{"matches":[{"vulnerability":{"id":"GHSA-35jh-r3h4-6jhm","dataSource":"https://github.com/advisories/GHSA-35jh-r3h4-6jhm","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-23337","https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c","https://snyk.io/vuln/SNYK-JS-LODASH-1040724","https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js#L14851","https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074932","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074930","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074928","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074931","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074929","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf","https://security.netapp.com/advisory/ntap-20210312-0006","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2021-23337.yml"],"description":"Command Injection in lodash","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"exploitabilityScore":1.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-23337","epss":0.21333,"percentile":0.97602,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-23337","cwe":"CWE-94","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["4.17.21"],"state":"fixed","available":[{"version":"4.17.21","date":"2021-05-07","kind":"first-observed"}]},"advisories":[],"risk":15.679754999999998},"relatedVulnerabilities":[{"id":"CVE-2021-23337","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-23337","namespace":"nvd:cpe","severity":"High","urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf","https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js%23L14851","https://security.netapp.com/advisory/ntap-20210312-0006/","https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074932","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074930","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074928","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074931","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074929","https://snyk.io/vuln/SNYK-JS-LODASH-1040724","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"description":"Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"exploitabilityScore":1.3,"impactScore":5.9},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"exploitabilityScore":8,"impactScore":6.5},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"exploitabilityScore":1.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-23337","epss":0.21333,"percentile":0.97602,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-23337","cwe":"CWE-94","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"lodash","version":"4.17.5"}},"found":{"vulnerabilityID":"GHSA-35jh-r3h4-6jhm","versionConstraint":"<4.17.21 (semantic)"},"fix":{"suggestedVersion":"4.17.21"}}],"artifact":{"id":"pkg:npm/lodash@4.17.5?package-id=6dbd6165006e1c97","name":"lodash","version":"4.17.5","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:lodash:lodash:4.17.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/lodash@4.17.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-8hfj-j24r-96c4","dataSource":"https://github.com/advisories/GHSA-8hfj-j24r-96c4","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/moment/moment/security/advisories/GHSA-8hfj-j24r-96c4","https://nvd.nist.gov/vuln/detail/CVE-2022-24785","https://github.com/moment/moment/commit/4211bfc8f15746be4019bba557e29a7ba83d54c5","https://www.tenable.com/security/tns-2022-09","https://lists.debian.org/debian-lts-announce/2023/01/msg00035.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QIO6YNLTK2T7SPKDS4JEL45FANLNC2Q","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORJX2LF6KMPIHP6B2P6KZIVKMLE3LVJ5","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6QIO6YNLTK2T7SPKDS4JEL45FANLNC2Q","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ORJX2LF6KMPIHP6B2P6KZIVKMLE3LVJ5","https://security.netapp.com/advisory/ntap-20220513-0006","https://security.netapp.com/advisory/ntap-20241108-0002"],"description":"Path Traversal: 'dir/../../filename' in moment.locale","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-24785","epss":0.1384,"percentile":0.96524,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-24785","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2022-24785","cwe":"CWE-27","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2022-24785","cwe":"CWE-22","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["2.29.2"],"state":"fixed","available":[{"version":"2.29.2","date":"2022-04-09","kind":"first-observed"}]},"advisories":[],"risk":10.38},"relatedVulnerabilities":[{"id":"CVE-2022-24785","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-24785","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/moment/moment/commit/4211bfc8f15746be4019bba557e29a7ba83d54c5","https://github.com/moment/moment/security/advisories/GHSA-8hfj-j24r-96c4","https://lists.debian.org/debian-lts-announce/2023/01/msg00035.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QIO6YNLTK2T7SPKDS4JEL45FANLNC2Q/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORJX2LF6KMPIHP6B2P6KZIVKMLE3LVJ5/","https://security.netapp.com/advisory/ntap-20220513-0006/","https://www.tenable.com/security/tns-2022-09","https://security.netapp.com/advisory/ntap-20241108-0002/"],"description":"Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name before passing it to Moment.js.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-24785","epss":0.1384,"percentile":0.96524,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-24785","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2022-24785","cwe":"CWE-27","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2022-24785","cwe":"CWE-22","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"moment","version":"2.20.1"}},"found":{"vulnerabilityID":"GHSA-8hfj-j24r-96c4","versionConstraint":"<2.29.2 (semantic)"},"fix":{"suggestedVersion":"2.29.2"}}],"artifact":{"id":"pkg:npm/moment@2.20.1?package-id=00632b4d0a8d4b58","name":"moment","version":"2.20.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:momentjs:moment:2.20.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/moment@2.20.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-2p57-rm9w-gvfp","dataSource":"https://github.com/advisories/GHSA-2p57-rm9w-gvfp","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-29415","https://github.com/indutny/node-ip/issues/150","https://github.com/indutny/node-ip/pull/143","https://github.com/indutny/node-ip/pull/144","https://security.netapp.com/advisory/ntap-20250117-0010"],"description":"ip SSRF improper categorization in isPublic","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-29415","epss":0.08279,"percentile":0.94916,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-29415","cwe":"CWE-918","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"cve":"CVE-2024-29415","cwe":"CWE-941","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":6.45762},"relatedVulnerabilities":[{"id":"CVE-2024-29415","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-29415","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/indutny/node-ip/issues/150","https://github.com/indutny/node-ip/pull/143","https://github.com/indutny/node-ip/pull/144","https://security.netapp.com/advisory/ntap-20250117-0010/"],"description":"The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2023-42282.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-29415","epss":0.08279,"percentile":0.94916,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-29415","cwe":"CWE-918","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"cve":"CVE-2024-29415","cwe":"CWE-941","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"ip","version":"2.0.0"}},"found":{"vulnerabilityID":"GHSA-2p57-rm9w-gvfp","versionConstraint":"<=2.0.1 (semantic)"}}],"artifact":{"id":"pkg:npm/ip@2.0.0?package-id=9ea3e86e58333d8a","name":"ip","version":"2.0.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:fedorindutny:ip:2.0.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/ip@2.0.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-jf85-cpcp-j695","dataSource":"https://github.com/advisories/GHSA-jf85-cpcp-j695","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/lodash/lodash/pull/4336","https://nvd.nist.gov/vuln/detail/CVE-2019-10744","https://snyk.io/vuln/SNYK-JS-LODASH-450202","https://access.redhat.com/errata/RHSA-2019:3024","https://support.f5.com/csp/article/K47105354?utm_source=f5support&amp;utm_medium=RSS","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://support.f5.com/csp/article/K47105354?utm_source=f5support&amp%3Butm_medium=RSS","https://security.netapp.com/advisory/ntap-20191004-0005","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2019-10744.yml"],"description":"Prototype Pollution in lodash","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-10744","epss":0.05006,"percentile":0.9224,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2019-10744","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["4.17.12"],"state":"fixed","available":[{"version":"4.17.12","date":"2020-07-28","kind":"first-observed"}]},"advisories":[],"risk":4.53043},"relatedVulnerabilities":[{"id":"CVE-2019-10744","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-10744","namespace":"nvd:cpe","severity":"Critical","urls":["https://access.redhat.com/errata/RHSA-2019:3024","https://security.netapp.com/advisory/ntap-20191004-0005/","https://snyk.io/vuln/SNYK-JS-LODASH-450202","https://support.f5.com/csp/article/K47105354?utm_source=f5support&amp%3Butm_medium=RSS","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpuoct2020.html"],"description":"Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:P","metrics":{"baseScore":6.4,"exploitabilityScore":10,"impactScore":5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-10744","epss":0.05006,"percentile":0.9224,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2019-10744","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"lodash","version":"4.17.5"}},"found":{"vulnerabilityID":"GHSA-jf85-cpcp-j695","versionConstraint":"<4.17.12 (semantic)"},"fix":{"suggestedVersion":"4.17.12"}}],"artifact":{"id":"pkg:npm/lodash@4.17.5?package-id=6dbd6165006e1c97","name":"lodash","version":"4.17.5","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:lodash:lodash:4.17.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/lodash@4.17.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-wc69-rhjr-hc9g","dataSource":"https://github.com/advisories/GHSA-wc69-rhjr-hc9g","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/moment/moment/security/advisories/GHSA-wc69-rhjr-hc9g","https://github.com/moment/moment/pull/6015#issuecomment-1152961973","https://github.com/moment/moment/commit/9a3b5894f3d5d602948ac8a02e4ee528a49ca3a3","https://nvd.nist.gov/vuln/detail/CVE-2022-31129","https://lists.debian.org/debian-lts-announce/2023/01/msg00035.html","https://github.com/moment/moment/pull/6015/commits/4bbb9f3ccbe231de40207503f344fe5ce97584f4","https://github.com/moment/moment/pull/6015/commits/bfd4f2375d5c1a2106246721d693a9611dddfbfe","https://github.com/moment/moment/pull/6015/commits/dc0d180e90d8a84f7ff13572363330a22b3ea504","https://security.netapp.com/advisory/ntap-20241108-0002","https://security.netapp.com/advisory/ntap-20221014-0003","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZMX5YHELQVCGKKQVFXIYOTBMN23YYSRO","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ORJX2LF6KMPIHP6B2P6KZIVKMLE3LVJ5","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IWY24RJA3SBJGA5N4CU4VBPHJPPPJL5O","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6QIO6YNLTK2T7SPKDS4JEL45FANLNC2Q","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZMX5YHELQVCGKKQVFXIYOTBMN23YYSRO","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORJX2LF6KMPIHP6B2P6KZIVKMLE3LVJ5","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IWY24RJA3SBJGA5N4CU4VBPHJPPPJL5O","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QIO6YNLTK2T7SPKDS4JEL45FANLNC2Q","https://huntr.dev/bounties/f0952b67-f2ff-44a9-a9cd-99e0a87cb633"],"description":"Moment.js vulnerable to Inefficient Regular Expression Complexity","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-31129","epss":0.05551,"percentile":0.92844,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-31129","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2022-31129","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["2.29.4"],"state":"fixed","available":[{"version":"2.29.4","date":"2022-07-08","kind":"first-observed"}]},"advisories":[],"risk":4.16325},"relatedVulnerabilities":[{"id":"CVE-2022-31129","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-31129","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/moment/moment/commit/9a3b5894f3d5d602948ac8a02e4ee528a49ca3a3","https://github.com/moment/moment/pull/6015#issuecomment-1152961973","https://github.com/moment/moment/security/advisories/GHSA-wc69-rhjr-hc9g","https://huntr.dev/bounties/f0952b67-f2ff-44a9-a9cd-99e0a87cb633/","https://lists.debian.org/debian-lts-announce/2023/01/msg00035.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QIO6YNLTK2T7SPKDS4JEL45FANLNC2Q/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IWY24RJA3SBJGA5N4CU4VBPHJPPPJL5O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORJX2LF6KMPIHP6B2P6KZIVKMLE3LVJ5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZMX5YHELQVCGKKQVFXIYOTBMN23YYSRO/","https://security.netapp.com/advisory/ntap-20221014-0003/","https://security.netapp.com/advisory/ntap-20241108-0002/"],"description":"moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment (more specifically rfc2822 parsing, which is tried by default) has quadratic (N^2) complexity on specific inputs. Users may notice a noticeable slowdown is observed with inputs above 10k characters. Users who pass user-provided strings without sanity length checks to moment constructor are vulnerable to (Re)DoS attacks. The problem is patched in 2.29.4, the patch can be applied to all affected versions with minimal tweaking. Users are advised to upgrade. Users unable to upgrade should consider limiting date lengths accepted from user input.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-31129","epss":0.05551,"percentile":0.92844,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-31129","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2022-31129","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"moment","version":"2.20.1"}},"found":{"vulnerabilityID":"GHSA-wc69-rhjr-hc9g","versionConstraint":">=2.18.0,<2.29.4 (semantic)"},"fix":{"suggestedVersion":"2.29.4"}}],"artifact":{"id":"pkg:npm/moment@2.20.1?package-id=00632b4d0a8d4b58","name":"moment","version":"2.20.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:momentjs:moment:2.20.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/moment@2.20.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-p6mc-m468-83gw","dataSource":"https://github.com/advisories/GHSA-p6mc-m468-83gw","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/lodash/lodash/issues/4744","https://github.com/lodash/lodash/commit/c84fe82760fb2d3e03a63379b297a1cc1a2fce12","https://nvd.nist.gov/vuln/detail/CVE-2020-8203","https://hackerone.com/reports/712065","https://github.com/lodash/lodash/issues/4874","https://github.com/github/advisory-database/pull/2884","https://hackerone.com/reports/864701","https://github.com/lodash/lodash/wiki/Changelog#v41719","https://web.archive.org/web/20210914001339/https://github.com/lodash/lodash/issues/4744","https://security.netapp.com/advisory/ntap-20200724-0006","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2020-8203.yml"],"description":"Prototype Pollution in lodash","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-8203","epss":0.05213,"percentile":0.92501,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-8203","cwe":"CWE-770","source":"support@hackerone.com","type":"Secondary"},{"cve":"CVE-2020-8203","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["4.17.19"],"state":"fixed","available":[{"version":"4.17.19","date":"2020-07-28","kind":"first-observed"}]},"advisories":[],"risk":3.883685},"relatedVulnerabilities":[{"id":"CVE-2020-8203","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-8203","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/lodash/lodash/issues/4874","https://hackerone.com/reports/712065","https://security.netapp.com/advisory/ntap-20200724-0006/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"description":"Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:P","metrics":{"baseScore":5.8,"exploitabilityScore":8.6,"impactScore":5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-8203","epss":0.05213,"percentile":0.92501,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-8203","cwe":"CWE-770","source":"support@hackerone.com","type":"Secondary"},{"cve":"CVE-2020-8203","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"lodash","version":"4.17.5"}},"found":{"vulnerabilityID":"GHSA-p6mc-m468-83gw","versionConstraint":">=3.7.0,<4.17.19 (semantic)"},"fix":{"suggestedVersion":"4.17.19"}}],"artifact":{"id":"pkg:npm/lodash@4.17.5?package-id=6dbd6165006e1c97","name":"lodash","version":"4.17.5","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:lodash:lodash:4.17.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/lodash@4.17.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-29mw-wpgm-hmr9","dataSource":"https://github.com/advisories/GHSA-29mw-wpgm-hmr9","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-28500","https://github.com/lodash/lodash/pull/5065","https://github.com/lodash/lodash/pull/5065/commits/02906b8191d3c100c193fe6f7b27d1c40f200bb7","https://github.com/lodash/lodash/blob/npm/trimEnd.js%23L8","https://snyk.io/vuln/SNYK-JS-LODASH-1018905","https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074896","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074894","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074892","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074895","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074893","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf","https://github.com/lodash/lodash/commit/c4847ebe7d14540bb28a8b932a9ce1b9ecbfee1a","https://security.netapp.com/advisory/ntap-20210312-0006","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2020-28500.yml","https://github.com/github/advisory-database/pull/6139"],"description":"Regular Expression Denial of Service (ReDoS) in lodash","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-28500","epss":0.07336,"percentile":0.94394,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-28500","cwe":"NVD-CWE-Other","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["4.17.21"],"state":"fixed","available":[{"version":"4.17.21","date":"2022-01-07","kind":"first-observed"}]},"advisories":[],"risk":3.77804},"relatedVulnerabilities":[{"id":"CVE-2020-28500","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-28500","namespace":"nvd:cpe","severity":"Medium","urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf","https://github.com/lodash/lodash/blob/npm/trimEnd.js%23L8","https://github.com/lodash/lodash/pull/5065","https://security.netapp.com/advisory/ntap-20210312-0006/","https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074896","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074894","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074892","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074895","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074893","https://snyk.io/vuln/SNYK-JS-LODASH-1018905","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"description":"Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-28500","epss":0.07336,"percentile":0.94394,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-28500","cwe":"NVD-CWE-Other","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"lodash","version":"4.17.5"}},"found":{"vulnerabilityID":"GHSA-29mw-wpgm-hmr9","versionConstraint":">=4.0.0,<4.17.21 (semantic)"},"fix":{"suggestedVersion":"4.17.21"}}],"artifact":{"id":"pkg:npm/lodash@4.17.5?package-id=6dbd6165006e1c97","name":"lodash","version":"4.17.5","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:lodash:lodash:4.17.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/lodash@4.17.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-r5fr-rjxr-66jc","dataSource":"https://github.com/advisories/GHSA-r5fr-rjxr-66jc","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/lodash/lodash/security/advisories/GHSA-r5fr-rjxr-66jc","https://nvd.nist.gov/vuln/detail/CVE-2026-4800","https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c","https://cna.openjsf.org/security-advisories.html","https://github.com/advisories/GHSA-35jh-r3h4-6jhm"],"description":"lodash vulnerable to Code Injection via `_.template` imports key names","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-4800","epss":0.02808,"percentile":0.86506,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-4800","cwe":"CWE-94","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-4800","cwe":"CWE-94","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["4.18.0"],"state":"fixed","available":[{"version":"4.18.0","date":"2026-04-02","kind":"first-observed"}]},"advisories":[],"risk":2.19024},"relatedVulnerabilities":[{"id":"CVE-2026-4800","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4800","namespace":"nvd:cpe","severity":"Critical","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/lodash/lodash/security/advisories/GHSA-r5fr-rjxr-66jc","https://access.redhat.com/errata/RHBA-2026:21387","https://access.redhat.com/errata/RHSA-2026:10131","https://access.redhat.com/errata/RHSA-2026:10175","https://access.redhat.com/errata/RHSA-2026:10710","https://access.redhat.com/errata/RHSA-2026:10713","https://access.redhat.com/errata/RHSA-2026:11454","https://access.redhat.com/errata/RHSA-2026:11469","https://access.redhat.com/errata/RHSA-2026:11470","https://access.redhat.com/errata/RHSA-2026:11471","https://access.redhat.com/errata/RHSA-2026:11493","https://access.redhat.com/errata/RHSA-2026:11494","https://access.redhat.com/errata/RHSA-2026:11495","https://access.redhat.com/errata/RHSA-2026:11516","https://access.redhat.com/errata/RHSA-2026:12277","https://access.redhat.com/errata/RHSA-2026:12279","https://access.redhat.com/errata/RHSA-2026:13545","https://access.redhat.com/errata/RHSA-2026:13553","https://access.redhat.com/errata/RHSA-2026:13571","https://access.redhat.com/errata/RHSA-2026:13826","https://access.redhat.com/errata/RHSA-2026:14870","https://access.redhat.com/errata/RHSA-2026:14871","https://access.redhat.com/errata/RHSA-2026:16874","https://access.redhat.com/errata/RHSA-2026:17448","https://access.redhat.com/errata/RHSA-2026:17468","https://access.redhat.com/errata/RHSA-2026:17469","https://access.redhat.com/errata/RHSA-2026:17547","https://access.redhat.com/errata/RHSA-2026:17549","https://access.redhat.com/errata/RHSA-2026:17550","https://access.redhat.com/errata/RHSA-2026:17598","https://access.redhat.com/errata/RHSA-2026:17789","https://access.redhat.com/errata/RHSA-2026:19008","https://access.redhat.com/errata/RHSA-2026:19167","https://access.redhat.com/errata/RHSA-2026:19409","https://access.redhat.com/errata/RHSA-2026:19410","https://access.redhat.com/errata/RHSA-2026:19712","https://access.redhat.com/errata/RHSA-2026:20041","https://access.redhat.com/errata/RHSA-2026:20042","https://access.redhat.com/errata/RHSA-2026:20943","https://access.redhat.com/errata/RHSA-2026:20946","https://access.redhat.com/errata/RHSA-2026:21658","https://access.redhat.com/errata/RHSA-2026:22619","https://access.redhat.com/errata/RHSA-2026:24331","https://access.redhat.com/errata/RHSA-2026:24762","https://access.redhat.com/errata/RHSA-2026:24977","https://access.redhat.com/errata/RHSA-2026:29795","https://access.redhat.com/errata/RHSA-2026:34100","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:36621","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:37186","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40795","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:40984","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41941","https://access.redhat.com/errata/RHSA-2026:41944","https://access.redhat.com/errata/RHSA-2026:42078","https://access.redhat.com/errata/RHSA-2026:44235","https://access.redhat.com/errata/RHSA-2026:48699","https://access.redhat.com/errata/RHSA-2026:54188","https://access.redhat.com/errata/RHSA-2026:56789","https://access.redhat.com/errata/RHSA-2026:56854","https://access.redhat.com/errata/RHSA-2026:56912","https://access.redhat.com/errata/RHSA-2026:59833","https://access.redhat.com/errata/RHSA-2026:60023","https://access.redhat.com/errata/RHSA-2026:8483","https://access.redhat.com/errata/RHSA-2026:8484","https://access.redhat.com/errata/RHSA-2026:8490","https://access.redhat.com/errata/RHSA-2026:8491","https://access.redhat.com/errata/RHSA-2026:8493","https://access.redhat.com/errata/RHSA-2026:8498","https://access.redhat.com/errata/RHSA-2026:9385","https://access.redhat.com/errata/RHSA-2026:9742","https://access.redhat.com/security/cve/CVE-2026-4800","https://bugzilla.redhat.com/show_bug.cgi?id=2453496","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4800.json"],"description":"The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink. When an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in, so if Object.prototype has been polluted by another vector the polluted keys are copied into the imports object and passed to Function(). The issue is fixed in 4.18.1 for lodash, lodash-es, lodash-amd, and lodash.template. As a workaround, do not pass untrusted input as key names in options.imports; use only developer-controlled, static key names.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-4800","epss":0.02808,"percentile":0.86506,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-4800","cwe":"CWE-94","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-4800","cwe":"CWE-94","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"lodash","version":"4.17.21"}},"found":{"vulnerabilityID":"GHSA-r5fr-rjxr-66jc","versionConstraint":">=4.0.0,<=4.17.23 (semantic)"},"fix":{"suggestedVersion":"4.18.0"}}],"artifact":{"id":"pkg:npm/lodash@4.17.21?package-id=cb6dfff11809ad1e","name":"lodash","version":"4.17.21","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:lodash:lodash:4.17.21:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/lodash@4.17.21","upstreams":[]}},{"vulnerability":{"id":"GHSA-r5fr-rjxr-66jc","dataSource":"https://github.com/advisories/GHSA-r5fr-rjxr-66jc","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/lodash/lodash/security/advisories/GHSA-r5fr-rjxr-66jc","https://nvd.nist.gov/vuln/detail/CVE-2026-4800","https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c","https://cna.openjsf.org/security-advisories.html","https://github.com/advisories/GHSA-35jh-r3h4-6jhm"],"description":"lodash vulnerable to Code Injection via `_.template` imports key names","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-4800","epss":0.02808,"percentile":0.86506,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-4800","cwe":"CWE-94","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-4800","cwe":"CWE-94","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["4.18.0"],"state":"fixed","available":[{"version":"4.18.0","date":"2026-04-02","kind":"first-observed"}]},"advisories":[],"risk":2.19024},"relatedVulnerabilities":[{"id":"CVE-2026-4800","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4800","namespace":"nvd:cpe","severity":"Critical","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/lodash/lodash/security/advisories/GHSA-r5fr-rjxr-66jc","https://access.redhat.com/errata/RHBA-2026:21387","https://access.redhat.com/errata/RHSA-2026:10131","https://access.redhat.com/errata/RHSA-2026:10175","https://access.redhat.com/errata/RHSA-2026:10710","https://access.redhat.com/errata/RHSA-2026:10713","https://access.redhat.com/errata/RHSA-2026:11454","https://access.redhat.com/errata/RHSA-2026:11469","https://access.redhat.com/errata/RHSA-2026:11470","https://access.redhat.com/errata/RHSA-2026:11471","https://access.redhat.com/errata/RHSA-2026:11493","https://access.redhat.com/errata/RHSA-2026:11494","https://access.redhat.com/errata/RHSA-2026:11495","https://access.redhat.com/errata/RHSA-2026:11516","https://access.redhat.com/errata/RHSA-2026:12277","https://access.redhat.com/errata/RHSA-2026:12279","https://access.redhat.com/errata/RHSA-2026:13545","https://access.redhat.com/errata/RHSA-2026:13553","https://access.redhat.com/errata/RHSA-2026:13571","https://access.redhat.com/errata/RHSA-2026:13826","https://access.redhat.com/errata/RHSA-2026:14870","https://access.redhat.com/errata/RHSA-2026:14871","https://access.redhat.com/errata/RHSA-2026:16874","https://access.redhat.com/errata/RHSA-2026:17448","https://access.redhat.com/errata/RHSA-2026:17468","https://access.redhat.com/errata/RHSA-2026:17469","https://access.redhat.com/errata/RHSA-2026:17547","https://access.redhat.com/errata/RHSA-2026:17549","https://access.redhat.com/errata/RHSA-2026:17550","https://access.redhat.com/errata/RHSA-2026:17598","https://access.redhat.com/errata/RHSA-2026:17789","https://access.redhat.com/errata/RHSA-2026:19008","https://access.redhat.com/errata/RHSA-2026:19167","https://access.redhat.com/errata/RHSA-2026:19409","https://access.redhat.com/errata/RHSA-2026:19410","https://access.redhat.com/errata/RHSA-2026:19712","https://access.redhat.com/errata/RHSA-2026:20041","https://access.redhat.com/errata/RHSA-2026:20042","https://access.redhat.com/errata/RHSA-2026:20943","https://access.redhat.com/errata/RHSA-2026:20946","https://access.redhat.com/errata/RHSA-2026:21658","https://access.redhat.com/errata/RHSA-2026:22619","https://access.redhat.com/errata/RHSA-2026:24331","https://access.redhat.com/errata/RHSA-2026:24762","https://access.redhat.com/errata/RHSA-2026:24977","https://access.redhat.com/errata/RHSA-2026:29795","https://access.redhat.com/errata/RHSA-2026:34100","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:36621","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:37186","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40795","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:40984","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41941","https://access.redhat.com/errata/RHSA-2026:41944","https://access.redhat.com/errata/RHSA-2026:42078","https://access.redhat.com/errata/RHSA-2026:44235","https://access.redhat.com/errata/RHSA-2026:48699","https://access.redhat.com/errata/RHSA-2026:54188","https://access.redhat.com/errata/RHSA-2026:56789","https://access.redhat.com/errata/RHSA-2026:56854","https://access.redhat.com/errata/RHSA-2026:56912","https://access.redhat.com/errata/RHSA-2026:59833","https://access.redhat.com/errata/RHSA-2026:60023","https://access.redhat.com/errata/RHSA-2026:8483","https://access.redhat.com/errata/RHSA-2026:8484","https://access.redhat.com/errata/RHSA-2026:8490","https://access.redhat.com/errata/RHSA-2026:8491","https://access.redhat.com/errata/RHSA-2026:8493","https://access.redhat.com/errata/RHSA-2026:8498","https://access.redhat.com/errata/RHSA-2026:9385","https://access.redhat.com/errata/RHSA-2026:9742","https://access.redhat.com/security/cve/CVE-2026-4800","https://bugzilla.redhat.com/show_bug.cgi?id=2453496","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4800.json"],"description":"The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink. When an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in, so if Object.prototype has been polluted by another vector the polluted keys are copied into the imports object and passed to Function(). The issue is fixed in 4.18.1 for lodash, lodash-es, lodash-amd, and lodash.template. As a workaround, do not pass untrusted input as key names in options.imports; use only developer-controlled, static key names.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-4800","epss":0.02808,"percentile":0.86506,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-4800","cwe":"CWE-94","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-4800","cwe":"CWE-94","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"lodash","version":"4.17.5"}},"found":{"vulnerabilityID":"GHSA-r5fr-rjxr-66jc","versionConstraint":">=4.0.0,<=4.17.23 (semantic)"},"fix":{"suggestedVersion":"4.18.0"}}],"artifact":{"id":"pkg:npm/lodash@4.17.5?package-id=6dbd6165006e1c97","name":"lodash","version":"4.17.5","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:lodash:lodash:4.17.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/lodash@4.17.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-c2qf-rxjj-qqgw","dataSource":"https://github.com/advisories/GHSA-c2qf-rxjj-qqgw","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-25883","https://github.com/npm/node-semver/pull/564","https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441","https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795","https://github.com/npm/node-semver/blob/main/classes/range.js#L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js#L138","https://github.com/npm/node-semver/blob/main/internal/re.js#L160","https://github.com/npm/node-semver/pull/585","https://github.com/npm/node-semver/commit/928e56d21150da0413a3333a3148b20e741a920c","https://github.com/npm/node-semver/pull/593","https://github.com/npm/node-semver/commit/2f8fd41487acf380194579ecb6f8b1bbfe116be0","https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js%23L138","https://github.com/npm/node-semver/blob/main/internal/re.js%23L160","https://security.netapp.com/advisory/ntap-20241025-0004"],"description":"semver vulnerable to Regular Expression Denial of Service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-25883","epss":0.02761,"percentile":0.86272,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["5.7.2"],"state":"fixed","available":[{"version":"5.7.2","date":"2023-07-11","kind":"first-observed"}]},"advisories":[],"risk":2.07075},"relatedVulnerabilities":[{"id":"CVE-2022-25883","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-25883","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js%23L138","https://github.com/npm/node-semver/blob/main/internal/re.js%23L160","https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441","https://github.com/npm/node-semver/pull/564","https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795","https://security.netapp.com/advisory/ntap-20241025-0004/"],"description":"Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-25883","epss":0.02761,"percentile":0.86272,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"semver","version":"5.5.0"}},"found":{"vulnerabilityID":"GHSA-c2qf-rxjj-qqgw","versionConstraint":">=2.0.0-alpha,<5.7.2 (semantic)"},"fix":{"suggestedVersion":"5.7.2"}}],"artifact":{"id":"pkg:npm/semver@5.5.0?package-id=eed9e9f14fae8ac4","name":"semver","version":"5.5.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:npmjs:semver:5.5.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/semver@5.5.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-c2qf-rxjj-qqgw","dataSource":"https://github.com/advisories/GHSA-c2qf-rxjj-qqgw","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-25883","https://github.com/npm/node-semver/pull/564","https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441","https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795","https://github.com/npm/node-semver/blob/main/classes/range.js#L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js#L138","https://github.com/npm/node-semver/blob/main/internal/re.js#L160","https://github.com/npm/node-semver/pull/585","https://github.com/npm/node-semver/commit/928e56d21150da0413a3333a3148b20e741a920c","https://github.com/npm/node-semver/pull/593","https://github.com/npm/node-semver/commit/2f8fd41487acf380194579ecb6f8b1bbfe116be0","https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js%23L138","https://github.com/npm/node-semver/blob/main/internal/re.js%23L160","https://security.netapp.com/advisory/ntap-20241025-0004"],"description":"semver vulnerable to Regular Expression Denial of Service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-25883","epss":0.02761,"percentile":0.86272,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["5.7.2"],"state":"fixed","available":[{"version":"5.7.2","date":"2023-07-11","kind":"first-observed"}]},"advisories":[],"risk":2.07075},"relatedVulnerabilities":[{"id":"CVE-2022-25883","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-25883","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js%23L138","https://github.com/npm/node-semver/blob/main/internal/re.js%23L160","https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441","https://github.com/npm/node-semver/pull/564","https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795","https://security.netapp.com/advisory/ntap-20241025-0004/"],"description":"Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-25883","epss":0.02761,"percentile":0.86272,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"semver","version":"5.7.1"}},"found":{"vulnerabilityID":"GHSA-c2qf-rxjj-qqgw","versionConstraint":">=2.0.0-alpha,<5.7.2 (semantic)"},"fix":{"suggestedVersion":"5.7.2"}}],"artifact":{"id":"pkg:npm/semver@5.7.1?package-id=8ed5c77bbf184264","name":"semver","version":"5.7.