE-2026-94486","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94486","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/vercel/next.js/commit/2d9f50a409312696145b82b3157aadb6b1fef476","https://github.com/vercel/next.js/releases/tag/v16.3.8","https://github.com/vercel/next.js/security/advisories/GHSA-39w2-rjm5-chcv"],"description":"Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read the project's disk location, source code snippets from error reports, route inventory, and development logs. Production deployments do not serve this endpoint. This issue is fixed in version 16.3.8.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"exploitabilityScore":2.9,"impactScore":2.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-94486","epss":0.00114,"percentile":0.01436,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-94486","cwe":"CWE-346","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"next","version":"16.1.7"}},"found":{"vulnerabilityID":"GHSA-39w2-rjm5-chcv","versionConstraint":">=16.0.0,<16.3.8 (semantic)"},"fix":{"suggestedVersion":"16.3.8"}}],"artifact":{"id":"pkg:npm/next@16.1.7?package-id=662de087d22e519d","name":"next","version":"16.1.7","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vercel:next.js:16.1.7:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/next@16.1.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-h6cr-wjv9-3cpp","dataSource":"https://github.com/advisories/GHSA-h6cr-wjv9-3cpp","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/digitalbazaar/forge/security/advisories/GHSA-h6cr-wjv9-3cpp","https://nvd.nist.gov/vuln/detail/CVE-2026-118781","https://github.com/digitalbazaar/forge/commit/e96c47b7f006dec66fb7bb1934e7375498b04a72","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1"],"description":"Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"exploitabilityScore":1.5,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118781","epss":0.00119,"percentile":0.01735,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118781","cwe":"CWE-835","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.4.1"],"state":"fixed","available":[{"version":"1.4.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.035105},"relatedVulnerabilities":[{"id":"CVE-2026-118781","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118781","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/digitalbazaar/forge/commit/e96c47b7f006dec66fb7bb1934e7375498b04a72","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","https://github.com/digitalbazaar/forge/security/advisories/GHSA-h6cr-wjv9-3cpp"],"description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used BigInteger.prototype.modInverse(), bnModInverse(), lib/jsbn.js, RSA public exponent e to process the relevant input or security decision. node-forge's bundled jsbn implementation entered an infinite loop when BigInteger.prototype.modInverse() received a negative value or modulus. An attacker who could control the RSA public exponent passed to key generation, or a direct modInverse() operand, could block the Node.js event loop at full CPU. Parsed DER, PEM, JWK, PKCS#12, X.509, and TLS values are unsigned and cannot trigger this issue. This issue is fixed in version 1.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"exploitabilityScore":1.5,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118781","epss":0.00119,"percentile":0.01735,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118781","cwe":"CWE-835","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"node-forge","version":"1.4.0"}},"found":{"vulnerabilityID":"GHSA-h6cr-wjv9-3cpp","versionConstraint":"<=1.4.0 (semantic)"},"fix":{"suggestedVersion":"1.4.1"}}],"artifact":{"id":"pkg:npm/node-forge@1.4.0?package-id=86ba9cb3dfe9125a","name":"node-forge","version":"1.4.0","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause OR GPL-2.0"],"cpes":["cpe:2.3:a:digitalbazaar:forge:1.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/node-forge@1.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-h6cr-wjv9-3cpp","dataSource":"https://github.com/advisories/GHSA-h6cr-wjv9-3cpp","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/digitalbazaar/forge/security/advisories/GHSA-h6cr-wjv9-3cpp","https://nvd.nist.gov/vuln/detail/CVE-2026-118781","https://github.com/digitalbazaar/forge/commit/e96c47b7f006dec66fb7bb1934e7375498b04a72","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1"],"description":"Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"exploitabilityScore":1.5,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118781","epss":0.00119,"percentile":0.01735,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118781","cwe":"CWE-835","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.4.1"],"state":"fixed","available":[{"version":"1.4.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.035105},"relatedVulnerabilities":[{"id":"CVE-2026-118781","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118781","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/digitalbazaar/forge/commit/e96c47b7f006dec66fb7bb1934e7375498b04a72","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","https://github.com/digitalbazaar/forge/security/advisories/GHSA-h6cr-wjv9-3cpp"],"description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used BigInteger.prototype.modInverse(), bnModInverse(), lib/jsbn.js, RSA public exponent e to process the relevant input or security decision. node-forge's bundled jsbn implementation entered an infinite loop when BigInteger.prototype.modInverse() received a negative value or modulus. An attacker who could control the RSA public exponent passed to key generation, or a direct modInverse() operand, could block the Node.js event loop at full CPU. Parsed DER, PEM, JWK, PKCS#12, X.509, and TLS values are unsigned and cannot trigger this issue. This issue is fixed in version 1.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"exploitabilityScore":1.5,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118781","epss":0.00119,"percentile":0.01735,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118781","cwe":"CWE-835","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"node-forge","version":"1.4.0"}},"found":{"vulnerabilityID":"GHSA-h6cr-wjv9-3cpp","versionConstraint":"<=1.4.0 (semantic)"},"fix":{"suggestedVersion":"1.4.1"}}],"artifact":{"id":"pkg:npm/node-forge@1.4.0?package-id=1e94284aa936f13c","name":"node-forge","version":"1.4.0","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause OR GPL-2.0"],"cpes":["cpe:2.3:a:digitalbazaar:forge:1.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/node-forge@1.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-6q48-6c7w-9gw2","dataSource":"https://github.com/advisories/GHSA-6q48-6c7w-9gw2","namespace":"github:language:python","severity":"Critical","urls":["https://github.com/certifi/python-certifi/security/advisories/GHSA-6q48-6c7w-9gw2","https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576","https://emudhra.we-have-a-problem.com"],"description":"certifi bundles emSign root CAs with compromised intermediate CA keys","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":9.1},"vendorMetadata":{}}],"fix":{"versions":["2026.10.18"],"state":"fixed","available":[{"version":"2026.10.18","date":"2026-10-26","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"certifi","version":"2025.10.5"}},"found":{"vulnerabilityID":"GHSA-6q48-6c7w-9gw2","versionConstraint":">=2019.03.09,<2026.10.18 (python)"},"fix":{"suggestedVersion":"2026.10.18"}}],"artifact":{"id":"pkg:pypi/certifi@2025.10.5?package-id=501a20bb948bfb86","name":"certifi","version":"2025.10.5","type":"python","locations":[{"path":"/backend/bdd/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:certifi:certifi:2025.10.5:*:*:*:*:python:*:*"],"purl":"pkg:pypi/certifi@2025.10.