{"matches":[{"vulnerability":{"id":"GHSA-587h-7wmj-h5pm","dataSource":"https://github.com/advisories/GHSA-587h-7wmj-h5pm","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/vitejs/launch-editor/security/advisories/GHSA-587h-7wmj-h5pm","https://nvd.nist.gov/vuln/detail/CVE-2026-112942","https://github.com/vitejs/launch-editor/commit/f13cd835d4b8e860b1d4d080ad8a490cc2463679","https://github.com/vitejs/launch-editor/releases/tag/v2.14.2"],"description":"launch-editor: `fs.existsSync()` existence check can be bypassed on Windows","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":7.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112942","epss":0.01344,"percentile":0.71405,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112942","cwe":"CWE-77","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["8.3.3"],"state":"fixed","available":[{"version":"8.3.3","date":"2026-10-21","kind":"first-observed"}]},"advisories":[],"risk":1.008},"relatedVulnerabilities":[{"id":"CVE-2026-112942","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112942","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/vitejs/launch-editor/commit/f13cd835d4b8e860b1d4d080ad8a490cc2463679","https://github.com/vitejs/launch-editor/releases/tag/v2.14.2","https://github.com/vitejs/launch-editor/security/advisories/GHSA-587h-7wmj-h5pm"],"description":"launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor-middleware processes an attacker-controlled Windows file argument where the file argument ends in a parent-directory component plus a line-and-column suffix: the path is resolved while the suffix is still present, and launch-editor removes the suffix before its existsSync check, leaving the existing parent directory for existsSync and allowing the attacker-controlled file argument to pass filename existence validation without requiring the malicious filename to exist. The bypass can lead to OS command injection when combined with the separately described Windows percent-expansion flaw. This issue is fixed in version 2.14.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112942","epss":0.01344,"percentile":0.71405,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112942","cwe":"CWE-77","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"vite","version":"8.3.0"}},"found":{"vulnerabilityID":"GHSA-587h-7wmj-h5pm","versionConstraint":">=8.3.0,<=8.3.2 (semantic)"},"fix":{"suggestedVersion":"8.3.3"}}],"artifact":{"id":"pkg:npm/vite@8.3.0?package-id=901eaa4e2288cc6e","name":"vite","version":"8.3.0","type":"npm","locations":[{"path":"/web/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vitejs:vite:8.3.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/vite@8.3.0","upstreams":[]}},{"vulnerability":{"id":"GO-2026-6612","dataSource":"https://go.dev/cl/847187","namespace":"govulndb:language:go","severity":"Critical","urls":["https://go.dev/cl/847310","https://go.dev/issue/81743","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"],"description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78663","epss":0.00622,"percentile":0.49817,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78663","cwe":"CWE-675","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.60.0"],"state":"fixed","available":[{"version":"0.60.0","date":"2026-10-08","kind":"release"}]},"advisories":[],"risk":0.56291},"relatedVulnerabilities":[{"id":"CVE-2026-78663","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78663","namespace":"nvd:cpe","severity":"Critical","urls":["https://go.dev/cl/847187","https://go.dev/cl/847310","https://go.dev/issue/81743","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://pkg.go.dev/vuln/GO-2026-6612"],"description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78663","epss":0.00622,"percentile":0.49817,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78663","cwe":"CWE-675","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.58.0"}},"found":{"vulnerabilityID":"GO-2026-6612","versionConstraint":"<0.60.0 (go)"},"fix":{"suggestedVersion":"0.60.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.58.0?package-id=f556606ebb1221ee","name":"golang.org/x/net","version":"v0.58.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.58.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.58.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.58.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To="}}},{"vulnerability":{"id":"GHSA-2v4p-qf9q-27wj","dataSource":"https://github.com/advisories/GHSA-2v4p-qf9q-27wj","namespace":"github:language:go","severity":"High","urls":["https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj","https://github.com/grpc/grpc-go/issues/9354","https://github.com/grpc/grpc-go/pull/9365","https://github.com/grpc/grpc-go/pull/9366","https://github.com/grpc/grpc-go/pull/9367","https://github.com/grpc/grpc-go/commit/3822494d8ea03b992c089fd2a195f041762fffb7","https://github.com/grpc/grpc-go/commit/8668b69c167df908b6b3666dcbf40992b9e932a4","https://github.com/grpc/grpc-go/commit/93e31b48545e2a8aaeb6e06b47fb249f94e6297f","https://github.com/grpc/grpc-go/releases/tag/v1.82.2","https://github.com/grpc/grpc-go/releases/tag/v1.83.2","https://nvd.nist.gov/vuln/detail/CVE-2026-84445"],"description":"gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84445","epss":0.00641,"percentile":0.50726,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84445","cwe":"CWE-129","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-84445","cwe":"CWE-248","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