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:npmjs:semver:5.7.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/semver@5.7.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-c2qf-rxjj-qqgw","dataSource":"https://github.com/advisories/GHSA-c2qf-rxjj-qqgw","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-25883","https://github.com/npm/node-semver/pull/564","https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441","https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795","https://github.com/npm/node-semver/blob/main/classes/range.js#L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js#L138","https://github.com/npm/node-semver/blob/main/internal/re.js#L160","https://github.com/npm/node-semver/pull/585","https://github.com/npm/node-semver/commit/928e56d21150da0413a3333a3148b20e741a920c","https://github.com/npm/node-semver/pull/593","https://github.com/npm/node-semver/commit/2f8fd41487acf380194579ecb6f8b1bbfe116be0","https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js%23L138","https://github.com/npm/node-semver/blob/main/internal/re.js%23L160","https://security.netapp.com/advisory/ntap-20241025-0004"],"description":"semver vulnerable to Regular Expression Denial of Service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-25883","epss":0.02761,"percentile":0.86272,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["6.3.1"],"state":"fixed","available":[{"version":"6.3.1","date":"2023-07-11","kind":"first-observed"}]},"advisories":[],"risk":2.07075},"relatedVulnerabilities":[{"id":"CVE-2022-25883","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-25883","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js%23L138","https://github.com/npm/node-semver/blob/main/internal/re.js%23L160","https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441","https://github.com/npm/node-semver/pull/564","https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795","https://security.netapp.com/advisory/ntap-20241025-0004/"],"description":"Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-25883","epss":0.02761,"percentile":0.86272,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"semver","version":"6.3.0"}},"found":{"vulnerabilityID":"GHSA-c2qf-rxjj-qqgw","versionConstraint":">=6.0.0,<6.3.1 (semantic)"},"fix":{"suggestedVersion":"6.3.1"}}],"artifact":{"id":"pkg:npm/semver@6.3.0?package-id=a86ffcaa86821397","name":"semver","version":"6.3.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:npmjs:semver:6.3.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/semver@6.3.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-c2qf-rxjj-qqgw","dataSource":"https://github.com/advisories/GHSA-c2qf-rxjj-qqgw","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-25883","https://github.com/npm/node-semver/pull/564","https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441","https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795","https://github.com/npm/node-semver/blob/main/classes/range.js#L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js#L138","https://github.com/npm/node-semver/blob/main/internal/re.js#L160","https://github.com/npm/node-semver/pull/585","https://github.com/npm/node-semver/commit/928e56d21150da0413a3333a3148b20e741a920c","https://github.com/npm/node-semver/pull/593","https://github.com/npm/node-semver/commit/2f8fd41487acf380194579ecb6f8b1bbfe116be0","https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js%23L138","https://github.com/npm/node-semver/blob/main/internal/re.js%23L160","https://security.netapp.com/advisory/ntap-20241025-0004"],"description":"semver vulnerable to Regular Expression Denial of Service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-25883","epss":0.02761,"percentile":0.86272,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["7.5.2"],"state":"fixed","available":[{"version":"7.5.2","date":"2023-06-23","kind":"first-observed"}]},"advisories":[],"risk":2.07075},"relatedVulnerabilities":[{"id":"CVE-2022-25883","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-25883","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js%23L138","https://github.com/npm/node-semver/blob/main/internal/re.js%23L160","https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441","https://github.com/npm/node-semver/pull/564","https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795","https://security.netapp.com/advisory/ntap-20241025-0004/"],"description":"Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-25883","epss":0.02761,"percentile":0.86272,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"semver","version":"7.3.7"}},"found":{"vulnerabilityID":"GHSA-c2qf-rxjj-qqgw","versionConstraint":">=7.0.0,<7.5.2 (semantic)"},"fix":{"suggestedVersion":"7.5.2"}}],"artifact":{"id":"pkg:npm/semver@7.3.7?package-id=8427288e901d6c3d","name":"semver","version":"7.3.7","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:npmjs:semver:7.3.7:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/semver@7.3.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-c2qf-rxjj-qqgw","dataSource":"https://github.com/advisories/GHSA-c2qf-rxjj-qqgw","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-25883","https://github.com/npm/node-semver/pull/564","https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441","https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795","https://github.com/npm/node-semver/blob/main/classes/range.js#L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js#L138","https://github.com/npm/node-semver/blob/main/internal/re.js#L160","https://github.com/npm/node-semver/pull/585","https://github.com/npm/node-semver/commit/928e56d21150da0413a3333a3148b20e741a920c","https://github.com/npm/node-semver/pull/593","https://github.com/npm/node-semver/commit/2f8fd41487acf380194579ecb6f8b1bbfe116be0","https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js%23L138","https://github.com/npm/node-semver/blob/main/internal/re.js%23L160","https://security.netapp.com/advisory/ntap-20241025-0004"],"description":"semver vulnerable to Regular Expression Denial of Service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-25883","epss":0.02761,"percentile":0.86272,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["7.5.2"],"state":"fixed","available":[{"version":"7.5.2","date":"2023-06-23","kind":"first-observed"}]},"advisories":[],"risk":2.07075},"relatedVulnerabilities":[{"id":"CVE-2022-25883","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-25883","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js%23L138","https://github.com/npm/node-semver/blob/main/internal/re.js%23L160","https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441","https://github.com/npm/node-semver/pull/564","https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795","https://security.netapp.com/advisory/ntap-20241025-0004/"],"description":"Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-25883","epss":0.02761,"percentile":0.86272,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"semver","version":"7.3.7"}},"found":{"vulnerabilityID":"GHSA-c2qf-rxjj-qqgw","versionConstraint":">=7.0.0,<7.5.2 (semantic)"},"fix":{"suggestedVersion":"7.5.2"}}],"artifact":{"id":"pkg:npm/semver@7.3.7?package-id=7cba7f1d6b8028d6","name":"semver","version":"7.3.7","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:npmjs:semver:7.3.7:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/semver@7.3.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-x5rq-j2xg-h7qm","dataSource":"https://github.com/advisories/GHSA-x5rq-j2xg-h7qm","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-1010266","https://github.com/lodash/lodash/issues/3359","https://snyk.io/vuln/SNYK-JS-LODASH-73639","https://github.com/lodash/lodash/commit/5c08f18d365b64063bfbfa686cbb97cdd6267347","https://github.com/lodash/lodash/wiki/Changelog","https://security.netapp.com/advisory/ntap-20190919-0004","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2019-1010266.yml","https://github.com/github/advisory-database/pull/6138"],"description":"Regular Expression Denial of Service (ReDoS) in lodash","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-1010266","epss":0.03038,"percentile":0.87513,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2019-1010266","cwe":"CWE-400","source":"josh@bress.net","type":"Secondary"},{"cve":"CVE-2019-1010266","cwe":"CWE-770","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["4.17.11"],"state":"fixed","available":[{"version":"4.17.11","date":"2020-07-28","kind":"first-observed"}]},"advisories":[],"risk":1.7468499999999998},"relatedVulnerabilities":[{"id":"CVE-2019-1010266","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010266","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/lodash/lodash/issues/3359","https://github.com/lodash/lodash/wiki/Changelog","https://security.netapp.com/advisory/ntap-20190919-0004/","https://snyk.io/vuln/SNYK-JS-LODASH-73639"],"description":"lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":4,"exploitabilityScore":8,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-1010266","epss":0.03038,"percentile":0.87513,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2019-1010266","cwe":"CWE-400","source":"josh@bress.net","type":"Secondary"},{"cve":"CVE-2019-1010266","cwe":"CWE-770","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"lodash","version":"4.17.5"}},"found":{"vulnerabilityID":"GHSA-x5rq-j2xg-h7qm","versionConstraint":">=4.7.0,<4.17.11 (semantic)"},"fix":{"suggestedVersion":"4.17.11"}}],"artifact":{"id":"pkg:npm/lodash@4.17.5?package-id=6dbd6165006e1c97","name":"lodash","version":"4.17.5","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:lodash:lodash:4.17.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/lodash@4.17.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-fjxv-7rqg-78g4","dataSource":"https://github.com/advisories/GHSA-fjxv-7rqg-78g4","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/form-data/form-data/security/advisories/GHSA-fjxv-7rqg-78g4","https://nvd.nist.gov/vuln/detail/CVE-2025-7783","https://github.com/form-data/form-data/commit/3d1723080e6577a66f17f163ecd345a21d8d0fd0","https://github.com/benweissmann/CVE-2025-7783-poc","https://lists.debian.org/debian-lts-announce/2025/07/msg00023.html"],"description":"form-data uses unsafe random function in form-data for choosing boundary","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N","metrics":{"baseScore":9.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-7783","epss":0.0181,"percentile":0.78614,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-7783","cwe":"CWE-330","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}],"fix":{"versions":["2.5.4"],"state":"fixed","available":[{"version":"2.5.4","date":"2025-07-22","kind":"first-observed"}]},"advisories":[],"risk":1.6652000000000005},"relatedVulnerabilities":[{"id":"CVE-2025-7783","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-7783","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/form-data/form-data/commit/3d1723080e6577a66f17f163ecd345a21d8d0fd0","https://github.com/form-data/form-data/security/advisories/GHSA-fjxv-7rqg-78g4","https://lists.debian.org/debian-lts-announce/2025/07/msg00023.html"],"description":"Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js.\n\nThis issue affects form-data: < 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3.","cvss":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-7783","epss":0.0181,"percentile":0.78614,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-7783","cwe":"CWE-330","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"form-data","version":"2.3.3"}},"found":{"vulnerabilityID":"GHSA-fjxv-7rqg-78g4","versionConstraint":"<2.5.4 (semantic)"},"fix":{"suggestedVersion":"2.5.4"}}],"artifact":{"id":"pkg:npm/form-data@2.3.3?package-id=1ae90c2a623c09d0","name":"form-data","version":"2.3.3","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:form-data:form-data:2.3.3:*:*:*:*:*:*:*","cpe:2.3:a:form-data:form_data:2.3.3:*:*:*:*:*:*:*","cpe:2.3:a:form_data:form-data:2.3.3:*:*:*:*:*:*:*","cpe:2.3:a:form_data:form_data:2.3.3:*:*:*:*:*:*:*","cpe:2.3:a:form:form-data:2.3.3:*:*:*:*:*:*:*","cpe:2.3:a:form:form_data:2.3.3:*:*:*:*:*:*:*"],"purl":"pkg:npm/form-data@2.3.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-72xf-g2v4-qvf3","dataSource":"https://github.com/advisories/GHSA-72xf-g2v4-qvf3","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2023-26136","https://github.com/salesforce/tough-cookie/issues/282","https://github.com/salesforce/tough-cookie/commit/12d474791bb856004e858fdb1c47b7608d09cf6e","https://github.com/salesforce/tough-cookie/releases/tag/v4.1.3","https://security.snyk.io/vuln/SNYK-JS-TOUGHCOOKIE-5672873","https://lists.debian.org/debian-lts-announce/2023/07/msg00010.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3HUE6ZR5SL73KHL7XUPAOEL6SB7HUDT2","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6PVVPNSAGSDS63HQ74PJ7MZ3MU5IYNVZ","https://security.netapp.com/advisory/ntap-20240621-0006"],"description":"tough-cookie Prototype Pollution vulnerability","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-26136","epss":0.02627,"percentile":0.85495,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2023-26136","cwe":"CWE-1321","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2023-26136","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["4.1.3"],"state":"fixed","available":[{"version":"4.1.3","date":"2023-07-08","kind":"first-observed"}]},"advisories":[],"risk":1.5105250000000001},"relatedVulnerabilities":[{"id":"CVE-2023-26136","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-26136","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/salesforce/tough-cookie/commit/12d474791bb856004e858fdb1c47b7608d09cf6e","https://github.com/salesforce/tough-cookie/issues/282","https://github.com/salesforce/tough-cookie/releases/tag/v4.1.3","https://lists.debian.org/debian-lts-announce/2023/07/msg00010.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3HUE6ZR5SL73KHL7XUPAOEL6SB7HUDT2/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6PVVPNSAGSDS63HQ74PJ7MZ3MU5IYNVZ/","https://security.netapp.com/advisory/ntap-20240621-0006/","https://security.snyk.io/vuln/SNYK-JS-TOUGHCOOKIE-5672873"],"description":"Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-26136","epss":0.02627,"percentile":0.85495,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2023-26136","cwe":"CWE-1321","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2023-26136","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tough-cookie","version":"2.3.4"}},"found":{"vulnerabilityID":"GHSA-72xf-g2v4-qvf3","versionConstraint":"<4.1.3 (semantic)"},"fix":{"suggestedVersion":"4.1.3"}}],"artifact":{"id":"pkg:npm/tough-cookie@2.3.4?package-id=540bcb995fa12e9c","name":"tough-cookie","version":"2.3.4","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:salesforce:tough-cookie:2.3.4:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tough-cookie@2.3.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-v88g-cgmw-v5xw","dataSource":"https://github.com/advisories/GHSA-v88g-cgmw-v5xw","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-15366","https://github.com/ajv-validator/ajv/commit/65b2f7d76b190ac63a0d4e9154c712d7aa37049f","https://github.com/ajv-validator/ajv/releases/tag/v6.12.3","https://hackerone.com/bugs?subject=user&report_id=894259","https://github.com/ajv-validator/ajv/tags","https://security.netapp.com/advisory/ntap-20240621-0007"],"description":"Prototype Pollution in Ajv","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"exploitabilityScore":2.3,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-15366","epss":0.02313,"percentile":0.83405,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-15366","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["6.12.3"],"state":"fixed","available":[{"version":"6.12.3","date":"2022-02-11","kind":"first-observed"}]},"advisories":[],"risk":1.2258900000000001},"relatedVulnerabilities":[{"id":"CVE-2020-15366","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-15366","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/ajv-validator/ajv/releases/tag/v6.12.3","https://github.com/ajv-validator/ajv/tags","https://hackerone.com/bugs?subject=user&report_id=894259","https://security.netapp.com/advisory/ntap-20240621-0007/"],"description":"An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.)","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"exploitabilityScore":2.3,"impactScore":3.4},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"exploitabilityScore":8.6,"impactScore":6.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-15366","epss":0.02313,"percentile":0.83405,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-15366","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"ajv","version":"5.5.2"}},"found":{"vulnerabilityID":"GHSA-v88g-cgmw-v5xw","versionConstraint":"<6.12.3 (semantic)"},"fix":{"suggestedVersion":"6.12.3"}}],"artifact":{"id":"pkg:npm/ajv@5.5.2?package-id=859f099e55e379f3","name":"ajv","version":"5.5.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:ajv:ajv:5.5.2:*:*:*:*:*:*:*"],"purl":"pkg:npm/ajv@5.5.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-4xc9-xhrj-v574","dataSource":"https://github.com/advisories/GHSA-4xc9-xhrj-v574","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2018-16487","https://hackerone.com/reports/380873","https://github.com/lodash/lodash/commit/90e6199a161b6445b01454517b40ef65ebecd2ad","https://security.netapp.com/advisory/ntap-20190919-0004","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2018-16487.yml"],"description":"Prototype Pollution in lodash","cvss":[],"epss":[{"cve":"CVE-2018-16487","epss":0.01491,"percentile":0.74127,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2018-16487","cwe":"CWE-400","source":"support@hackerone.com","type":"Secondary"}],"fix":{"versions":["4.17.11"],"state":"fixed","available":[{"version":"4.17.11","date":"2020-07-28","kind":"first-observed"}]},"advisories":[],"risk":1.11825},"relatedVulnerabilities":[{"id":"CVE-2018-16487","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-16487","namespace":"nvd:cpe","severity":"Medium","urls":["https://hackerone.com/reports/380873","https://security.netapp.com/advisory/ntap-20190919-0004/"],"description":"A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"exploitabilityScore":2.3,"impactScore":3.4},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"exploitabilityScore":8.6,"impactScore":6.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-16487","epss":0.01491,"percentile":0.74127,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2018-16487","cwe":"CWE-400","source":"support@hackerone.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"lodash","version":"4.17.5"}},"found":{"vulnerabilityID":"GHSA-4xc9-xhrj-v574","versionConstraint":"<4.17.11 (semantic)"},"fix":{"suggestedVersion":"4.17.11"}}],"artifact":{"id":"pkg:npm/lodash@4.17.5?package-id=6dbd6165006e1c97","name":"lodash","version":"4.17.5","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:lodash:lodash:4.17.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/lodash@4.17.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-xxjr-mmjv-4gpg","dataSource":"https://github.com/advisories/GHSA-xxjr-mmjv-4gpg","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg","https://nvd.nist.gov/vuln/detail/CVE-2025-13465","https://github.com/lodash/lodash/commit/edadd452146f7e4bad4ea684e955708931d84d81","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"description":"Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H/E:P","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-13465","epss":0.01823,"percentile":0.78783,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-13465","cwe":"CWE-1321","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2025-13465","cwe":"CWE-1321","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["4.17.23"],"state":"fixed","available":[{"version":"4.17.23","date":"2026-01-22","kind":"first-observed"}]},"advisories":[],"risk":1.066455},"relatedVulnerabilities":[{"id":"CVE-2025-13465","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-13465","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg","https://access.redhat.com/errata/RHSA-2026:11414","https://access.redhat.com/errata/RHSA-2026:13542","https://access.redhat.com/errata/RHSA-2026:13548","https://access.redhat.com/errata/RHSA-2026:13829","https://access.redhat.com/errata/RHSA-2026:14774","https://access.redhat.com/errata/RHSA-2026:14870","https://access.redhat.com/errata/RHSA-2026:14871","https://access.redhat.com/errata/RHSA-2026:15091","https://access.redhat.com/errata/RHSA-2026:17469","https://access.redhat.com/errata/RHSA-2026:1845","https://access.redhat.com/errata/RHSA-2026:18480","https://access.redhat.com/errata/RHSA-2026:18868","https://access.redhat.com/errata/RHSA-2026:19712","https://access.redhat.com/errata/RHSA-2026:20042","https://access.redhat.com/errata/RHSA-2026:20088","https://access.redhat.com/errata/RHSA-2026:2078","https://access.redhat.com/errata/RHSA-2026:2119","https://access.redhat.com/errata/RHSA-2026:2145","https://access.redhat.com/errata/RHSA-2026:2147","https://access.redhat.com/errata/RHSA-2026:2148","https://access.redhat.com/errata/RHSA-2026:2149","https://access.redhat.com/errata/RHSA-2026:21658","https://access.redhat.com/errata/RHSA-2026:24331","https://access.redhat.com/errata/RHSA-2026:2438","https://access.redhat.com/errata/RHSA-2026:2452","https://access.redhat.com/errata/RHSA-2026:2462","https://access.redhat.com/errata/RHSA-2026:2465","https://access.redhat.com/errata/RHSA-2026:2469","https://access.redhat.com/errata/RHSA-2026:2484","https://access.redhat.com/errata/RHSA-2026:25089","https://access.redhat.com/errata/RHSA-2026:2651","https://access.redhat.com/errata/RHSA-2026:2661","https://access.redhat.com/errata/RHSA-2026:2672","https://access.redhat.com/errata/RHSA-2026:2675","https://access.redhat.com/errata/RHSA-2026:2694","https://access.redhat.com/errata/RHSA-2026:2816","https://access.redhat.com/errata/RHSA-2026:2817","https://access.redhat.com/errata/RHSA-2026:2818","https://access.redhat.com/errata/RHSA-2026:2819","https://access.redhat.com/errata/RHSA-2026:2900","https://access.redhat.com/errata/RHSA-2026:2926","https://access.redhat.com/errata/RHSA-2026:2984","https://access.redhat.com/errata/RHSA-2026:2990","https://access.redhat.com/errata/RHSA-2026:3087","https://access.redhat.com/errata/RHSA-2026:33154","https://access.redhat.com/errata/RHSA-2026:33371","https://access.redhat.com/errata/RHSA-2026:34100","https://access.redhat.com/errata/RHSA-2026:3422","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:36882","https://access.redhat.com/errata/RHSA-2026:3710","https://access.redhat.com/errata/RHSA-2026:3782","https://access.redhat.com/errata/RHSA-2026:3825","https://access.redhat.com/errata/RHSA-2026:3869","https://access.redhat.com/errata/RHSA-2026:3870","https://access.redhat.com/errata/RHSA-2026:3874","https://access.redhat.com/errata/RHSA-2026:3884","https://access.redhat.com/errata/RHSA-2026:3958","https://access.redhat.com/errata/RHSA-2026:3960","https://access.redhat.com/errata/RHSA-2026:3962","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:40984","https://access.redhat.com/errata/RHSA-2026:41064","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41941","https://access.redhat.com/errata/RHSA-2026:41944","https://access.redhat.com/errata/RHSA-2026:4423","https://access.redhat.com/errata/RHSA-2026:4466","https://access.redhat.com/errata/RHSA-2026:4467","https://access.redhat.com/errata/RHSA-2026:4630","https://access.redhat.com/errata/RHSA-2026:4782","https://access.redhat.com/errata/RHSA-2026:5633","https://access.redhat.com/errata/RHSA-2026:5636","https://access.redhat.com/errata/RHSA-2026:57487","https://access.redhat.com/errata/RHSA-2026:6192","https://access.redhat.com/errata/RHSA-2026:6288","https://access.redhat.com/errata/RHSA-2026:6497","https://access.redhat.com/errata/RHSA-2026:6567","https://access.redhat.com/errata/RHSA-2026:8218","https://access.redhat.com/errata/RHSA-2026:8229","https://access.redhat.com/errata/RHSA-2026:9848","https://access.redhat.com/security/cve/CVE-2025-13465","https://bugzilla.redhat.com/show_bug.cgi?id=2431740","https://cert-portal.siemens.com/productcert/html/ssa-253495.html","https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-13465.json"],"description":"The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their original behavior. The issue is patched from 4.17.23 to 4.18.0 depending on the package: lodash, lodash-es, and lodash-amd in 4.17.23, and the standalone lodash.unset and lodash.omit packages in 4.18.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"exploitabilityScore":3.9,"impactScore":4.3},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-13465","epss":0.01823,"percentile":0.78783,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-13465","cwe":"CWE-1321","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2025-13465","cwe":"CWE-1321","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"lodash","version":"4.17.21"}},"found":{"vulnerabilityID":"GHSA-xxjr-mmjv-4gpg","versionConstraint":">=4.0.0,<=4.17.22 (semantic)"},"fix":{"suggestedVersion":"4.17.23"}}],"artifact":{"id":"pkg:npm/lodash@4.17.21?package-id=cb6dfff11809ad1e","name":"lodash","version":"4.17.21","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:lodash:lodash:4.17.21:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/lodash@4.17.21","upstreams":[]}},{"vulnerability":{"id":"GHSA-xxjr-mmjv-4gpg","dataSource":"https://github.com/advisories/GHSA-xxjr-mmjv-4gpg","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg","https://nvd.nist.gov/vuln/detail/CVE-2025-13465","https://github.com/lodash/lodash/commit/edadd452146f7e4bad4ea684e955708931d84d81","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"description":"Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H/E:P","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-13465","epss":0.01823,"percentile":0.78783,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-13465","cwe":"CWE-1321","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2025-13465","cwe":"CWE-1321","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["4.17.23"],"state":"fixed","available":[{"version":"4.17.23","date":"2026-01-22","kind":"first-observed"}]},"advisories":[],"risk":1.066455},"relatedVulnerabilities":[{"id":"CVE-2025-13465","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-13465","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg","https://access.redhat.com/errata/RHSA-2026:11414","https://access.redhat.com/errata/RHSA-2026:13542","https://access.redhat.com/errata/RHSA-2026:13548","https://access.redhat.com/errata/RHSA-2026:13829","https://access.redhat.com/errata/RHSA-2026:14774","https://access.redhat.com/errata/RHSA-2026:14870","https://access.redhat.com/errata/RHSA-2026:14871","https://access.redhat.com/errata/RHSA-2026:15091","https://access.redhat.com/errata/RHSA-2026:17469","https://access.redhat.com/errata/RHSA-2026:1845","https://access.redhat.com/errata/RHSA-2026:18480","https://access.redhat.com/errata/RHSA-2026:18868","https://access.redhat.com/errata/RHSA-2026:19712","https://access.redhat.com/errata/RHSA-2026:20042","https://access.redhat.com/errata/RHSA-2026:20088","https://access.redhat.com/errata/RHSA-2026:2078","https://access.redhat.com/errata/RHSA-2026:2119","https://access.redhat.com/errata/RHSA-2026:2145","https://access.redhat.com/errata/RHSA-2026:2147","https://access.redhat.com/errata/RHSA-2026:2148","https://access.redhat.com/errata/RHSA-2026:2149","https://access.redhat.com/errata/RHSA-2026:21658","https://access.redhat.com/errata/RHSA-2026:24331","https://access.redhat.com/errata/RHSA-2026:2438","https://access.redhat.com/errata/RHSA-2026:2452","https://access.redhat.com/errata/RHSA-2026:2462","https://access.redhat.com/errata/RHSA-2026:2465","https://access.redhat.com/errata/RHSA-2026:2469","https://access.redhat.com/errata/RHSA-2026:2484","https://access.redhat.com/errata/RHSA-2026:25089","https://access.redhat.com/errata/RHSA-2026:2651","https://access.redhat.com/errata/RHSA-2026:2661","https://access.redhat.com/errata/RHSA-2026:2672","https://access.redhat.com/errata/RHSA-2026:2675","https://access.redhat.com/errata/RHSA-2026:2694","https://access.redhat.com/errata/RHSA-2026:2816","https://access.redhat.com/errata/RHSA-2026:2817","https://access.redhat.com/errata/RHSA-2026:2818","https://access.redhat.com/errata/RHSA-2026:2819","https://access.redhat.com/errata/RHSA-2026:2900","https://access.redhat.com/errata/RHSA-2026:2926","https://access.redhat.com/errata/RHSA-2026:2984","https://access.redhat.com/errata/RHSA-2026:2990","https://access.redhat.com/errata/RHSA-2026:3087","https://access.redhat.com/errata/RHSA-2026:33154","https://access.redhat.com/errata/RHSA-2026:33371","https://access.redhat.com/errata/RHSA-2026:34100","https://access.redhat.com/errata/RHSA-2026:3422","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:36882","https://access.redhat.com/errata/RHSA-2026:3710","https://access.redhat.com/errata/RHSA-2026:3782","https://access.redhat.com/errata/RHSA-2026:3825","https://access.redhat.com/errata/RHSA-2026:3869","https://access.redhat.com/errata/RHSA-2026:3870","https://access.redhat.com/errata/RHSA-2026:3874","https://access.redhat.com/errata/RHSA-2026:3884","https://access.redhat.com/errata/RHSA-2026:3958","https://access.redhat.com/errata/RHSA-2026:3960","https://access.redhat.com/errata/RHSA-2026:3962","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:40984","https://access.redhat.com/errata/RHSA-2026:41064","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41941","https://access.redhat.com/errata/RHSA-2026:41944","https://access.redhat.com/errata/RHSA-2026:4423","https://access.redhat.com/errata/RHSA-2026:4466","https://access.redhat.com/errata/RHSA-2026:4467","https://access.redhat.com/errata/RHSA-2026:4630","https://access.redhat.com/errata/RHSA-2026:4782","https://access.redhat.com/errata/RHSA-2026:5633","https://access.redhat.com/errata/RHSA-2026:5636","https://access.redhat.com/errata/RHSA-2026:57487","https://access.redhat.com/errata/RHSA-2026:6192","https://access.redhat.com/errata/RHSA-2026:6288","https://access.redhat.com/errata/RHSA-2026:6497","https://access.redhat.com/errata/RHSA-2026:6567","https://access.redhat.com/errata/RHSA-2026:8218","https://access.redhat.com/errata/RHSA-2026:8229","https://access.redhat.com/errata/RHSA-2026:9848","https://access.redhat.com/security/cve/CVE-2025-13465","https://bugzilla.redhat.com/show_bug.cgi?id=2431740","https://cert-portal.siemens.com/productcert/html/ssa-253495.html","https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-13465.json"],"description":"The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their original behavior. The issue is patched from 4.17.23 to 4.18.0 depending on the package: lodash, lodash-es, and lodash-amd in 4.17.23, and the standalone lodash.unset and lodash.omit packages in 4.18.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"exploitabilityScore":3.9,"impactScore":4.3},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-13465","epss":0.01823,"percentile":0.78783,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-13465","cwe":"CWE-1321","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2025-13465","cwe":"CWE-1321","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"lodash","version":"4.17.5"}},"found":{"vulnerabilityID":"GHSA-xxjr-mmjv-4gpg","versionConstraint":">=4.0.0,<=4.17.22 (semantic)"},"fix":{"suggestedVersion":"4.17.23"}}],"artifact":{"id":"pkg:npm/lodash@4.17.5?package-id=6dbd6165006e1c97","name":"lodash","version":"4.17.5","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:lodash:lodash:4.17.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/lodash@4.17.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-c429-5p7v-vgjp","dataSource":"https://github.com/advisories/GHSA-c429-5p7v-vgjp","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-36604","https://github.com/hapijs/hoek/issues/352","https://github.com/hapijs/hoek/commit/4d0804bc6135ad72afdc5e1ec002b935b2f5216a","https://github.com/hapijs/hoek/commit/948baf98634a5c206875b67d11368f133034fa90"],"description":"hoek subject to prototype pollution via the clone function.","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-36604","epss":0.01241,"percentile":0.69195,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-36604","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2020-36604","cwe":"CWE-1321","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.9679799999999998},"relatedVulnerabilities":[{"id":"CVE-2020-36604","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-36604","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/hapijs/hoek/issues/352","https://security.snyk.io/vuln/SNYK-JS-HAPIHOEK-548452%29"],"description":"hoek before 8.5.1 and 9.x before 9.0.3 allows prototype poisoning in the clone function.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-36604","epss":0.01241,"percentile":0.69195,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-36604","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2020-36604","cwe":"CWE-1321","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"hoek","version":"4.3.1"}},"found":{"vulnerabilityID":"GHSA-c429-5p7v-vgjp","versionConstraint":"<=6.1.3 (semantic)"}}],"artifact":{"id":"pkg:npm/hoek@4.3.1?package-id=78d229e9d8dc2a95","name":"hoek","version":"4.3.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:hoek:hoek:4.3.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/hoek@4.3.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-44pw-h2cw-w3vq","dataSource":"https://github.com/advisories/GHSA-44pw-h2cw-w3vq","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/mozilla/hawk/security/advisories/GHSA-44pw-h2cw-w3vq","https://nvd.nist.gov/vuln/detail/CVE-2022-29167","https://github.com/mozilla/hawk/pull/286","https://github.com/mozilla/hawk/commit/d10d72ca82db967f6c5fcf866ff78e3ca25ce1ab"],"description":"Uncontrolled Resource Consumption in Hawk","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H","metrics":{"baseScore":7.4,"exploitabilityScore":2.9,"impactScore":4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-29167","epss":0.01101,"percentile":0.65704,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-29167","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2022-29167","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["9.0.1"],"state":"fixed","available":[{"version":"9.0.1","date":"2022-05-24","kind":"first-observed"}]},"advisories":[],"risk":0.820245},"relatedVulnerabilities":[{"id":"CVE-2022-29167","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-29167","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/mozilla/hawk/pull/286","https://github.com/mozilla/hawk/security/advisories/GHSA-44pw-h2cw-w3vq"],"description":"Hawk is an HTTP authentication scheme providing mechanisms for making authenticated HTTP requests with partial cryptographic verification of the request and response, covering the HTTP method, request URI, host, and optionally the request payload. Hawk used a regular expression to parse `Host` HTTP header (`Hawk.utils.parseHost()`), which was subject to regular expression DoS attack - meaning each added character in the attacker's input increases the computation time exponentially. `parseHost()` was patched in `9.0.1` to use built-in `URL` class to parse hostname instead. `Hawk.authenticate()` accepts `options` argument. If that contains `host` and `port`, those would be used instead of a call to `utils.parseHost()`.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H","metrics":{"baseScore":7.4,"exploitabilityScore":2.9,"impactScore":4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-29167","epss":0.01101,"percentile":0.65704,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-29167","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2022-29167","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"hawk","version":"6.0.2"}},"found":{"vulnerabilityID":"GHSA-44pw-h2cw-w3vq","versionConstraint":"<9.0.1 (semantic)"},"fix":{"suggestedVersion":"9.0.1"}}],"artifact":{"id":"pkg:npm/hawk@6.0.2?package-id=e1550cab3bb167f8","name":"hawk","version":"6.0.