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-cg2g-xh64-v4q7","dataSource":"https://github.com/advisories/GHSA-cg2g-xh64-v4q7","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/cure53/DOMPurify/security/advisories/GHSA-cg2g-xh64-v4q7","https://github.com/cure53/DOMPurify/pull/1672","https://github.com/cure53/DOMPurify/commit/a77a3e78b59f72fa4d1c83f22e121ad9cc7d3575","https://github.com/cure53/DOMPurify/releases/tag/3.4.17"],"description":"DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":9.2},"vendorMetadata":{}}],"fix":{"versions":["3.4.17"],"state":"fixed","available":[{"version":"3.4.17","date":"2026-10-23","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"dompurify","version":"3.4.16"}},"found":{"vulnerabilityID":"GHSA-cg2g-xh64-v4q7","versionConstraint":">=3.4.4,<=3.4.16 (semantic)"},"fix":{"suggestedVersion":"3.4.17"}}],"artifact":{"id":"pkg:npm/dompurify@3.4.16?package-id=9696e2d4a493519d","name":"dompurify","version":"3.4.16","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MPL-2.0 OR Apache-2.0"],"cpes":["cpe:2.3:a:dompurify:dompurify:3.4.16:*:*:*:*:*:*:*"],"purl":"pkg:npm/dompurify@3.4.16","upstreams":[]}},{"vulnerability":{"id":"GHSA-2464-fhr4-w9xw","dataSource":"https://github.com/advisories/GHSA-2464-fhr4-w9xw","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/vercel/next.js/security/advisories/GHSA-2464-fhr4-w9xw","https://nvd.nist.gov/vuln/detail/CVE-2026-96889","https://github.com/vercel/next.js/commit/5e3b687b5edb868b064bdc058d768a7021e7f6ad","https://github.com/vercel/next.js/commit/9571ec899f063df6533351bec390ccb2cc0af6a3","https://github.com/vercel/next.js/releases/tag/v15.5.28","https://github.com/vercel/next.js/releases/tag/v16.4.1"],"description":"Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","metrics":{"baseScore":9.5},"vendorMetadata":{}}],"fix":{"versions":["16.4.1"],"state":"fixed","available":[{"version":"16.4.1","date":"2026-10-22","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"next","version":"16.1.7"}},"found":{"vulnerabilityID":"GHSA-2464-fhr4-w9xw","versionConstraint":">=16.0.0,<=16.4.0 (semantic)"},"fix":{"suggestedVersion":"16.4.1"}}],"artifact":{"id":"pkg:npm/next@16.1.7?package-id=662de087d22e519d","name":"next","version":"16.1.7","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vercel:next.js:16.1.7:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/next@16.1.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-2xp9-vwfh-vxw4","dataSource":"https://github.com/advisories/GHSA-2xp9-vwfh-vxw4","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/strukturag/libheif/security/advisories/GHSA-g89c-p67h-r497","https://github.com/vercel/next.js/security/advisories/GHSA-2xp9-vwfh-vxw4","https://github.com/vercel/next.js/pull/97875","https://github.com/vercel/next.js/pull/97931","https://github.com/vercel/next.js/commit/3a15b4ac6ac8e70b1a9b18ecc18e8434462899b3","https://github.com/vercel/next.js/commit/409772ec807def20132d251ad48fd8d8ad4c73c2","https://github.com/vercel/next.js/commit/7a5937a8ab20b89d0a961f75eabb11577f5d5998","https://github.com/vercel/next.js/releases/tag/v15.5.24","https://github.com/vercel/next.js/releases/tag/v16.3.3"],"description":"Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","metrics":{"baseScore":9.5},"vendorMetadata":{}}],"fix":{"versions":["16.3.3"],"state":"fixed","available":[{"version":"16.3.3","date":"2026-09-09","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"next","version":"16.1.7"}},"found":{"vulnerabilityID":"GHSA-2xp9-vwfh-vxw4","versionConstraint":">=16.0.0,<16.3.3 (semantic)"},"fix":{"suggestedVersion":"16.3.3"}}],"artifact":{"id":"pkg:npm/next@16.1.7?package-id=662de087d22e519d","name":"next","version":"16.1.7","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vercel:next.js:16.1.7:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/next@16.1.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-673q-mjm6-r5xr","dataSource":"https://github.com/advisories/GHSA-673q-mjm6-r5xr","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/vercel/next.js/security/advisories/GHSA-673q-mjm6-r5xr","https://github.com/vercel/next.js/commit/a4cea6aec5da89d116b8960e113189cf51745d2f","https://github.com/vercel/next.js/releases/tag/v16.4.1"],"description":"Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N","metrics":{"baseScore":9.5},"vendorMetadata":{}}],"fix":{"versions":["16.4.1"],"state":"fixed","available":[{"version":"16.4.1","date":"2026-10-23","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"next","version":"16.1.7"}},"found":{"vulnerabilityID":"GHSA-673q-mjm6-r5xr","versionConstraint":">=16.0.0,<=16.4.0 (semantic)"},"fix":{"suggestedVersion":"16.4.1"}}],"artifact":{"id":"pkg:npm/next@16.1.7?package-id=662de087d22e519d","name":"next","version":"16.1.7","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vercel:next.js:16.1.7:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/next@16.1.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-46jr-4wx8-v453","dataSource":"https://github.com/advisories/GHSA-46jr-4wx8-v453","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-46jr-4wx8-v453","https://github.com/modelcontextprotocol/typescript-sdk/pull/2926","https://github.com/modelcontextprotocol/typescript-sdk/pull/2927","https://github.com/modelcontextprotocol/typescript-sdk/commit/6d8dbc6cb590edf766fcb66b636ca6b654e99c37","https://github.com/modelcontextprotocol/typescript-sdk/commit/fd26801b3b387742fe24a90ed4b275dd6072209f"],"description":"MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"fix":{"versions":["1.32.0"],"state":"fixed","available":[{"version":"1.32.0","date":"2026-10-21","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[{"id":"CVE-2026-111768","dataSource":"nvd","namespace":"nvd:cpe","severity":"Unknown","urls":[],"cvss":[]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@modelcontextprotocol/sdk","version":"1.29.0"}},"found":{"vulnerabilityID":"GHSA-46jr-4wx8-v453","versionConstraint":">=1.3.0,<1.32.0 (semantic)"},"fix":{"suggestedVersion":"1.32.0"}}],"artifact":{"id":"pkg:npm/%40modelcontextprotocol/sdk@1.29.0?package-id=0c66cca13b59eb9b","name":"@modelcontextprotocol/sdk","version":"1.29.0","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:\\@modelcontextprotocol\\/sdk:\\@modelcontextprotocol\\/sdk:1.29.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40modelcontextprotocol/sdk@1.29.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-f897-62hf-6gxq","dataSource":"https://github.com/advisories/GHSA-f897-62hf-6gxq","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-f897-62hf-6gxq","https://github.com/modelcontextprotocol/typescript-sdk/pull/2698","https://github.com/modelcontextprotocol/typescript-sdk/pull/2717","https://github.com/modelcontextprotocol/typescript-sdk/commit/7b781ed4e25355a25d15974f3c76de81299694ed","https://github.com/modelcontextprotocol/typescript-sdk/commit/a9f6eb709b85459d01e8f2a9e881fef2621756c1","https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/1.30.1","https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/@modelcontextprotocol/hono@2.0.1","https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/@modelcontextprotocol/node@2.1.0","https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/@modelcontextprotocol/server@2.1.0"],"description":"MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"fix":{"versions":["1.30.1"],"state":"fixed","available":[{"version":"1.30.1","date":"2026-10-28","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@modelcontextprotocol/sdk","version":"1.29.0"}},"found":{"vulnerabilityID":"GHSA-f897-62hf-6gxq","versionConstraint":">=1.10.0,<1.30.1 (semantic)"},"fix":{"suggestedVersion":"1.30.1"}}],"artifact":{"id":"pkg:npm/%40modelcontextprotocol/sdk@1.29.0?package-id=0c66cca13b59eb9b","name":"@modelcontextprotocol/sdk","version":"1.29.0","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:\\@modelcontextprotocol\\/sdk:\\@modelcontextprotocol\\/sdk:1.29.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40modelcontextprotocol/sdk@1.29.