["1.83.2"],"state":"fixed","available":[{"version":"1.83.2","date":"2026-09-09","kind":"first-observed"}]},"advisories":[],"risk":0.51921},"relatedVulnerabilities":[{"id":"CVE-2026-84445","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84445","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/grpc/grpc-go/commit/3822494d8ea03b992c089fd2a195f041762fffb7","https://github.com/grpc/grpc-go/commit/8668b69c167df908b6b3666dcbf40992b9e932a4","https://github.com/grpc/grpc-go/commit/93e31b48545e2a8aaeb6e06b47fb249f94e6297f","https://github.com/grpc/grpc-go/issues/9354","https://github.com/grpc/grpc-go/pull/9365","https://github.com/grpc/grpc-go/pull/9366","https://github.com/grpc/grpc-go/pull/9367","https://github.com/grpc/grpc-go/releases/tag/v1.82.2","https://github.com/grpc/grpc-go/releases/tag/v1.83.2","https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj"],"description":"gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow internal/transport/http2_server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in internal/xds/server/routing.go assumes that an authority value exists and indexes the empty slice. A remote client that can complete transport connection establishment can trigger an index-out-of-bounds panic that is not recovered by the per-RPC goroutine and terminates the entire server process. In insecure or ordinary TLS deployments the request can be unauthenticated, while strict mTLS or ALTS deployments require valid transport credentials before the malformed RPC can reach the interceptor. This issue is fixed in versions 1.82.2 and 1.83.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84445","epss":0.00641,"percentile":0.50726,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84445","cwe":"CWE-129","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-84445","cwe":"CWE-248","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"google.golang.org/grpc","version":"v1.83.1"}},"found":{"vulnerabilityID":"GHSA-2v4p-qf9q-27wj","versionConstraint":">=1.83.0,<1.83.2 (go)"},"fix":{"suggestedVersion":"1.83.2"}}],"artifact":{"id":"pkg:golang/google.golang.org/grpc@v1.83.1?package-id=f694e901ae5b5efc","name":"google.golang.org/grpc","version":"v1.83.1","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:google:grpc:v1.83.1:*:*:*:*:*:*:*"],"purl":"pkg:golang/google.golang.org/grpc@v1.83.1","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:HIO0+BEtBP6soyqvqC8sNUjZ7bTs+0hFQuFF+RAy++Y="}}},{"vulnerability":{"id":"GHSA-rq7h-c2jc-7f22","dataSource":"https://github.com/advisories/GHSA-rq7h-c2jc-7f22","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/vitejs/vite/security/advisories/GHSA-rq7h-c2jc-7f22","https://nvd.nist.gov/vuln/detail/CVE-2026-112946","https://github.com/vitejs/vite/pull/23656","https://github.com/vitejs/vite/commit/170b92791421bcd484f7325936d989a82d6bd4aa","https://github.com/vitejs/vite/commit/45c0e3392a298626955a0ab93a8e51232daac721","https://github.com/vitejs/vite/commit/c3e06f92e969952466b4e2f5801e85e1e00cd905","https://github.com/vitejs/vite/commit/e570d8d016096b5f8f6f09808376ca6cf73f27d0","https://github.com/vitejs/vite/commit/f0d76c7da13d5e794807b82f0b86c1931a8438e3"],"description":"Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112946","epss":0.00852,"percentile":0.58266,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112946","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-112946","cwe":"CWE-284","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["8.3.3"],"state":"fixed","available":[{"version":"8.3.3","date":"2026-10-22","kind":"first-observed"}]},"advisories":[],"risk":0.4813799999999999},"relatedVulnerabilities":[{"id":"CVE-2026-112946","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112946","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/vitejs/vite/commit/170b92791421bcd484f7325936d989a82d6bd4aa","https://github.com/vitejs/vite/commit/45c0e3392a298626955a0ab93a8e51232daac721","https://github.com/vitejs/vite/commit/c3e06f92e969952466b4e2f5801e85e1e00cd905","https://github.com/vitejs/vite/commit/e570d8d016096b5f8f6f09808376ca6cf73f27d0","https://github.com/vitejs/vite/commit/f0d76c7da13d5e794807b82f0b86c1931a8438e3","https://github.com/vitejs/vite/pull/23656","https://github.com/vitejs/vite/security/advisories/GHSA-rq7h-c2jc-7f22"],"description":"Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, import analysis can record a root-relative browser URL in safeModulePaths instead of the cleaned resolved module identifier. On a network-accessible, non-Windows development server, an imported project file whose URL matches an absolute host path can authorize a later raw-filesystem request for that host file, provided server.fs.deny does not block it. The request can disclose the matching file outside the project root, but it does not allow arbitrary path traversal because the host path must correspond to a project-relative URL authorized by the application graph. This issue is fixed in versions 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112946","epss":0.00852,"percentile":0.58266,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112946","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-112946","cwe":"CWE-284","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"vite","version":"8.3.0"}},"found":{"vulnerabilityID":"GHSA-rq7h-c2jc-7f22","versionConstraint":">=8.3.0,<=8.3.2 (semantic)"},"fix":{"suggestedVersion":"8.3.3"}}],"artifact":{"id":"pkg:npm/vite@8.3.0?package-id=901eaa4e2288cc6e","name":"vite","version":"8.3.0","type":"npm","locations":[{"path":"/web/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vitejs:vite:8.3.