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:hawk:hawk:6.0.2:*:*:*:*:*:*:*"],"purl":"pkg:npm/hawk@6.0.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-8r5x-fm3f-whwj","dataSource":"https://github.com/advisories/GHSA-8r5x-fm3f-whwj","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-8r5x-fm3f-whwj","https://nvd.nist.gov/vuln/detail/CVE-2026-106446","https://github.com/handlebars-lang/handlebars.js/pull/2185","https://github.com/handlebars-lang/handlebars.js/commit/703fdcc5fd6cc8d1cc0c33cc19de40c467c4b8d2","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10"],"description":"Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-106446","epss":0.00786,"percentile":0.56142,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-106446","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-106446","cwe":"CWE-843","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.7.10"],"state":"fixed","available":[{"version":"4.7.10","date":"2026-10-09","kind":"first-observed"}]},"advisories":[],"risk":0.73884},"relatedVulnerabilities":[{"id":"CVE-2026-106446","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106446","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/handlebars-lang/handlebars.js/commit/703fdcc5fd6cc8d1cc0c33cc19de40c467c4b8d2","https://github.com/handlebars-lang/handlebars.js/pull/2185","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10","https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-8r5x-fm3f-whwj"],"description":"Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.compile() and Handlebars.precompile() accept pre-parsed AST objects while validating only selected PathExpression, NumberLiteral, and BooleanLiteral values. This issue bypasses the AST validation introduced in version 4.7.9 for CVE-2026-33937. An attacker who can supply an object instead of a template string can place JavaScript expressions in unchecked values such as Program.blockParams.length, a non-PathExpression parameter depth, a non-string StringLiteral.value, or a non-string PathExpression.original. The compiler emits those values into generated JavaScript, causing code execution in the server process when compile output renders or wherever precompile output is loaded. Applications that pass only template strings are not affected. This issue is fixed in version 4.7.10.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-106446","epss":0.00786,"percentile":0.56142,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-106446","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-106446","cwe":"CWE-843","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"handlebars","version":"4.7.9"}},"found":{"vulnerabilityID":"GHSA-8r5x-fm3f-whwj","versionConstraint":">=4.0.0,<=4.7.9 (semantic)"},"fix":{"suggestedVersion":"4.7.10"}}],"artifact":{"id":"pkg:npm/handlebars@4.7.9?package-id=e10bd740e9465895","name":"handlebars","version":"4.7.9","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:handlebars.js_project:handlebars.js:4.7.9:*:*:*:*:node.js:*:*","cpe:2.3:a:handlebarsjs:handlebars:4.7.9:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/handlebars@4.7.9","upstreams":[]}},{"vulnerability":{"id":"GHSA-952p-6rrq-rcjv","dataSource":"https://github.com/advisories/GHSA-952p-6rrq-rcjv","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-4067","https://github.com/micromatch/micromatch/issues/243","https://github.com/micromatch/micromatch/pull/247","https://devhub.checkmarx.com/cve-details/CVE-2024-4067","https://github.com/micromatch/micromatch/blob/2c56a8604b68c1099e7bc0f807ce0865a339747a/index.js#L448","https://github.com/micromatch/micromatch/commit/500d5d6f42f0e8dfa1cb5464c6cb420b1b6aaaa0","https://github.com/micromatch/micromatch/pull/266","https://github.com/micromatch/micromatch/commit/03aa8052171e878897eee5d7bb2ae0ae83ec2ade","https://advisory.checkmarx.net/advisory/CVE-2024-4067","https://github.com/micromatch/micromatch/releases/tag/4.0.8"],"description":"Regular Expression Denial of Service (ReDoS) in micromatch","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-4067","epss":0.01429,"percentile":0.73001,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-4067","cwe":"CWE-1333","source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","type":"Secondary"}],"fix":{"versions":["4.0.8"],"state":"fixed","available":[{"version":"4.0.8","date":"2024-08-24","kind":"first-observed"}]},"advisories":[],"risk":0.735935},"relatedVulnerabilities":[{"id":"CVE-2024-4067","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-4067","namespace":"nvd:cpe","severity":"Medium","urls":["https://advisory.checkmarx.net/advisory/CVE-2024-4067/","https://devhub.checkmarx.com/cve-details/CVE-2024-4067/","https://github.com/micromatch/micromatch/commit/03aa8052171e878897eee5d7bb2ae0ae83ec2ade","https://github.com/micromatch/micromatch/pull/266","https://github.com/micromatch/micromatch/releases/tag/4.0.8","https://github.com/micromatch/micromatch/blob/2c56a8604b68c1099e7bc0f807ce0865a339747a/index.js#L448","https://github.com/micromatch/micromatch/issues/243","https://github.com/micromatch/micromatch/pull/247"],"description":"The NPM package `micromatch` prior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in `micromatch.braces()` in `index.js` because the pattern `.*` will greedily match anything. By passing a malicious payload, the pattern matching will keep backtracking to the input while it doesn't find the closing bracket. As the input size increases, the consumption time will also increase until it causes the application to hang or slow down. There was a merged fix but further testing shows the issue persists. This issue should be mitigated by using a safe pattern that won't start backtracking the regular expression due to greedy matching. This issue was fixed in version 4.0.8.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-4067","epss":0.01429,"percentile":0.73001,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-4067","cwe":"CWE-1333","source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"micromatch","version":"4.0.5"}},"found":{"vulnerabilityID":"GHSA-952p-6rrq-rcjv","versionConstraint":"<4.0.8 (semantic)"},"fix":{"suggestedVersion":"4.0.8"}}],"artifact":{"id":"pkg:npm/micromatch@4.0.5?package-id=8f1a15b330948c74","name":"micromatch","version":"4.0.5","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:jonschlinkert:micromatch:4.0.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/micromatch@4.0.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-3xgq-45jj-v275","dataSource":"https://github.com/advisories/GHSA-3xgq-45jj-v275","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-21538","https://github.com/moxystudio/node-cross-spawn/pull/160","https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff","https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f","https://security.snyk.io/vuln/SNYK-JS-CROSSSPAWN-8303230","https://github.com/moxystudio/node-cross-spawn/issues/165","https://github.com/moxystudio/node-cross-spawn/commit/d35c865b877d2f9ded7c1ed87521c2fdb689c8dd","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8366349"],"description":"Regular Expression Denial of Service (ReDoS) in cross-spawn","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-21538","epss":0.00868,"percentile":0.58749,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-21538","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2024-21538","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["6.0.6"],"state":"fixed","available":[{"version":"6.0.6","date":"2024-11-19","kind":"first-observed"}]},"advisories":[],"risk":0.65534},"relatedVulnerabilities":[{"id":"CVE-2024-21538","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-21538","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff","https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f","https://github.com/moxystudio/node-cross-spawn/pull/160","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8366349","https://security.snyk.io/vuln/SNYK-JS-CROSSSPAWN-8303230"],"description":"Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.","cvss":[{"source":"report@snyk.io","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-21538","epss":0.00868,"percentile":0.58749,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-21538","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2024-21538","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"cross-spawn","version":"5.1.0"}},"found":{"vulnerabilityID":"GHSA-3xgq-45jj-v275","versionConstraint":"<6.0.6 (semantic)"},"fix":{"suggestedVersion":"6.0.6"}}],"artifact":{"id":"pkg:npm/cross-spawn@5.1.0?package-id=f82e5f1636149020","name":"cross-spawn","version":"5.1.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:cross-spawn:cross-spawn:5.1.0:*:*:*:*:*:*:*","cpe:2.3:a:cross-spawn:cross_spawn:5.1.0:*:*:*:*:*:*:*","cpe:2.3:a:cross_spawn:cross-spawn:5.1.0:*:*:*:*:*:*:*","cpe:2.3:a:cross_spawn:cross_spawn:5.1.0:*:*:*:*:*:*:*","cpe:2.3:a:cross:cross-spawn:5.1.0:*:*:*:*:*:*:*","cpe:2.3:a:cross:cross_spawn:5.1.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/cross-spawn@5.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-3xgq-45jj-v275","dataSource":"https://github.com/advisories/GHSA-3xgq-45jj-v275","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-21538","https://github.com/moxystudio/node-cross-spawn/pull/160","https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff","https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f","https://security.snyk.io/vuln/SNYK-JS-CROSSSPAWN-8303230","https://github.com/moxystudio/node-cross-spawn/issues/165","https://github.com/moxystudio/node-cross-spawn/commit/d35c865b877d2f9ded7c1ed87521c2fdb689c8dd","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8366349"],"description":"Regular Expression Denial of Service (ReDoS) in cross-spawn","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-21538","epss":0.00868,"percentile":0.58749,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-21538","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2024-21538","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["6.0.6"],"state":"fixed","available":[{"version":"6.0.6","date":"2024-11-19","kind":"first-observed"}]},"advisories":[],"risk":0.65534},"relatedVulnerabilities":[{"id":"CVE-2024-21538","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-21538","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff","https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f","https://github.com/moxystudio/node-cross-spawn/pull/160","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8366349","https://security.snyk.io/vuln/SNYK-JS-CROSSSPAWN-8303230"],"description":"Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.","cvss":[{"source":"report@snyk.io","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-21538","epss":0.00868,"percentile":0.58749,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-21538","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2024-21538","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"cross-spawn","version":"6.0.5"}},"found":{"vulnerabilityID":"GHSA-3xgq-45jj-v275","versionConstraint":"<6.0.6 (semantic)"},"fix":{"suggestedVersion":"6.0.6"}}],"artifact":{"id":"pkg:npm/cross-spawn@6.0.5?package-id=28198c4f8ea76061","name":"cross-spawn","version":"6.0.5","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:cross-spawn:cross-spawn:6.0.5:*:*:*:*:*:*:*","cpe:2.3:a:cross-spawn:cross_spawn:6.0.5:*:*:*:*:*:*:*","cpe:2.3:a:cross_spawn:cross-spawn:6.0.5:*:*:*:*:*:*:*","cpe:2.3:a:cross_spawn:cross_spawn:6.0.5:*:*:*:*:*:*:*","cpe:2.3:a:cross:cross-spawn:6.0.5:*:*:*:*:*:*:*","cpe:2.3:a:cross:cross_spawn:6.0.5:*:*:*:*:*:*:*"],"purl":"pkg:npm/cross-spawn@6.0.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-p8wg-vrv2-v86f","dataSource":"https://github.com/advisories/GHSA-p8wg-vrv2-v86f","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-p8wg-vrv2-v86f","https://nvd.nist.gov/vuln/detail/CVE-2026-106445","https://github.com/handlebars-lang/handlebars.js/pull/2185","https://github.com/handlebars-lang/handlebars.js/commit/ceec388abe1d1aac8f6369860d5f390fa71ef4fa","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10"],"description":"Handlebars: JavaScript Injection via Own Property Check Bypass","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":9.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-106445","epss":0.00589,"percentile":0.48165,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-106445","cwe":"CWE-184","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-106445","cwe":"CWE-1289","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.7.10"],"state":"fixed","available":[{"version":"4.7.10","date":"2026-10-09","kind":"first-observed"}]},"advisories":[],"risk":0.53599},"relatedVulnerabilities":[{"id":"CVE-2026-106445","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106445","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/handlebars-lang/handlebars.js/commit/ceec388abe1d1aac8f6369860d5f390fa71ef4fa","https://github.com/handlebars-lang/handlebars.js/pull/2185","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10","https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-p8wg-vrv2-v86f"],"description":"Handlebars provides the power necessary to let users build semantic templates. From 3.0.0 until 4.7.10, Handlebars lookupProperty returns Function.prototype.constructor before applying the prototype-access deny list because constructor is an own property of Function.prototype. When an attacker can render a controlled template with allowProtoMethodsByDefault enabled and an accessible function in the template context, the template can traverse from that function through its prototype to Function.prototype and then obtain the Function constructor through the own-property bypass. This permits attacker-controlled JavaScript to execute with the server application's privileges. This issue is fixed in version 4.7.10.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-106445","epss":0.00589,"percentile":0.48165,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-106445","cwe":"CWE-184","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-106445","cwe":"CWE-1289","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"handlebars","version":"4.7.9"}},"found":{"vulnerabilityID":"GHSA-p8wg-vrv2-v86f","versionConstraint":">=3.0.0,<=4.7.9 (semantic)"},"fix":{"suggestedVersion":"4.7.10"}}],"artifact":{"id":"pkg:npm/handlebars@4.7.9?package-id=e10bd740e9465895","name":"handlebars","version":"4.7.9","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:handlebars.js_project:handlebars.js:4.7.9:*:*:*:*:node.js:*:*","cpe:2.3:a:handlebarsjs:handlebars:4.7.9:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/handlebars@4.7.9","upstreams":[]}},{"vulnerability":{"id":"GHSA-f5x3-32g6-xq36","dataSource":"https://github.com/advisories/GHSA-f5x3-32g6-xq36","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-f5x3-32g6-xq36","https://nvd.nist.gov/vuln/detail/CVE-2024-28863","https://github.com/isaacs/node-tar/commit/fe8cd57da5686f8695415414bda49206a545f7f7","https://security.netapp.com/advisory/ntap-20240524-0005"],"description":"Denial of service while parsing a tar file due to lack of folders count validation","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-28863","epss":0.00929,"percentile":0.6059,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-28863","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2024-28863","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["6.2.1"],"state":"fixed","available":[{"version":"6.2.1","date":"2024-04-10","kind":"first-observed"}]},"advisories":[],"risk":0.534175},"relatedVulnerabilities":[{"id":"CVE-2024-28863","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-28863","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-tar/commit/fe8cd57da5686f8695415414bda49206a545f7f7","https://github.com/isaacs/node-tar/security/advisories/GHSA-f5x3-32g6-xq36","https://security.netapp.com/advisory/ntap-20240524-0005/"],"description":"node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js client within few seconds of running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing extraction in excessively deep sub-folders.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-28863","epss":0.00929,"percentile":0.6059,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-28863","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2024-28863","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"6.1.11"}},"found":{"vulnerabilityID":"GHSA-f5x3-32g6-xq36","versionConstraint":"<6.2.1 (semantic)"},"fix":{"suggestedVersion":"6.2.1"}}],"artifact":{"id":"pkg:npm/tar@6.1.11?package-id=3853c86fbd5d8342","name":"tar","version":"6.1.11","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:tar_project:tar:6.1.11:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:6.1.11:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:6.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@6.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-hmw2-7cc7-3qxx","dataSource":"https://github.com/advisories/GHSA-hmw2-7cc7-3qxx","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/form-data/form-data/security/advisories/GHSA-hmw2-7cc7-3qxx","https://nvd.nist.gov/vuln/detail/CVE-2026-12143","https://github.com/form-data/form-data/commit/64190db548c0179e37206858e39f27cf513e9435","https://github.com/form-data/form-data/commit/be3f3cf553978bac15a5182f1f3c3d2d38ccf229","https://github.com/form-data/form-data/commit/c7133499c2ee1b80c678e411244f4442bf902045","https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart-form-data","https://www.npmjs.com/package/form-data"],"description":"form-data: CRLF injection in form-data via unescaped multipart field names and filenames","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-12143","epss":0.00669,"percentile":0.51971,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-12143","cwe":"CWE-93","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-12143","cwe":"CWE-93","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["2.5.6"],"state":"fixed","available":[{"version":"2.5.6","date":"2026-06-15","kind":"first-observed"}]},"advisories":[],"risk":0.5218200000000001},"relatedVulnerabilities":[{"id":"CVE-2026-12143","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12143","namespace":"nvd:cpe","severity":"High","urls":["https://cwe.mitre.org/data/definitions/93.html","https://github.com/form-data/form-data/commit/64190db548c0179e37206858e39f27cf513e9435","https://github.com/form-data/form-data/commit/be3f3cf553978bac15a5182f1f3c3d2d38ccf229","https://github.com/form-data/form-data/commit/c7133499c2ee1b80c678e411244f4442bf902045","https://github.com/form-data/form-data/security/advisories/GHSA-hmw2-7cc7-3qxx","https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart-form-data","https://www.npmjs.com/package/form-data","https://access.redhat.com/errata/RHSA-2026:33155","https://access.redhat.com/errata/RHSA-2026:33160","https://access.redhat.com/errata/RHSA-2026:33163","https://access.redhat.com/errata/RHSA-2026:33173","https://access.redhat.com/errata/RHSA-2026:33183","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:36319","https://access.redhat.com/errata/RHSA-2026:36625","https://access.redhat.com/errata/RHSA-2026:36754","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41929","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:44263","https://access.redhat.com/errata/RHSA-2026:44267","https://access.redhat.com/errata/RHSA-2026:48124","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:48693","https://access.redhat.com/errata/RHSA-2026:50300","https://access.redhat.com/errata/RHSA-2026:54770","https://access.redhat.com/errata/RHSA-2026:56338","https://access.redhat.com/errata/RHSA-2026:56366","https://access.redhat.com/errata/RHSA-2026:56431","https://access.redhat.com/errata/RHSA-2026:57013","https://access.redhat.com/errata/RHSA-2026:57545","https://access.redhat.com/errata/RHSA-2026:57590","https://access.redhat.com/errata/RHSA-2026:57801","https://access.redhat.com/errata/RHSA-2026:59136","https://access.redhat.com/errata/RHSA-2026:59153","https://access.redhat.com/errata/RHSA-2026:59155","https://access.redhat.com/errata/RHSA-2026:59556","https://access.redhat.com/errata/RHSA-2026:59557","https://access.redhat.com/errata/RHSA-2026:59558","https://access.redhat.com/errata/RHSA-2026:59559","https://access.redhat.com/errata/RHSA-2026:59579","https://access.redhat.com/errata/RHSA-2026:60387","https://access.redhat.com/errata/RHSA-2026:60388","https://access.redhat.com/errata/RHSA-2026:60389","https://access.redhat.com/errata/RHSA-2026:60390","https://access.redhat.com/errata/RHSA-2026:60391","https://access.redhat.com/errata/RHSA-2026:60446","https://access.redhat.com/errata/RHSA-2026:60477","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:63047","https://access.redhat.com/errata/RHSA-2026:63355","https://access.redhat.com/errata/RHSA-2026:63373","https://access.redhat.com/errata/RHSA-2026:66003","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-12143","https://bugzilla.redhat.com/show_bug.cgi?id=2488480","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12143.json"],"description":"form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Disposition` header without escaping carriage return (CR), line feed (LF), or double-quote (\") characters. An application that passes attacker-controlled data as a field name or filename (for example, an API gateway that turns JSON object keys into multipart field names) allows the attacker to terminate the header line and inject additional headers, or to smuggle entire additional multipart parts, into the request the application forwards to a backend. This can let the attacker add or override form fields (e.g. set `is_admin=true`) seen by the downstream parser. This is an instance of CWE-93 (CRLF injection). The fix escapes CR, LF, and `\"` as `%0D`, `%0A`, and `%22` in field names and filenames, matching the serialization browsers use per the WHATWG HTML multipart/form-data encoding algorithm. Exploitation requires the consuming application to use untrusted input as a field name or filename; applications that use only fixed/trusted field names are not affected. Fixed in 2.5.6, 3.0.5, and 4.0.6.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-12143","epss":0.00669,"percentile":0.51971,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-12143","cwe":"CWE-93","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-12143","cwe":"CWE-93","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"form-data","version":"2.3.3"}},"found":{"vulnerabilityID":"GHSA-hmw2-7cc7-3qxx","versionConstraint":"<2.5.6 (semantic)"},"fix":{"suggestedVersion":"2.5.6"}}],"artifact":{"id":"pkg:npm/form-data@2.3.3?package-id=1ae90c2a623c09d0","name":"form-data","version":"2.3.3","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:form-data:form-data:2.3.3:*:*:*:*:*:*:*","cpe:2.3:a:form-data:form_data:2.3.3:*:*:*:*:*:*:*","cpe:2.3:a:form_data:form-data:2.3.3:*:*:*:*:*:*:*","cpe:2.3:a:form_data:form_data:2.3.3:*:*:*:*:*:*:*","cpe:2.3:a:form:form-data:2.3.3:*:*:*:*:*:*:*","cpe:2.3:a:form:form_data:2.3.3:*:*:*:*:*:*:*"],"purl":"pkg:npm/form-data@2.3.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-23hp-3jrh-7fpw","dataSource":"https://github.com/advisories/GHSA-23hp-3jrh-7fpw","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw","https://nvd.nist.gov/vuln/detail/CVE-2026-59873","https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3","https://github.com/isaacs/node-tar/releases/tag/v7.5.19"],"description":"node-tar: Decompression/parse DoS via unlimited input","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","metrics":{"baseScore":9.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59873","epss":0.00582,"percentile":0.47813,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59873","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.5.19"],"state":"fixed","available":[{"version":"7.5.19","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.5048849999999999},"relatedVulnerabilities":[{"id":"CVE-2026-59873","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59873","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3","https://github.com/isaacs/node-tar/releases/tag/v7.5.19","https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw"],"description":"node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as src/extract.ts, allowing a small crafted gzip bomb to exhaust disk space and CPU. This issue is fixed in version 7.5.19.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59873","epss":0.00582,"percentile":0.47813,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59873","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"6.1.11"}},"found":{"vulnerabilityID":"GHSA-23hp-3jrh-7fpw","versionConstraint":"<=7.5.18 (semantic)"},"fix":{"suggestedVersion":"7.5.19"}}],"artifact":{"id":"pkg:npm/tar@6.1.11?package-id=3853c86fbd5d8342","name":"tar","version":"6.1.11","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:tar_project:tar:6.1.11:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:6.1.11:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:6.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@6.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-rgw5-rvv9-x895","dataSource":"https://github.com/advisories/GHSA-rgw5-rvv9-x895","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895","https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d","https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac","https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf","https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031","https://nvd.nist.gov/vuln/detail/CVE-2026-69152"],"description":"brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69152","epss":0.00647,"percentile":0.51007,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69152","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69152","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.1.18"],"state":"fixed","available":[{"version":"1.1.18","date":"2026-08-03","kind":"first-observed"}]},"advisories":[],"risk":0.48525},"relatedVulnerabilities":[{"id":"CVE-2026-69152","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-69152","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d","https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac","https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf","https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop. The fix for CVE-2026-14257 is bypassed by the vulnerability. This issue is fixed in versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69152","epss":0.00647,"percentile":0.51007,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69152","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69152","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.11"}},"found":{"vulnerabilityID":"GHSA-rgw5-rvv9-x895","versionConstraint":"<1.1.18 (semantic)"},"fix":{"suggestedVersion":"1.1.18"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.11?package-id=bb6331f39e7684a6","name":"brace-expansion","version":"1.1.11","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-rgw5-rvv9-x895","dataSource":"https://github.com/advisories/GHSA-rgw5-rvv9-x895","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895","https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d","https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac","https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf","https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031","https://nvd.nist.gov/vuln/detail/CVE-2026-69152"],"description":"brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69152","epss":0.00647,"percentile":0.51007,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69152","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69152","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.1.4"],"state":"fixed","available":[{"version":"2.1.4","date":"2026-08-03","kind":"first-observed"}]},"advisories":[],"risk":0.48525},"relatedVulnerabilities":[{"id":"CVE-2026-69152","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-69152","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d","https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac","https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf","https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop. The fix for CVE-2026-14257 is bypassed by the vulnerability. This issue is fixed in versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69152","epss":0.00647,"percentile":0.51007,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69152","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69152","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"2.0.1"}},"found":{"vulnerabilityID":"GHSA-rgw5-rvv9-x895","versionConstraint":">=2.0.0,<2.1.4 (semantic)"},"fix":{"suggestedVersion":"2.1.4"}}],"artifact":{"id":"pkg:npm/brace-expansion@2.0.1?package-id=569f54ca8e83a456","name":"brace-expansion","version":"2.0.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:2.0.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@2.0.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-78xj-cgh5-2h22","dataSource":"https://github.com/advisories/GHSA-78xj-cgh5-2h22","namespace":"github:language:javascript","severity":"Low","urls":["https://nvd.nist.gov/vuln/detail/CVE-2023-42282","https://cosmosofcyberspace.github.io/npm_ip_cve/npm_ip_cve.html","https://github.com/JoshGlazebrook/socks/issues/93#issue-2128357447","https://github.com/github/advisory-database/pull/3504#issuecomment-1937179999","https://github.com/indutny/node-ip/pull/138","https://github.com/indutny/node-ip/commit/32f468f1245574785ec080705737a579be1223aa","https://github.com/indutny/node-ip/commit/6a3ada9b471b09d5f0f5be264911ab564bf67894"],"description":"NPM IP package incorrectly identifies some private IP addresses as public","cvss":[],"epss":[{"cve":"CVE-2023-42282","epss":0.01613,"percentile":0.75979,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2023-42282","cwe":"CWE-918","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2023-42282","cwe":"CWE-918","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["2.0.1"],"state":"fixed","available":[{"version":"2.0.1","date":"2024-02-21","kind":"first-observed"}]},"advisories":[],"risk":0.48389999999999994},"relatedVulnerabilities":[{"id":"CVE-2023-42282","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-42282","namespace":"nvd:cpe","severity":"Critical","urls":["https://cosmosofcyberspace.github.io/npm_ip_cve/npm_ip_cve.html","https://github.com/indutny/node-ip/commit/6a3ada9b471b09d5f0f5be264911ab564bf67894","https://huntr.com/bounties/bfc3b23f-ddc0-4ee7-afab-223b07115ed3/","https://security.netapp.com/advisory/ntap-20240315-0008/","https://www.bleepingcomputer.com/news/security/dev-rejects-cve-severity-makes-his-github-repo-read-only/"],"description":"The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-42282","epss":0.01613,"percentile":0.75979,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2023-42282","cwe":"CWE-918","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2023-42282","cwe":"CWE-918","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"ip","version":"2.0.0"}},"found":{"vulnerabilityID":"GHSA-78xj-cgh5-2h22","versionConstraint":"=2.0.0 (semantic)"},"fix":{"suggestedVersion":"2.0.1"}}],"artifact":{"id":"pkg:npm/ip@2.0.0?package-id=9ea3e86e58333d8a","name":"ip","version":"2.0.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:fedorindutny:ip:2.0.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/ip@2.0.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-mh99-v99m-4gvg","dataSource":"https://github.com/advisories/GHSA-mh99-v99m-4gvg","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-mh99-v99m-4gvg","https://nvd.nist.gov/vuln/detail/CVE-2026-14257","https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5","https://github.com/juliangruber/brace-expansion","https://www.npmjs.com/package/brace-expansion","https://github.com/juliangruber/brace-expansion/pull/129","https://github.com/juliangruber/brace-expansion/pull/130","https://github.com/juliangruber/brace-expansion/pull/136","https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d","https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031","https://github.com/juliangruber/brace-expansion/commit/d13ff455a58b0d56704f0111e3c2a0b16ceb06eb"],"description":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-14257","epss":0.00643,"percentile":0.5082,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-14257","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-14257","cwe":"CWE-770","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}],"fix":{"versions":["1.1.17"],"state":"fixed","available":[{"version":"1.1.17","date":"2026-08-01","kind":"first-observed"}]},"advisories":[],"risk":0.48225000000000007},"relatedVulnerabilities":[{"id":"CVE-2026-14257","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-14257","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion","https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5","https://www.npmjs.com/package/brace-expansion"],"description":"brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays.","cvss":[{"source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-14257","epss":0.00643,"percentile":0.5082,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-14257","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-14257","cwe":"CWE-770","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.11"}},"found":{"vulnerabilityID":"GHSA-mh99-v99m-4gvg","versionConstraint":"<1.1.17 (semantic)"},"fix":{"suggestedVersion":"1.1.17"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.11?package-id=bb6331f39e7684a6","name":"brace-expansion","version":"1.1.11","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-mh99-v99m-4gvg","dataSource":"https://github.com/advisories/GHSA-mh99-v99m-4gvg","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-mh99-v99m-4gvg","https://nvd.nist.gov/vuln/detail/CVE-2026-14257","https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5","https://github.com/juliangruber/brace-expansion","https://www.npmjs.com/package/brace-expansion","https://github.com/juliangruber/brace-expansion/pull/129","https://github.com/juliangruber/brace-expansion/pull/130","https://github.com/juliangruber/brace-expansion/pull/136","https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d","https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031","https://github.com/juliangruber/brace-expansion/commit/d13ff455a58b0d56704f0111e3c2a0b16ceb06eb"],"description":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-14257","epss":0.00643,"percentile":0.5082,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-14257","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-14257","cwe":"CWE-770","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}],"fix":{"versions":["2.1.3"],"state":"fixed","available":[{"version":"2.1.3","date":"2026-08-01","kind":"first-observed"}]},"advisories":[],"risk":0.48225000000000007},"relatedVulnerabilities":[{"id":"CVE-2026-14257","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-14257","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion","https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5","https://www.npmjs.com/package/brace-expansion"],"description":"brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays.","cvss":[{"source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-14257","epss":0.00643,"percentile":0.5082,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-14257","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-14257","cwe":"CWE-770","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"2.0.1"}},"found":{"vulnerabilityID":"GHSA-mh99-v99m-4gvg","versionConstraint":">=2.0.0,<2.1.3 (semantic)"},"fix":{"suggestedVersion":"2.1.3"}}],"artifact":{"id":"pkg:npm/brace-expansion@2.0.1?package-id=569f54ca8e83a456","name":"brace-expansion","version":"2.0.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:2.0.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@2.0.