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-537c-gmf6-5ccf","dataSource":"https://github.com/advisories/GHSA-537c-gmf6-5ccf","namespace":"github:language:python","severity":"High","urls":["https://github.com/pyca/cryptography/security/advisories/GHSA-537c-gmf6-5ccf","https://openssl-library.org/news/secadv/20260609.txt"],"description":"Vulnerable OpenSSL included in cryptography wheels","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"fix":{"versions":["48.0.1"],"state":"fixed","available":[{"version":"48.0.1","date":"2026-06-16","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"cryptography","version":"46.0.7"}},"found":{"vulnerabilityID":"GHSA-537c-gmf6-5ccf","versionConstraint":">=0.5.0,<48.0.1 (python)"},"fix":{"suggestedVersion":"48.0.1"}}],"artifact":{"id":"pkg:pypi/cryptography@46.0.7?package-id=b8850d2d1ea9f785","name":"cryptography","version":"46.0.7","type":"python","locations":[{"path":"/backend/bdd/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:cryptography.io:cryptography:46.0.7:*:*:*:*:python:*:*","cpe:2.3:a:cryptography.io:cryptography:46.0.7:*:*:*:*:*:*:*"],"purl":"pkg:pypi/cryptography@46.0.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-mrv2-3pqr-j5jr","dataSource":"https://github.com/advisories/GHSA-mrv2-3pqr-j5jr","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/cure53/DOMPurify/security/advisories/GHSA-mrv2-3pqr-j5jr","https://github.com/cure53/DOMPurify/pull/1672","https://github.com/cure53/DOMPurify/commit/a77a3e78b59f72fa4d1c83f22e121ad9cc7d3575","https://github.com/cure53/DOMPurify/releases/tag/3.4.17"],"description":"DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":7.6},"vendorMetadata":{}}],"fix":{"versions":["3.4.17"],"state":"fixed","available":[{"version":"3.4.17","date":"2026-10-23","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"dompurify","version":"3.3.3"}},"found":{"vulnerabilityID":"GHSA-mrv2-3pqr-j5jr","versionConstraint":"<=3.4.16 (semantic)"},"fix":{"suggestedVersion":"3.4.17"}}],"artifact":{"id":"pkg:npm/dompurify@3.3.3?package-id=5ef50eed3845476c","name":"dompurify","version":"3.3.3","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MPL-2.0 OR Apache-2.0"],"cpes":["cpe:2.3:a:dompurify:dompurify:3.3.3:*:*:*:*:*:*:*"],"purl":"pkg:npm/dompurify@3.3.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-mrv2-3pqr-j5jr","dataSource":"https://github.com/advisories/GHSA-mrv2-3pqr-j5jr","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/cure53/DOMPurify/security/advisories/GHSA-mrv2-3pqr-j5jr","https://github.com/cure53/DOMPurify/pull/1672","https://github.com/cure53/DOMPurify/commit/a77a3e78b59f72fa4d1c83f22e121ad9cc7d3575","https://github.com/cure53/DOMPurify/releases/tag/3.4.17"],"description":"DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":7.6},"vendorMetadata":{}}],"fix":{"versions":["3.4.17"],"state":"fixed","available":[{"version":"3.4.17","date":"2026-10-23","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"dompurify","version":"3.4.16"}},"found":{"vulnerabilityID":"GHSA-mrv2-3pqr-j5jr","versionConstraint":"<=3.4.16 (semantic)"},"fix":{"suggestedVersion":"3.4.17"}}],"artifact":{"id":"pkg:npm/dompurify@3.4.16?package-id=9696e2d4a493519d","name":"dompurify","version":"3.4.16","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MPL-2.0 OR Apache-2.0"],"cpes":["cpe:2.3:a:dompurify:dompurify:3.4.16:*:*:*:*:*:*:*"],"purl":"pkg:npm/dompurify@3.4.16","upstreams":[]}},{"vulnerability":{"id":"GHSA-5p4m-2wfm-xmqj","dataSource":"https://github.com/advisories/GHSA-5p4m-2wfm-xmqj","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj"],"description":"JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"fix":{"versions":["4.3.1"],"state":"fixed","available":[{"version":"4.3.1","date":"2026-08-07","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"4.1.1"}},"found":{"vulnerabilityID":"GHSA-5p4m-2wfm-xmqj","versionConstraint":">=4.0.0,<4.3.1 (semantic)"},"fix":{"suggestedVersion":"4.3.1"}}],"artifact":{"id":"pkg:npm/js-yaml@4.1.1?package-id=15e5564f07e87e23","name":"js-yaml","version":"4.1.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodeca:js-yaml:4.1.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@4.1.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-5p4m-2wfm-xmqj","dataSource":"https://github.com/advisories/GHSA-5p4m-2wfm-xmqj","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj"],"description":"JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"fix":{"versions":["4.3.1"],"state":"fixed","available":[{"version":"4.3.1","date":"2026-08-07","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"4.1.1"}},"found":{"vulnerabilityID":"GHSA-5p4m-2wfm-xmqj","versionConstraint":">=4.0.0,<4.3.1 (semantic)"},"fix":{"suggestedVersion":"4.3.1"}}],"artifact":{"id":"pkg:npm/js-yaml@4.1.1?package-id=b47d2ee1a6cdb382","name":"js-yaml","version":"4.1.1","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodeca:js-yaml:4.1.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@4.1.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-8h8q-6873-q5fj","dataSource":"https://github.com/advisories/GHSA-8h8q-6873-q5fj","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/facebook/react/security/advisories/GHSA-rv78-f8rc-xrxh","https://github.com/vercel/next.js/security/advisories/GHSA-8h8q-6873-q5fj","https://github.com/vitejs/vite-plugin-react/security/advisories/GHSA-w94c-4vhp-22gx","https://nvd.nist.gov/vuln/detail/CVE-2026-23870"],"description":"Next.js Vulnerable to Denial of Service with Server Components","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"fix":{"versions":["16.2.5"],"state":"fixed","available":[{"version":"16.2.5","date":"2026-05-11","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"next","version":"16.1.7"}},"found":{"vulnerabilityID":"GHSA-8h8q-6873-q5fj","versionConstraint":">=16.0.0,<16.2.5 (semantic)"},"fix":{"suggestedVersion":"16.2.5"}}],"artifact":{"id":"pkg:npm/next@16.1.7?package-id=662de087d22e519d","name":"next","version":"16.1.7","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vercel:next.js:16.1.7:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/next@16.1.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-q4gf-8mx6-v5v3","dataSource":"https://github.com/advisories/GHSA-q4gf-8mx6-v5v3","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/vercel/next.js/security/advisories/GHSA-q4gf-8mx6-v5v3","https://vercel.com/changelog/summary-of-cve-2026-23869"],"description":"Next.js has a Denial of Service with Server Components","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"fix":{"versions":["16.2.3"],"state":"fixed","available":[{"version":"16.2.3","date":"2026-04-10","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"next","version":"16.1.7"}},"found":{"vulnerabilityID":"GHSA-q4gf-8mx6-v5v3","versionConstraint":">=16.0.0-beta.0,<16.2.3 (semantic)"},"fix":{"suggestedVersion":"16.2.3"}}],"artifact":{"id":"pkg:npm/next@16.1.7?package-id=662de087d22e519d","name":"next","version":"16.1.7","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vercel:next.js:16.1.7:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/next@16.1.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-f88m-g3jw-g9cj","dataSource":"https://github.com/advisories/GHSA-f88m-g3jw-g9cj","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/libvips/libvips/security/advisories/GHSA-2fcj-gj27-279x","https://github.com/libvips/libvips/security/advisories/GHSA-523x-vhfw-6r76","https://github.com/libvips/libvips/security/advisories/GHSA-jmwm-wc68-mhwm","https://github.com/libvips/libvips/security/advisories/GHSA-r98w-4fp7-m9c7","https://github.com/lovell/sharp/security/advisories/GHSA-f88m-g3jw-g9cj"],"description":"sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":7},"vendorMetadata":{}}],"fix":{"versions":["0.35.0"],"state":"fixed","available":[{"version":"0.35.0","date":"2026-07-22","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"sharp","version":"0.34.5"}},"found":{"vulnerabilityID":"GHSA-f88m-g3jw-g9cj","versionConstraint":"<0.35.0 (semantic)"},"fix":{"suggestedVersion":"0.35.0"}}],"artifact":{"id":"pkg:npm/sharp@0.34.5?package-id=2980364737d674c2","name":"sharp","version":"0.34.5","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["Apache-2.0"],"cpes":["cpe:2.3:a:sharp_project:sharp:0.34.