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/vite@8.3.0","upstreams":[]}},{"vulnerability":{"id":"GO-2026-6603","dataSource":"https://go.dev/cl/847185","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/cl/847314","https://go.dev/issue/81857","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"],"description":"When \"Trailer\" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a \"Trailer\" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78659","epss":0.00627,"percentile":0.50086,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78659","cwe":"CWE-405","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.60.0"],"state":"fixed","available":[{"version":"0.60.0","date":"2026-10-08","kind":"release"}]},"advisories":[],"risk":0.47025},"relatedVulnerabilities":[{"id":"CVE-2026-78659","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78659","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/847185","https://go.dev/cl/847314","https://go.dev/issue/81857","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://pkg.go.dev/vuln/GO-2026-6603"],"description":"When \"Trailer\" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a \"Trailer\" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78659","epss":0.00627,"percentile":0.50086,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78659","cwe":"CWE-405","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.58.0"}},"found":{"vulnerabilityID":"GO-2026-6603","versionConstraint":"<0.60.0 (go)"},"fix":{"suggestedVersion":"0.60.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.58.0?package-id=f556606ebb1221ee","name":"golang.org/x/net","version":"v0.58.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.58.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.58.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.58.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To="}}},{"vulnerability":{"id":"GHSA-xjh9-v7x6-24jw","dataSource":"https://github.com/advisories/GHSA-xjh9-v7x6-24jw","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/fastify/busboy/security/advisories/GHSA-xjh9-v7x6-24jw","https://nvd.nist.gov/vuln/detail/CVE-2026-19484","https://github.com/fastify/busboy/commit/632a237e7fb6b3b7a30e0de8fab2ee72ca5bf722","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/busboy/releases/tag/v3.2.1"],"description":"@fastify/busboy vulnerable to Denial of Service via oversized multipart boundary","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-19484","epss":0.00615,"percentile":0.49453,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-19484","cwe":"CWE-835","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-19484","cwe":"CWE-1322","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["3.2.1"],"state":"fixed","available":[{"version":"3.2.1","date":"2026-10-03","kind":"first-observed"}]},"advisories":[],"risk":0.46125000000000005},"relatedVulnerabilities":[{"id":"CVE-2026-19484","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19484","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/busboy/security/advisories/GHSA-xjh9-v7x6-24jw"],"description":"@fastify/busboy is a multipart form-data parser. In versions 3.1.0 through 3.2.0, a remote unauthenticated attacker can stall the Node.js event loop by sending a multipart request whose boundary is crafted to a specific length. The vendored streaming search stores its skip table in a fixed 256 entry byte array, and a boundary of exactly 252 bytes makes the search needle 256 bytes, which truncates the default skip distance to zero and turns the search into a CPU bound loop on a small body. A single small request can keep one core busy and deny service to other requests handled by the same process. The issue is fixed in @fastify/busboy 3.2.1, which widens the skip table so the skip distance is preserved. Users should upgrade to 3.2.1.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-19484","epss":0.00615,"percentile":0.49453,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-19484","cwe":"CWE-835","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-19484","cwe":"CWE-1322","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@fastify/busboy","version":"3.2.0"}},"found":{"vulnerabilityID":"GHSA-xjh9-v7x6-24jw","versionConstraint":">=3.1.0,<3.2.1 (semantic)"},"fix":{"suggestedVersion":"3.2.1"}}],"artifact":{"id":"pkg:npm/%40fastify/busboy@3.2.0?package-id=b983dcf7d5513432","name":"@fastify/busboy","version":"3.2.0","type":"npm","locations":[{"path":"/web/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:fastify:fastify\\/busyboy:3.2.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/%40fastify/busboy@3.2.0","upstreams":[]}},{"vulnerability":{"id":"GO-2026-6611","dataSource":"https://go.dev/cl/847186","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/cl/847308","https://go.dev/issue/81742","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"],"description":"A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78669","epss":0.00614,"percentile":0.49429,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78669","cwe":"CWE-405","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.60.0"],"state":"fixed","available":[{"version":"0.60.0","date":"2026-10-08","kind":"release"}]},"advisories":[],"risk":0.46049999999999996},"relatedVulnerabilities":[{"id":"CVE-2026-78669","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78669","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/847186","https://go.dev/cl/847308","https://go.dev/issue/81742","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://pkg.go.dev/vuln/GO-2026-6611"],"description":"A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78669","epss":0.00614,"percentile":0.49429,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78669","cwe":"CWE-405","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.58.0"}},"found":{"vulnerabilityID":"GO-2026-6611","versionConstraint":"<0.60.0 (go)"},"fix":{"suggestedVersion":"0.60.