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-34x7-hfp2-rc4v","dataSource":"https://github.com/advisories/GHSA-34x7-hfp2-rc4v","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-34x7-hfp2-rc4v","https://nvd.nist.gov/vuln/detail/CVE-2026-24842","https://github.com/isaacs/node-tar/commit/f4a7aa9bc3d717c987fdf1480ff7a64e87ffdb46"],"description":"node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":2.9,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-24842","epss":0.00608,"percentile":0.49105,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-24842","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-24842","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-24842","cwe":"CWE-59","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["7.5.7"],"state":"fixed","available":[{"version":"7.5.7","date":"2026-01-29","kind":"first-observed"}]},"advisories":[],"risk":0.47728},"relatedVulnerabilities":[{"id":"CVE-2026-24842","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24842","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/node-tar/commit/f4a7aa9bc3d717c987fdf1480ff7a64e87ffdb46","https://github.com/isaacs/node-tar/security/advisories/GHSA-34x7-hfp2-rc4v","https://access.redhat.com/errata/RHSA-2026:18480","https://access.redhat.com/errata/RHSA-2026:18868","https://access.redhat.com/errata/RHSA-2026:2900","https://access.redhat.com/errata/RHSA-2026:33371","https://access.redhat.com/errata/RHSA-2026:5447","https://access.redhat.com/errata/RHSA-2026:6192","https://access.redhat.com/security/cve/CVE-2026-24842","https://bugzilla.redhat.com/show_bug.cgi?id=2433645","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24842.json"],"description":"node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory. Version 7.5.7 contains a fix for the issue.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":2.9,"impactScore":4.8},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":2.9,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-24842","epss":0.00608,"percentile":0.49105,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-24842","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-24842","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-24842","cwe":"CWE-59","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"6.1.11"}},"found":{"vulnerabilityID":"GHSA-34x7-hfp2-rc4v","versionConstraint":"<7.5.7 (semantic)"},"fix":{"suggestedVersion":"7.5.7"}}],"artifact":{"id":"pkg:npm/tar@6.1.11?package-id=3853c86fbd5d8342","name":"tar","version":"6.1.11","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:tar_project:tar:6.1.11:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:6.1.11:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:6.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@6.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-4x5v-gmq8-25ch","dataSource":"https://github.com/advisories/GHSA-4x5v-gmq8-25ch","namespace":"github:language:javascript","severity":"Low","urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-43307","https://research.jfrog.com/vulnerabilities/semver-regex-redos-xray-211349/","https://github.com/sindresorhus/semver-regex/commit/d8ba39a528c1027c43ab23f12eec28ca4d40dd0c"],"description":"Regular expression denial of service in semver-regex","cvss":[],"epss":[{"cve":"CVE-2021-43307","epss":0.01558,"percentile":0.75202,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-43307","cwe":"CWE-1333","source":"reefs@jfrog.com","type":"Secondary"},{"cve":"CVE-2021-43307","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["3.1.4"],"state":"fixed","available":[{"version":"3.1.4","date":"2022-06-04","kind":"first-observed"}]},"advisories":[],"risk":0.46740000000000004},"relatedVulnerabilities":[{"id":"CVE-2021-43307","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-43307","namespace":"nvd:cpe","severity":"High","urls":["https://research.jfrog.com/vulnerabilities/semver-regex-redos-xray-211349/"],"description":"An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the semver-regex npm package, when an attacker is able to supply arbitrary input to the test() method","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}},{"source":"reefs@jfrog.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-43307","epss":0.01558,"percentile":0.75202,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-43307","cwe":"CWE-1333","source":"reefs@jfrog.com","type":"Secondary"},{"cve":"CVE-2021-43307","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"semver-regex","version":"3.1.3"}},"found":{"vulnerabilityID":"GHSA-4x5v-gmq8-25ch","versionConstraint":"<3.1.4 (semantic)"},"fix":{"suggestedVersion":"3.1.4"}}],"artifact":{"id":"pkg:npm/semver-regex@3.1.3?package-id=cee900d45a902f9a","name":"semver-regex","version":"3.1.3","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:semver-regex_project:semver-regex:3.1.3:*:*:*:*:*:*:*"],"purl":"pkg:npm/semver-regex@3.1.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-3ppc-4f35-3m26","dataSource":"https://github.com/advisories/GHSA-3ppc-4f35-3m26","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26","https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://nvd.nist.gov/vuln/detail/CVE-2026-26996"],"description":"minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.00577,"percentile":0.47578,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.1.3"],"state":"fixed","available":[{"version":"3.1.3","date":"2026-03-04","kind":"first-observed"}]},"advisories":[],"risk":0.46736999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-26996","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26996","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.00577,"percentile":0.47578,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-3ppc-4f35-3m26","versionConstraint":"<3.1.3 (semantic)"},"fix":{"suggestedVersion":"3.1.3"}}],"artifact":{"id":"pkg:npm/minimatch@3.1.2?package-id=7a05a1c46734c75f","name":"minimatch","version":"3.1.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-3ppc-4f35-3m26","dataSource":"https://github.com/advisories/GHSA-3ppc-4f35-3m26","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26","https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://nvd.nist.gov/vuln/detail/CVE-2026-26996"],"description":"minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.00577,"percentile":0.47578,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["5.1.7"],"state":"fixed","available":[{"version":"5.1.7","date":"2026-03-04","kind":"first-observed"}]},"advisories":[],"risk":0.46736999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-26996","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26996","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.00577,"percentile":0.47578,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"5.1.0"}},"found":{"vulnerabilityID":"GHSA-3ppc-4f35-3m26","versionConstraint":">=5.0.0,<5.1.7 (semantic)"},"fix":{"suggestedVersion":"5.1.7"}}],"artifact":{"id":"pkg:npm/minimatch@5.1.0?package-id=2a8799ea853a469d","name":"minimatch","version":"5.1.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:5.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@5.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-r7fv-28h4-cvq7","dataSource":"https://github.com/advisories/GHSA-r7fv-28h4-cvq7","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/markdown-it/markdown-it/security/advisories/GHSA-r7fv-28h4-cvq7","https://nvd.nist.gov/vuln/detail/CVE-2026-111759","https://github.com/markdown-it/markdown-it/commit/1b379c1b6d0522421bd1a51b77337c79af2c8670","https://github.com/markdown-it/markdown-it/commit/cf27366035edf9196667110c47d9d67b030a4152","https://github.com/markdown-it/markdown-it/commit/daf5a3c32303e5d9de01b12eeb725fb5990b8162","https://github.com/markdown-it/markdown-it/releases/tag/14.3.2","https://github.com/markdown-it/markdown-it/releases/tag/15.0.2"],"description":"markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111759","epss":0.00591,"percentile":0.48256,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111759","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-111759","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["14.3.2"],"state":"fixed","available":[{"version":"14.3.2","date":"2026-10-20","kind":"first-observed"}]},"advisories":[],"risk":0.4432500000000001},"relatedVulnerabilities":[{"id":"CVE-2026-111759","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111759","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/markdown-it/markdown-it/commit/1b379c1b6d0522421bd1a51b77337c79af2c8670","https://github.com/markdown-it/markdown-it/commit/cf27366035edf9196667110c47d9d67b030a4152","https://github.com/markdown-it/markdown-it/commit/daf5a3c32303e5d9de01b12eeb725fb5990b8162","https://github.com/markdown-it/markdown-it/releases/tag/14.3.2","https://github.com/markdown-it/markdown-it/releases/tag/15.0.2","https://github.com/markdown-it/markdown-it/security/advisories/GHSA-r7fv-28h4-cvq7"],"description":"markdown-it is a Markdown parser. Prior to 14.3.2 and 15.0.2, when typographer: true is enabled, specially crafted Markdown can cause quadratic processing time in the smartquotes rule, potentially leading to denial of service in applications processing untrusted input. Many opening double quotes followed by unmatched closing single quotes cause repeated scans of the entire opener stack. The same issue occurs with the quote types reversed. The default configuration (typographer: false) is not affected, but this option is enabled with high probability. This issue is fixed in versions 14.3.2 and 15.0.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111759","epss":0.00591,"percentile":0.48256,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111759","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-111759","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"markdown-it","version":"13.0.1"}},"found":{"vulnerabilityID":"GHSA-r7fv-28h4-cvq7","versionConstraint":"<14.3.2 (semantic)"},"fix":{"suggestedVersion":"14.3.2"}}],"artifact":{"id":"pkg:npm/markdown-it@13.0.1?package-id=59ad530bbde4b9d0","name":"markdown-it","version":"13.0.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:markdown-it_project:markdown-it:13.0.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/markdown-it@13.0.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-7r86-cg39-jmmj","dataSource":"https://github.com/advisories/GHSA-7r86-cg39-jmmj","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj","https://nvd.nist.gov/vuln/detail/CVE-2026-27903","https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748"],"description":"minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27903","epss":0.00576,"percentile":0.47498,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27903","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.1.3"],"state":"fixed","available":[{"version":"3.1.3","date":"2026-02-27","kind":"first-observed"}]},"advisories":[],"risk":0.432},"relatedVulnerabilities":[{"id":"CVE-2026-27903","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27903","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent `**` (GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where `n` is the number of path segments and `k` is the number of globstars. With k=11 and n=30, a call to the default `minimatch()` API stalls for roughly 5 seconds. With k=13, it exceeds 15 seconds. No memoization or call budget exists to bound this behavior. Any application where an attacker can influence the glob pattern passed to `minimatch()` is vulnerable. The realistic attack surface includes build tools and task runners that accept user-supplied glob arguments (ESLint, Webpack, Rollup config), multi-tenant systems where one tenant configures glob-based rules that run in a shared process, admin or developer interfaces that accept ignore-rule or filter configuration as globs, and CI/CD pipelines that evaluate user-submitted config files containing glob patterns. An attacker who can place a crafted pattern into any of these paths can stall the Node.js event loop for tens of seconds per invocation. The pattern is 56 bytes for a 5-second stall and does not require authentication in contexts where pattern input is part of the feature. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3 fix the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27903","epss":0.00576,"percentile":0.47498,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27903","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-7r86-cg39-jmmj","versionConstraint":"<3.1.3 (semantic)"},"fix":{"suggestedVersion":"3.1.3"}}],"artifact":{"id":"pkg:npm/minimatch@3.1.2?package-id=7a05a1c46734c75f","name":"minimatch","version":"3.1.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-7r86-cg39-jmmj","dataSource":"https://github.com/advisories/GHSA-7r86-cg39-jmmj","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj","https://nvd.nist.gov/vuln/detail/CVE-2026-27903","https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748"],"description":"minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27903","epss":0.00576,"percentile":0.47498,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27903","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["5.1.8"],"state":"fixed","available":[{"version":"5.1.8","date":"2026-02-27","kind":"first-observed"}]},"advisories":[],"risk":0.432},"relatedVulnerabilities":[{"id":"CVE-2026-27903","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27903","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent `**` (GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where `n` is the number of path segments and `k` is the number of globstars. With k=11 and n=30, a call to the default `minimatch()` API stalls for roughly 5 seconds. With k=13, it exceeds 15 seconds. No memoization or call budget exists to bound this behavior. Any application where an attacker can influence the glob pattern passed to `minimatch()` is vulnerable. The realistic attack surface includes build tools and task runners that accept user-supplied glob arguments (ESLint, Webpack, Rollup config), multi-tenant systems where one tenant configures glob-based rules that run in a shared process, admin or developer interfaces that accept ignore-rule or filter configuration as globs, and CI/CD pipelines that evaluate user-submitted config files containing glob patterns. An attacker who can place a crafted pattern into any of these paths can stall the Node.js event loop for tens of seconds per invocation. The pattern is 56 bytes for a 5-second stall and does not require authentication in contexts where pattern input is part of the feature. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3 fix the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27903","epss":0.00576,"percentile":0.47498,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27903","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"5.1.0"}},"found":{"vulnerabilityID":"GHSA-7r86-cg39-jmmj","versionConstraint":">=5.0.0,<5.1.8 (semantic)"},"fix":{"suggestedVersion":"5.1.8"}}],"artifact":{"id":"pkg:npm/minimatch@5.1.0?package-id=2a8799ea853a469d","name":"minimatch","version":"5.1.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:5.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@5.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-rmvr-2pp2-xj38","dataSource":"https://github.com/advisories/GHSA-rmvr-2pp2-xj38","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/octokit/request.js/security/advisories/GHSA-rmvr-2pp2-xj38","https://github.com/octokit/request.js/commit/34ff07ee86fc5c20865982d77391bc910ef19c68","https://nvd.nist.gov/vuln/detail/CVE-2025-25290","https://github.com/octokit/request.js/releases/tag/v8.4.1","https://github.com/octokit/request.js/commit/356411e3217019aa9fc8a68f4236af82490873c2","https://github.com/octokit/request.js/commit/6bb29ba92a52f7bf94469c3433707c682c17126c","https://github.com/octokit/request.js/releases/tag/v9.2.1"],"description":"@octokit/request has a Regular Expression in fetchWrapper that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-25290","epss":0.00783,"percentile":0.56031,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-25290","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["8.4.1"],"state":"fixed","available":[{"version":"8.4.1","date":"2025-02-19","kind":"first-observed"}]},"advisories":[],"risk":0.40324499999999996},"relatedVulnerabilities":[{"id":"CVE-2025-25290","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-25290","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/octokit/request.js/commit/34ff07ee86fc5c20865982d77391bc910ef19c68","https://github.com/octokit/request.js/commit/356411e3217019aa9fc8a68f4236af82490873c2","https://github.com/octokit/request.js/commit/6bb29ba92a52f7bf94469c3433707c682c17126c","https://github.com/octokit/request.js/releases/tag/v8.4.1","https://github.com/octokit/request.js/releases/tag/v9.2.1","https://github.com/octokit/request.js/security/advisories/GHSA-rmvr-2pp2-xj38"],"description":"@octokit/request sends parameterized requests to GitHub’s APIs with sensible defaults in browsers and Node. Starting in version 1.0.0 and prior to versions 9.2.1 and 8.4.1, the regular expression `/<([^>]+)>; rel=\"deprecation\"/` used to match the `link` header in HTTP responses is vulnerable to a ReDoS (Regular Expression Denial of Service) attack. This vulnerability arises due to the unbounded nature of the regex's matching behavior, which can lead to catastrophic backtracking when processing specially crafted input. An attacker could exploit this flaw by sending a malicious `link` header, resulting in excessive CPU usage and potentially causing the server to become unresponsive, impacting service availability. Versions 9.2.1 and 8.4.1 fix the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-25290","epss":0.00783,"percentile":0.56031,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-25290","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@octokit/request","version":"5.6.3"}},"found":{"vulnerabilityID":"GHSA-rmvr-2pp2-xj38","versionConstraint":">=1.0.0,<8.4.1 (semantic)"},"fix":{"suggestedVersion":"8.4.1"}}],"artifact":{"id":"pkg:npm/%40octokit/request@5.6.3?package-id=886f56f0b941dcc4","name":"@octokit/request","version":"5.6.3","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:\\@octokit\\/request:\\@octokit\\/request:5.6.3:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40octokit/request@5.6.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-p8p7-x288-28g6","dataSource":"https://github.com/advisories/GHSA-p8p7-x288-28g6","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2023-28155","https://github.com/request/request/issues/3442","https://github.com/request/request/pull/3444","https://doyensec.com/resources/Doyensec_Advisory_RequestSSRF_Q12023.pdf","https://github.com/github/advisory-database/pull/2500","https://github.com/cypress-io/request/blob/master/lib/redirect.js#L116","https://github.com/request/request/blob/master/lib/redirect.js#L111","https://github.com/cypress-io/request/pull/28","https://github.com/cypress-io/request/commit/c5bcf21d40fb61feaff21a0e5a2b3934a440024f","https://github.com/cypress-io/request/releases/tag/v3.0.0","https://security.netapp.com/advisory/ntap-20230413-0007"],"description":"Server-Side Request Forgery in Request","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-28155","epss":0.00719,"percentile":0.53916,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2023-28155","cwe":"CWE-918","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.399045},"relatedVulnerabilities":[{"id":"CVE-2023-28155","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-28155","namespace":"nvd:cpe","severity":"Medium","urls":["https://doyensec.com/resources/Doyensec_Advisory_RequestSSRF_Q12023.pdf","https://github.com/request/request/issues/3442","https://github.com/request/request/pull/3444","https://security.netapp.com/advisory/ntap-20230413-0007/"],"description":"The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-28155","epss":0.00719,"percentile":0.53916,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2023-28155","cwe":"CWE-918","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"request","version":"2.83.0"}},"found":{"vulnerabilityID":"GHSA-p8p7-x288-28g6","versionConstraint":"<=2.88.2 (semantic)"}}],"artifact":{"id":"pkg:npm/request@2.83.0?package-id=9364326ebe589b24","name":"request","version":"2.83.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:request_project:request:2.83.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/request@2.83.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-r292-9mhp-454m","dataSource":"https://github.com/advisories/GHSA-r292-9mhp-454m","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-r292-9mhp-454m","https://github.com/isaacs/node-tar/commit/631ae59121bf8fc8a22bbae35f074cb9b789cd4a","https://github.com/isaacs/node-tar/releases/tag/v7.5.21","https://nvd.nist.gov/vuln/detail/CVE-2026-73566"],"description":"node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73566","epss":0.00531,"percentile":0.44907,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73566","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-73566","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.5.21"],"state":"fixed","available":[{"version":"7.5.21","date":"2026-07-24","kind":"first-observed"}]},"advisories":[],"risk":0.39825},"relatedVulnerabilities":[{"id":"CVE-2026-73566","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-73566","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/node-tar/commit/631ae59121bf8fc8a22bbae35f074cb9b789cd4a","https://github.com/isaacs/node-tar/security/advisories/GHSA-r292-9mhp-454m"],"description":"node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an archive entry path upward with path.dirname() and no segment cap when tar.t(...) or tar.x(...) receives a non-empty member-selection list. A crafted GNU L or PAX x long-path header with thousands of slash-separated segments reaches this.filter(entry.path, entry) in Parser[CONSUMEHEADER] in src/parse.ts before Unpack[CHECKPATH] applies maxDepth, causing an uncatchable RangeError stack overflow that terminates asynchronous and streaming Node.js consumers. This issue is fixed in version 7.5.21.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73566","epss":0.00531,"percentile":0.44907,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73566","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-73566","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"6.1.11"}},"found":{"vulnerabilityID":"GHSA-r292-9mhp-454m","versionConstraint":"<=7.5.20 (semantic)"},"fix":{"suggestedVersion":"7.5.21"}}],"artifact":{"id":"pkg:npm/tar@6.1.11?package-id=3853c86fbd5d8342","name":"tar","version":"6.1.11","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:tar_project:tar:6.1.11:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:6.1.11:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:6.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@6.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-23c5-xmqv-rm74","dataSource":"https://github.com/advisories/GHSA-23c5-xmqv-rm74","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74","https://nvd.nist.gov/vuln/detail/CVE-2026-27904","https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce"],"description":"minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27904","epss":0.00525,"percentile":0.4453,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27904","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.1.4"],"state":"fixed","available":[{"version":"3.1.4","date":"2026-02-27","kind":"first-observed"}]},"advisories":[],"risk":0.39375},"relatedVulnerabilities":[{"id":"CVE-2026-27904","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27904","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default `minimatch()` API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects `+()` extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27904","epss":0.00525,"percentile":0.4453,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27904","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-23c5-xmqv-rm74","versionConstraint":"<3.1.4 (semantic)"},"fix":{"suggestedVersion":"3.1.4"}}],"artifact":{"id":"pkg:npm/minimatch@3.1.2?package-id=7a05a1c46734c75f","name":"minimatch","version":"3.1.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-23c5-xmqv-rm74","dataSource":"https://github.com/advisories/GHSA-23c5-xmqv-rm74","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74","https://nvd.nist.gov/vuln/detail/CVE-2026-27904","https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce"],"description":"minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27904","epss":0.00525,"percentile":0.4453,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27904","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["5.1.8"],"state":"fixed","available":[{"version":"5.1.8","date":"2026-02-27","kind":"first-observed"}]},"advisories":[],"risk":0.39375},"relatedVulnerabilities":[{"id":"CVE-2026-27904","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27904","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default `minimatch()` API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects `+()` extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27904","epss":0.00525,"percentile":0.4453,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27904","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"5.1.0"}},"found":{"vulnerabilityID":"GHSA-23c5-xmqv-rm74","versionConstraint":">=5.0.0,<5.1.8 (semantic)"},"fix":{"suggestedVersion":"5.1.8"}}],"artifact":{"id":"pkg:npm/minimatch@5.1.0?package-id=2a8799ea853a469d","name":"minimatch","version":"5.1.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:5.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@5.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-38c4-r59v-3vqw","dataSource":"https://github.com/advisories/GHSA-38c4-r59v-3vqw","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-2327","https://github.com/markdown-it/markdown-it/commit/4b4bbcae5e0990a5b172378e507b33a59012ed26","https://gist.github.com/ltduc147/c9abecae1b291ede4f692f2ab988c917","https://security.snyk.io/vuln/SNYK-JS-MARKDOWNIT-10666750","https://github.com/markdown-it/markdown-it/blob/14.1.0/lib/rules_inline/linkify.mjs#L33"],"description":"markdown-it is has a Regular Expression Denial of Service (ReDoS)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":5.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-2327","epss":0.00739,"percentile":0.54576,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-2327","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"}],"fix":{"versions":["14.1.1"],"state":"fixed","available":[{"version":"14.1.1","date":"2026-03-04","kind":"first-observed"}]},"advisories":[],"risk":0.38428},"relatedVulnerabilities":[{"id":"CVE-2026-2327","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2327","namespace":"nvd:cpe","severity":"High","urls":["https://gist.github.com/ltduc147/c9abecae1b291ede4f692f2ab988c917","https://github.com/markdown-it/markdown-it/blob/14.1.0/lib/rules_inline/linkify.mjs%23L33","https://github.com/markdown-it/markdown-it/commit/4b4bbcae5e0990a5b172378e507b33a59012ed26","https://security.snyk.io/vuln/SNYK-JS-MARKDOWNIT-10666750"],"description":"Versions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of the regex /\\*+$/ in the linkify function. An attacker can supply a long sequence of * characters followed by a non-matching character, which triggers excessive backtracking and may lead to a denial-of-service condition.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.5},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-2327","epss":0.00739,"percentile":0.54576,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-2327","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"markdown-it","version":"13.0.1"}},"found":{"vulnerabilityID":"GHSA-38c4-r59v-3vqw","versionConstraint":">=13.0.0,<14.1.1 (semantic)"},"fix":{"suggestedVersion":"14.1.1"}}],"artifact":{"id":"pkg:npm/markdown-it@13.0.1?package-id=59ad530bbde4b9d0","name":"markdown-it","version":"13.0.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:markdown-it_project:markdown-it:13.0.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/markdown-it@13.0.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-qhr7-859c-m2p7","dataSource":"https://github.com/advisories/GHSA-qhr7-859c-m2p7","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7","https://nvd.nist.gov/vuln/detail/CVE-2026-102278","https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db"],"description":"brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102278","epss":0.00491,"percentile":0.42217,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102278","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102278","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.1.20"],"state":"fixed","available":[{"version":"1.1.20","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.36825},"relatedVulnerabilities":[{"id":"CVE-2026-102278","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102278","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102278","epss":0.00491,"percentile":0.42217,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102278","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102278","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.11"}},"found":{"vulnerabilityID":"GHSA-qhr7-859c-m2p7","versionConstraint":"<1.1.20 (semantic)"},"fix":{"suggestedVersion":"1.1.20"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.11?package-id=bb6331f39e7684a6","name":"brace-expansion","version":"1.1.11","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-qhr7-859c-m2p7","dataSource":"https://github.com/advisories/GHSA-qhr7-859c-m2p7","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7","https://nvd.nist.gov/vuln/detail/CVE-2026-102278","https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db"],"description":"brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102278","epss":0.00491,"percentile":0.42217,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102278","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102278","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.1.20"],"state":"fixed","available":[{"version":"1.1.20","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.36825},"relatedVulnerabilities":[{"id":"CVE-2026-102278","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102278","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102278","epss":0.00491,"percentile":0.42217,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102278","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102278","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.18"}},"found":{"vulnerabilityID":"GHSA-qhr7-859c-m2p7","versionConstraint":"<1.1.20 (semantic)"},"fix":{"suggestedVersion":"1.1.20"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.18?package-id=15a6fd05718afea9","name":"brace-expansion","version":"1.1.18","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.18:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.18","upstreams":[]}},{"vulnerability":{"id":"GHSA-qhr7-859c-m2p7","dataSource":"https://github.com/advisories/GHSA-qhr7-859c-m2p7","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7","https://nvd.nist.gov/vuln/detail/CVE-2026-102278","https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db"],"description":"brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102278","epss":0.00491,"percentile":0.42217,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102278","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102278","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.1.6"],"state":"fixed","available":[{"version":"2.1.6","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.36825},"relatedVulnerabilities":[{"id":"CVE-2026-102278","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102278","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102278","epss":0.00491,"percentile":0.42217,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102278","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102278","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"2.0.1"}},"found":{"vulnerabilityID":"GHSA-qhr7-859c-m2p7","versionConstraint":">=2.0.0,<2.1.6 (semantic)"},"fix":{"suggestedVersion":"2.1.6"}}],"artifact":{"id":"pkg:npm/brace-expansion@2.0.1?package-id=569f54ca8e83a456","name":"brace-expansion","version":"2.0.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:2.0.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@2.0.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-qhr7-859c-m2p7","dataSource":"https://github.com/advisories/GHSA-qhr7-859c-m2p7","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7","https://nvd.nist.gov/vuln/detail/CVE-2026-102278","https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db"],"description":"brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102278","epss":0.00491,"percentile":0.42217,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102278","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102278","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.1.6"],"state":"fixed","available":[{"version":"2.1.6","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.36825},"relatedVulnerabilities":[{"id":"CVE-2026-102278","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102278","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102278","epss":0.00491,"percentile":0.42217,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102278","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102278","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"2.1.4"}},"found":{"vulnerabilityID":"GHSA-qhr7-859c-m2p7","versionConstraint":">=2.0.0,<2.1.6 (semantic)"},"fix":{"suggestedVersion":"2.1.6"}}],"artifact":{"id":"pkg:npm/brace-expansion@2.1.4?package-id=7ae261f9c7255d9e","name":"brace-expansion","version":"2.1.4","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:2.1.4:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@2.1.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-qffp-2rhf-9h96","dataSource":"https://github.com/advisories/GHSA-qffp-2rhf-9h96","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96","https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f","https://nvd.nist.gov/vuln/detail/CVE-2026-29786"],"description":"tar has Hardlink Path Traversal via Drive-Relative Linkpath","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-29786","epss":0.00466,"percentile":0.40354,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-29786","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-29786","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-29786","cwe":"CWE-22","source":"nvd@nist.gov","type":"Secondary"},{"cve":"CVE-2026-29786","cwe":"CWE-22","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["7.5.10"],"state":"fixed","available":[{"version":"7.5.10","date":"2026-03-05","kind":"first-observed"}]},"advisories":[],"risk":0.36580999999999997},"relatedVulnerabilities":[{"id":"CVE-2026-29786","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-29786","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f","https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96","https://access.redhat.com/security/cve/CVE-2026-29786","https://bugzilla.redhat.com/show_bug.cgi?id=2445476","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-29786.json"],"description":"node-tar is a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a hardlink that points outside the extraction directory by using a drive-relative link target such as C:../target.txt, which enables file overwrite outside cwd during normal tar.x() extraction. This issue has been patched in version 7.5.10.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.3,"exploitabilityScore":1.9,"impactScore":4},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":8.6,"exploitabilityScore":3.9,"impactScore":4},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-29786","epss":0.00466,"percentile":0.40354,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-29786","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-29786","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-29786","cwe":"CWE-22","source":"nvd@nist.gov","type":"Secondary"},{"cve":"CVE-2026-29786","cwe":"CWE-22","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"6.1.11"}},"found":{"vulnerabilityID":"GHSA-qffp-2rhf-9h96","versionConstraint":"<=7.5.9 (semantic)"},"fix":{"suggestedVersion":"7.5.10"}}],"artifact":{"id":"pkg:npm/tar@6.1.11?package-id=3853c86fbd5d8342","name":"tar","version":"6.1.11","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:tar_project:tar:6.1.11:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:6.1.11:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:6.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@6.