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/sharp@0.34.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-rgj7-g3m4-5g8c","dataSource":"https://github.com/advisories/GHSA-rgj7-g3m4-5g8c","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/lovell/sharp/security/advisories/GHSA-rgj7-g3m4-5g8c","https://github.com/strukturag/libheif/security/advisories/GHSA-2jg2-4ch7-h545","https://github.com/strukturag/libheif/security/advisories/GHSA-g89c-p67h-r497","https://github.com/lovell/sharp/releases/tag/v0.35.4"],"description":"sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","metrics":{"baseScore":8.9},"vendorMetadata":{}}],"fix":{"versions":["0.35.4"],"state":"fixed","available":[{"version":"0.35.4","date":"2026-09-09","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"sharp","version":"0.34.5"}},"found":{"vulnerabilityID":"GHSA-rgj7-g3m4-5g8c","versionConstraint":"<0.35.4 (semantic)"},"fix":{"suggestedVersion":"0.35.4"}}],"artifact":{"id":"pkg:npm/sharp@0.34.5?package-id=2980364737d674c2","name":"sharp","version":"0.34.5","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["Apache-2.0"],"cpes":["cpe:2.3:a:sharp_project:sharp:0.34.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/sharp@0.34.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-wq5f-xc86-pv6w","dataSource":"https://github.com/advisories/GHSA-wq5f-xc86-pv6w","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/lovell/sharp/security/advisories/GHSA-wq5f-xc86-pv6w","https://github.com/lovell/sharp/commit/96de105d9d36ab04c76c2b78b97255171630d236","https://github.com/lovell/sharp/releases/tag/v0.35.5","https://gitlab.gnome.org/GNOME/librsvg/-/work_items/1241","https://www.cve.org/CVERecord?id=CVE-2026-96889"],"description":"sharp : Vulnerability in librsvg dependency CVE-2026-96889","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","metrics":{"baseScore":8.9},"vendorMetadata":{}}],"fix":{"versions":["0.35.5"],"state":"fixed","available":[{"version":"0.35.5","date":"2026-10-06","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"sharp","version":"0.34.5"}},"found":{"vulnerabilityID":"GHSA-wq5f-xc86-pv6w","versionConstraint":"<0.35.5 (semantic)"},"fix":{"suggestedVersion":"0.35.5"}}],"artifact":{"id":"pkg:npm/sharp@0.34.5?package-id=2980364737d674c2","name":"sharp","version":"0.34.5","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["Apache-2.0"],"cpes":["cpe:2.3:a:sharp_project:sharp:0.34.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/sharp@0.34.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-mrhx-c7xc-m3w5","dataSource":"https://github.com/advisories/GHSA-mrhx-c7xc-m3w5","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2023-54404","https://github.com/colinhacks/zod/issues/1872","https://github.com/colinhacks/zod/pull/6475","https://www.vulncheck.com/advisories/zod-uncontrolled-resource-consumption-via-array-validation","https://github.com/colinhacks/zod/pull/6652","https://github.com/colinhacks/zod/commit/a0ebf970f2d752e5f58527cd2942ff48be4f46bd"],"description":"Zod can exhaust memory while validating oversized constrained collections","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"fix":{"versions":["4.6.6"],"state":"fixed","available":[{"version":"4.6.6","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[{"id":"CVE-2023-54404","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-54404","namespace":"nvd:cpe","severity":"Unknown","urls":[],"description":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. The described memory use only grows in proportion to input already allocated by JSON.parse before Zod runs, is reachable only without an application request-size limit, and reflects expected validator behavior rather than a defect in Zod.","cvss":[]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"zod","version":"3.24.1"}},"found":{"vulnerabilityID":"GHSA-mrhx-c7xc-m3w5","versionConstraint":"<4.6.6 (semantic)"},"fix":{"suggestedVersion":"4.6.6"}}],"artifact":{"id":"pkg:npm/zod@3.24.1?package-id=22dd4fe8cc0417d4","name":"zod","version":"3.24.1","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:zod:zod:3.24.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/zod@3.24.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-mrhx-c7xc-m3w5","dataSource":"https://github.com/advisories/GHSA-mrhx-c7xc-m3w5","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2023-54404","https://github.com/colinhacks/zod/issues/1872","https://github.com/colinhacks/zod/pull/6475","https://www.vulncheck.com/advisories/zod-uncontrolled-resource-consumption-via-array-validation","https://github.com/colinhacks/zod/pull/6652","https://github.com/colinhacks/zod/commit/a0ebf970f2d752e5f58527cd2942ff48be4f46bd"],"description":"Zod can exhaust memory while validating oversized constrained collections","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"fix":{"versions":["4.6.6"],"state":"fixed","available":[{"version":"4.6.6","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[{"id":"CVE-2023-54404","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-54404","namespace":"nvd:cpe","severity":"Unknown","urls":[],"description":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. The described memory use only grows in proportion to input already allocated by JSON.parse before Zod runs, is reachable only without an application request-size limit, and reflects expected validator behavior rather than a defect in Zod.","cvss":[]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"zod","version":"3.25.76"}},"found":{"vulnerabilityID":"GHSA-mrhx-c7xc-m3w5","versionConstraint":"<4.6.6 (semantic)"},"fix":{"suggestedVersion":"4.6.6"}}],"artifact":{"id":"pkg:npm/zod@3.25.76?package-id=e5935931b95897a8","name":"zod","version":"3.25.76","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:zod:zod:3.25.76:*:*:*:*:*:*:*"],"purl":"pkg:npm/zod@3.25.76","upstreams":[]}},{"vulnerability":{"id":"GHSA-mrhx-c7xc-m3w5","dataSource":"https://github.com/advisories/GHSA-mrhx-c7xc-m3w5","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2023-54404","https://github.com/colinhacks/zod/issues/1872","https://github.com/colinhacks/zod/pull/6475","https://www.vulncheck.com/advisories/zod-uncontrolled-resource-consumption-via-array-validation","https://github.com/colinhacks/zod/pull/6652","https://github.com/colinhacks/zod/commit/a0ebf970f2d752e5f58527cd2942ff48be4f46bd"],"description":"Zod can exhaust memory while validating oversized constrained collections","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"fix":{"versions":["4.6.6"],"state":"fixed","available":[{"version":"4.6.6","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[{"id":"CVE-2023-54404","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-54404","namespace":"nvd:cpe","severity":"Unknown","urls":[],"description":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. The described memory use only grows in proportion to input already allocated by JSON.parse before Zod runs, is reachable only without an application request-size limit, and reflects expected validator behavior rather than a defect in Zod.","cvss":[]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"zod","version":"4.4.1"}},"found":{"vulnerabilityID":"GHSA-mrhx-c7xc-m3w5","versionConstraint":"<4.6.6 (semantic)"},"fix":{"suggestedVersion":"4.6.6"}}],"artifact":{"id":"pkg:npm/zod@4.4.1?package-id=bec5e8af43336528","name":"zod","version":"4.4.1","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:zod:zod:4.4.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/zod@4.4.