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.58.0?package-id=f556606ebb1221ee","name":"golang.org/x/net","version":"v0.58.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.58.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.58.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.58.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To="}}},{"vulnerability":{"id":"GHSA-px85-f4q5-jh77","dataSource":"https://github.com/advisories/GHSA-px85-f4q5-jh77","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/storybookjs/storybook/security/advisories/GHSA-px85-f4q5-jh77","https://nvd.nist.gov/vuln/detail/CVE-2026-114126","https://github.com/storybookjs/storybook/pull/36726","https://github.com/storybookjs/storybook/commit/243c06bf8f1e2f09446c44868ea100261e1374da","https://github.com/storybookjs/storybook/commit/3be03ec6f11f4616471cebc3fc65c13e1bf8c178","https://github.com/storybookjs/storybook/commit/5540f03b209cc56c66f56a9c7cb4b2ee5b883ce5","https://github.com/storybookjs/storybook/commit/a9ef9345d73224c73e0b81dc2701ec5b465ea9bb","https://github.com/storybookjs/storybook/commit/d9b09e332510a88689c71ecc081bbbc2d072476e","https://github.com/storybookjs/storybook/commit/df3fed468c9b4830605f00068c4bc6b7e1e215ed","https://github.com/storybookjs/storybook/releases/tag/v10.6.2","https://github.com/storybookjs/storybook/releases/tag/v11.0.0-alpha.6","https://github.com/storybookjs/storybook/releases/tag/v8.6.19","https://github.com/storybookjs/storybook/releases/tag/v9.1.21"],"description":"Storybook dev server vulnerable to code injection from the local network","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-114126","epss":0.00529,"percentile":0.4478,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-114126","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-114126","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-114126","cwe":"CWE-306","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["10.6.2"],"state":"fixed","available":[{"version":"10.6.2","date":"2026-10-23","kind":"first-observed"}]},"advisories":[],"risk":0.42849000000000004},"relatedVulnerabilities":[{"id":"CVE-2026-114126","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114126","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/storybookjs/storybook/commit/243c06bf8f1e2f09446c44868ea100261e1374da","https://github.com/storybookjs/storybook/commit/3be03ec6f11f4616471cebc3fc65c13e1bf8c178","https://github.com/storybookjs/storybook/commit/5540f03b209cc56c66f56a9c7cb4b2ee5b883ce5","https://github.com/storybookjs/storybook/commit/a9ef9345d73224c73e0b81dc2701ec5b465ea9bb","https://github.com/storybookjs/storybook/commit/d9b09e332510a88689c71ecc081bbbc2d072476e","https://github.com/storybookjs/storybook/commit/df3fed468c9b4830605f00068c4bc6b7e1e215ed","https://github.com/storybookjs/storybook/pull/36726","https://github.com/storybookjs/storybook/releases/tag/v10.6.2","https://github.com/storybookjs/storybook/releases/tag/v11.0.0-alpha.6","https://github.com/storybookjs/storybook/releases/tag/v8.6.19","https://github.com/storybookjs/storybook/releases/tag/v9.1.21","https://github.com/storybookjs/storybook/security/advisories/GHSA-px85-f4q5-jh77"],"description":"Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, the Storybook development server can expose its WebSocket authentication token to clients able to load its HTML pages over a local network. A LAN attacker can obtain the token and invoke WebSocket-backed file-writing or testing functionality. Weak story-write validation can allow code to be placed in story files. If the Storybook Vitest addon is installed with an old version of Vitest, the payload can use a Vitest API to write additional files or execute commands. Depending on the payload and local tooling, the attack can lead to code execution with the developer's privileges. This issue is fixed in 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-114126","epss":0.00529,"percentile":0.4478,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-114126","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-114126","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-114126","cwe":"CWE-306","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"storybook","version":"10.6.0"}},"found":{"vulnerabilityID":"GHSA-px85-f4q5-jh77","versionConstraint":">=10.0.0,<10.6.2 (semantic)"},"fix":{"suggestedVersion":"10.6.2"}}],"artifact":{"id":"pkg:npm/storybook@10.6.0?package-id=97e6e3f239cabd12","name":"storybook","version":"10.6.0","type":"npm","locations":[{"path":"/web/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:storybook:storybook:10.6.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/storybook@10.6.