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-v245-v573-v5vm","dataSource":"https://github.com/advisories/GHSA-v245-v573-v5vm","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/markdown-it/linkify-it/security/advisories/GHSA-v245-v573-v5vm","https://nvd.nist.gov/vuln/detail/CVE-2026-59887","https://github.com/markdown-it/linkify-it/commit/105e5d77f7d119871d2b2d86ed208568eb3e7ffe","https://github.com/markdown-it/linkify-it/releases/tag/5.0.2"],"description":"linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59887","epss":0.00467,"percentile":0.40435,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59887","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["5.0.2"],"state":"fixed","available":[{"version":"5.0.2","date":"2026-07-22","kind":"first-observed"}]},"advisories":[],"risk":0.35024999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-59887","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59887","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/markdown-it/linkify-it/commit/105e5d77f7d119871d2b2d86ed208568eb3e7ffe","https://github.com/markdown-it/linkify-it/releases/tag/5.0.2","https://github.com/markdown-it/linkify-it/security/advisories/GHSA-v245-v573-v5vm"],"description":"linkify-it is a links recognition library with full Unicode support. Prior to 5.0.2, the mailto: schema validator used by .test() and .match() can be invoked at every mailto: occurrence and scan the remaining input through src_email_name in lib/re.mjs, causing O(n^2) CPU consumption on crafted user text. This issue is fixed in version 5.0.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59887","epss":0.00467,"percentile":0.40435,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59887","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"linkify-it","version":"4.0.1"}},"found":{"vulnerabilityID":"GHSA-v245-v573-v5vm","versionConstraint":"<=5.0.1 (semantic)"},"fix":{"suggestedVersion":"5.0.2"}}],"artifact":{"id":"pkg:npm/linkify-it@4.0.1?package-id=5a4bf8b0f98f9465","name":"linkify-it","version":"4.0.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:linkify-it:linkify-it:4.0.1:*:*:*:*:*:*:*","cpe:2.3:a:linkify-it:linkify_it:4.0.1:*:*:*:*:*:*:*","cpe:2.3:a:linkify_it:linkify-it:4.0.1:*:*:*:*:*:*:*","cpe:2.3:a:linkify_it:linkify_it:4.0.1:*:*:*:*:*:*:*","cpe:2.3:a:linkify:linkify-it:4.0.1:*:*:*:*:*:*:*","cpe:2.3:a:linkify:linkify_it:4.0.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/linkify-it@4.0.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-6j4f-fj2g-mc7p","dataSource":"https://github.com/advisories/GHSA-6j4f-fj2g-mc7p","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"],"description":"brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102276","epss":0.00455,"percentile":0.3952,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102276","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102276","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.1.19"],"state":"fixed","available":[{"version":"1.1.19","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.34125},"relatedVulnerabilities":[{"id":"CVE-2026-102276","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102276","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102276","epss":0.00455,"percentile":0.3952,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102276","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102276","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.11"}},"found":{"vulnerabilityID":"GHSA-6j4f-fj2g-mc7p","versionConstraint":"<1.1.19 (semantic)"},"fix":{"suggestedVersion":"1.1.19"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.11?package-id=bb6331f39e7684a6","name":"brace-expansion","version":"1.1.11","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-6j4f-fj2g-mc7p","dataSource":"https://github.com/advisories/GHSA-6j4f-fj2g-mc7p","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"],"description":"brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102276","epss":0.00455,"percentile":0.3952,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102276","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102276","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.1.19"],"state":"fixed","available":[{"version":"1.1.19","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.34125},"relatedVulnerabilities":[{"id":"CVE-2026-102276","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102276","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102276","epss":0.00455,"percentile":0.3952,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102276","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102276","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.18"}},"found":{"vulnerabilityID":"GHSA-6j4f-fj2g-mc7p","versionConstraint":"<1.1.19 (semantic)"},"fix":{"suggestedVersion":"1.1.19"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.18?package-id=15a6fd05718afea9","name":"brace-expansion","version":"1.1.18","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.18:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.18","upstreams":[]}},{"vulnerability":{"id":"GHSA-6j4f-fj2g-mc7p","dataSource":"https://github.com/advisories/GHSA-6j4f-fj2g-mc7p","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"],"description":"brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102276","epss":0.00455,"percentile":0.3952,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102276","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102276","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.1.5"],"state":"fixed","available":[{"version":"2.1.5","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.34125},"relatedVulnerabilities":[{"id":"CVE-2026-102276","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102276","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102276","epss":0.00455,"percentile":0.3952,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102276","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102276","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"2.0.1"}},"found":{"vulnerabilityID":"GHSA-6j4f-fj2g-mc7p","versionConstraint":">=2.0.0,<2.1.5 (semantic)"},"fix":{"suggestedVersion":"2.1.5"}}],"artifact":{"id":"pkg:npm/brace-expansion@2.0.1?package-id=569f54ca8e83a456","name":"brace-expansion","version":"2.0.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:2.0.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@2.0.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-6j4f-fj2g-mc7p","dataSource":"https://github.com/advisories/GHSA-6j4f-fj2g-mc7p","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"],"description":"brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102276","epss":0.00455,"percentile":0.3952,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102276","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102276","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.1.5"],"state":"fixed","available":[{"version":"2.1.5","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.34125},"relatedVulnerabilities":[{"id":"CVE-2026-102276","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102276","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102276","epss":0.00455,"percentile":0.3952,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102276","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102276","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"2.1.4"}},"found":{"vulnerabilityID":"GHSA-6j4f-fj2g-mc7p","versionConstraint":">=2.0.0,<2.1.5 (semantic)"},"fix":{"suggestedVersion":"2.1.5"}}],"artifact":{"id":"pkg:npm/brace-expansion@2.1.4?package-id=7ae261f9c7255d9e","name":"brace-expansion","version":"2.1.4","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:2.1.4:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@2.1.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-8x88-c5mf-7j5w","dataSource":"https://github.com/advisories/GHSA-8x88-c5mf-7j5w","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w","https://nvd.nist.gov/vuln/detail/CVE-2026-59874","https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5","https://github.com/isaacs/node-tar/releases/tag/v7.5.18"],"description":"node-tar: Negative tar entry size causes infinite loop in archive replace","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59874","epss":0.00434,"percentile":0.37694,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59874","cwe":"CWE-835","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.5.18"],"state":"fixed","available":[{"version":"7.5.18","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.33852},"relatedVulnerabilities":[{"id":"CVE-2026-59874","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59874","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5","https://github.com/isaacs/node-tar/releases/tag/v7.5.18","https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w"],"description":"node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59874","epss":0.00434,"percentile":0.37694,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59874","cwe":"CWE-835","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"6.1.11"}},"found":{"vulnerabilityID":"GHSA-8x88-c5mf-7j5w","versionConstraint":"<=7.5.17 (semantic)"},"fix":{"suggestedVersion":"7.5.18"}}],"artifact":{"id":"pkg:npm/tar@6.1.11?package-id=3853c86fbd5d8342","name":"tar","version":"6.1.11","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:tar_project:tar:6.1.11:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:6.1.11:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:6.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@6.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-pqg4-j6r4-53mv","dataSource":"https://github.com/advisories/GHSA-pqg4-j6r4-53mv","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/ljharb/shell-quote/security/advisories/GHSA-pqg4-j6r4-53mv","https://nvd.nist.gov/vuln/detail/CVE-2026-102422","https://github.com/ljharb/shell-quote/commit/6002b2ed90c6b83095eb272b6b0adaf3a172b0bc"],"description":"shell-quote: `quote()` command injection via a line terminator in a token after a `{ comment }` token","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":9.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102422","epss":0.00378,"percentile":0.31768,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102422","cwe":"CWE-78","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}],"fix":{"versions":["1.11.0"],"state":"fixed","available":[{"version":"1.11.0","date":"2026-10-06","kind":"first-observed"}]},"advisories":[],"risk":0.33358499999999996},"relatedVulnerabilities":[{"id":"CVE-2026-102422","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102422","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/ljharb/shell-quote","https://github.com/ljharb/shell-quote/commit/6002b2ed90c6b83095eb272b6b0adaf3a172b0bc","https://github.com/ljharb/shell-quote/security/advisories/GHSA-pqg4-j6r4-53mv","https://www.npmjs.com/package/shell-quote"],"description":"shell-quote's `quote()` function emits a `{ comment }` token as `#` followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator (\\n, \\r, U+2028, U+2029) in that later string therefore ends the comment, and the rest of the string is parsed as shell input: `quote(['echo', 'ok', { comment: 'x' }, 'a\\nid;#'])` runs `id` in sh, bash, dash, ksh and zsh. `parse()` emits a comment token for a `#` in the middle of a word (for example `http://example.com/#frag`), so callers that combine `parse()` output with another untrusted string, such as `quote(parse(untrustedCommand).concat(untrustedArg))`, are affected. The fix for CVE-2026-9277 rejected line terminators in the comment's own text, but not in the tokens after it. Fixed in 1.11.0: `quote()` throws a `TypeError` when a string after a `{ comment }` token contains a line terminator.","cvss":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102422","epss":0.00378,"percentile":0.31768,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102422","cwe":"CWE-78","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"shell-quote","version":"1.10.0"}},"found":{"vulnerabilityID":"GHSA-pqg4-j6r4-53mv","versionConstraint":">=1.8.4,<1.11.0 (semantic)"},"fix":{"suggestedVersion":"1.11.0"}}],"artifact":{"id":"pkg:npm/shell-quote@1.10.0?package-id=0fbbbf55207e724d","name":"shell-quote","version":"1.10.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:shell-quote_project:shell-quote:1.10.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/shell-quote@1.10.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-w8wr-v893-vjvp","dataSource":"https://github.com/advisories/GHSA-w8wr-v893-vjvp","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-w8wr-v893-vjvp","https://nvd.nist.gov/vuln/detail/CVE-2026-59871","https://github.com/isaacs/node-tar/commit/e02a4e9e013c4be95302e2eb2047a942b883c27b","https://github.com/isaacs/node-tar/releases/tag/v7.5.18"],"description":"node-tar: Process crash via PAX numeric path type confusion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59871","epss":0.00644,"percentile":0.50876,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59871","cwe":"CWE-704","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.5.18"],"state":"fixed","available":[{"version":"7.5.18","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.33166},"relatedVulnerabilities":[{"id":"CVE-2026-59871","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59871","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/node-tar/commit/e02a4e9e013c4be95302e2eb2047a942b883c27b","https://github.com/isaacs/node-tar/releases/tag/v7.5.18","https://github.com/isaacs/node-tar/security/advisories/GHSA-w8wr-v893-vjvp"],"description":"node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as normalizeWindowsPath(entry.path).split('/') to throw an uncaught TypeError. This issue is fixed in version 7.5.18.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59871","epss":0.00644,"percentile":0.50876,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59871","cwe":"CWE-704","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"6.1.11"}},"found":{"vulnerabilityID":"GHSA-w8wr-v893-vjvp","versionConstraint":"<=7.5.17 (semantic)"},"fix":{"suggestedVersion":"7.5.18"}}],"artifact":{"id":"pkg:npm/tar@6.1.11?package-id=3853c86fbd5d8342","name":"tar","version":"6.1.11","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:tar_project:tar:6.1.11:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:6.1.11:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:6.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@6.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-h5c3-5r3r-rr8q","dataSource":"https://github.com/advisories/GHSA-h5c3-5r3r-rr8q","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/octokit/plugin-paginate-rest.js/security/advisories/GHSA-h5c3-5r3r-rr8q","https://github.com/octokit/plugin-paginate-rest.js/commit/bb6c4f945d8023902cf387391d2b2209261044ab","https://nvd.nist.gov/vuln/detail/CVE-2025-25288","https://github.com/octokit/plugin-paginate-rest.js/blob/main/src/iterator.ts","https://github.com/octokit/plugin-paginate-rest.js/releases/tag/v9.2.2"],"description":"@octokit/plugin-paginate-rest has a Regular Expression in iterator Leads to ReDoS Vulnerability Due to Catastrophic Backtracking","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-25288","epss":0.00628,"percentile":0.5009,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-25288","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["9.2.2"],"state":"fixed","available":[{"version":"9.2.2","date":"2025-02-19","kind":"first-observed"}]},"advisories":[],"risk":0.32342},"relatedVulnerabilities":[{"id":"CVE-2025-25288","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-25288","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/octokit/plugin-paginate-rest.js/blob/main/src/iterator.ts","https://github.com/octokit/plugin-paginate-rest.js/commit/bb6c4f945d8023902cf387391d2b2209261044ab","https://github.com/octokit/plugin-paginate-rest.js/security/advisories/GHSA-h5c3-5r3r-rr8q"],"description":"@octokit/plugin-paginate-rest is the Octokit plugin to paginate REST API endpoint responses. For versions starting in 1.0.0 and prior to 11.4.1 of the npm package `@octokit/plugin-paginate-rest`, when calling `octokit.paginate.iterator()`, a specially crafted `octokit` instance—particularly with a malicious `link` parameter in the `headers` section of the `request`—can trigger a ReDoS attack. Version 11.4.1 contains a fix for the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-25288","epss":0.00628,"percentile":0.5009,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-25288","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@octokit/plugin-paginate-rest","version":"2.17.0"}},"found":{"vulnerabilityID":"GHSA-h5c3-5r3r-rr8q","versionConstraint":">=1.0.0,<9.2.2 (semantic)"},"fix":{"suggestedVersion":"9.2.2"}}],"artifact":{"id":"pkg:npm/%40octokit/plugin-paginate-rest@2.17.0?package-id=5002016b85521d00","name":"@octokit/plugin-paginate-rest","version":"2.17.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:\\@octokit\\/plugin-paginate-rest:\\@octokit\\/plugin-paginate-rest:2.17.0:*:*:*:*:*:*:*","cpe:2.3:a:\\@octokit\\/plugin-paginate-rest:\\@octokit\\/plugin_paginate_rest:2.17.0:*:*:*:*:*:*:*","cpe:2.3:a:\\@octokit\\/plugin_paginate_rest:\\@octokit\\/plugin-paginate-rest:2.17.0:*:*:*:*:*:*:*","cpe:2.3:a:\\@octokit\\/plugin_paginate_rest:\\@octokit\\/plugin_paginate_rest:2.17.0:*:*:*:*:*:*:*","cpe:2.3:a:\\@octokit\\/plugin-paginate:\\@octokit\\/plugin-paginate-rest:2.17.0:*:*:*:*:*:*:*","cpe:2.3:a:\\@octokit\\/plugin-paginate:\\@octokit\\/plugin_paginate_rest:2.17.0:*:*:*:*:*:*:*","cpe:2.3:a:\\@octokit\\/plugin_paginate:\\@octokit\\/plugin-paginate-rest:2.17.0:*:*:*:*:*:*:*","cpe:2.3:a:\\@octokit\\/plugin_paginate:\\@octokit\\/plugin_paginate_rest:2.17.0:*:*:*:*:*:*:*","cpe:2.3:a:\\@octokit\\/plugin:\\@octokit\\/plugin-paginate-rest:2.17.0:*:*:*:*:*:*:*","cpe:2.3:a:\\@octokit\\/plugin:\\@octokit\\/plugin_paginate_rest:2.17.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40octokit/plugin-paginate-rest@2.17.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-xx4v-prfh-6cgc","dataSource":"https://github.com/advisories/GHSA-xx4v-prfh-6cgc","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/octokit/request-error.js/security/advisories/GHSA-xx4v-prfh-6cgc","https://github.com/octokit/request-error.js/commit/d558320874a4bc8d356babf1079e6f0056a59b9e","https://nvd.nist.gov/vuln/detail/CVE-2025-25289","https://github.com/octokit/request-error.js/blob/main/src/index.ts"],"description":"@octokit/request-error has a Regular Expression in index that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-25289","epss":0.00628,"percentile":0.5009,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-25289","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["5.1.1"],"state":"fixed","available":[{"version":"5.1.1","date":"2025-02-15","kind":"first-observed"}]},"advisories":[],"risk":0.32342},"relatedVulnerabilities":[{"id":"CVE-2025-25289","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-25289","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/octokit/request-error.js/blob/main/src/index.ts","https://github.com/octokit/request-error.js/commit/d558320874a4bc8d356babf1079e6f0056a59b9e","https://github.com/octokit/request-error.js/security/advisories/GHSA-xx4v-prfh-6cgc"],"description":"@octokit/request-error is an error class for Octokit request errors. Starting in version 1.0.0 and prior to version 6.1.7, a Regular Expression Denial of Service (ReDoS) vulnerability exists in the processing of HTTP request headers. By sending an authorization header containing an excessively long sequence of spaces followed by a newline and \"@\", an attacker can exploit inefficient regular expression processing, leading to excessive resource consumption. This can significantly degrade server performance or cause a denial-of-service (DoS) condition, impacting availability. Version 6.1.7 contains a fix for the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-25289","epss":0.00628,"percentile":0.5009,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-25289","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@octokit/request-error","version":"2.1.0"}},"found":{"vulnerabilityID":"GHSA-xx4v-prfh-6cgc","versionConstraint":">=1.0.0,<5.1.1 (semantic)"},"fix":{"suggestedVersion":"5.1.1"}}],"artifact":{"id":"pkg:npm/%40octokit/request-error@2.1.0?package-id=3dec07dab5da3c8f","name":"@octokit/request-error","version":"2.1.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:\\@octokit\\/request-error:\\@octokit\\/request-error:2.1.0:*:*:*:*:*:*:*","cpe:2.3:a:\\@octokit\\/request-error:\\@octokit\\/request_error:2.1.0:*:*:*:*:*:*:*","cpe:2.3:a:\\@octokit\\/request_error:\\@octokit\\/request-error:2.1.0:*:*:*:*:*:*:*","cpe:2.3:a:\\@octokit\\/request_error:\\@octokit\\/request_error:2.1.0:*:*:*:*:*:*:*","cpe:2.3:a:\\@octokit\\/request:\\@octokit\\/request-error:2.1.0:*:*:*:*:*:*:*","cpe:2.3:a:\\@octokit\\/request:\\@octokit\\/request_error:2.1.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40octokit/request-error@2.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-22p9-wv53-3rq4","dataSource":"https://github.com/advisories/GHSA-22p9-wv53-3rq4","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/markdown-it/linkify-it/security/advisories/GHSA-22p9-wv53-3rq4"],"description":"LinkifyIt#match scan loop has quadratic algorithmic complexity","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-48801","epss":0.00394,"percentile":0.33576,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-48801","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["5.0.1"],"state":"fixed","available":[{"version":"5.0.1","date":"2026-06-27","kind":"first-observed"}]},"advisories":[],"risk":0.31914},"relatedVulnerabilities":[{"id":"CVE-2026-48801","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48801","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/markdown-it/linkify-it/commit/6be6d15e0641bf1daeaa977d500cabc743166159","https://github.com/markdown-it/linkify-it/security/advisories/GHSA-22p9-wv53-3rq4"],"description":"linkify-it is a links recognition library with full Unicode support. Prior to 5.0.1, LinkifyIt.prototype.match, the package's primary public API, has O(N²) algorithmic complexity for inputs containing many fuzzy links or emails because the JavaScript-level scan loop re-slices input and re-runs unanchored regex searches on progressively shorter tails. Any service that synchronously renders untrusted Markdown with linkify:true on a request hot path can inherit a worker-process denial of service triggerable by a tens-of-KB request body. This issue is fixed in version 5.0.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-48801","epss":0.00394,"percentile":0.33576,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-48801","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"linkify-it","version":"4.0.1"}},"found":{"vulnerabilityID":"GHSA-22p9-wv53-3rq4","versionConstraint":"<=5.0.0 (semantic)"},"fix":{"suggestedVersion":"5.0.1"}}],"artifact":{"id":"pkg:npm/linkify-it@4.0.1?package-id=5a4bf8b0f98f9465","name":"linkify-it","version":"4.0.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:linkify-it:linkify-it:4.0.1:*:*:*:*:*:*:*","cpe:2.3:a:linkify-it:linkify_it:4.0.1:*:*:*:*:*:*:*","cpe:2.3:a:linkify_it:linkify-it:4.0.1:*:*:*:*:*:*:*","cpe:2.3:a:linkify_it:linkify_it:4.0.1:*:*:*:*:*:*:*","cpe:2.3:a:linkify:linkify-it:4.0.1:*:*:*:*:*:*:*","cpe:2.3:a:linkify:linkify_it:4.0.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/linkify-it@4.0.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-8qq5-rm4j-mr97","dataSource":"https://github.com/advisories/GHSA-8qq5-rm4j-mr97","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-8qq5-rm4j-mr97","https://github.com/isaacs/node-tar/commit/340eb285b6d986e91969a1170d7fe9b0face405e","https://nvd.nist.gov/vuln/detail/CVE-2026-23745"],"description":"node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-23745","epss":0.00376,"percentile":0.31592,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-23745","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-23745","cwe":"CWE-22","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["7.5.3"],"state":"fixed","available":[{"version":"7.5.3","date":"2026-01-17","kind":"first-observed"}]},"advisories":[],"risk":0.29516},"relatedVulnerabilities":[{"id":"CVE-2026-23745","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-23745","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-tar/commit/340eb285b6d986e91969a1170d7fe9b0face405e","https://github.com/isaacs/node-tar/security/advisories/GHSA-8qq5-rm4j-mr97","https://access.redhat.com/errata/RHSA-2026:18480","https://access.redhat.com/errata/RHSA-2026:18868","https://access.redhat.com/errata/RHSA-2026:19712","https://access.redhat.com/errata/RHSA-2026:2144","https://access.redhat.com/errata/RHSA-2026:2900","https://access.redhat.com/errata/RHSA-2026:2926","https://access.redhat.com/errata/RHSA-2026:3782","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:6192","https://access.redhat.com/security/cve/CVE-2026-23745","https://bugzilla.redhat.com/show_bug.cgi?id=2430538","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23745.json"],"description":"node-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default secure behavior). This allows malicious archives to bypass the extraction root restriction, leading to Arbitrary File Overwrite via hardlinks and Symlink Poisoning via absolute symlink targets. This vulnerability is fixed in 7.5.3.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":1.9,"impactScore":4.3},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.2,"exploitabilityScore":1.5,"impactScore":6.1},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-23745","epss":0.00376,"percentile":0.31592,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-23745","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-23745","cwe":"CWE-22","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"6.1.11"}},"found":{"vulnerabilityID":"GHSA-8qq5-rm4j-mr97","versionConstraint":"<=7.5.2 (semantic)"},"fix":{"suggestedVersion":"7.5.3"}}],"artifact":{"id":"pkg:npm/tar@6.1.11?package-id=3853c86fbd5d8342","name":"tar","version":"6.1.11","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:tar_project:tar:6.1.11:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:6.1.11:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:6.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@6.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-2g4f-4pwh-qvx6","dataSource":"https://github.com/advisories/GHSA-2g4f-4pwh-qvx6","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-69873","https://github.com/EthanKim88/ethan-cve-disclosures/blob/main/CVE-2025-69873-ajv-ReDoS.md","https://github.com/ajv-validator/ajv/pull/2586","https://github.com/ajv-validator/ajv/commit/720a23fa453ffae8340e92c9b0fe886c54cfe0d5","https://github.com/ajv-validator/ajv/releases/tag/v8.18.0","https://github.com/ajv-validator/ajv/pull/2588","https://github.com/ajv-validator/ajv/releases/tag/v6.14.0","https://github.com/ajv-validator/ajv/pull/2590","https://github.com/github/advisory-database/pull/6991"],"description":"ajv has ReDoS when using `$data` option","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":5.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-69873","epss":0.00547,"percentile":0.45847,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-69873","cwe":"CWE-1333","source":"cve@mitre.org","type":"Secondary"},{"cve":"CVE-2025-69873","cwe":"CWE-400","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"cve":"CVE-2025-69873","cwe":"CWE-1333","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["6.14.0"],"state":"fixed","available":[{"version":"6.14.0","date":"2026-03-04","kind":"first-observed"}]},"advisories":[],"risk":0.287175},"relatedVulnerabilities":[{"id":"CVE-2025-69873","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69873","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/EthanKim88/ethan-cve-disclosures/blob/main/CVE-2025-69873-ajv-ReDoS.md","https://github.com/advisories/GHSA-2g4f-4pwh-qvx6","https://github.com/ajv-validator/ajv/pull/2588","https://github.com/ajv-validator/ajv/pull/2590","https://github.com/ajv-validator/ajv/releases/tag/v6.14.0","https://github.com/github/advisory-database/pull/6991","https://access.redhat.com/errata/RHSA-2026:10093","https://access.redhat.com/errata/RHSA-2026:13512","https://access.redhat.com/errata/RHSA-2026:14774","https://access.redhat.com/errata/RHSA-2026:15091","https://access.redhat.com/errata/RHSA-2026:16874","https://access.redhat.com/errata/RHSA-2026:19712","https://access.redhat.com/errata/RHSA-2026:26211","https://access.redhat.com/errata/RHSA-2026:26214","https://access.redhat.com/errata/RHSA-2026:33371","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:40984","https://access.redhat.com/errata/RHSA-2026:41941","https://access.redhat.com/errata/RHSA-2026:41944","https://access.redhat.com/errata/RHSA-2026:5168","https://access.redhat.com/errata/RHSA-2026:5807","https://access.redhat.com/errata/RHSA-2026:5907","https://access.redhat.com/errata/RHSA-2026:5910","https://access.redhat.com/errata/RHSA-2026:6192","https://access.redhat.com/errata/RHSA-2026:6277","https://access.redhat.com/errata/RHSA-2026:6309","https://access.redhat.com/errata/RHSA-2026:6497","https://access.redhat.com/errata/RHSA-2026:6567","https://access.redhat.com/errata/RHSA-2026:6568","https://access.redhat.com/errata/RHSA-2026:6802","https://access.redhat.com/errata/RHSA-2026:7314","https://access.redhat.com/errata/RHSA-2026:9742","https://access.redhat.com/security/cve/CVE-2025-69873","https://bugzilla.redhat.com/show_bug.cgi?id=2439070","https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-69873.json"],"description":"ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., \"^(a|a)*$\") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation. This issue is also fixed in version 6.14.0.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"cve@mitre.org","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"exploitabilityScore":1.5,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-69873","epss":0.00547,"percentile":0.45847,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-69873","cwe":"CWE-1333","source":"cve@mitre.org","type":"Secondary"},{"cve":"CVE-2025-69873","cwe":"CWE-400","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"cve":"CVE-2025-69873","cwe":"CWE-1333","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"ajv","version":"5.5.2"}},"found":{"vulnerabilityID":"GHSA-2g4f-4pwh-qvx6","versionConstraint":"<6.14.0 (semantic)"},"fix":{"suggestedVersion":"6.14.0"}}],"artifact":{"id":"pkg:npm/ajv@5.5.2?package-id=859f099e55e379f3","name":"ajv","version":"5.5.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:ajv:ajv:5.5.2:*:*:*:*:*:*:*"],"purl":"pkg:npm/ajv@5.5.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-2g4f-4pwh-qvx6","dataSource":"https://github.com/advisories/GHSA-2g4f-4pwh-qvx6","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-69873","https://github.com/EthanKim88/ethan-cve-disclosures/blob/main/CVE-2025-69873-ajv-ReDoS.md","https://github.com/ajv-validator/ajv/pull/2586","https://github.com/ajv-validator/ajv/commit/720a23fa453ffae8340e92c9b0fe886c54cfe0d5","https://github.com/ajv-validator/ajv/releases/tag/v8.18.0","https://github.com/ajv-validator/ajv/pull/2588","https://github.com/ajv-validator/ajv/releases/tag/v6.14.0","https://github.com/ajv-validator/ajv/pull/2590","https://github.com/github/advisory-database/pull/6991"],"description":"ajv has ReDoS when using `$data` option","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":5.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-69873","epss":0.00547,"percentile":0.45847,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-69873","cwe":"CWE-1333","source":"cve@mitre.org","type":"Secondary"},{"cve":"CVE-2025-69873","cwe":"CWE-400","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"cve":"CVE-2025-69873","cwe":"CWE-1333","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["6.14.0"],"state":"fixed","available":[{"version":"6.14.0","date":"2026-03-04","kind":"first-observed"}]},"advisories":[],"risk":0.287175},"relatedVulnerabilities":[{"id":"CVE-2025-69873","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69873","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/EthanKim88/ethan-cve-disclosures/blob/main/CVE-2025-69873-ajv-ReDoS.md","https://github.com/advisories/GHSA-2g4f-4pwh-qvx6","https://github.com/ajv-validator/ajv/pull/2588","https://github.com/ajv-validator/ajv/pull/2590","https://github.com/ajv-validator/ajv/releases/tag/v6.14.0","https://github.com/github/advisory-database/pull/6991","https://access.redhat.com/errata/RHSA-2026:10093","https://access.redhat.com/errata/RHSA-2026:13512","https://access.redhat.com/errata/RHSA-2026:14774","https://access.redhat.com/errata/RHSA-2026:15091","https://access.redhat.com/errata/RHSA-2026:16874","https://access.redhat.com/errata/RHSA-2026:19712","https://access.redhat.com/errata/RHSA-2026:26211","https://access.redhat.com/errata/RHSA-2026:26214","https://access.redhat.com/errata/RHSA-2026:33371","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:40984","https://access.redhat.com/errata/RHSA-2026:41941","https://access.redhat.com/errata/RHSA-2026:41944","https://access.redhat.com/errata/RHSA-2026:5168","https://access.redhat.com/errata/RHSA-2026:5807","https://access.redhat.com/errata/RHSA-2026:5907","https://access.redhat.com/errata/RHSA-2026:5910","https://access.redhat.com/errata/RHSA-2026:6192","https://access.redhat.com/errata/RHSA-2026:6277","https://access.redhat.com/errata/RHSA-2026:6309","https://access.redhat.com/errata/RHSA-2026:6497","https://access.redhat.com/errata/RHSA-2026:6567","https://access.redhat.com/errata/RHSA-2026:6568","https://access.redhat.com/errata/RHSA-2026:6802","https://access.redhat.com/errata/RHSA-2026:7314","https://access.redhat.com/errata/RHSA-2026:9742","https://access.redhat.com/security/cve/CVE-2025-69873","https://bugzilla.redhat.com/show_bug.cgi?id=2439070","https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-69873.json"],"description":"ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., \"^(a|a)*$\") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation. This issue is also fixed in version 6.14.0.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"cve@mitre.org","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"exploitabilityScore":1.5,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-69873","epss":0.00547,"percentile":0.45847,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-69873","cwe":"CWE-1333","source":"cve@mitre.org","type":"Secondary"},{"cve":"CVE-2025-69873","cwe":"CWE-400","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"cve":"CVE-2025-69873","cwe":"CWE-1333","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"ajv","version":"6.12.6"}},"found":{"vulnerabilityID":"GHSA-2g4f-4pwh-qvx6","versionConstraint":"<6.14.0 (semantic)"},"fix":{"suggestedVersion":"6.14.0"}}],"artifact":{"id":"pkg:npm/ajv@6.12.6?package-id=d100e5c840b24965","name":"ajv","version":"6.12.6","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:ajv:ajv:6.12.6:*:*:*:*:*:*:*"],"purl":"pkg:npm/ajv@6.12.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-2g4f-4pwh-qvx6","dataSource":"https://github.com/advisories/GHSA-2g4f-4pwh-qvx6","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-69873","https://github.com/EthanKim88/ethan-cve-disclosures/blob/main/CVE-2025-69873-ajv-ReDoS.md","https://github.com/ajv-validator/ajv/pull/2586","https://github.com/ajv-validator/ajv/commit/720a23fa453ffae8340e92c9b0fe886c54cfe0d5","https://github.com/ajv-validator/ajv/releases/tag/v8.18.0","https://github.com/ajv-validator/ajv/pull/2588","https://github.com/ajv-validator/ajv/releases/tag/v6.14.0","https://github.com/ajv-validator/ajv/pull/2590","https://github.com/github/advisory-database/pull/6991"],"description":"ajv has ReDoS when using `$data` option","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":5.