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-mrhx-c7xc-m3w5","dataSource":"https://github.com/advisories/GHSA-mrhx-c7xc-m3w5","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2023-54404","https://github.com/colinhacks/zod/issues/1872","https://github.com/colinhacks/zod/pull/6475","https://www.vulncheck.com/advisories/zod-uncontrolled-resource-consumption-via-array-validation","https://github.com/colinhacks/zod/pull/6652","https://github.com/colinhacks/zod/commit/a0ebf970f2d752e5f58527cd2942ff48be4f46bd"],"description":"Zod can exhaust memory while validating oversized constrained collections","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"fix":{"versions":["4.6.6"],"state":"fixed","available":[{"version":"4.6.6","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[{"id":"CVE-2023-54404","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-54404","namespace":"nvd:cpe","severity":"Unknown","urls":[],"description":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. The described memory use only grows in proportion to input already allocated by JSON.parse before Zod runs, is reachable only without an application request-size limit, and reflects expected validator behavior rather than a defect in Zod.","cvss":[]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"zod","version":"4.6.5"}},"found":{"vulnerabilityID":"GHSA-mrhx-c7xc-m3w5","versionConstraint":"<4.6.6 (semantic)"},"fix":{"suggestedVersion":"4.6.6"}}],"artifact":{"id":"pkg:npm/zod@4.6.5?package-id=2b691a8bd20ddf66","name":"zod","version":"4.6.5","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:zod:zod:4.6.5:*:*:*:*:*:*:*"],"purl":"pkg:npm/zod@4.6.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-frvp-7c67-39w9","dataSource":"https://github.com/advisories/GHSA-frvp-7c67-39w9","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/honojs/node-server/security/advisories/GHSA-frvp-7c67-39w9","https://github.com/honojs/node-server/commit/cd076e117cfe4cb8d31f9eb11d2e8f38a6cb8faf","https://github.com/honojs/node-server/releases/tag/v2.0.5"],"description":"Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"fix":{"versions":["1.19.15"],"state":"fixed","available":[{"version":"1.19.15","date":"2026-08-13","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@hono/node-server","version":"1.19.14"}},"found":{"vulnerabilityID":"GHSA-frvp-7c67-39w9","versionConstraint":"<1.19.15 (semantic)"},"fix":{"suggestedVersion":"1.19.15"}}],"artifact":{"id":"pkg:npm/%40hono/node-server@1.19.14?package-id=e2a24eeea3066caa","name":"@hono/node-server","version":"1.19.14","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:\\@hono\\/node-server:\\@hono\\/node-server:1.19.14:*:*:*:*:*:*:*","cpe:2.3:a:\\@hono\\/node-server:\\@hono\\/node_server:1.19.14:*:*:*:*:*:*:*","cpe:2.3:a:\\@hono\\/node_server:\\@hono\\/node-server:1.19.14:*:*:*:*:*:*:*","cpe:2.3:a:\\@hono\\/node_server:\\@hono\\/node_server:1.19.14:*:*:*:*:*:*:*","cpe:2.3:a:\\@hono\\/node:\\@hono\\/node-server:1.19.14:*:*:*:*:*:*:*","cpe:2.3:a:\\@hono\\/node:\\@hono\\/node_server:1.19.14:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40hono/node-server@1.19.14","upstreams":[]}},{"vulnerability":{"id":"GHSA-6prh-2h8m-c8cw","dataSource":"https://github.com/advisories/GHSA-6prh-2h8m-c8cw","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-6prh-2h8m-c8cw","https://github.com/modelcontextprotocol/typescript-sdk/pull/2901","https://github.com/modelcontextprotocol/typescript-sdk/pull/2902","https://github.com/modelcontextprotocol/typescript-sdk/commit/30bfe5139f4b0825c90cd725f9a7e3f9af5e120d","https://github.com/modelcontextprotocol/typescript-sdk/commit/433eb413dc305ebeb93b8ebcde0095a8fc0d5fa0"],"description":"MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.3,"impactScore":4.3},"vendorMetadata":{}}],"fix":{"versions":["1.32.0"],"state":"fixed","available":[{"version":"1.32.0","date":"2026-10-21","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[{"id":"CVE-2026-111769","dataSource":"nvd","namespace":"nvd:cpe","severity":"Unknown","urls":[],"cvss":[]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@modelcontextprotocol/sdk","version":"1.29.0"}},"found":{"vulnerabilityID":"GHSA-6prh-2h8m-c8cw","versionConstraint":"<1.32.0 (semantic)"},"fix":{"suggestedVersion":"1.32.0"}}],"artifact":{"id":"pkg:npm/%40modelcontextprotocol/sdk@1.29.0?package-id=0c66cca13b59eb9b","name":"@modelcontextprotocol/sdk","version":"1.29.0","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:\\@modelcontextprotocol\\/sdk:\\@modelcontextprotocol\\/sdk:1.29.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40modelcontextprotocol/sdk@1.29.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-rvq5-wwqv-78pq","dataSource":"https://github.com/advisories/GHSA-rvq5-wwqv-78pq","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-rvq5-wwqv-78pq","https://github.com/modelcontextprotocol/typescript-sdk/commit/40f8f4e229d963cd7fd2890bda2aeebe7005299a","https://github.com/modelcontextprotocol/typescript-sdk/commit/5a0724d14cf34a27a3b070224d2996cdd611df9f","https://github.com/modelcontextprotocol/typescript-sdk/commit/5a1867390b91b8836f49af76c45427279f513325"],"description":"MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"exploitabilityScore":1.7,"impactScore":5.2},"vendorMetadata":{}}],"fix":{"versions":["1.32.0"],"state":"fixed","available":[{"version":"1.32.0","date":"2026-10-21","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[{"id":"CVE-2026-111771","dataSource":"nvd","namespace":"nvd:cpe","severity":"Unknown","urls":[],"cvss":[]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@modelcontextprotocol/sdk","version":"1.29.0"}},"found":{"vulnerabilityID":"GHSA-rvq5-wwqv-78pq","versionConstraint":">=1.6.0,<1.32.0 (semantic)"},"fix":{"suggestedVersion":"1.32.0"}}],"artifact":{"id":"pkg:npm/%40modelcontextprotocol/sdk@1.29.0?package-id=0c66cca13b59eb9b","name":"@modelcontextprotocol/sdk","version":"1.29.0","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:\\@modelcontextprotocol\\/sdk:\\@modelcontextprotocol\\/sdk:1.29.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40modelcontextprotocol/sdk@1.29.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-55q2-fjhq-7xh7","dataSource":"https://github.com/advisories/GHSA-55q2-fjhq-7xh7","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/cure53/DOMPurify/security/advisories/GHSA-55q2-fjhq-7xh7","https://github.com/cure53/DOMPurify/pull/1557","https://github.com/cure53/DOMPurify/commit/3067f7746769","https://github.com/cure53/DOMPurify/releases/tag/3.4.13"],"description":"DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","metrics":{"baseScore":5.1},"vendorMetadata":{}}],"fix":{"versions":["3.4.13"],"state":"fixed","available":[{"version":"3.4.13","date":"2026-08-07","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"dompurify","version":"3.3.3"}},"found":{"vulnerabilityID":"GHSA-55q2-fjhq-7xh7","versionConstraint":"<=3.4.12 (semantic)"},"fix":{"suggestedVersion":"3.4.13"}}],"artifact":{"id":"pkg:npm/dompurify@3.3.3?package-id=5ef50eed3845476c","name":"dompurify","version":"3.3.3","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MPL-2.0 OR Apache-2.0"],"cpes":["cpe:2.3:a:dompurify:dompurify:3.3.3:*:*:*:*:*:*:*"],"purl":"pkg:npm/dompurify@3.3.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-jggr-w7fw-pc2j","dataSource":"https://github.com/advisories/GHSA-jggr-w7fw-pc2j","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/planttheidea/fast-copy/security/advisories/GHSA-jggr-w7fw-pc2j","https://github.com/planttheidea/fast-copy/pull/137","https://github.com/planttheidea/fast-copy/pull/138","https://github.com/planttheidea/fast-copy/pull/139","https://github.com/planttheidea/fast-copy/commit/359c00884ae8ae31f10925fd0e2fc66661db6cef","https://github.com/planttheidea/fast-copy/commit/caa7caace65767dfe252f0dc5115d82c99ca16b9","https://github.com/planttheidea/fast-copy/commit/dedf465e5329fbd149f13b53521af962d16ff8df","https://github.com/planttheidea/fast-copy/releases/tag/v2.2.0","https://github.com/planttheidea/fast-copy/releases/tag/v3.1.0","https://github.com/planttheidea/fast-copy/releases/tag/v4.1.0"],"description":"fast-copy: Stack exhaustion in fast-copy when copying deeply-nested values","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"fix":{"versions":["3.1.0"],"state":"fixed","available":[{"version":"3.1.0","date":"2026-10-06","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-copy","version":"3.0.1"}},"found":{"vulnerabilityID":"GHSA-jggr-w7fw-pc2j","versionConstraint":">=3.0.0,<3.1.0 (semantic)"},"fix":{"suggestedVersion":"3.1.0"}}],"artifact":{"id":"pkg:npm/fast-copy@3.0.1?package-id=085cd8099926a0e2","name":"fast-copy","version":"3.0.1","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:fast-copy:fast-copy:3.