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-542g-h47m-68v8","dataSource":"https://github.com/advisories/GHSA-542g-h47m-68v8","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-542g-h47m-68v8","https://nvd.nist.gov/vuln/detail/CVE-2026-101901","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/releases/tag/v1.20.0"],"description":"Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101901","epss":0.00536,"percentile":0.45211,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101901","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.20.0"],"state":"fixed","available":[{"version":"1.20.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.42075999999999997},"relatedVulnerabilities":[{"id":"CVE-2026-101901","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101901","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/axios/axios/security/advisories/GHSA-542g-h47m-68v8"],"description":"Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Http2Sessions does not install adequate error handling for a ClientHttp2Session during Axios HTTP/2 session initialization or reuse. A request uses httpVersion: 2 and the ClientHttp2Session emits an error during session initialization or reuse. The unhandled session error escapes normal Promise rejection handling. The uncaught error can terminate the Node.js process and cause denial of service. This issue is fixed in version 1.20.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101901","epss":0.00536,"percentile":0.45211,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101901","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.18.1"}},"found":{"vulnerabilityID":"GHSA-542g-h47m-68v8","versionConstraint":">=1.13.0,<1.20.0 (semantic)"},"fix":{"suggestedVersion":"1.20.0"}}],"artifact":{"id":"pkg:npm/axios@1.18.1?package-id=7e4c2bd70000d786","name":"axios","version":"1.18.1","type":"npm","locations":[{"path":"/web/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.18.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.18.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-r825-w8mm-5pxw","dataSource":"https://github.com/advisories/GHSA-r825-w8mm-5pxw","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/vitejs/launch-editor/security/advisories/GHSA-r825-w8mm-5pxw","https://nvd.nist.gov/vuln/detail/CVE-2026-112944","https://github.com/vitejs/launch-editor/pull/156","https://github.com/vitejs/launch-editor/commit/f6e6701bb1f16f2dd242b321374f1b6cca6eb6d4","https://github.com/vitejs/launch-editor/releases/tag/v2.14.2"],"description":"launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112944","epss":0.00705,"percentile":0.53381,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112944","cwe":"CWE-88","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["8.3.3"],"state":"fixed","available":[{"version":"8.3.3","date":"2026-10-21","kind":"first-observed"}]},"advisories":[],"risk":0.398325},"relatedVulnerabilities":[{"id":"CVE-2026-112944","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112944","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/vitejs/launch-editor/commit/f6e6701bb1f16f2dd242b321374f1b6cca6eb6d4","https://github.com/vitejs/launch-editor/pull/156","https://github.com/vitejs/launch-editor/releases/tag/v2.14.2","https://github.com/vitejs/launch-editor/security/advisories/GHSA-r825-w8mm-5pxw"],"description":"launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, when an attacker can create a filesystem entry beginning with plus or minus in the working directory, an affected editor is selected, and the path can remain relative or is converted to a relative WSL path, launchEditor forwards the path without forcing it to be interpreted as a positional filename. Editor option parsing then treats the attacker-controlled filename as a command-line flag, which can cause unintended file overwrite or arbitrary command execution by the selected editor. The affected editors are Vim and gVim, MacVim, Emacs and Emacsclient, and Notepad++ when a plugin exposes dangerous operations; WSL path conversion keeps Vite and newer middleware callers exposed. This issue is fixed in version 2.14.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112944","epss":0.00705,"percentile":0.53381,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112944","cwe":"CWE-88","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"vite","version":"8.3.0"}},"found":{"vulnerabilityID":"GHSA-r825-w8mm-5pxw","versionConstraint":">=8.3.0,<=8.3.2 (semantic)"},"fix":{"suggestedVersion":"8.3.3"}}],"artifact":{"id":"pkg:npm/vite@8.3.0?package-id=901eaa4e2288cc6e","name":"vite","version":"8.3.0","type":"npm","locations":[{"path":"/web/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vitejs:vite:8.3.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/vite@8.3.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-3pq3-5fj3-cg6v","dataSource":"https://github.com/advisories/GHSA-3pq3-5fj3-cg6v","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-3pq3-5fj3-cg6v","https://nvd.nist.gov/vuln/detail/CVE-2026-101898","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/releases/tag/v1.20.0"],"description":"Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","metrics":{"baseScore":7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101898","epss":0.00545,"percentile":0.45769,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101898","cwe":"CWE-918","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["1.20.0"],"state":"fixed","available":[{"version":"1.20.