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-69873","epss":0.00547,"percentile":0.45847,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-69873","cwe":"CWE-1333","source":"cve@mitre.org","type":"Secondary"},{"cve":"CVE-2025-69873","cwe":"CWE-400","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"cve":"CVE-2025-69873","cwe":"CWE-1333","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["8.18.0"],"state":"fixed","available":[{"version":"8.18.0","date":"2026-03-04","kind":"first-observed"}]},"advisories":[],"risk":0.287175},"relatedVulnerabilities":[{"id":"CVE-2025-69873","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69873","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/EthanKim88/ethan-cve-disclosures/blob/main/CVE-2025-69873-ajv-ReDoS.md","https://github.com/advisories/GHSA-2g4f-4pwh-qvx6","https://github.com/ajv-validator/ajv/pull/2588","https://github.com/ajv-validator/ajv/pull/2590","https://github.com/ajv-validator/ajv/releases/tag/v6.14.0","https://github.com/github/advisory-database/pull/6991","https://access.redhat.com/errata/RHSA-2026:10093","https://access.redhat.com/errata/RHSA-2026:13512","https://access.redhat.com/errata/RHSA-2026:14774","https://access.redhat.com/errata/RHSA-2026:15091","https://access.redhat.com/errata/RHSA-2026:16874","https://access.redhat.com/errata/RHSA-2026:19712","https://access.redhat.com/errata/RHSA-2026:26211","https://access.redhat.com/errata/RHSA-2026:26214","https://access.redhat.com/errata/RHSA-2026:33371","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:40984","https://access.redhat.com/errata/RHSA-2026:41941","https://access.redhat.com/errata/RHSA-2026:41944","https://access.redhat.com/errata/RHSA-2026:5168","https://access.redhat.com/errata/RHSA-2026:5807","https://access.redhat.com/errata/RHSA-2026:5907","https://access.redhat.com/errata/RHSA-2026:5910","https://access.redhat.com/errata/RHSA-2026:6192","https://access.redhat.com/errata/RHSA-2026:6277","https://access.redhat.com/errata/RHSA-2026:6309","https://access.redhat.com/errata/RHSA-2026:6497","https://access.redhat.com/errata/RHSA-2026:6567","https://access.redhat.com/errata/RHSA-2026:6568","https://access.redhat.com/errata/RHSA-2026:6802","https://access.redhat.com/errata/RHSA-2026:7314","https://access.redhat.com/errata/RHSA-2026:9742","https://access.redhat.com/security/cve/CVE-2025-69873","https://bugzilla.redhat.com/show_bug.cgi?id=2439070","https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-69873.json"],"description":"ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., \"^(a|a)*$\") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation. This issue is also fixed in version 6.14.0.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"cve@mitre.org","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"exploitabilityScore":1.5,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-69873","epss":0.00547,"percentile":0.45847,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-69873","cwe":"CWE-1333","source":"cve@mitre.org","type":"Secondary"},{"cve":"CVE-2025-69873","cwe":"CWE-400","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"cve":"CVE-2025-69873","cwe":"CWE-1333","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"ajv","version":"8.11.2"}},"found":{"vulnerabilityID":"GHSA-2g4f-4pwh-qvx6","versionConstraint":">=7.0.0-alpha.0,<8.18.0 (semantic)"},"fix":{"suggestedVersion":"8.18.0"}}],"artifact":{"id":"pkg:npm/ajv@8.11.2?package-id=18d2d21a0d1e33a3","name":"ajv","version":"8.11.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:ajv:ajv:8.11.2:*:*:*:*:*:*:*"],"purl":"pkg:npm/ajv@8.11.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-qj8w-gfj5-8c6v","dataSource":"https://github.com/advisories/GHSA-qj8w-gfj5-8c6v","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-qj8w-gfj5-8c6v","https://github.com/yahoo/serialize-javascript/commit/f147e90269b58bb6e539cfdf3d0e20d6ad14204b","https://github.com/yahoo/serialize-javascript/releases/tag/v7.0.5","https://nvd.nist.gov/vuln/detail/CVE-2026-34043","https://github.com/yahoo/serialize-javascript/releases/tag/v5.0.0"],"description":"Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34043","epss":0.00491,"percentile":0.42208,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-34043","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-34043","cwe":"CWE-834","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.0.5"],"state":"fixed","available":[{"version":"7.0.5","date":"2026-03-28","kind":"first-observed"}]},"advisories":[],"risk":0.267595},"relatedVulnerabilities":[{"id":"CVE-2026-34043","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34043","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/yahoo/serialize-javascript/commit/f147e90269b58bb6e539cfdf3d0e20d6ad14204b","https://github.com/yahoo/serialize-javascript/releases/tag/v7.0.5","https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-qj8w-gfj5-8c6v"],"description":"Serialize JavaScript to a superset of JSON that includes regular expressions and functions. Prior to version 7.0.5, there is a Denial of Service (DoS) vulnerability caused by CPU exhaustion. When serializing a specially crafted \"array-like\" object (an object that inherits from Array.prototype but has a very large length property), the process enters an intensive loop that consumes 100% CPU and hangs indefinitely. This issue has been patched in version 7.0.5.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34043","epss":0.00491,"percentile":0.42208,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-34043","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-34043","cwe":"CWE-834","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"serialize-javascript","version":"6.0.2"}},"found":{"vulnerabilityID":"GHSA-qj8w-gfj5-8c6v","versionConstraint":">=5.0.0,<7.0.5 (semantic)"},"fix":{"suggestedVersion":"7.0.5"}}],"artifact":{"id":"pkg:npm/serialize-javascript@6.0.2?package-id=16a1894b547e5cc6","name":"serialize-javascript","version":"6.0.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:verizon:serialize-javascript:6.0.2:*:*:*:*:node.js:*:*","cpe:2.3:a:yahoo:serialize_javascript:6.0.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/serialize-javascript@6.0.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-w4pp-8pjf-rmxw","dataSource":"https://github.com/advisories/GHSA-w4pp-8pjf-rmxw","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-9496","https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js%23L2C1-L13C2","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-16874025","https://security.snyk.io/vuln/SNYK-JS-PACOTE-8225084","https://github.com/npm/pacote/commit/627a7dc1a214d857472a13b48e42559c75288c9e","https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508","https://github.com/npm/pacote/releases/tag/v21.5.1","https://github.com/npm/pacote/releases/tag/v22.0.0"],"description":"pacote is vulnerable to Denial of Service (DoS) via the addGitSha function","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-9496","epss":0.00346,"percentile":0.28189,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-9496","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2026-9496","cwe":"CWE-400","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["21.5.1"],"state":"fixed","available":[{"version":"21.5.1","date":"2026-08-27","kind":"first-observed"}]},"advisories":[],"risk":0.26123},"relatedVulnerabilities":[{"id":"CVE-2026-9496","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9496","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js%23L2C1-L13C2","https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-16874025","https://security.snyk.io/vuln/SNYK-JS-PACOTE-8225084"],"description":"Versions of the package pacote from 11.2.7 and before 21.5.1 are vulnerable to Denial of Service (DoS) via the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value that triggers the function’s regex replacement and string-manipulation logic,  causing excessive CPU consumption and potentially stalling or crashing the process.","cvss":[{"source":"report@snyk.io","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-9496","epss":0.00346,"percentile":0.28189,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-9496","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2026-9496","cwe":"CWE-400","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"pacote","version":"13.6.2"}},"found":{"vulnerabilityID":"GHSA-w4pp-8pjf-rmxw","versionConstraint":">=11.2.7,<21.5.1 (semantic)"},"fix":{"suggestedVersion":"21.5.1"}}],"artifact":{"id":"pkg:npm/pacote@13.6.2?package-id=6cf7767725fe92c3","name":"pacote","version":"13.6.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:pacote:pacote:13.6.2:*:*:*:*:*:*:*"],"purl":"pkg:npm/pacote@13.6.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-f886-m6hf-6m8v","dataSource":"https://github.com/advisories/GHSA-f886-m6hf-6m8v","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v","https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113","https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184","https://github.com/juliangruber/brace-expansion/issues/98","https://github.com/juliangruber/brace-expansion/pull/95","https://github.com/juliangruber/brace-expansion/pull/96","https://github.com/juliangruber/brace-expansion/pull/97","https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5","https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2","https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a","https://nvd.nist.gov/vuln/detail/CVE-2026-33750"],"description":"brace-expansion: Zero-step sequence causes process hang and memory exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33750","epss":0.00447,"percentile":0.38908,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33750","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.1.13"],"state":"fixed","available":[{"version":"1.1.13","date":"2026-03-27","kind":"first-observed"}]},"advisories":[],"risk":0.25702499999999995},"relatedVulnerabilities":[{"id":"CVE-2026-33750","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33750","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113","https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184","https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5","https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2","https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a","https://github.com/juliangruber/brace-expansion/issues/98","https://github.com/juliangruber/brace-expansion/pull/95","https://github.com/juliangruber/brace-expansion/pull/96","https://github.com/juliangruber/brace-expansion/pull/97","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) causes the sequence generation loop to run indefinitely, making the process hang for seconds and allocate heaps of memory. Versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13 fix the issue. As a workaround, sanitize strings passed to `expand()` to ensure a step value of `0` is not used.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33750","epss":0.00447,"percentile":0.38908,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33750","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.11"}},"found":{"vulnerabilityID":"GHSA-f886-m6hf-6m8v","versionConstraint":"<1.1.13 (semantic)"},"fix":{"suggestedVersion":"1.1.13"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.11?package-id=bb6331f39e7684a6","name":"brace-expansion","version":"1.1.11","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-f886-m6hf-6m8v","dataSource":"https://github.com/advisories/GHSA-f886-m6hf-6m8v","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v","https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113","https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184","https://github.com/juliangruber/brace-expansion/issues/98","https://github.com/juliangruber/brace-expansion/pull/95","https://github.com/juliangruber/brace-expansion/pull/96","https://github.com/juliangruber/brace-expansion/pull/97","https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5","https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2","https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a","https://nvd.nist.gov/vuln/detail/CVE-2026-33750"],"description":"brace-expansion: Zero-step sequence causes process hang and memory exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33750","epss":0.00447,"percentile":0.38908,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33750","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.0.3"],"state":"fixed","available":[{"version":"2.0.3","date":"2026-03-27","kind":"first-observed"}]},"advisories":[],"risk":0.25702499999999995},"relatedVulnerabilities":[{"id":"CVE-2026-33750","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33750","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113","https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184","https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5","https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2","https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a","https://github.com/juliangruber/brace-expansion/issues/98","https://github.com/juliangruber/brace-expansion/pull/95","https://github.com/juliangruber/brace-expansion/pull/96","https://github.com/juliangruber/brace-expansion/pull/97","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) causes the sequence generation loop to run indefinitely, making the process hang for seconds and allocate heaps of memory. Versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13 fix the issue. As a workaround, sanitize strings passed to `expand()` to ensure a step value of `0` is not used.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33750","epss":0.00447,"percentile":0.38908,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33750","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"2.0.1"}},"found":{"vulnerabilityID":"GHSA-f886-m6hf-6m8v","versionConstraint":">=2.0.0,<2.0.3 (semantic)"},"fix":{"suggestedVersion":"2.0.3"}}],"artifact":{"id":"pkg:npm/brace-expansion@2.0.1?package-id=569f54ca8e83a456","name":"brace-expansion","version":"2.0.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:2.0.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@2.0.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-3jxr-9vmj-r5cp","dataSource":"https://github.com/advisories/GHSA-3jxr-9vmj-r5cp","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-3jxr-9vmj-r5cp","https://nvd.nist.gov/vuln/detail/CVE-2026-13149","https://github.com/juliangruber/brace-expansion/pull/122","https://github.com/juliangruber/brace-expansion/pull/123","https://github.com/juliangruber/brace-expansion/commit/835d6be91201122d9adffb0c0c8c094189ace265","https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754","https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95","https://github.com/juliangruber/brace-expansion/releases/tag/v1.1.16","https://github.com/juliangruber/brace-expansion/releases/tag/v2.1.2","https://github.com/juliangruber/brace-expansion/releases/tag/v5.0.7","https://www.npmjs.com/package/brace-expansion"],"description":"brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-13149","epss":0.00364,"percentile":0.30245,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-13149","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-13149","cwe":"CWE-407","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}],"fix":{"versions":["1.1.16"],"state":"fixed","available":[{"version":"1.1.16","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.25479999999999997},"relatedVulnerabilities":[{"id":"CVE-2026-13149","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13149","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754","https://www.npmjs.com/package/brace-expansion"],"description":"brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.","cvss":[{"source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-13149","epss":0.00364,"percentile":0.30245,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-13149","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-13149","cwe":"CWE-407","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.11"}},"found":{"vulnerabilityID":"GHSA-3jxr-9vmj-r5cp","versionConstraint":"<1.1.16 (semantic)"},"fix":{"suggestedVersion":"1.1.16"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.11?package-id=bb6331f39e7684a6","name":"brace-expansion","version":"1.1.11","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-3jxr-9vmj-r5cp","dataSource":"https://github.com/advisories/GHSA-3jxr-9vmj-r5cp","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-3jxr-9vmj-r5cp","https://nvd.nist.gov/vuln/detail/CVE-2026-13149","https://github.com/juliangruber/brace-expansion/pull/122","https://github.com/juliangruber/brace-expansion/pull/123","https://github.com/juliangruber/brace-expansion/commit/835d6be91201122d9adffb0c0c8c094189ace265","https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754","https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95","https://github.com/juliangruber/brace-expansion/releases/tag/v1.1.16","https://github.com/juliangruber/brace-expansion/releases/tag/v2.1.2","https://github.com/juliangruber/brace-expansion/releases/tag/v5.0.7","https://www.npmjs.com/package/brace-expansion"],"description":"brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-13149","epss":0.00364,"percentile":0.30245,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-13149","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-13149","cwe":"CWE-407","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}],"fix":{"versions":["2.1.2"],"state":"fixed","available":[{"version":"2.1.2","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.25479999999999997},"relatedVulnerabilities":[{"id":"CVE-2026-13149","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13149","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754","https://www.npmjs.com/package/brace-expansion"],"description":"brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.","cvss":[{"source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-13149","epss":0.00364,"percentile":0.30245,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-13149","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-13149","cwe":"CWE-407","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"2.0.1"}},"found":{"vulnerabilityID":"GHSA-3jxr-9vmj-r5cp","versionConstraint":">=2.0.0,<2.1.2 (semantic)"},"fix":{"suggestedVersion":"2.1.2"}}],"artifact":{"id":"pkg:npm/brace-expansion@2.0.1?package-id=569f54ca8e83a456","name":"brace-expansion","version":"2.0.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:2.0.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@2.0.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-83g3-92jg-28cx","dataSource":"https://github.com/advisories/GHSA-83g3-92jg-28cx","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-83g3-92jg-28cx","https://github.com/isaacs/node-tar/commit/2cb1120bcefe28d7ecc719b41441ade59c52e384","https://github.com/isaacs/node-tar/commit/d18e4e1f846f4ddddc153b0f536a19c050e7499f","https://nvd.nist.gov/vuln/detail/CVE-2026-26960"],"description":"Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.1,"exploitabilityScore":1.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26960","epss":0.00328,"percentile":0.25996,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-26960","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.5.8"],"state":"fixed","available":[{"version":"7.5.8","date":"2026-03-04","kind":"first-observed"}]},"advisories":[],"risk":0.23944000000000001},"relatedVulnerabilities":[{"id":"CVE-2026-26960","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26960","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/node-tar/commit/2cb1120bcefe28d7ecc719b41441ade59c52e384","https://github.com/isaacs/node-tar/commit/d18e4e1f846f4ddddc153b0f536a19c050e7499f","https://github.com/isaacs/node-tar/security/advisories/GHSA-83g3-92jg-28cx"],"description":"node-tar is a full-featured Tar for Node.js. When using default options in versions 7.5.7 and below, an attacker-controlled archive can create a hardlink inside the extraction directory that points to a file outside the extraction root, enabling arbitrary file read and write as the extracting user. Severity is high because the primitive bypasses path protections and turns archive extraction into a direct filesystem access primitive. This issue has been fixed in version 7.5.8.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.1,"exploitabilityScore":1.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.1,"exploitabilityScore":1.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26960","epss":0.00328,"percentile":0.25996,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-26960","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"6.1.11"}},"found":{"vulnerabilityID":"GHSA-83g3-92jg-28cx","versionConstraint":"<7.5.8 (semantic)"},"fix":{"suggestedVersion":"7.5.8"}}],"artifact":{"id":"pkg:npm/tar@6.1.11?package-id=3853c86fbd5d8342","name":"tar","version":"6.1.11","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:tar_project:tar:6.1.11:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:6.1.11:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:6.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@6.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-48c2-rrv3-qjmp","dataSource":"https://github.com/advisories/GHSA-48c2-rrv3-qjmp","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/eemeli/yaml/security/advisories/GHSA-48c2-rrv3-qjmp","https://github.com/eemeli/yaml/commit/1e84ebbea7ec35011a4c61bbb820a529ee4f359b","https://github.com/eemeli/yaml/releases/tag/v1.10.3","https://github.com/eemeli/yaml/releases/tag/v2.8.3","https://nvd.nist.gov/vuln/detail/CVE-2026-33532"],"description":"yaml is vulnerable to Stack Overflow via deeply nested YAML collections","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"exploitabilityScore":2.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33532","epss":0.00488,"percentile":0.42057,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33532","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.10.3"],"state":"fixed","available":[{"version":"1.10.3","date":"2026-03-26","kind":"first-observed"}]},"advisories":[],"risk":0.22691999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-33532","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33532","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/eemeli/yaml/commit/1e84ebbea7ec35011a4c61bbb820a529ee4f359b","https://github.com/eemeli/yaml/releases/tag/v1.10.3","https://github.com/eemeli/yaml/releases/tag/v2.8.3","https://github.com/eemeli/yaml/security/advisories/GHSA-48c2-rrv3-qjmp"],"description":"`yaml` is a YAML parser and serialiser for JavaScript. Parsing a YAML document with a version of `yaml` on the 1.x branch prior to 1.10.3 or on the 2.x branch prior to 2.8.3 may throw a RangeError due to a stack overflow. The node resolution/composition phase uses recursive function calls without a depth bound. An attacker who can supply YAML for parsing can trigger a `RangeError: Maximum call stack size exceeded` with a small payload (~2–10 KB). The `RangeError` is not a `YAMLParseError`, so applications that only catch YAML-specific errors will encounter an unexpected exception type. Depending on the host application's exception handling, this can fail requests or terminate the Node.js process. Flow sequences allow deep nesting with minimal bytes (2 bytes per level: one `[` and one `]`). On the default Node.js stack, approximately 1,000–5,000 levels of nesting (2–10 KB input) exhaust the call stack. The exact threshold is environment-dependent (Node.js version, stack size, call stack depth at invocation). Note: the library's `Parser` (CST phase) uses a stack-based iterative approach and is not affected. Only the compose/resolve phase uses actual call-stack recursion. All three public parsing APIs are affected: `YAML.parse()`, `YAML.parseDocument()`, and `YAML.parseAllDocuments()`. Versions 1.10.3 and 2.8.3 contain a patch.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"exploitabilityScore":2.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33532","epss":0.00488,"percentile":0.42057,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33532","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"yaml","version":"1.10.2"}},"found":{"vulnerabilityID":"GHSA-48c2-rrv3-qjmp","versionConstraint":">=1.0.0,<1.10.3 (semantic)"},"fix":{"suggestedVersion":"1.10.3"}}],"artifact":{"id":"pkg:npm/yaml@1.10.2?package-id=e521328978338dae","name":"yaml","version":"1.10.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:eemeli:yaml:1.10.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/yaml@1.10.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-6rw7-vpxm-498p","dataSource":"https://github.com/advisories/GHSA-6rw7-vpxm-498p","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/ljharb/qs/security/advisories/GHSA-6rw7-vpxm-498p","https://nvd.nist.gov/vuln/detail/CVE-2025-15284","https://github.com/ljharb/qs/commit/3086902ecf7f088d0d1803887643ac6c03d415b9"],"description":"qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-15284","epss":0.0045,"percentile":0.39088,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-15284","cwe":"CWE-20","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}],"fix":{"versions":["6.14.1"],"state":"fixed","available":[{"version":"6.14.1","date":"2026-01-01","kind":"first-observed"}]},"advisories":[],"risk":0.22499999999999998},"relatedVulnerabilities":[{"id":"CVE-2025-15284","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15284","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/ljharb/qs/commit/3086902ecf7f088d0d1803887643ac6c03d415b9","https://github.com/ljharb/qs/security/advisories/GHSA-6rw7-vpxm-498p"],"description":"Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1.\n\n\nSummary\n\nThe arrayLimit option in qs did not enforce limits for bracket notation (a[]=1&a[]=2), only for indexed notation (a[0]=1). This is a consistency bug; arrayLimit should apply uniformly across all array notations.\n\nNote: The default parameterLimit of 1000 effectively mitigates the DoS scenario originally described. With default options, bracket notation cannot produce arrays larger than parameterLimit regardless of arrayLimit, because each a[]=valueconsumes one parameter slot. The severity has been reduced accordingly.\n\nDetails\n\nThe arrayLimit option only checked limits for indexed notation (a[0]=1&a[1]=2) but did not enforce it for bracket notation (a[]=1&a[]=2).\n\nVulnerable code (lib/parse.js:159-162):\n\nif (root === '[]' && options.parseArrays) {\n    obj = utils.combine([], leaf);  // No arrayLimit check\n}\n\n\n\n\n\nWorking code (lib/parse.js:175):\n\nelse if (index <= options.arrayLimit) {  // Limit checked here\n    obj = [];\n    obj[index] = leaf;\n}\n\n\n\n\n\nThe bracket notation handler at line 159 uses utils.combine([], leaf) without validating against options.arrayLimit, while indexed notation at line 175 checks index <= options.arrayLimit before creating arrays.\n\n\n\nPoC\n\nconst qs = require('qs');\nconst result = qs.parse('a[]=1&a[]=2&a[]=3&a[]=4&a[]=5&a[]=6', { arrayLimit: 5 });\nconsole.log(result.a.length);  // Output: 6 (should be max 5)\n\n\n\n\n\nNote on parameterLimit interaction: The original advisory's \"DoS demonstration\" claimed a length of 10,000, but parameterLimit (default: 1000) caps parsing to 1,000 parameters. With default options, the actual output is 1,000, not 10,000.\n\nImpact\n\nConsistency bug in arrayLimit enforcement. With default parameterLimit, the practical DoS risk is negligible since parameterLimit already caps the total number of parsed parameters (and thus array elements from bracket notation). The risk increases only when parameterLimit is explicitly set to a very high value.","cvss":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-15284","epss":0.0045,"percentile":0.39088,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-15284","cwe":"CWE-20","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"qs","version":"6.5.3"}},"found":{"vulnerabilityID":"GHSA-6rw7-vpxm-498p","versionConstraint":"<6.14.1 (semantic)"},"fix":{"suggestedVersion":"6.14.1"}}],"artifact":{"id":"pkg:npm/qs@6.5.3?package-id=979ee9c113623ac2","name":"qs","version":"6.5.3","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:qs_project:qs:6.5.3:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/qs@6.5.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-q2hr-2g5m-vwhr","dataSource":"https://github.com/advisories/GHSA-q2hr-2g5m-vwhr","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr","https://nvd.nist.gov/vuln/detail/CVE-2026-102277","https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e"],"description":"brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102277","epss":0.00428,"percentile":0.37125,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102277","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102277","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.1.21"],"state":"fixed","available":[{"version":"1.1.21","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.22042},"relatedVulnerabilities":[{"id":"CVE-2026-102277","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102277","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-input rescans with linear working-string growth cause quadratic CPU time and memory pressure that can block the Node.js event loop. The process eventually recovers, making the impact a recoverable CPU denial of service. This issue is fixed in versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102277","epss":0.00428,"percentile":0.37125,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102277","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102277","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.11"}},"found":{"vulnerabilityID":"GHSA-q2hr-2g5m-vwhr","versionConstraint":"<1.1.21 (semantic)"},"fix":{"suggestedVersion":"1.1.21"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.11?package-id=bb6331f39e7684a6","name":"brace-expansion","version":"1.1.11","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-q2hr-2g5m-vwhr","dataSource":"https://github.com/advisories/GHSA-q2hr-2g5m-vwhr","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr","https://nvd.nist.gov/vuln/detail/CVE-2026-102277","https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e"],"description":"brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102277","epss":0.00428,"percentile":0.37125,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102277","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102277","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.1.21"],"state":"fixed","available":[{"version":"1.1.21","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.22042},"relatedVulnerabilities":[{"id":"CVE-2026-102277","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102277","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-input rescans with linear working-string growth cause quadratic CPU time and memory pressure that can block the Node.js event loop. The process eventually recovers, making the impact a recoverable CPU denial of service. This issue is fixed in versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102277","epss":0.00428,"percentile":0.37125,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102277","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102277","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.18"}},"found":{"vulnerabilityID":"GHSA-q2hr-2g5m-vwhr","versionConstraint":"<1.1.21 (semantic)"},"fix":{"suggestedVersion":"1.1.21"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.18?package-id=15a6fd05718afea9","name":"brace-expansion","version":"1.1.18","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.18:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.18","upstreams":[]}},{"vulnerability":{"id":"GHSA-q2hr-2g5m-vwhr","dataSource":"https://github.com/advisories/GHSA-q2hr-2g5m-vwhr","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr","https://nvd.nist.gov/vuln/detail/CVE-2026-102277","https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e"],"description":"brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102277","epss":0.00428,"percentile":0.37125,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102277","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102277","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.1.7"],"state":"fixed","available":[{"version":"2.1.7","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.22042},"relatedVulnerabilities":[{"id":"CVE-2026-102277","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102277","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-input rescans with linear working-string growth cause quadratic CPU time and memory pressure that can block the Node.js event loop. The process eventually recovers, making the impact a recoverable CPU denial of service. This issue is fixed in versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102277","epss":0.00428,"percentile":0.37125,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102277","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102277","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"2.0.1"}},"found":{"vulnerabilityID":"GHSA-q2hr-2g5m-vwhr","versionConstraint":">=2.0.0,<2.1.7 (semantic)"},"fix":{"suggestedVersion":"2.1.7"}}],"artifact":{"id":"pkg:npm/brace-expansion@2.0.1?package-id=569f54ca8e83a456","name":"brace-expansion","version":"2.0.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:2.0.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@2.0.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-q2hr-2g5m-vwhr","dataSource":"https://github.com/advisories/GHSA-q2hr-2g5m-vwhr","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr","https://nvd.nist.gov/vuln/detail/CVE-2026-102277","https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e"],"description":"brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102277","epss":0.00428,"percentile":0.37125,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102277","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102277","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.1.7"],"state":"fixed","available":[{"version":"2.1.7","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.22042},"relatedVulnerabilities":[{"id":"CVE-2026-102277","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102277","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-input rescans with linear working-string growth cause quadratic CPU time and memory pressure that can block the Node.js event loop. The process eventually recovers, making the impact a recoverable CPU denial of service. This issue is fixed in versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102277","epss":0.00428,"percentile":0.37125,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102277","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102277","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"2.1.4"}},"found":{"vulnerabilityID":"GHSA-q2hr-2g5m-vwhr","versionConstraint":">=2.0.0,<2.1.7 (semantic)"},"fix":{"suggestedVersion":"2.1.7"}}],"artifact":{"id":"pkg:npm/brace-expansion@2.1.4?package-id=7ae261f9c7255d9e","name":"brace-expansion","version":"2.1.4","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:2.1.4:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@2.1.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-r6q2-hw4h-h46w","dataSource":"https://github.com/advisories/GHSA-r6q2-hw4h-h46w","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-r6q2-hw4h-h46w","https://nvd.nist.gov/vuln/detail/CVE-2026-23950","https://github.com/isaacs/node-tar/commit/3b1abfae650056edfabcbe0a0df5954d390521e6"],"description":"Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-23950","epss":0.00264,"percentile":0.18349,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-23950","cwe":"CWE-176","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-23950","cwe":"CWE-352","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-23950","cwe":"CWE-367","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-23950","cwe":"CWE-367","source":"nvd@nist.gov","type":"Secondary"},{"cve":"CVE-2026-23950","cwe":"CWE-367","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["7.5.4"],"state":"fixed","available":[{"version":"7.5.4","date":"2026-01-22","kind":"first-observed"}]},"advisories":[],"risk":0.21516000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-23950","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-23950","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-tar/commit/3b1abfae650056edfabcbe0a0df5954d390521e6","https://github.com/isaacs/node-tar/security/advisories/GHSA-r6q2-hw4h-h46w","https://access.redhat.com/errata/RHSA-2026:18480","https://access.redhat.com/errata/RHSA-2026:18868","https://access.redhat.com/errata/RHSA-2026:2144","https://access.redhat.com/errata/RHSA-2026:2926","https://access.redhat.com/errata/RHSA-2026:6192","https://access.redhat.com/security/cve/CVE-2026-23950","https://bugzilla.redhat.com/show_bug.cgi?id=2431036","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23950.json"],"description":"node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3. This is due to an incomplete handling of Unicode path collisions in the `path-reservations` system. On case-insensitive or normalization-insensitive filesystems (such as macOS APFS, In which it has been tested), the library fails to lock colliding paths (e.g., `ß` and `ss`), allowing them to be processed in parallel. This bypasses the library's internal concurrency safeguards and permits Symlink Poisoning attacks via race conditions. The library uses a `PathReservations` system to ensure that metadata checks and file operations for the same path are serialized. This prevents race conditions where one entry might clobber another concurrently. This is a Race Condition which enables Arbitrary File Overwrite. This vulnerability affects users and systems using node-tar on macOS (APFS/HFS+). Because of using `NFD` Unicode normalization (in which `ß` and `ss` are different), conflicting paths do not have their order properly preserved under filesystems that ignore Unicode normalization (e.g., APFS (in which `ß` causes an inode collision with `ss`)). This enables an attacker to circumvent internal parallelization locks (`PathReservations`) using conflicting filenames within a malicious tar archive. The patch in version 7.5.4 updates `path-reservations.js` to use a normalization form that matches the target filesystem's behavior (e.g., `NFKD`), followed by first `toLocaleLowerCase('en')` and then `toLocaleUpperCase('en')`. As a workaround, users who cannot upgrade promptly, and who are programmatically using `node-tar` to extract arbitrary tarball data should filter out all `SymbolicLink` entries (as npm does) to defend against arbitrary file writes via this file system entry name collision issue.