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fast-copy:fast_copy:3.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fast_copy:fast-copy:3.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fast_copy:fast_copy:3.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fast:fast-copy:3.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fast:fast_copy:3.0.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/fast-copy@3.0.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-85x2-q946-cp5h","dataSource":"https://github.com/advisories/GHSA-85x2-q946-cp5h","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-85x2-q946-cp5h","https://github.com/nodemailer/nodemailer/commit/1cd57d2b8c49dff048c21cdbafdb54439a7f07e2","https://github.com/nodemailer/nodemailer/releases/tag/v10.1.4"],"description":"Nodemailer: A \">\" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.3,"impactScore":4.3},"vendorMetadata":{}}],"fix":{"versions":["10.1.4"],"state":"fixed","available":[{"version":"10.1.4","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"nodemailer","version":"10.0.16"}},"found":{"vulnerabilityID":"GHSA-85x2-q946-cp5h","versionConstraint":">=3.0.0,<10.1.4 (semantic)"},"fix":{"suggestedVersion":"10.1.4"}}],"artifact":{"id":"pkg:npm/nodemailer@10.0.16?package-id=2222dfbd9d2b3d65","name":"nodemailer","version":"10.0.16","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT-0"],"cpes":["cpe:2.3:a:nodemailer:nodemailer:10.0.16:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/nodemailer@10.0.16","upstreams":[]}},{"vulnerability":{"id":"GHSA-8c8m-p3m8-cjg8","dataSource":"https://github.com/advisories/GHSA-8c8m-p3m8-cjg8","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-8c8m-p3m8-cjg8","https://github.com/nodemailer/nodemailer/commit/0a8761762ac78f2db2ba37f712f2a52a404ce011","https://github.com/nodemailer/nodemailer/releases/tag/v10.1.4"],"description":"Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.3,"impactScore":4.3},"vendorMetadata":{}}],"fix":{"versions":["10.1.4"],"state":"fixed","available":[{"version":"10.1.4","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"nodemailer","version":"10.0.16"}},"found":{"vulnerabilityID":"GHSA-8c8m-p3m8-cjg8","versionConstraint":">=3.0.0,<10.1.4 (semantic)"},"fix":{"suggestedVersion":"10.1.4"}}],"artifact":{"id":"pkg:npm/nodemailer@10.0.16?package-id=2222dfbd9d2b3d65","name":"nodemailer","version":"10.0.16","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT-0"],"cpes":["cpe:2.3:a:nodemailer:nodemailer:10.0.16:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/nodemailer@10.0.16","upstreams":[]}},{"vulnerability":{"id":"GHSA-m943-m63m-w62w","dataSource":"https://github.com/advisories/GHSA-m943-m63m-w62w","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-m943-m63m-w62w","https://github.com/nodemailer/nodemailer/commit/1cd57d2b8c49dff048c21cdbafdb54439a7f07e2","https://github.com/nodemailer/nodemailer/releases/tag/v10.1.4"],"description":"Nodemailer: A \";\" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.3,"impactScore":4.3},"vendorMetadata":{}}],"fix":{"versions":["10.1.4"],"state":"fixed","available":[{"version":"10.1.4","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"nodemailer","version":"10.0.16"}},"found":{"vulnerabilityID":"GHSA-m943-m63m-w62w","versionConstraint":">=3.0.0,<10.1.4 (semantic)"},"fix":{"suggestedVersion":"10.1.4"}}],"artifact":{"id":"pkg:npm/nodemailer@10.0.16?package-id=2222dfbd9d2b3d65","name":"nodemailer","version":"10.0.16","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT-0"],"cpes":["cpe:2.3:a:nodemailer:nodemailer:10.0.16:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/nodemailer@10.0.16","upstreams":[]}},{"vulnerability":{"id":"GHSA-6hxq-p678-4hr2","dataSource":"https://github.com/advisories/GHSA-6hxq-p678-4hr2","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/MasterKale/SimpleWebAuthn/security/advisories/GHSA-6hxq-p678-4hr2","https://github.com/MasterKale/SimpleWebAuthn/commit/67a41fed3dfd96cab1dcf414f6d1792a72e06e35","https://github.com/MasterKale/SimpleWebAuthn/commit/8a53d70f42bcbb7c744ef1b90e6db35bc4b26d06","https://github.com/MasterKale/SimpleWebAuthn/commit/dd0d73c716a528e6645efafbd43a972b64df71f9","https://github.com/MasterKale/SimpleWebAuthn/releases/tag/v13.3.2"],"description":"SimpleWebAuthn: Registration verification does not sufficiently ensure that attestation certificates chain to a trust anchor","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":2},"vendorMetadata":{}}],"fix":{"versions":["13.3.2"],"state":"fixed","available":[{"version":"13.3.2","date":"2026-09-05","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@simplewebauthn/server","version":"13.2.2"}},"found":{"vulnerabilityID":"GHSA-6hxq-p678-4hr2","versionConstraint":"<=13.3.1 (semantic)"},"fix":{"suggestedVersion":"13.3.2"}}],"artifact":{"id":"pkg:npm/%40simplewebauthn/server@13.2.2?package-id=4323f0dea7595a58","name":"@simplewebauthn/server","version":"13.2.2","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:\\@simplewebauthn\\/server:\\@simplewebauthn\\/server:13.2.2:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40simplewebauthn/server@13.2.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-6688-9rhm-gjv2","dataSource":"https://github.com/advisories/GHSA-6688-9rhm-gjv2","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/cure53/DOMPurify/security/advisories/GHSA-6688-9rhm-gjv2","https://github.com/cure53/DOMPurify/pull/1636","https://github.com/cure53/DOMPurify/commit/b9b9d80f7e401771c2ccaef5f45def7eec8f27d7","https://github.com/cure53/DOMPurify/releases/tag/3.4.16"],"description":"DOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup — pure HTML reparse executes","cvss":[],"fix":{"versions":["3.4.16"],"state":"fixed","available":[{"version":"3.4.16","date":"2026-10-06","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"dompurify","version":"3.3.3"}},"found":{"vulnerabilityID":"GHSA-6688-9rhm-gjv2","versionConstraint":"<=3.4.15 (semantic)"},"fix":{"suggestedVersion":"3.4.16"}}],"artifact":{"id":"pkg:npm/dompurify@3.3.3?package-id=5ef50eed3845476c","name":"dompurify","version":"3.3.3","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MPL-2.0 OR Apache-2.0"],"cpes":["cpe:2.3:a:dompurify:dompurify:3.3.3:*:*:*:*:*:*:*"],"purl":"pkg:npm/dompurify@3.3.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-c6gr-qvv4-5v3f","dataSource":"https://github.com/advisories/GHSA-c6gr-qvv4-5v3f","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/cure53/DOMPurify/security/advisories/GHSA-c6gr-qvv4-5v3f","https://github.com/cure53/DOMPurify/pull/1672","https://github.com/cure53/DOMPurify/commit/a77a3e78b59f72fa4d1c83f22e121ad9cc7d3575","https://github.com/cure53/DOMPurify/releases/tag/3.4.17"],"description":"DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml","cvss":[],"fix":{"versions":["3.4.17"],"state":"fixed","available":[{"version":"3.4.17","date":"2026-10-23","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"dompurify","version":"3.3.3"}},"found":{"vulnerabilityID":"GHSA-c6gr-qvv4-5v3f","versionConstraint":"<=3.4.16 (semantic)"},"fix":{"suggestedVersion":"3.4.17"}}],"artifact":{"id":"pkg:npm/dompurify@3.3.3?package-id=5ef50eed3845476c","name":"dompurify","version":"3.3.3","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MPL-2.0 OR Apache-2.0"],"cpes":["cpe:2.3:a:dompurify:dompurify:3.3.3:*:*:*:*:*:*:*"],"purl":"pkg:npm/dompurify@3.3.