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.395125},"relatedVulnerabilities":[{"id":"CVE-2026-101898","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101898","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/axios/axios/security/advisories/GHSA-3pq3-5fj3-cg6v"],"description":"Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Axios HTTP/2 request setup does not consistently apply proxy settings and caller-supplied DNS lookup policy. An HTTPS request uses httpVersion: 2 with explicit config.proxy or environment-derived proxy settings, or relies on caller-supplied config.lookup DNS policy. The HTTP/2 path can connect without the configured proxy behavior or without applying the caller-supplied config.lookup policy before http2.connect(). Requests can bypass the intended proxy route or the caller-supplied DNS resolution policy. This issue is fixed in version 1.20.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101898","epss":0.00545,"percentile":0.45769,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101898","cwe":"CWE-918","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.18.1"}},"found":{"vulnerabilityID":"GHSA-3pq3-5fj3-cg6v","versionConstraint":">=1.13.0,<1.20.0 (semantic)"},"fix":{"suggestedVersion":"1.20.0"}}],"artifact":{"id":"pkg:npm/axios@1.18.1?package-id=7e4c2bd70000d786","name":"axios","version":"1.18.1","type":"npm","locations":[{"path":"/web/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.18.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.18.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-x97p-jq2g-jp4f","dataSource":"https://github.com/advisories/GHSA-x97p-jq2g-jp4f","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-x97p-jq2g-jp4f","https://nvd.nist.gov/vuln/detail/CVE-2026-101909","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/commit/d29be181f85f6fe93397a07b1f69606d9622637b","https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0"],"description":"Axios: Prototype Pollution Gadget in axios toFormData Options","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101909","epss":0.00497,"percentile":0.42653,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101909","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.20.0"],"state":"fixed","available":[{"version":"1.20.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.39263},"relatedVulnerabilities":[{"id":"CVE-2026-101909","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101909","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/commit/d29be181f85f6fe93397a07b1f69606d9622637b","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/axios/axios/security/advisories/GHSA-x97p-jq2g-jp4f"],"description":"Axios is a promise-based HTTP client for the browser and Node.js. From 0.28.0 until 0.34.0 and 1.15.1 until 1.20.0, ToFormData processes inherited serialization options and visitor properties supplied through prototype pollution. A separate same-process prototype-pollution flaw supplies inherited dots, indexes, metaTokens, maxDepth, visitor, or Blob values before object serialization. The inherited options alter toFormData field naming and data interpretation, maxDepth can force request failure, Blob changes value handling, and a polluted visitor can execute when an attacker already has the stronger ability to inject a function. Serialized field naming and data interpretation can change, maxDepth can cause request failure, Blob can alter value handling, and a polluted visitor can execute under the stronger function-injection primitive. This issue is fixed in versions 0.34.0 and 1.20.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101909","epss":0.00497,"percentile":0.42653,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101909","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.18.1"}},"found":{"vulnerabilityID":"GHSA-x97p-jq2g-jp4f","versionConstraint":">=1.15.1,<1.20.0 (semantic)"},"fix":{"suggestedVersion":"1.20.0"}}],"artifact":{"id":"pkg:npm/axios@1.18.1?package-id=7e4c2bd70000d786","name":"axios","version":"1.18.1","type":"npm","locations":[{"path":"/web/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.18.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.18.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-x8mw-p69m-v3mx","dataSource":"https://github.com/advisories/GHSA-x8mw-p69m-v3mx","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/fastify/busboy/security/advisories/GHSA-x8mw-p69m-v3mx","https://nvd.nist.gov/vuln/detail/CVE-2026-19481","https://github.com/fastify/busboy/commit/957a24b66d5915e6d0a6ac988c9dbcee86373e9b","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/busboy/releases/tag/v3.2.1"],"description":"@fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-19481","epss":0.00493,"percentile":0.42383,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-19481","cwe":"CWE-754","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["3.2.1"],"state":"fixed","available":[{"version":"3.2.1","date":"2026-10-03","kind":"first-observed"}]},"advisories":[],"risk":0.36975},"relatedVulnerabilities":[{"id":"CVE-2026-19481","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19481","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/busboy/security/advisories/GHSA-x8mw-p69m-v3mx"],"description":"@fastify/busboy is a multipart form-data parser. In versions 1.0.0 through 3.2.0, an attacker who can submit multipart form-data can crash the parser by sending a part header whose name is a prototype-inherited property such as __proto__ or constructor. The internal header parser stores headers in a plain JavaScript object and assumes each value is an array, so an inherited property name resolves to a truthy non-array value and triggers a TypeError. In the common pipe integration the failure surfaces as an error event, but in direct write or end usage the exception is thrown synchronously and can terminate the Node.js process, causing an unauthenticated denial of service. The issue is fixed in @fastify/busboy 3.2.1, which creates the header object with a null prototype. Users should upgrade to 3.2.1.