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.3},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-23950","epss":0.00264,"percentile":0.18349,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-23950","cwe":"CWE-176","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-23950","cwe":"CWE-352","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-23950","cwe":"CWE-367","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-23950","cwe":"CWE-367","source":"nvd@nist.gov","type":"Secondary"},{"cve":"CVE-2026-23950","cwe":"CWE-367","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"6.1.11"}},"found":{"vulnerabilityID":"GHSA-r6q2-hw4h-h46w","versionConstraint":"<=7.5.3 (semantic)"},"fix":{"suggestedVersion":"7.5.4"}}],"artifact":{"id":"pkg:npm/tar@6.1.11?package-id=3853c86fbd5d8342","name":"tar","version":"6.1.11","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:tar_project:tar:6.1.11:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:6.1.11:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:6.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@6.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-4mjr-xmp4-gh2g","dataSource":"https://github.com/advisories/GHSA-4mjr-xmp4-gh2g","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/ljharb/qs/security/advisories/GHSA-4mjr-xmp4-gh2g","https://nvd.nist.gov/vuln/detail/CVE-2026-82417","https://github.com/ljharb/qs/commit/e83d321ffafb38cf210683ac31714fce6ce1c6c6"],"description":"qs: Denial of Service via Attacker Controlled isBuffer","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-82417","epss":0.00396,"percentile":0.33816,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-82417","cwe":"CWE-248","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-82417","cwe":"CWE-703","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}],"fix":{"versions":["6.16.0"],"state":"fixed","available":[{"version":"6.16.0","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.21384},"relatedVulnerabilities":[{"id":"CVE-2026-82417","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82417","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/ljharb/qs/commit/e83d321ffafb38cf210683ac31714fce6ce1c6c6","https://github.com/ljharb/qs/security/advisories/GHSA-4mjr-xmp4-gh2g"],"description":"### Summary\n\n\n\n`qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member. `utils.isBuffer` duck-types buffers by calling `obj.constructor.isBuffer(obj)` after checking only that the property is truthy, so a value such as `{ constructor: { isBuffer: \"x\" } }` makes the call throw `TypeError: obj.constructor.isBuffer is not a function`.\n\n\n\n### Details\n\n\n\n`lib/stringify.js:127` calls `utils.isBuffer` on every non-primitive value it serializes. `utils.isBuffer` (`lib/utils.js:332`) reads `obj.constructor.isBuffer` and invokes it without verifying that it is a function. `constructor` and `isBuffer` are ordinary property names, so any object carrying them as own properties reaches the unchecked call.\n\n\n\nSuch an object can be built from untrusted input. `qs.parse(\"x[constructor][isBuffer]=y\", { plainObjects: true })` or `{ allowPrototypes: true }` keeps the `constructor` key as an own property (the default parse options drop it), and `JSON.parse(\"{\\\"a\\\":{\\\"constructor\\\":{\\\"isBuffer\\\":\\\"x\\\"}}}\")` produces the same shape with no qs option involved. Express 4 with its default `query parser` setting and body-parser with `extended: true` both call `qs.parse` with `allowPrototypes: true`, so on those stacks `req.query` and `req.body` can carry the shape directly.\n\n\n\n#### PoC\n\n\n\n```js\n\n\n\nvar qs = require(\"qs\");\n\n\n\nqs.stringify(qs.parse(\"x[constructor][isBuffer]=y\", { plainObjects: true }));\n\n\n\nqs.stringify(JSON.parse(\"{\\\"a\\\":{\\\"constructor\\\":{\\\"isBuffer\\\":\\\"x\\\"}}}\"));\n\n\n\n// TypeError: obj.constructor.isBuffer is not a function\n\n\n\n//     at Object.isBuffer (lib/utils.js:332:78)\n\n\n\n//     at stringify (lib/stringify.js:127:45)\n\n\n\n```\n\n\n\n#### Fix\n\n\n\n`lib/utils.js`, applied in e83d321 on `main` and released as v6.16.0:\n\n\n\n```diff\n\n\n\n- return !!(obj.constructor && obj.constructor.isBuffer && obj.constructor.isBuffer(obj));\n\n\n\n+ return !!(obj.constructor && typeof obj.constructor.isBuffer === \"function\" && obj.constructor.isBuffer(obj));\n\n\n\n```\n\n\n\nReal `Buffer`, `safer-buffer`, and browserify `buffer` polyfill instances serialize exactly as before; only the throw is removed.\n\n\n\n### Affected versions\n\n\n\n`>=2.2.5 <6.16.0`, fixed in v6.16.0.\n\n\n\nThe unguarded duck-type was introduced in 3768a75 and first shipped in v2.2.5 (September 2014). v2.2.4 and earlier used `Buffer.isBuffer` and are not affected. Every release from v2.2.5 through v6.15.3 contains the unguarded call.\n\n\n\n### Impact\n\n\n\nAn unauthenticated request can make any code path that re-serializes attacker-influenced data with `qs.stringify` (for example, rebuilding a query string from `req.query` for a redirect or an upstream request, or serializing a parsed JSON body) throw synchronously. In a typical Node.js HTTP framework the throw is caught by the framework error boundary and the affected request returns a 500; the process survives and other requests are unaffected. Where the call runs outside an error boundary, such as an `async` Express 4 handler (where the throw becomes an unhandled promise rejection) or a background job, the process exits, so the impact in that case depends on the application error handling rather than on qs.","cvss":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-82417","epss":0.00396,"percentile":0.33816,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-82417","cwe":"CWE-248","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-82417","cwe":"CWE-703","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"qs","version":"6.5.3"}},"found":{"vulnerabilityID":"GHSA-4mjr-xmp4-gh2g","versionConstraint":">=2.2.5,<6.16.0 (semantic)"},"fix":{"suggestedVersion":"6.16.0"}}],"artifact":{"id":"pkg:npm/qs@6.5.3?package-id=979ee9c113623ac2","name":"qs","version":"6.5.3","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:qs_project:qs:6.5.3:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/qs@6.5.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-rj75-hqrm-r3gf","dataSource":"https://github.com/advisories/GHSA-rj75-hqrm-r3gf","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/postcss/postcss-selector-parser/security/advisories/GHSA-rj75-hqrm-r3gf","https://nvd.nist.gov/vuln/detail/CVE-2026-104844","https://github.com/postcss/postcss-selector-parser/commit/62b191792df0a0bc56062e5a875bc74aae2a51cd","https://github.com/postcss/postcss-selector-parser/releases/tag/7.1.6","https://github.com/postcss/postcss-selector-parser/pull/346","https://github.com/postcss/postcss-selector-parser/commit/70b0779c843462197380d25daa02d1528bf7eae5","https://github.com/postcss/postcss-selector-parser/releases/tag/6.1.5"],"description":"PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-104844","epss":0.00389,"percentile":0.32999,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-104844","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-104844","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["6.1.5"],"state":"fixed","available":[{"version":"6.1.5","date":"2026-10-26","kind":"first-observed"}]},"advisories":[],"risk":0.212005},"relatedVulnerabilities":[{"id":"CVE-2026-104844","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-104844","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/postcss/postcss-selector-parser/commit/62b191792df0a0bc56062e5a875bc74aae2a51cd","https://github.com/postcss/postcss-selector-parser/releases/tag/7.1.6","https://github.com/postcss/postcss-selector-parser/security/advisories/GHSA-rj75-hqrm-r3gf"],"description":"PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it. Prior to 7.1.6, src/parser.js splitWord() can receive a flat selector as one word token carrying many class or ID indexes because period and hash characters are not tokenizer word delimiters. The uniqs() deduplication and per-index class and ID membership checks repeatedly scan the class and ID index arrays, while a separate Sass-interpolation filtering pass also performs repeated linear scanning. Together, these passes make parsing quadratic in the number of indexes and allow a crafted selector to occupy a synchronous parser thread. The maxNestingDepth guard does not mitigate the issue because the hostile selector can have zero nesting depth. Only consumers that synchronously parse untrusted selectors in an exposed request path are affected; ordinary build-time parsing of trusted sources is not affected. This issue is fixed in version 7.1.6.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-104844","epss":0.00389,"percentile":0.32999,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-104844","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-104844","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"postcss-selector-parser","version":"6.0.10"}},"found":{"vulnerabilityID":"GHSA-rj75-hqrm-r3gf","versionConstraint":"<6.1.5 (semantic)"},"fix":{"suggestedVersion":"6.1.5"}}],"artifact":{"id":"pkg:npm/postcss-selector-parser@6.0.10?package-id=59f398b70d163cc3","name":"postcss-selector-parser","version":"6.0.10","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:postcss-selector-parser:postcss-selector-parser:6.0.10:*:*:*:*:*:*:*","cpe:2.3:a:postcss-selector-parser:postcss_selector_parser:6.0.10:*:*:*:*:*:*:*","cpe:2.3:a:postcss_selector_parser:postcss-selector-parser:6.0.10:*:*:*:*:*:*:*","cpe:2.3:a:postcss_selector_parser:postcss_selector_parser:6.0.10:*:*:*:*:*:*:*","cpe:2.3:a:postcss-selector:postcss-selector-parser:6.0.10:*:*:*:*:*:*:*","cpe:2.3:a:postcss-selector:postcss_selector_parser:6.0.10:*:*:*:*:*:*:*","cpe:2.3:a:postcss_selector:postcss-selector-parser:6.0.10:*:*:*:*:*:*:*","cpe:2.3:a:postcss_selector:postcss_selector_parser:6.0.10:*:*:*:*:*:*:*","cpe:2.3:a:postcss:postcss-selector-parser:6.0.10:*:*:*:*:*:*:*","cpe:2.3:a:postcss:postcss_selector_parser:6.0.10:*:*:*:*:*:*:*"],"purl":"pkg:npm/postcss-selector-parser@6.0.10","upstreams":[]}},{"vulnerability":{"id":"GHSA-9ppj-qmqm-q256","dataSource":"https://github.com/advisories/GHSA-9ppj-qmqm-q256","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-9ppj-qmqm-q256","https://nvd.nist.gov/vuln/detail/CVE-2026-31802","https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad"],"description":"node-tar Symlink Path Traversal via Drive-Relative Linkpath","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-31802","epss":0.00269,"percentile":0.19059,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-31802","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.5.11"],"state":"fixed","available":[{"version":"7.5.11","date":"2026-03-11","kind":"first-observed"}]},"advisories":[],"risk":0.21116500000000002},"relatedVulnerabilities":[{"id":"CVE-2026-31802","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-31802","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad","https://github.com/isaacs/node-tar/security/advisories/GHSA-9ppj-qmqm-q256"],"description":"node-tar is a full-featured Tar for Node.js. Prior to version 7.5.11, tar (npm) can be tricked into creating a symlink that points outside the extraction directory by using a drive-relative symlink target such as C:../../../target.txt, which enables file overwrite outside cwd during normal tar.x() extraction. This vulnerability is fixed in 7.5.11.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.5,"exploitabilityScore":1.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-31802","epss":0.00269,"percentile":0.19059,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-31802","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"6.1.11"}},"found":{"vulnerabilityID":"GHSA-9ppj-qmqm-q256","versionConstraint":"<=7.5.10 (semantic)"},"fix":{"suggestedVersion":"7.5.11"}}],"artifact":{"id":"pkg:npm/tar@6.1.11?package-id=3853c86fbd5d8342","name":"tar","version":"6.1.11","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:tar_project:tar:6.1.11:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:6.1.11:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:6.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@6.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-w5hq-g745-h8pq","dataSource":"https://github.com/advisories/GHSA-w5hq-g745-h8pq","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pq","https://github.com/uuidjs/uuid/commit/3d2c5b0342f0fcb52a5ac681c3d47c13e7444b34","https://github.com/uuidjs/uuid/releases/tag/v14.0.0","https://nvd.nist.gov/vuln/detail/CVE-2026-41907","https://github.com/uuidjs/uuid/commit/32389c887c9e75f90442ee4cc95bbab0c4e8346e","https://github.com/uuidjs/uuid/commit/3d61d6ac1f782cf6b1dd8661c60f11722cd49a0d","https://github.com/uuidjs/uuid/commit/9d27ddf7046ce496ef39569ff84d948eeff9cb2a","https://github.com/uuidjs/uuid/releases/tag/v11.1.1","https://github.com/uuidjs/uuid/releases/tag/v12.0.1","https://github.com/uuidjs/uuid/releases/tag/v13.0.1"],"description":"uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41907","epss":0.0035,"percentile":0.28636,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41907","cwe":"CWE-787","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-41907","cwe":"CWE-823","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["11.1.1"],"state":"fixed","available":[{"version":"11.1.1","date":"2026-05-05","kind":"first-observed"}]},"advisories":[],"risk":0.20825000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-41907","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41907","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pq"],"description":"uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41907","epss":0.0035,"percentile":0.28636,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41907","cwe":"CWE-787","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-41907","cwe":"CWE-823","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"uuid","version":"3.4.0"}},"found":{"vulnerabilityID":"GHSA-w5hq-g745-h8pq","versionConstraint":"<11.1.1 (semantic)"},"fix":{"suggestedVersion":"11.1.1"}}],"artifact":{"id":"pkg:npm/uuid@3.4.0?package-id=1a43dd05f36c1ec7","name":"uuid","version":"3.4.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:uuidjs:uuid:3.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/uuid@3.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-3g3m-2fjr-6pw4","dataSource":"https://github.com/advisories/GHSA-3g3m-2fjr-6pw4","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/node-glob/security/advisories/GHSA-3g3m-2fjr-6pw4","https://nvd.nist.gov/vuln/detail/CVE-2026-118773","https://github.com/isaacs/node-glob/commit/4682e8c9babee1b385202ede36389634e12076d7","https://github.com/isaacs/node-glob/releases/tag/v14.0.2"],"description":"Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118773","epss":0.0035,"percentile":0.28709,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118773","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["14.0.2"],"state":"fixed","available":[{"version":"14.0.2","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.19774999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-118773","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118773","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-glob/commit/4682e8c9babee1b385202ede36389634e12076d7","https://github.com/isaacs/node-glob/releases/tag/v14.0.2","https://github.com/isaacs/node-glob/security/advisories/GHSA-3g3m-2fjr-6pw4"],"description":"Glob matches files using patterns the shell uses. From 9.0.0 until 14.0.2, abort branches in src/walker.ts, including GlobUtil.walkCB(), GlobUtil.walkCB2(), GlobUtil.walkCBSync(), and GlobUtil.walkCB2Sync(), invoke the callbacks without returning. After AbortSignal or AbortSignal.timeout() rejects or emits an error, execution can continue into processor.processPatterns(), readdirCB(), and recursive traversal. The issue affects glob() and globStream() when applications expose attacker-influenced patterns or directory trees and rely on cancellation as a traversal budget. Repeated timed-out requests can stack background filesystem operations and CPU work, degrading worker throughput or service availability; no confidentiality or integrity impact was observed. This issue is fixed in 14.0.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118773","epss":0.0035,"percentile":0.28709,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118773","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"glob","version":"10.5.0"}},"found":{"vulnerabilityID":"GHSA-3g3m-2fjr-6pw4","versionConstraint":">=9.0.0,<=14.0.1 (semantic)"},"fix":{"suggestedVersion":"14.0.2"}}],"artifact":{"id":"pkg:npm/glob@10.5.0?package-id=89315431e8067bda","name":"glob","version":"10.5.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:isaacs:glob:10.5.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/glob@10.5.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-6v5v-wf23-fmfq","dataSource":"https://github.com/advisories/GHSA-6v5v-wf23-fmfq","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/markdown-it/markdown-it/security/advisories/GHSA-6v5v-wf23-fmfq"],"description":"markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-48988","epss":0.00379,"percentile":0.31865,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-48988","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["14.2.0"],"state":"fixed","available":[{"version":"14.2.0","date":"2026-06-16","kind":"first-observed"}]},"advisories":[],"risk":0.195185},"relatedVulnerabilities":[{"id":"CVE-2026-48988","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48988","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/markdown-it/markdown-it/commit/9ce2087562c45d1e5ddd9f76b990f4b3fbe040e5","https://github.com/markdown-it/markdown-it/security/advisories/GHSA-6v5v-wf23-fmfq"],"description":"markdown-it is a Markdown parser. Versions 14.1.1 and below contain a denial-of-service vulnerability when typographer: true is enabled, due to quadratic (O(n^2)) processing in the smartquotes rule. The issue stems from repeatedly modifying strings with replaceAt(), which performs O(n) slicing and concatenation per quote character. This can cause excessive CPU consumption when parsing quote-heavy, user-supplied markdown and may let attackers degrade or disrupt service availability. Although typographer is disabled by default, many production apps enable it for smart typography, making the issue relevant. This issue has been fixed in version 14.2.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-48988","epss":0.00379,"percentile":0.31865,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-48988","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"markdown-it","version":"13.0.1"}},"found":{"vulnerabilityID":"GHSA-6v5v-wf23-fmfq","versionConstraint":"<=14.1.1 (semantic)"},"fix":{"suggestedVersion":"14.2.0"}}],"artifact":{"id":"pkg:npm/markdown-it@13.0.1?package-id=59ad530bbde4b9d0","name":"markdown-it","version":"13.0.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:markdown-it_project:markdown-it:13.0.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/markdown-it@13.0.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-f23m-r3pf-42rh","dataSource":"https://github.com/advisories/GHSA-f23m-r3pf-42rh","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh","https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg","https://nvd.nist.gov/vuln/detail/CVE-2026-2950"],"description":"lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-2950","epss":0.00337,"percentile":0.27173,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-2950","cwe":"CWE-1321","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["4.18.0"],"state":"fixed","available":[{"version":"4.18.0","date":"2026-04-02","kind":"first-observed"}]},"advisories":[],"risk":0.193775},"relatedVulnerabilities":[{"id":"CVE-2026-2950","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2950","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh"],"description":"The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype. The issue permits deletion of prototype properties but does not allow overwriting their original behavior. The issue is patched from 4.18.0 to 4.18.1 depending on the package: lodash, lodash-es, and lodash-amd in 4.18.1, and the standalone lodash.unset and lodash.omit packages in 4.18.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-2950","epss":0.00337,"percentile":0.27173,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-2950","cwe":"CWE-1321","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"lodash","version":"4.17.21"}},"found":{"vulnerabilityID":"GHSA-f23m-r3pf-42rh","versionConstraint":"<=4.17.23 (semantic)"},"fix":{"suggestedVersion":"4.18.0"}}],"artifact":{"id":"pkg:npm/lodash@4.17.21?package-id=cb6dfff11809ad1e","name":"lodash","version":"4.17.21","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:lodash:lodash:4.17.21:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/lodash@4.17.21","upstreams":[]}},{"vulnerability":{"id":"GHSA-f23m-r3pf-42rh","dataSource":"https://github.com/advisories/GHSA-f23m-r3pf-42rh","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh","https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg","https://nvd.nist.gov/vuln/detail/CVE-2026-2950"],"description":"lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-2950","epss":0.00337,"percentile":0.27173,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-2950","cwe":"CWE-1321","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["4.18.0"],"state":"fixed","available":[{"version":"4.18.0","date":"2026-04-02","kind":"first-observed"}]},"advisories":[],"risk":0.193775},"relatedVulnerabilities":[{"id":"CVE-2026-2950","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2950","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh"],"description":"The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype. The issue permits deletion of prototype properties but does not allow overwriting their original behavior. The issue is patched from 4.18.0 to 4.18.1 depending on the package: lodash, lodash-es, and lodash-amd in 4.18.1, and the standalone lodash.unset and lodash.omit packages in 4.18.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-2950","epss":0.00337,"percentile":0.27173,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-2950","cwe":"CWE-1321","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"lodash","version":"4.17.5"}},"found":{"vulnerabilityID":"GHSA-f23m-r3pf-42rh","versionConstraint":"<=4.17.23 (semantic)"},"fix":{"suggestedVersion":"4.18.0"}}],"artifact":{"id":"pkg:npm/lodash@4.17.5?package-id=6dbd6165006e1c97","name":"lodash","version":"4.17.5","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:lodash:lodash:4.17.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/lodash@4.17.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-gvwx-54wh-qm9j","dataSource":"https://github.com/advisories/GHSA-gvwx-54wh-qm9j","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-gvwx-54wh-qm9j","https://nvd.nist.gov/vuln/detail/CVE-2026-59875","https://github.com/isaacs/node-tar/commit/7a635c29f5edbf083557374d43984273ecfed5b3","https://github.com/isaacs/node-tar/releases/tag/v7.5.17"],"description":"node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59875","epss":0.00354,"percentile":0.29162,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59875","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.5.17"],"state":"fixed","available":[{"version":"7.5.17","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.18231000000000003},"relatedVulnerabilities":[{"id":"CVE-2026-59875","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59875","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-tar/commit/7a635c29f5edbf083557374d43984273ecfed5b3","https://github.com/isaacs/node-tar/releases/tag/v7.5.17","https://github.com/isaacs/node-tar/security/advisories/GHSA-gvwx-54wh-qm9j"],"description":"node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL bytes from PAX path and linkpath records in src/pax.ts, allowing a crafted archive with values to reach fs.lstat or fs.open and terminate the process with an uncaught exception. This issue is fixed in version 7.5.17.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59875","epss":0.00354,"percentile":0.29162,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59875","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"6.1.11"}},"found":{"vulnerabilityID":"GHSA-gvwx-54wh-qm9j","versionConstraint":"<=7.5.16 (semantic)"},"fix":{"suggestedVersion":"7.5.17"}}],"artifact":{"id":"pkg:npm/tar@6.1.11?package-id=3853c86fbd5d8342","name":"tar","version":"6.1.11","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:tar_project:tar:6.1.11:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:6.1.11:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:6.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@6.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-gcqx-w48m-w2h4","dataSource":"https://github.com/advisories/GHSA-gcqx-w48m-w2h4","namespace":"github:language:javascript","severity":"Low","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-93753","https://github.com/TehShrike/deepmerge/issues/273","https://github.com/TehShrike/deepmerge/blob/5b87756a5671635679001cbac72aa42f23472c81/index.js#L39-L60","https://www.vulncheck.com/advisories/deepmerge-through-4.3.1-prototype-poisoning-via-mergeobject"],"description":"deepmerge mergeObject() allows prototype poisoning of returned objects","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U","metrics":{"baseScore":2.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-93753","epss":0.00514,"percentile":0.43823,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-93753","cwe":"CWE-1321","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.17989999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-93753","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93753","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/TehShrike/deepmerge","https://github.com/TehShrike/deepmerge/blob/5b87756a5671635679001cbac72aa42f23472c81/index.js#L39-L60","https://github.com/TehShrike/deepmerge/issues/273","https://www.vulncheck.com/advisories/deepmerge-through-4.3.1-prototype-poisoning-via-mergeobject"],"description":"deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject() function that fails to properly validate keys being written to target objects. Attackers can supply malicious source objects in merge operations to inject attacker-controlled properties into the returned object's prototype, causing applications to inherit unintended values when accessing properties without own-property checks.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-93753","epss":0.00514,"percentile":0.43823,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-93753","cwe":"CWE-1321","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"deepmerge","version":"4.2.2"}},"found":{"vulnerabilityID":"GHSA-gcqx-w48m-w2h4","versionConstraint":">=4.2.0,<=4.3.1 (semantic)"}}],"artifact":{"id":"pkg:npm/deepmerge@4.2.2?package-id=81e88dc6128ed90d","name":"deepmerge","version":"4.2.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:deepmerge:deepmerge:4.2.2:*:*:*:*:*:*:*"],"purl":"pkg:npm/deepmerge@4.2.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-73rr-hh4g-fpgx","dataSource":"https://github.com/advisories/GHSA-73rr-hh4g-fpgx","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/kpdecker/jsdiff/security/advisories/GHSA-73rr-hh4g-fpgx","https://github.com/kpdecker/jsdiff/pull/649","https://github.com/kpdecker/jsdiff/commit/15a1585230748c8ae6f8274c202e0c87309142f5","https://github.com/kpdecker/jsdiff/issues/653","https://nvd.nist.gov/vuln/detail/CVE-2026-24001"],"description":"jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U","metrics":{"baseScore":2.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-24001","epss":0.00616,"percentile":0.49546,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-24001","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-24001","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-24001","cwe":"CWE-400","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["5.2.2"],"state":"fixed","available":[{"version":"5.2.2","date":"2026-01-21","kind":"first-observed"}]},"advisories":[],"risk":0.17556000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-24001","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24001","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/kpdecker/jsdiff/commit/15a1585230748c8ae6f8274c202e0c87309142f5","https://github.com/kpdecker/jsdiff/issues/653","https://github.com/kpdecker/jsdiff/pull/649","https://github.com/kpdecker/jsdiff/security/advisories/GHSA-73rr-hh4g-fpgx","https://access.redhat.com/security/cve/CVE-2026-24001","https://bugzilla.redhat.com/show_bug.cgi?id=2431930","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24001.json"],"description":"jsdiff is a JavaScript text differencing implementation. Prior to versions 8.0.3, 5.2.2, 4.0.4, and 3.5.1, attempting to parse a patch whose filename headers contain the line break characters `\\r`, `\\u2028`, or `\\u2029` can cause the `parsePatch` method to enter an infinite loop. It then consumes memory without limit until the process crashes due to running out of memory. Applications are therefore likely to be vulnerable to a denial-of-service attack if they call `parsePatch` with a user-provided patch as input. A large payload is not needed to trigger the vulnerability, so size limits on user input do not provide any protection. Furthermore, some applications may be vulnerable even when calling `parsePatch` on a patch generated by the application itself if the user is nonetheless able to control the filename headers (e.g. by directly providing the filenames of the files to be diffed). The `applyPatch` method is similarly affected if (and only if) called with a string representation of a patch as an argument, since under the hood it parses that string using `parsePatch`. Other methods of the library are unaffected. Finally, a second and lesser interdependent bug - a ReDOS - also exhibits when those same line break characters are present in a patch's *patch* header (also known as its \"leading garbage\"). A maliciously-crafted patch header of length *n* can take `parsePatch` O(*n*³) time to parse. Versions 8.0.3, 5.2.2, 4.0.4, and 3.5.1 contain a fix. As a workaround, do not attempt to parse patches that contain any of these characters: `\\r`, `\\u2028`, or `\\u2029`.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-24001","epss":0.00616,"percentile":0.49546,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-24001","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-24001","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-24001","cwe":"CWE-400","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"diff","version":"5.1.0"}},"found":{"vulnerabilityID":"GHSA-73rr-hh4g-fpgx","versionConstraint":">=5.0.0,<5.2.2 (semantic)"},"fix":{"suggestedVersion":"5.2.2"}}],"artifact":{"id":"pkg:npm/diff@5.1.0?package-id=b94fda0553e1ad2c","name":"diff","version":"5.1.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:kpdecker:jsdiff:5.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/diff@5.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-73rr-hh4g-fpgx","dataSource":"https://github.com/advisories/GHSA-73rr-hh4g-fpgx","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/kpdecker/jsdiff/security/advisories/GHSA-73rr-hh4g-fpgx","https://github.com/kpdecker/jsdiff/pull/649","https://github.com/kpdecker/jsdiff/commit/15a1585230748c8ae6f8274c202e0c87309142f5","https://github.com/kpdecker/jsdiff/issues/653","https://nvd.nist.gov/vuln/detail/CVE-2026-24001"],"description":"jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U","metrics":{"baseScore":2.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-24001","epss":0.00616,"percentile":0.49546,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-24001","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-24001","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-24001","cwe":"CWE-400","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["8.0.3"],"state":"fixed","available":[{"version":"8.0.3","date":"2026-01-15","kind":"first-observed"}]},"advisories":[],"risk":0.17556000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-24001","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24001","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/kpdecker/jsdiff/commit/15a1585230748c8ae6f8274c202e0c87309142f5","https://github.com/kpdecker/jsdiff/issues/653","https://github.com/kpdecker/jsdiff/pull/649","https://github.com/kpdecker/jsdiff/security/advisories/GHSA-73rr-hh4g-fpgx","https://access.redhat.com/security/cve/CVE-2026-24001","https://bugzilla.redhat.com/show_bug.cgi?id=2431930","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24001.json"],"description":"jsdiff is a JavaScript text differencing implementation. Prior to versions 8.0.3, 5.2.2, 4.0.4, and 3.5.1, attempting to parse a patch whose filename headers contain the line break characters `\\r`, `\\u2028`, or `\\u2029` can cause the `parsePatch` method to enter an infinite loop. It then consumes memory without limit until the process crashes due to running out of memory. Applications are therefore likely to be vulnerable to a denial-of-service attack if they call `parsePatch` with a user-provided patch as input. A large payload is not needed to trigger the vulnerability, so size limits on user input do not provide any protection. Furthermore, some applications may be vulnerable even when calling `parsePatch` on a patch generated by the application itself if the user is nonetheless able to control the filename headers (e.g. by directly providing the filenames of the files to be diffed). The `applyPatch` method is similarly affected if (and only if) called with a string representation of a patch as an argument, since under the hood it parses that string using `parsePatch`. Other methods of the library are unaffected. Finally, a second and lesser interdependent bug - a ReDOS - also exhibits when those same line break characters are present in a patch's *patch* header (also known as its \"leading garbage\"). A maliciously-crafted patch header of length *n* can take `parsePatch` O(*n*³) time to parse. Versions 8.0.3, 5.2.2, 4.0.4, and 3.5.1 contain a fix. As a workaround, do not attempt to parse patches that contain any of these characters: `\\r`, `\\u2028`, or `\\u2029`.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-24001","epss":0.00616,"percentile":0.49546,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-24001","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-24001","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-24001","cwe":"CWE-400","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"diff","version":"7.0.0"}},"found":{"vulnerabilityID":"GHSA-73rr-hh4g-fpgx","versionConstraint":">=6.0.0,<8.0.3 (semantic)"},"fix":{"suggestedVersion":"8.0.3"}}],"artifact":{"id":"pkg:npm/diff@7.0.0?package-id=4948ddc305989acb","name":"diff","version":"7.0.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:kpdecker:jsdiff:7.0.