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-c6gr-qvv4-5v3f","dataSource":"https://github.com/advisories/GHSA-c6gr-qvv4-5v3f","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/cure53/DOMPurify/security/advisories/GHSA-c6gr-qvv4-5v3f","https://github.com/cure53/DOMPurify/pull/1672","https://github.com/cure53/DOMPurify/commit/a77a3e78b59f72fa4d1c83f22e121ad9cc7d3575","https://github.com/cure53/DOMPurify/releases/tag/3.4.17"],"description":"DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml","cvss":[],"fix":{"versions":["3.4.17"],"state":"fixed","available":[{"version":"3.4.17","date":"2026-10-23","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"dompurify","version":"3.4.16"}},"found":{"vulnerabilityID":"GHSA-c6gr-qvv4-5v3f","versionConstraint":"<=3.4.16 (semantic)"},"fix":{"suggestedVersion":"3.4.17"}}],"artifact":{"id":"pkg:npm/dompurify@3.4.16?package-id=9696e2d4a493519d","name":"dompurify","version":"3.4.16","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MPL-2.0 OR Apache-2.0"],"cpes":["cpe:2.3:a:dompurify:dompurify:3.4.16:*:*:*:*:*:*:*"],"purl":"pkg:npm/dompurify@3.4.16","upstreams":[]}},{"vulnerability":{"id":"GHSA-g7r4-m6w7-qqqr","dataSource":"https://github.com/advisories/GHSA-g7r4-m6w7-qqqr","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/evanw/esbuild/security/advisories/GHSA-g7r4-m6w7-qqqr","https://github.com/evanw/esbuild/releases/tag/v0.28.1"],"description":"esbuild allows arbitrary file read when running the development server on Windows","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":2.5,"exploitabilityScore":1.1,"impactScore":1.5},"vendorMetadata":{}}],"fix":{"versions":["0.28.1"],"state":"fixed","available":[{"version":"0.28.1","date":"2026-06-13","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"esbuild","version":"0.27.3"}},"found":{"vulnerabilityID":"GHSA-g7r4-m6w7-qqqr","versionConstraint":">=0.27.3,<0.28.1 (semantic)"},"fix":{"suggestedVersion":"0.28.1"}}],"artifact":{"id":"pkg:npm/esbuild@0.27.3?package-id=c616ba5cef15b829","name":"esbuild","version":"0.27.3","type":"npm","locations":[{"path":"/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:esbuild:esbuild:0.27.3:*:*:*:*:*:*:*"],"purl":"pkg:npm/esbuild@0.27.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-g7r4-m6w7-qqqr","dataSource":"https://github.com/advisories/GHSA-g7r4-m6w7-qqqr","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/evanw/esbuild/security/advisories/GHSA-g7r4-m6w7-qqqr","https://github.com/evanw/esbuild/releases/tag/v0.28.1"],"description":"esbuild allows arbitrary file read when running the development server on Windows","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":2.5,"exploitabilityScore":1.1,"impactScore":1.5},"vendorMetadata":{}}],"fix":{"versions":["0.28.1"],"state":"fixed","available":[{"version":"0.28.1","date":"2026-06-13","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"esbuild","version":"0.27.7"}},"found":{"vulnerabilityID":"GHSA-g7r4-m6w7-qqqr","versionConstraint":">=0.27.3,<0.28.1 (semantic)"},"fix":{"suggestedVersion":"0.28.1"}}],"artifact":{"id":"pkg:npm/esbuild@0.27.7?package-id=9eeaa3c756f4c12a","name":"esbuild","version":"0.27.7","type":"npm","locations":[{"path":"/upgrade-impact/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:esbuild:esbuild:0.27.7:*:*:*:*:*:*:*"],"purl":"pkg:npm/esbuild@0.27.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-g7r4-m6w7-qqqr","dataSource":"https://github.com/advisories/GHSA-g7r4-m6w7-qqqr","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/evanw/esbuild/security/advisories/GHSA-g7r4-m6w7-qqqr","https://github.com/evanw/esbuild/releases/tag/v0.28.1"],"description":"esbuild allows arbitrary file read when running the development server on Windows","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":2.5,"exploitabilityScore":1.1,"impactScore":1.5},"vendorMetadata":{}}],"fix":{"versions":["0.28.1"],"state":"fixed","available":[{"version":"0.28.1","date":"2026-06-13","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"esbuild","version":"0.27.7"}},"found":{"vulnerabilityID":"GHSA-g7r4-m6w7-qqqr","versionConstraint":">=0.27.3,<0.28.1 (semantic)"},"fix":{"suggestedVersion":"0.28.1"}}],"artifact":{"id":"pkg:npm/esbuild@0.27.7?package-id=40387316935a08b1","name":"esbuild","version":"0.27.7","type":"npm","locations":[{"path":"/frontend/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:esbuild:esbuild:0.27.7:*:*:*:*:*:*:*"],"purl":"pkg:npm/esbuild@0.27.7","upstreams":[]}},{"vulnerability":{"id":"GO-2026-5774","dataSource":"https://github.com/go-chi/chi/security/advisories/GHSA-3fxj-6jh8-hvhx","namespace":"govulndb:language:go","severity":"Unknown","urls":["https://github.com/go-chi/chi/pull/967"],"description":"Chi has an IP spoofing vulnerability in middleware.RealIP in github.com/go-chi/chi","cvss":[],"fix":{"versions":["5.3.0"],"state":"fixed","available":[{"version":"5.3.0","date":"2026-05-22","kind":"release"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[{"id":"GHSA-3fxj-6jh8-hvhx","dataSource":"https://github.com/advisories/GHSA-3fxj-6jh8-hvhx","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/go-chi/chi/security/advisories/GHSA-3fxj-6jh8-hvhx"],"description":"chi Has an IP Spoofing Vulnerability in `middleware.RealIP`","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"github.com/go-chi/chi/v5","version":"v5.2.4"}},"found":{"vulnerabilityID":"GO-2026-5774","versionConstraint":">=5.2.1,<5.3.0 (go)"},"fix":{"suggestedVersion":"5.3.0"}}],"artifact":{"id":"pkg:golang/github.com/go-chi/chi/v5@v5.2.4?package-id=0f221d8b2d1bd0be","name":"github.com/go-chi/chi/v5","version":"v5.2.4","type":"go-module","locations":[{"path":"/backend-go/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:go-chi:chi\\/v5:v5.2.4:*:*:*:*:*:*:*","cpe:2.3:a:go_chi:chi\\/v5:v5.2.4:*:*:*:*:*:*:*","cpe:2.3:a:go:chi\\/v5:v5.2.4:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/go-chi/chi/v5@v5.2.4","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:WtFKPHwlywe8Srng8j2BhOD9312j9cGUxG1SP4V2cR4="}}},{"vulnerability":{"id":"GO-2026-5775","dataSource":"https://github.com/go-chi/chi/security/advisories/GHSA-9g5q-2w5x-hmxf","namespace":"govulndb:language:go","severity":"Unknown","urls":["https://github.com/go-chi/chi/pull/967","https://github.com/go-chi/chi/releases/tag/v5.3.0"],"description":"Chi Middleware vulnerable to IP spoofing via X-Forwarded-For header in github.com/go-chi/chi","cvss":[],"fix":{"versions":["5.3.0"],"state":"fixed","available":[{"version":"5.3.0","date":"2026-05-22","kind":"release"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[{"id":"GHSA-9g5q-2w5x-hmxf","dataSource":"https://github.com/advisories/GHSA-9g5q-2w5x-hmxf","namespace":"github:language:go","severity":"High","urls":["https://github.com/go-chi/chi/security/advisories/GHSA-9g5q-2w5x-hmxf","https://github.com/go-chi/chi/releases/tag/v5.3.0"],"description":"chi Middleware Vulnerable to Potential IP Spoofing via `X-Forwarded-For` Header in `Request.RemoteAddr` Resolution","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":7.7},"vendorMetadata":{}}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"github.com/go-chi/chi/v5","version":"v5.2.4"}},"found":{"vulnerabilityID":"GO-2026-5775","versionConstraint":"<5.3.0 (go)"},"fix":{"suggestedVersion":"5.3.0"}}],"artifact":{"id":"pkg:golang/github.com/go-chi/chi/v5@v5.2.4?package-id=0f221d8b2d1bd0be","name":"github.com/go-chi/chi/v5","version":"v5.2.4","type":"go-module","locations":[{"path":"/backend-go/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:go-chi:chi\\/v5:v5.2.4:*:*:*:*:*:*:*","cpe:2.3:a:go_chi:chi\\/v5:v5.2.4:*:*:*:*:*:*:*","cpe:2.3:a:go:chi\\/v5:v5.2.4:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/go-chi/chi/v5@v5.2.4","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:WtFKPHwlywe8Srng8j2BhOD9312j9cGUxG1SP4V2cR4="}}},{"vulnerability":{"id":"GO-2026-5777","dataSource":"https://github.com/go-chi/chi/security/advisories/GHSA-rjr7-jggh-pgcp","namespace":"govulndb:language:go","severity":"Unknown","urls":["https://github.com/go-chi/chi/pull/967","https://github.com/go-chi/chi/releases/tag/v5.3.0"],"description":"Chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header