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-19481","epss":0.00493,"percentile":0.42383,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-19481","cwe":"CWE-754","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@fastify/busboy","version":"3.2.0"}},"found":{"vulnerabilityID":"GHSA-x8mw-p69m-v3mx","versionConstraint":">=1.0.0,<3.2.1 (semantic)"},"fix":{"suggestedVersion":"3.2.1"}}],"artifact":{"id":"pkg:npm/%40fastify/busboy@3.2.0?package-id=b983dcf7d5513432","name":"@fastify/busboy","version":"3.2.0","type":"npm","locations":[{"path":"/web/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:fastify:fastify\\/busyboy:3.2.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/%40fastify/busboy@3.2.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-8r9p-f939-6h3c","dataSource":"https://github.com/advisories/GHSA-8r9p-f939-6h3c","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-8r9p-f939-6h3c","https://nvd.nist.gov/vuln/detail/CVE-2026-111755","https://github.com/follow-redirects/follow-redirects/commit/080a76d0e125b37bf81717368a61d5dc37aa56c8","https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1"],"description":"follow-redirects sensitiveHeaders regex escaping can expose credential headers","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111755","epss":0.00471,"percentile":0.40769,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111755","cwe":"CWE-185","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-111755","cwe":"CWE-200","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["1.16.1"],"state":"fixed","available":[{"version":"1.16.1","date":"2026-10-21","kind":"first-observed"}]},"advisories":[],"risk":0.3697349999999999},"relatedVulnerabilities":[{"id":"CVE-2026-111755","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111755","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/follow-redirects/follow-redirects/commit/080a76d0e125b37bf81717368a61d5dc37aa56c8","https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1","https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-8r9p-f939-6h3c"],"description":"follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.1, escapeRegex leaves valid header-name metacharacters unescaped in sensitiveHeaders. When an application declares a sensitive header whose name contains ^ or | and follows a cross-origin or HTTPS-to-HTTP redirect, unescaped regular-expression metacharacters prevent the generated filter from matching the declared header name, and the credential header is forwarded to an attacker-controlled redirect target. This issue is fixed in version 1.16.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111755","epss":0.00471,"percentile":0.40769,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111755","cwe":"CWE-185","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-111755","cwe":"CWE-200","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"follow-redirects","version":"1.16.0"}},"found":{"vulnerabilityID":"GHSA-8r9p-f939-6h3c","versionConstraint":">=1.16.0,<1.16.1 (semantic)"},"fix":{"suggestedVersion":"1.16.1"}}],"artifact":{"id":"pkg:npm/follow-redirects@1.16.0?package-id=9e867f7e3523a285","name":"follow-redirects","version":"1.16.0","type":"npm","locations":[{"path":"/web/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:follow-redirects:follow_redirects:1.16.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/follow-redirects@1.16.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-q3jh-wrc6-jgq8","dataSource":"https://github.com/advisories/GHSA-q3jh-wrc6-jgq8","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-q3jh-wrc6-jgq8","https://github.com/follow-redirects/follow-redirects/commit/9865ca45490e4d0f7b6944870318408344570aff","https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1"],"description":"follow-redirects array-form headers bypass cross-origin credential stripping","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111756","epss":0.00471,"percentile":0.40769,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111756","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-111756","cwe":"CWE-212","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.16.1"],"state":"fixed","available":[{"version":"1.16.1","date":"2026-10-21","kind":"first-observed"}]},"advisories":[],"risk":0.3697349999999999},"relatedVulnerabilities":[{"id":"CVE-2026-111756","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111756","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/follow-redirects/follow-redirects/commit/9865ca45490e4d0f7b6944870318408344570aff","https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1","https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-q3jh-wrc6-jgq8"],"description":"follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to before version 1.16.1, follow-redirects removes sensitive credential headers (Authorization, Proxy-Authorization, Cookie, and any caller-declared sensitiveHeaders) before following a redirect that crosses to a different host or downgrades to a less secure protocol. The removal routine iterates the caller's headers container with for...in and matches header names against a filter. This assumes the headers container is a plain object keyed by header names. Node's