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/diff@7.0.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-g3hv-75wg-m249","dataSource":"https://github.com/advisories/GHSA-g3hv-75wg-m249","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249","https://nvd.nist.gov/vuln/detail/CVE-2026-118764","https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1"],"description":"minimatch has potential denial of service via globparts amplification","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["11.0.1"],"state":"fixed","available":[{"version":"11.0.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.173145},"relatedVulnerabilities":[{"id":"CVE-2026-118764","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118764","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1","https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-g3hv-75wg-m249","versionConstraint":"<11.0.1 (semantic)"},"fix":{"suggestedVersion":"11.0.1"}}],"artifact":{"id":"pkg:npm/minimatch@3.1.2?package-id=7a05a1c46734c75f","name":"minimatch","version":"3.1.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-g3hv-75wg-m249","dataSource":"https://github.com/advisories/GHSA-g3hv-75wg-m249","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249","https://nvd.nist.gov/vuln/detail/CVE-2026-118764","https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1"],"description":"minimatch has potential denial of service via globparts amplification","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["11.0.1"],"state":"fixed","available":[{"version":"11.0.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.173145},"relatedVulnerabilities":[{"id":"CVE-2026-118764","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118764","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1","https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.5"}},"found":{"vulnerabilityID":"GHSA-g3hv-75wg-m249","versionConstraint":"<11.0.1 (semantic)"},"fix":{"suggestedVersion":"11.0.1"}}],"artifact":{"id":"pkg:npm/minimatch@3.1.5?package-id=0614d032aa840981","name":"minimatch","version":"3.1.5","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-g3hv-75wg-m249","dataSource":"https://github.com/advisories/GHSA-g3hv-75wg-m249","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249","https://nvd.nist.gov/vuln/detail/CVE-2026-118764","https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1"],"description":"minimatch has potential denial of service via globparts amplification","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["11.0.1"],"state":"fixed","available":[{"version":"11.0.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.173145},"relatedVulnerabilities":[{"id":"CVE-2026-118764","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118764","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1","https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"5.1.0"}},"found":{"vulnerabilityID":"GHSA-g3hv-75wg-m249","versionConstraint":"<11.0.1 (semantic)"},"fix":{"suggestedVersion":"11.0.1"}}],"artifact":{"id":"pkg:npm/minimatch@5.1.0?package-id=2a8799ea853a469d","name":"minimatch","version":"5.1.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:5.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@5.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-g3hv-75wg-m249","dataSource":"https://github.com/advisories/GHSA-g3hv-75wg-m249","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249","https://nvd.nist.gov/vuln/detail/CVE-2026-118764","https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1"],"description":"minimatch has potential denial of service via globparts amplification","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["11.0.1"],"state":"fixed","available":[{"version":"11.0.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.173145},"relatedVulnerabilities":[{"id":"CVE-2026-118764","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118764","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1","https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"5.1.9"}},"found":{"vulnerabilityID":"GHSA-g3hv-75wg-m249","versionConstraint":"<11.0.1 (semantic)"},"fix":{"suggestedVersion":"11.0.1"}}],"artifact":{"id":"pkg:npm/minimatch@5.1.9?package-id=9e7736b21b215b4d","name":"minimatch","version":"5.1.9","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:5.1.9:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@5.1.9","upstreams":[]}},{"vulnerability":{"id":"GHSA-g3hv-75wg-m249","dataSource":"https://github.com/advisories/GHSA-g3hv-75wg-m249","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249","https://nvd.nist.gov/vuln/detail/CVE-2026-118764","https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1"],"description":"minimatch has potential denial of service via globparts amplification","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["11.0.1"],"state":"fixed","available":[{"version":"11.0.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.173145},"relatedVulnerabilities":[{"id":"CVE-2026-118764","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118764","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1","https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"9.0.9"}},"found":{"vulnerabilityID":"GHSA-g3hv-75wg-m249","versionConstraint":"<11.0.1 (semantic)"},"fix":{"suggestedVersion":"11.0.1"}}],"artifact":{"id":"pkg:npm/minimatch@9.0.9?package-id=a7d1861a4b2f1279","name":"minimatch","version":"9.0.9","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:9.0.9:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@9.0.9","upstreams":[]}},{"vulnerability":{"id":"GHSA-v6h2-p8h4-qcjw","dataSource":"https://github.com/advisories/GHSA-v6h2-p8h4-qcjw","namespace":"github:language:javascript","severity":"Low","urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-5889","https://github.com/juliangruber/brace-expansion/pull/65/commits/a5b98a4f30d7813266b221435e1eaaf25a1b0ac5","https://gist.github.com/mmmsssttt404/37a40ce7d6e5ca604858fe30814d9466","https://vuldb.com/?ctiid.311660","https://vuldb.com/?id.311660","https://vuldb.com/?submit.585717","https://github.com/juliangruber/brace-expansion/commit/0b6a9781e18e9d2769bb2931f4856d1360243ed2","https://github.com/juliangruber/brace-expansion/commit/15f9b3c75ebf5988198241fecaebdc45eff28a9f","https://github.com/juliangruber/brace-expansion/commit/36603d5f3599a37af9e85eda30acd7d28599c36e","https://github.com/juliangruber/brace-expansion/commit/c3c73c8b088defc70851843be88ccc3af08e7217"],"description":"brace-expansion Regular Expression Denial of Service vulnerability","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.1,"exploitabilityScore":1.7,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-5889","epss":0.00586,"percentile":0.48006,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-5889","cwe":"CWE-400","source":"cna@vuldb.com","type":"Secondary"},{"cve":"CVE-2025-5889","cwe":"CWE-1333","source":"cna@vuldb.com","type":"Secondary"}],"fix":{"versions":["1.1.12"],"state":"fixed","available":[{"version":"1.1.12","date":"2025-06-12","kind":"first-observed"}]},"advisories":[],"risk":0.15236},"relatedVulnerabilities":[{"id":"CVE-2025-5889","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-5889","namespace":"nvd:cpe","severity":"Low","urls":["https://gist.github.com/mmmsssttt404/37a40ce7d6e5ca604858fe30814d9466","https://github.com/juliangruber/brace-expansion/pull/65/commits/a5b98a4f30d7813266b221435e1eaaf25a1b0ac5","https://github.com/juliangruber/brace-expansion/releases/tag/v4.0.1","https://vuldb.com/?ctiid.311660","https://vuldb.com/?id.311660","https://vuldb.com/?submit.585717"],"description":"A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.12, 2.0.2, 3.0.1 and 4.0.1 is able to address this issue. The name of the patch is a5b98a4f30d7813266b221435e1eaaf25a1b0ac5. It is recommended to upgrade the affected component.","cvss":[{"source":"cna@vuldb.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.3},"vendorMetadata":{}},{"source":"cna@vuldb.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.1,"exploitabilityScore":1.7,"impactScore":1.5},"vendorMetadata":{}},{"source":"cna@vuldb.com","type":"Secondary","version":"2.0","vector":"AV:N/AC:H/Au:S/C:N/I:N/A:P","metrics":{"baseScore":2.1,"exploitabilityScore":4,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-5889","epss":0.00586,"percentile":0.48006,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-5889","cwe":"CWE-400","source":"cna@vuldb.com","type":"Secondary"},{"cve":"CVE-2025-5889","cwe":"CWE-1333","source":"cna@vuldb.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.11"}},"found":{"vulnerabilityID":"GHSA-v6h2-p8h4-qcjw","versionConstraint":">=1.0.0,<=1.1.11 (semantic)"},"fix":{"suggestedVersion":"1.1.12"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.11?package-id=bb6331f39e7684a6","name":"brace-expansion","version":"1.1.11","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-v6h2-p8h4-qcjw","dataSource":"https://github.com/advisories/GHSA-v6h2-p8h4-qcjw","namespace":"github:language:javascript","severity":"Low","urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-5889","https://github.com/juliangruber/brace-expansion/pull/65/commits/a5b98a4f30d7813266b221435e1eaaf25a1b0ac5","https://gist.github.com/mmmsssttt404/37a40ce7d6e5ca604858fe30814d9466","https://vuldb.com/?ctiid.311660","https://vuldb.com/?id.311660","https://vuldb.com/?submit.585717","https://github.com/juliangruber/brace-expansion/commit/0b6a9781e18e9d2769bb2931f4856d1360243ed2","https://github.com/juliangruber/brace-expansion/commit/15f9b3c75ebf5988198241fecaebdc45eff28a9f","https://github.com/juliangruber/brace-expansion/commit/36603d5f3599a37af9e85eda30acd7d28599c36e","https://github.com/juliangruber/brace-expansion/commit/c3c73c8b088defc70851843be88ccc3af08e7217"],"description":"brace-expansion Regular Expression Denial of Service vulnerability","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.1,"exploitabilityScore":1.7,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-5889","epss":0.00586,"percentile":0.48006,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-5889","cwe":"CWE-400","source":"cna@vuldb.com","type":"Secondary"},{"cve":"CVE-2025-5889","cwe":"CWE-1333","source":"cna@vuldb.com","type":"Secondary"}],"fix":{"versions":["2.0.2"],"state":"fixed","available":[{"version":"2.0.2","date":"2025-06-12","kind":"first-observed"}]},"advisories":[],"risk":0.15236},"relatedVulnerabilities":[{"id":"CVE-2025-5889","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-5889","namespace":"nvd:cpe","severity":"Low","urls":["https://gist.github.com/mmmsssttt404/37a40ce7d6e5ca604858fe30814d9466","https://github.com/juliangruber/brace-expansion/pull/65/commits/a5b98a4f30d7813266b221435e1eaaf25a1b0ac5","https://github.com/juliangruber/brace-expansion/releases/tag/v4.0.1","https://vuldb.com/?ctiid.311660","https://vuldb.com/?id.311660","https://vuldb.com/?submit.585717"],"description":"A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.12, 2.0.2, 3.0.1 and 4.0.1 is able to address this issue. The name of the patch is a5b98a4f30d7813266b221435e1eaaf25a1b0ac5. It is recommended to upgrade the affected component.","cvss":[{"source":"cna@vuldb.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.3},"vendorMetadata":{}},{"source":"cna@vuldb.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.1,"exploitabilityScore":1.7,"impactScore":1.5},"vendorMetadata":{}},{"source":"cna@vuldb.com","type":"Secondary","version":"2.0","vector":"AV:N/AC:H/Au:S/C:N/I:N/A:P","metrics":{"baseScore":2.1,"exploitabilityScore":4,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-5889","epss":0.00586,"percentile":0.48006,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-5889","cwe":"CWE-400","source":"cna@vuldb.com","type":"Secondary"},{"cve":"CVE-2025-5889","cwe":"CWE-1333","source":"cna@vuldb.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"2.0.1"}},"found":{"vulnerabilityID":"GHSA-v6h2-p8h4-qcjw","versionConstraint":">=2.0.0,<=2.0.1 (semantic)"},"fix":{"suggestedVersion":"2.0.2"}}],"artifact":{"id":"pkg:npm/brace-expansion@2.0.1?package-id=569f54ca8e83a456","name":"brace-expansion","version":"2.0.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:2.0.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@2.0.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-vfgh-jcmw-g37q","dataSource":"https://github.com/advisories/GHSA-vfgh-jcmw-g37q","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/markdown-it/markdown-it/security/advisories/GHSA-vfgh-jcmw-g37q","https://nvd.nist.gov/vuln/detail/CVE-2026-111766","https://github.com/markdown-it/markdown-it/commit/928bc8c11ded60181c0e7fc5aa954eec582e8e79","https://github.com/markdown-it/markdown-it/commit/d99f48839d37af6fd8a2617516c43dab90755503","https://github.com/markdown-it/markdown-it/releases/tag/14.3.3","https://github.com/markdown-it/markdown-it/releases/tag/15.0.3"],"description":"markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111766","epss":0.00428,"percentile":0.37065,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111766","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-111766","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["14.3.3"],"state":"fixed","available":[{"version":"14.3.3","date":"2026-10-21","kind":"first-observed"}]},"advisories":[],"risk":0.14337999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-111766","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111766","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/markdown-it/markdown-it/commit/928bc8c11ded60181c0e7fc5aa954eec582e8e79","https://github.com/markdown-it/markdown-it/commit/d99f48839d37af6fd8a2617516c43dab90755503","https://github.com/markdown-it/markdown-it/releases/tag/14.3.3","https://github.com/markdown-it/markdown-it/releases/tag/15.0.3","https://github.com/markdown-it/markdown-it/security/advisories/GHSA-vfgh-jcmw-g37q"],"description":"markdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark preset is enabled and the constructs occur inside a paragraph, attacker-controlled Markdown containing repeated unterminated inline HTML comments, processing instructions, declarations, or CDATA sections reaches src/rules_inline/html_inline.ts. Its HTML_TAG_RE match searches the remaining suffix for the appropriate terminator; when no terminator is present, parsing advances to the next opener and repeats the match over overlapping input, causing quadratic processing and denial of service through event-loop blocking or an unresponsive browser main thread. HTML blocks and the default HTML-disabled configuration are not affected by these payloads. This issue is fixed in versions 14.3.3 and 15.0.3.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111766","epss":0.00428,"percentile":0.37065,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111766","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-111766","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"markdown-it","version":"13.0.1"}},"found":{"vulnerabilityID":"GHSA-vfgh-jcmw-g37q","versionConstraint":"<14.3.3 (semantic)"},"fix":{"suggestedVersion":"14.3.3"}}],"artifact":{"id":"pkg:npm/markdown-it@13.0.1?package-id=59ad530bbde4b9d0","name":"markdown-it","version":"13.0.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:markdown-it_project:markdown-it:13.0.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/markdown-it@13.0.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-xw65-4hp5-5hc7","dataSource":"https://github.com/advisories/GHSA-xw65-4hp5-5hc7","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xw65-4hp5-5hc7","https://nvd.nist.gov/vuln/detail/CVE-2026-106444","https://github.com/handlebars-lang/handlebars.js/pull/2185","https://github.com/handlebars-lang/handlebars.js/commit/609d1b11c833c9a3e00f56f2f34d22f425446725","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10"],"description":"Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":1.7,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-106444","epss":0.0029,"percentile":0.21631,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-106444","cwe":"CWE-116","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["4.7.10"],"state":"fixed","available":[{"version":"4.7.10","date":"2026-10-09","kind":"first-observed"}]},"advisories":[],"risk":0.14064999999999997},"relatedVulnerabilities":[{"id":"CVE-2026-106444","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106444","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/handlebars-lang/handlebars.js/commit/609d1b11c833c9a3e00f56f2f34d22f425446725","https://github.com/handlebars-lang/handlebars.js/pull/2185","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10","https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xw65-4hp5-5hc7"],"description":"Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.precompile() uses quotedString() in lib/handlebars/compiler/code-gen.js to emit static template text into generated JavaScript without escaping sequences that terminate an enclosing HTML script element. When an application precompiles attacker-controlled template text and embeds the generated source directly in an inline script element, a closing script delimiter can end the element and cause following attacker-controlled markup to be parsed and executed. Ordinary server-side rendering and precompiled templates served as external JavaScript files are not affected. This issue is fixed in version 4.7.10.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":1.7,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-106444","epss":0.0029,"percentile":0.21631,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-106444","cwe":"CWE-116","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"handlebars","version":"4.7.9"}},"found":{"vulnerabilityID":"GHSA-xw65-4hp5-5hc7","versionConstraint":">=4.0.0,<=4.7.9 (semantic)"},"fix":{"suggestedVersion":"4.7.10"}}],"artifact":{"id":"pkg:npm/handlebars@4.7.9?package-id=e10bd740e9465895","name":"handlebars","version":"4.7.9","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:handlebars.js_project:handlebars.js:4.7.9:*:*:*:*:node.js:*:*","cpe:2.3:a:handlebarsjs:handlebars:4.7.9:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/handlebars@4.7.9","upstreams":[]}},{"vulnerability":{"id":"GHSA-vmf3-w455-68vh","dataSource":"https://github.com/advisories/GHSA-vmf3-w455-68vh","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-vmf3-w455-68vh"],"description":"node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53655","epss":0.00156,"percentile":0.04757,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53655","cwe":"CWE-436","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.5.16"],"state":"fixed","available":[{"version":"7.5.16","date":"2026-06-15","kind":"first-observed"}]},"advisories":[],"risk":0.09281999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-53655","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53655","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-vmf3-w455-68vh"],"description":"node-tar is a full-featured Tar for Node.js. Prior to 7.5.16, tar (node-tar) applies a PAX extended header's size= record (and other PAX overrides) to the next header entry of any type, including intermediary metadata headers such as a GNU long-name (L) or long-link (K) entry. Per POSIX pax, a PAX extended header (x) describes the next file entry, not the intermediary extension headers that may sit between the x header and the file it annotates. Because node-tar lets the PAX size override the byte length of an intervening L/K/x header, an attacker can desynchronize node-tar's stream cursor relative to every other mainstream tar implementation (GNU tar, libarchive/bsdtar, Python tarfile, and the now-fixed tar-rs / astral-tokio-tar). The result is a tar parser interpretation differential (CWE-436): a single crafted archive yields a different set of members under node-tar than under the reference tar tools. An attacker can use this to hide a member from one parser while it is visible to another, which defeats security tooling whose scanner and extractor disagree on archive contents (e.g. a malware/secret scanner that lists entries with one library while a downstream step extracts with another) This vulnerability is fixed in 7.5.16.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.5,"exploitabilityScore":1.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53655","epss":0.00156,"percentile":0.04757,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53655","cwe":"CWE-436","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"6.1.11"}},"found":{"vulnerabilityID":"GHSA-vmf3-w455-68vh","versionConstraint":"<=7.5.15 (semantic)"},"fix":{"suggestedVersion":"7.5.16"}}],"artifact":{"id":"pkg:npm/tar@6.1.11?package-id=3853c86fbd5d8342","name":"tar","version":"6.1.11","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:tar_project:tar:6.1.11:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:6.1.11:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:6.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@6.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-m5mm-p8h7-m29v","dataSource":"https://github.com/advisories/GHSA-m5mm-p8h7-m29v","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-m5mm-p8h7-m29v","https://github.com/yahoo/serialize-javascript/pull/235","https://github.com/yahoo/serialize-javascript/commit/2864b3c6260a3bfd52d2db3e70d1a079de108a61","https://github.com/yahoo/serialize-javascript/releases/tag/v7.1.3"],"description":"Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","metrics":{"baseScore":2.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-115897","epss":0.00307,"percentile":0.23501,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-115897","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.1.3"],"state":"fixed","available":[{"version":"7.1.3","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.078285},"relatedVulnerabilities":[{"id":"CVE-2026-115897","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115897","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/yahoo/serialize-javascript/commit/2864b3c6260a3bfd52d2db3e70d1a079de108a61","https://github.com/yahoo/serialize-javascript/pull/235","https://github.com/yahoo/serialize-javascript/releases/tag/v7.1.3","https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-m5mm-p8h7-m29v"],"description":"Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. Prior to 7.1.3, the function-source escaping logic does not neutralize a bare closing-script prefix when attacker-influenced function source text ends exactly at that prefix. Because each function body is escaped independently, a delimiter supplied by surrounding serialized output can terminate an HTML script element, and a later serialized value supplies injected markup that becomes a live element in the page. Exploitation requires control of a serialized function's source text, such as through a spoofed toString(). This issue is fixed in version 7.1.3.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-115897","epss":0.00307,"percentile":0.23501,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-115897","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"serialize-javascript","version":"6.0.2"}},"found":{"vulnerabilityID":"GHSA-m5mm-p8h7-m29v","versionConstraint":"<7.1.3 (semantic)"},"fix":{"suggestedVersion":"7.1.3"}}],"artifact":{"id":"pkg:npm/serialize-javascript@6.0.2?package-id=16a1894b547e5cc6","name":"serialize-javascript","version":"6.0.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:verizon:serialize-javascript:6.0.2:*:*:*:*:node.js:*:*","cpe:2.3:a:yahoo:serialize_javascript:6.0.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/serialize-javascript@6.0.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-vpq2-c234-7xj6","dataSource":"https://github.com/advisories/GHSA-vpq2-c234-7xj6","namespace":"github:language:javascript","severity":"Low","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-3449","https://github.com/TooTallNate/once/issues/8","https://github.com/TooTallNate/once/commit/b9f43cc5259bee2952d91ad3cdbd201a82df448a","https://security.snyk.io/vuln/SNYK-JS-TOOTALLNATEONCE-15250612","https://github.com/TooTallNate/once/releases/tag/v2.0.1"],"description":"@tootallnate/once vulnerable to Incorrect Control Flow Scoping","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"exploitabilityScore":1.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":1.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-3449","epss":0.00128,"percentile":0.02454,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-3449","cwe":"CWE-705","source":"report@snyk.io","type":"Secondary"}],"fix":{"versions":["2.0.1"],"state":"fixed","available":[{"version":"2.0.1","date":"2026-05-21","kind":"first-observed"}]},"advisories":[],"risk":0.03584},"relatedVulnerabilities":[{"id":"CVE-2026-3449","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3449","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/TooTallNate/once/commit/b9f43cc5259bee2952d91ad3cdbd201a82df448a","https://github.com/TooTallNate/once/issues/8","https://security.snyk.io/vuln/SNYK-JS-TOOTALLNATEONCE-15250612"],"description":"Versions of the package @tootallnate/once before 3.0.1 are vulnerable to Incorrect Control Flow Scoping in promise resolving when AbortSignal option is used. The Promise remains in a permanently pending state after the signal is aborted, causing any await or .then() usage to hang indefinitely. This can cause a control-flow leak that can lead to stalled requests, blocked workers, or degraded application availability.","cvss":[{"source":"report@snyk.io","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.9},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"exploitabilityScore":1.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-3449","epss":0.00128,"percentile":0.02454,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-3449","cwe":"CWE-705","source":"report@snyk.io","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@tootallnate/once","version":"2.0.0"}},"found":{"vulnerabilityID":"GHSA-vpq2-c234-7xj6","versionConstraint":"<2.0.1 (semantic)"},"fix":{"suggestedVersion":"2.0.1"}}],"artifact":{"id":"pkg:npm/%40tootallnate/once@2.0.0?package-id=2bff9d2166572149","name":"@tootallnate/once","version":"2.0.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:\\@tootallnate\\/once:\\@tootallnate\\/once:2.0.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40tootallnate/once@2.0.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-vpq2-c234-7xj6","dataSource":"https://github.com/advisories/GHSA-vpq2-c234-7xj6","namespace":"github:language:javascript","severity":"Low","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-3449","https://github.com/TooTallNate/once/issues/8","https://github.com/TooTallNate/once/commit/b9f43cc5259bee2952d91ad3cdbd201a82df448a","https://security.snyk.io/vuln/SNYK-JS-TOOTALLNATEONCE-15250612","https://github.com/TooTallNate/once/releases/tag/v2.0.1"],"description":"@tootallnate/once vulnerable to Incorrect Control Flow Scoping","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"exploitabilityScore":1.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":1.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-3449","epss":0.00128,"percentile":0.02454,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-3449","cwe":"CWE-705","source":"report@snyk.io","type":"Secondary"}],"fix":{"versions":["2.0.1"],"state":"fixed","available":[{"version":"2.0.1","date":"2026-05-21","kind":"first-observed"}]},"advisories":[],"risk":0.03584},"relatedVulnerabilities":[{"id":"CVE-2026-3449","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3449","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/TooTallNate/once/commit/b9f43cc5259bee2952d91ad3cdbd201a82df448a","https://github.com/TooTallNate/once/issues/8","https://security.snyk.io/vuln/SNYK-JS-TOOTALLNATEONCE-15250612"],"description":"Versions of the package @tootallnate/once before 3.0.1 are vulnerable to Incorrect Control Flow Scoping in promise resolving when AbortSignal option is used. The Promise remains in a permanently pending state after the signal is aborted, causing any await or .then() usage to hang indefinitely. This can cause a control-flow leak that can lead to stalled requests, blocked workers, or degraded application availability.","cvss":[{"source":"report@snyk.io","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.9},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"exploitabilityScore":1.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-3449","epss":0.00128,"percentile":0.02454,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-3449","cwe":"CWE-705","source":"report@snyk.io","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@tootallnate/once","version":"2.0.0"}},"found":{"vulnerabilityID":"GHSA-vpq2-c234-7xj6","versionConstraint":"<2.0.1 (semantic)"},"fix":{"suggestedVersion":"2.0.1"}}],"artifact":{"id":"pkg:npm/%40tootallnate/once@2.0.0?package-id=67d9a1e0fa33fa4e","name":"@tootallnate/once","version":"2.0.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:\\@tootallnate\\/once:\\@tootallnate\\/once:2.0.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40tootallnate/once@2.0.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-5c6j-r48x-rmvq","dataSource":"https://github.com/advisories/GHSA-5c6j-r48x-rmvq","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-5c6j-r48x-rmvq","https://nvd.nist.gov/vuln/detail/CVE-2020-7660","https://github.com/yahoo/serialize-javascript/commit/2e609d0a9f4f5b097f0945af88bd45b9c7fb48d9","https://github.com/advisories/GHSA-hxcc-f52p-wc94","https://github.com/yahoo/serialize-javascript/releases/tag/v7.0.3"],"description":"Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}}],"fix":{"versions":["7.0.3"],"state":"fixed","available":[{"version":"7.0.3","date":"2026-02-28","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"serialize-javascript","version":"6.0.2"}},"found":{"vulnerabilityID":"GHSA-5c6j-r48x-rmvq","versionConstraint":"<=7.0.2 (semantic)"},"fix":{"suggestedVersion":"7.0.3"}}],"artifact":{"id":"pkg:npm/serialize-javascript@6.0.2?package-id=16a1894b547e5cc6","name":"serialize-javascript","version":"6.0.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:verizon:serialize-javascript:6.0.2:*:*:*:*:node.js:*:*","cpe:2.3:a:yahoo:serialize_javascript:6.0.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/serialize-javascript@6.0.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-253c-mchw-3w2r","dataSource":"https://github.com/advisories/GHSA-253c-mchw-3w2r","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/markdown-it/markdown-it/security/advisories/GHSA-253c-mchw-3w2r","https://github.com/markdown-it/markdown-it/commit/09fa07118dda4c953f058848f53dae88395618ca","https://github.com/markdown-it/markdown-it/commit/aaadcfa6d817b3c5f89afb49d97c7b797a6dd4fd","https://github.com/markdown-it/markdown-it/commit/ad70f6b7cff64bee10e42a774147112480ca0d49"],"description":"markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"fix":{"versions":["14.3.1"],"state":"fixed","available":[{"version":"14.3.1","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"markdown-it","version":"13.0.1"}},"found":{"vulnerabilityID":"GHSA-253c-mchw-3w2r","versionConstraint":"<14.3.1 (semantic)"},"fix":{"suggestedVersion":"14.3.1"}}],"artifact":{"id":"pkg:npm/markdown-it@13.0.1?package-id=59ad530bbde4b9d0","name":"markdown-it","version":"13.0.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:markdown-it_project:markdown-it:13.0.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/markdown-it@13.0.1","upstreams":[]}}],"source":{"type":"file","target":"eslint-community/eslint-plugin-security"},"distro":{"name":"","version":"","idLike":null},"descriptor":{"name":"grype","version":"0.121.0","configuration":{"output":["json"],"file":"./grype.json","pretty":false,"distro":"","add-cpes-if-none":false,"output-template-file":"","check-for-app-update":true,"only-fixed":false,"only-notfixed":false,"ignore-wontfix":"","platform":"","search":{"scope":"squashed","unindexed-archives":false,"indexed-archives":true},"ignore":[{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"kernel-headers","version":"","language":"","type":"rpm","location":"","upstream-name":"kernel"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux(-.*)?-headers-.*","version":"","language":"","type":"deb","location":"","upstream-name":"linux.*"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux-libc-dev","version":"","language":"","type":"deb","location":"","upstream-name":"linux"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux-kbuild-.*","version":"","language":"","type":"deb","location":"","upstream-name":"linux.*"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"}],"exclude":[],"externalSources":{"enable":false,"maven":{"searchUpstreamBySha1":true,"baseUrl":"https://search.maven.org/solrsearch/select","rateLimit":300000000}},"match":{"java":{"using-cpes":false},"jvm":{"using-cpes":true},"dotnet":{"using-cpes":false},"golang":{"using-cpes":false,"always-use-cpe-for-stdlib":false,"allow-main-module-pseudo-version-comparison":false},"javascript":{"using-cpes":false},"python":{"using-cpes":false},"ruby":{"using-cpes":false},"rust":{"using-cpes":false},"hex":{"using-cpes":false},"stock":{"using-cpes":true},"dpkg":{"using-cpes":false,"missing-epoch-strategy":"zero","use-cpes-for-eol":false},"rpm":{"using-cpes":false,"missing-epoch-strategy":"auto","use-cpes-for-eol":false}},"fail-on-severity":"","registry":{"insecure-skip-tls-verify":false,"insecure-use-http":false,"ca-cert":""},"show-suppressed":false,"include-matcher-suppressions":false,"by-cve":false,"SortBy":{"sort-by":"risk"},"name":"","default-image-pull-source":"","from":null,"vex-documents":[],"vex-add":[],"match-upstream-kernel-headers":false,"fix-channel":{"redhat-eus":{"apply":"auto","versions":">= 8.0"},"ubuntu-esm":{"apply":"auto","versions":""}},"timestamp":true,"alerts":{"enable-eol-distro-warnings":true},"db":{"cache-dir":"$HOME/.cache/grype/db","update-url":"https://grype.anchore.io/databases","ca-cert":"","auto-update":true,"validate-by-hash-on-start":true,"validate-age":true,"max-allowed-built-age":432000000000000,"require-update-check":false,"update-available-timeout":30000000000,"update-download-timeout":300000000000,"max-update-check-frequency":7200000000000},"exp":{},"dev":{"db":{"debug":false}}},"db":{"status":{"schemaVersion":"v6.1.10","from":"https://grype.anchore.io/databases/v6/vulnerability-db_v6.1.10_2026-11-01T00:24:34Z_1793514012.tar.zst?checksum=sha256%3Ad0e1af9e6491440e1a671d0a0aafc32c5c7cb5cda787dcec3482799ef298f31c","built":"2026-11-01T06:20:12Z","path":"$HOME/.cache/grype/db/6/vulnerability.db","valid":true},"providers":{"alma":{"captured":"2026-11-01T00:24:39Z","input":"xxh64:d398731e6455b022"},"alpine":{"captured":"2026-11-01T00:24:47Z","input":"xxh64:c40c8985935df81b"},"amazon":{"captured":"2026-11-01T00:24:37Z","input":"xxh64:ee129200b14d5c8a"},"arch":{"captured":"2026-11-01T00:24:47Z","input":"xxh64:14f6c24dd6cd12c8"},"bitnami":{"captured":"2026-11-01T00:24:34Z","input":"xxh64:971619846357ae10"},"chainguard":{"captured":"2026-11-01T00:24:48Z","input":"xxh64:dfbf78c7fc58a603"},"chainguard-libraries":{"captured":"2026-11-01T00:24:50Z","input":"xxh64:db9c34dd1b7bc8d0"},"debian":{"captured":"2026-11-01T00:24:52Z","input":"xxh64:078c82a49c8cb529"},"echo":{"captured":"2026-11-01T00:24:41Z","input":"xxh64:1d0df98736854a48"},"eol":{"captured":"2026-11-01T00:24:59Z","input":"xxh64:0f2164b3e62ba44b"},"epss":{"captured":"2026-11-01T00:25:00Z","input":"xxh64:0d4c3b8d2c2e5188"},"fedora":{"captured":"2026-11-01T00:24:40Z","input":"xxh64:28fe3d1d8ae41f9b"},"github":{"captured":"2026-11-01T00:24:57Z","input":"xxh64:076a86d2dc5c9e83"},"govulndb":{"captured":"2026-11-01T00:24:45Z","input":"xxh64:56e169604e12196e"},"hummingbird":{"captured":"2026-11-01T00:27:26Z","input":"xxh64:e86abd0466410fb6"},"kev":{"captured":"2026-11-01T00:25:06Z","input":"xxh64:cb0f4041bd51c379"},"mariner":{"captured":"2026-11-01T00:24:56Z","input":"xxh64:003337efdc7e1888"},"minimos":{"captured":"2026-11-01T00:24:56Z","input":"xxh64:219c30ffded7a12c"},"nvd":{"captured":"2026-11-01T00:25:41Z","input":"xxh64:75e41eec415fdb0a"},"oracle":{"captured":"2026-11-01T00:24:42Z","input":"xxh64:0546c2dd11a85c07"},"photon":{"captured":"2026-11-01T00:24:37Z","input":"xxh64:8dbfd0c521fd470a"},"rhel":{"captured":"2026-11-01T01:08:40Z","input":"xxh64:57c5e6a7f9f134ff"},"secureos":{"captured":"2026-11-01T00:24:34Z","input":"xxh64:ac7fa7f44e8ed7dd"},"sles":{"captured":"2026-11-01T00:26:56Z","input":"xxh64:025a1565b2cc7cdf"},"ubuntu":{"captured":"2026-11-01T00:25:58Z","input":"xxh64:9ab4d29f0ea6275d"},"wolfi":{"captured":"2026-11-01T00:25:02Z","input":"xxh64:d27b08e998baab8e"}}},"timestamp":"2026-11-02T03:07:34.941911066Z"}}