in github.com/go-chi/chi","cvss":[],"fix":{"versions":["5.3.0"],"state":"fixed","available":[{"version":"5.3.0","date":"2026-05-22","kind":"release"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[{"id":"GHSA-rjr7-jggh-pgcp","dataSource":"https://github.com/advisories/GHSA-rjr7-jggh-pgcp","namespace":"github:language:go","severity":"High","urls":["https://github.com/go-chi/chi/security/advisories/GHSA-rjr7-jggh-pgcp","https://github.com/go-chi/chi/releases/tag/v5.3.0"],"description":"chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":7.7},"vendorMetadata":{}}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"github.com/go-chi/chi/v5","version":"v5.2.4"}},"found":{"vulnerabilityID":"GO-2026-5777","versionConstraint":"<5.3.0 (go)"},"fix":{"suggestedVersion":"5.3.0"}}],"artifact":{"id":"pkg:golang/github.com/go-chi/chi/v5@v5.2.4?package-id=0f221d8b2d1bd0be","name":"github.com/go-chi/chi/v5","version":"v5.2.4","type":"go-module","locations":[{"path":"/backend-go/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:go-chi:chi\\/v5:v5.2.4:*:*:*:*:*:*:*","cpe:2.3:a:go_chi:chi\\/v5:v5.2.4:*:*:*:*:*:*:*","cpe:2.3:a:go:chi\\/v5:v5.2.4:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/go-chi/chi/v5@v5.2.4","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:WtFKPHwlywe8Srng8j2BhOD9312j9cGUxG1SP4V2cR4="}}},{"vulnerability":{"id":"GO-2026-5932","dataSource":"https://go.dev/issue/44226","namespace":"govulndb:language:go","severity":"Unknown","urls":[],"description":"The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used.\n\nIf you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package.","cvss":[],"fix":{"versions":[],"state":""},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/crypto","version":"v0.53.0"}},"found":{"vulnerabilityID":"GO-2026-5932","versionConstraint":"none (unknown)"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.53.0?package-id=2cfa42269238d9de","name":"golang.org/x/crypto","version":"v0.53.0","type":"go-module","locations":[{"path":"/backend-go/go.mod","accessPath":""}],"language":"go","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:golang:crypto:v0.53.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.53.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.53.0","upstreams":[],"metadataType":"GolangSourceMetadata","metadata":{"h1Digest":"h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto=","os":"linux","architecture":"amd64","cgoEnabled":true}}}],"source":{"type":"file","target":"Infisical/infisical"},"distro":{"name":"","version":"","idLike":null},"descriptor":{"name":"grype","version":"0.121.0","configuration":{"output":["json"],"file":"./grype.json","pretty":false,"distro":"","add-cpes-if-none":false,"output-template-file":"","check-for-app-update":true,"only-fixed":false,"only-notfixed":false,"ignore-wontfix":"","platform":"","search":{"scope":"squashed","unindexed-archives":false,"indexed-archives":true},"ignore":[{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"kernel-headers","version":"","language":"","type":"rpm","location":"","upstream-name":"kernel"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux(-.*)?-headers-.*","version":"","language":"","type":"deb","location":"","upstream-name":"linux.*"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux-libc-dev","version":"","language":"","type":"deb","location":"","upstream-name":"linux"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux-kbuild-.*","version":"","language":"","type":"deb","location":"","upstream-name":"linux.*"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"}],"exclude":[],"externalSources":{"enable":false,"maven":{"searchUpstreamBySha1":true,"baseUrl":"https://search.maven.org/solrsearch/select","rateLimit":300000000}},"match":{"java":{"using-cpes":false},"jvm":{"using-cpes":true},"dotnet":{"using-cpes":false},"golang":{"using-cpes":false,"always-use-cpe-for-stdlib":false,"allow-main-module-pseudo-version-comparison":false},"javascript":{"using-cpes":false},"python":{"using-cpes":false},"ruby":{"using-cpes":false},"rust":{"using-cpes":false},"hex":{"using-cpes":false},"stock":{"using-cpes":true},"dpkg":{"using-cpes":false,"missing-epoch-strategy":"zero","use-cpes-for-eol":false},"rpm":{"using-cpes":false,"missing-epoch-strategy":"auto","use-cpes-for-eol":false}},"fail-on-severity":"","registry":{"insecure-skip-tls-verify":false,"insecure-use-http":false,"ca-cert":""},"show-suppressed":false,"include-matcher-suppressions":false,"by-cve":false,"SortBy":{"sort-by":"risk"},"name":"","default-image-pull-source":"","from":null,"vex-documents":[],"vex-add":[],"match-upstream-kernel-headers":false,"fix-channel":{"redhat-eus":{"apply":"auto","versions":">= 8.0"},"ubuntu-esm":{"apply":"auto","versions":""}},"timestamp":true,"alerts":{"enable-eol-distro-warnings":true},"db":{"cache-dir":"$HOME/.cache/grype/db","update-url":"https://grype.anchore.io/databases","ca-cert":"","auto-update":true,"validate-by-hash-on-start":true,"validate-age":true,"max-allowed-built-age":432000000000000,"require-update-check":false,"update-available-timeout":30000000000,"update-download-timeout":300000000000,"max-update-check-frequency":7200000000000},"exp":{},"dev":{"db":{"debug":false}}},"db":{"status":{"schemaVersion":"v6.1.10","from":"https://grype.anchore.io/databases/v6/vulnerability-db_v6.1.10_2026-11-01T00:24:34Z_1793514012.tar.zst?checksum=sha256%3Ad0e1af9e6491440e1a671d0a0aafc32c5c7cb5cda787dcec3482799ef298f31c","built":"2026-11-01T06:20:12Z","path":"$HOME/.cache/grype/db/6/vulnerability.db","valid":true},"providers":{"alma":{"captured":"2026-11-01T00:24:39Z","input":"xxh64:d398731e6455b022"},"alpine":{"captured":"2026-11-01T00:24:47Z","input":"xxh64:c40c8985935df81b"},"amazon":{"captured":"2026-11-01T00:24:37Z","input":"xxh64:ee129200b14d5c8a"},"arch":{"captured":"2026-11-01T00:24:47Z","input":"xxh64:14f6c24dd6cd12c8"},"bitnami":{"captured":"2026-11-01T00:24:34Z","input":"xxh64:971619846357ae10"},"chainguard":{"captured":"2026-11-01T00:24:48Z","input":"xxh64:dfbf78c7fc58a603"},"chainguard-libraries":{"captured":"2026-11-01T00:24:50Z","input":"xxh64:db9c34dd1b7bc8d0"},"debian":{"captured":"2026-11-01T00:24:52Z","input":"xxh64:078c82a49c8cb529"},"echo":{"captured":"2026-11-01T00:24:41Z","input":"xxh64:1d0df98736854a48"},"eol":{"captured":"2026-11-01T00:24:59Z","input":"xxh64:0f2164b3e62ba44b"},"epss":{"captured":"2026-11-01T00:25:00Z","input":"xxh64:0d4c3b8d2c2e5188"},"fedora":{"captured":"2026-11-01T00:24:40Z","input":"xxh64:28fe3d1d8ae41f9b"},"github":{"captured":"2026-11-01T00:24:57Z","input":"xxh64:076a86d2dc5c9e83"},"govulndb":{"captured":"2026-11-01T00:24:45Z","input":"xxh64:56e169604e12196e"},"hummingbird":{"captured":"2026-11-01T00:27:26Z","input":"xxh64:e86abd0466410fb6"},"kev":{"captured":"2026-11-01T00:25:06Z","input":"xxh64:cb0f4041bd51c379"},"mariner":{"captured":"2026-11-01T00:24:56Z","input":"xxh64:003337efdc7e1888"},"minimos":{"captured":"2026-11-01T00:24:56Z","input":"xxh64:219c30ffded7a12c"},"nvd":{"captured":"2026-11-01T00:25:41Z","input":"xxh64:75e41eec415fdb0a"},"oracle":{"captured":"2026-11-01T00:24:42Z","input":"xxh64:0546c2dd11a85c07"},"photon":{"captured":"2026-11-01T00:24:37Z","input":"xxh64:8dbfd0c521fd470a"},"rhel":{"captured":"2026-11-01T01:08:40Z","input":"xxh64:57c5e6a7f9f134ff"},"secureos":{"captured":"2026-11-01T00:24:34Z","input":"xxh64:ac7fa7f44e8ed7dd"},"sles":{"captured":"2026-11-01T00:26:56Z","input":"xxh64:025a1565b2cc7cdf"},"ubuntu":{"captured":"2026-11-01T00:25:58Z","input":"xxh64:9ab4d29f0ea6275d"},"wolfi":{"captured":"2026-11-01T00:25:02Z","input":"xxh64:d27b08e998baab8e"}}},"timestamp":"2026-11-02T03:07:41.568706549Z"}}