underlying http.request, which follow-redirects is a drop-in replacement for, also accepts headers as an alternating array of names and values. For an array, for...in yields the numeric indices \"0\", \"1\", \"2\" and so on, which never match a header-name filter, so nothing is removed. An application that sends array-form headers and follows an attacker-controlled cross-origin redirect therefore forwards its Authorization, Cookie, and Proxy-Authorization headers verbatim to the attacker-controlled destination, with no error or warning. The sensitiveHeaders option added to fix CVE-2026-40895 / GHSA-r4q5-vmmm-2653 is equally ineffective, because it relies on the same helper. This is an unauthenticated confidentiality vulnerability: any remote server the victim application contacts can harvest the victim's credential headers by responding with a cross-origin redirect. This issue has been patched in version 1.16.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111756","epss":0.00471,"percentile":0.40769,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111756","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-111756","cwe":"CWE-212","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"follow-redirects","version":"1.16.0"}},"found":{"vulnerabilityID":"GHSA-q3jh-wrc6-jgq8","versionConstraint":">=1.16.0,<1.16.1 (semantic)"},"fix":{"suggestedVersion":"1.16.1"}}],"artifact":{"id":"pkg:npm/follow-redirects@1.16.0?package-id=9e867f7e3523a285","name":"follow-redirects","version":"1.16.0","type":"npm","locations":[{"path":"/web/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:follow-redirects:follow_redirects:1.16.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/follow-redirects@1.16.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-qhr7-859c-m2p7","dataSource":"https://github.com/advisories/GHSA-qhr7-859c-m2p7","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7","https://nvd.nist.gov/vuln/detail/CVE-2026-102278","https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db"],"description":"brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102278","epss":0.00491,"percentile":0.42217,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102278","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102278","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.1.6"],"state":"fixed","available":[{"version":"2.1.6","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.36825},"relatedVulnerabilities":[{"id":"CVE-2026-102278","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102278","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102278","epss":0.00491,"percentile":0.42217,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102278","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102278","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"2.1.4"}},"found":{"vulnerabilityID":"GHSA-qhr7-859c-m2p7","versionConstraint":">=2.0.0,<2.1.6 (semantic)"},"fix":{"suggestedVersion":"2.1.6"}}],"artifact":{"id":"pkg:npm/brace-expansion@2.1.4?package-id=67bb71a2992c722e","name":"brace-expansion","version":"2.1.4","type":"npm","locations":[{"path":"/.github/ga4-scripts/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:2.1.4:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@2.1.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-qhr7-859c-m2p7","dataSource":"https://github.com/advisories/GHSA-qhr7-859c-m2p7","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7","https://nvd.nist.gov/vuln/detail/CVE-2026-102278","https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db"],"description":"brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102278","epss":0.00491,"percentile":0.42217,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102278","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102278","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["5.0.11"],"state":"fixed","available":[{"version":"5.0.11","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.36825},"relatedVulnerabilities":[{"id":"CVE-2026-102278","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102278","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102278","epss":0.00491,"percentile":0.42217,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102278","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102278","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"5.0.9"}},"found":{"vulnerabilityID":"GHSA-qhr7-859c-m2p7","versionConstraint":">=4.0.0,<5.0.11 (semantic)"},"fix":{"suggestedVersion":"5.0.11"}}],"artifact":{"id":"pkg:npm/brace-expansion@5.0.9?package-id=da168845182b5f28","name":"brace-expansion","version":"5.0.9","type":"npm","locations":[{"path":"/web/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:5.0.9:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@5.0.9","upstreams":[]}},{"vulnerability":{"id":"GO-2026-6617","dataSource":"https://go.dev/cl/847188","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/cl/847313","https://go.dev/issue/81867","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"],"description":"HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-97032","epss":0.0049,"percentile":0.42162,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-97032","cwe":"CWE-362","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.60.0"],"state":"fixed","available":[{"version":"0.60.0","date":"2026-10-08","kind":"release"}]},"advisories":[],"risk":0.3675},"relatedVulnerabilities":[{"id":"CVE-2026-97032","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97032","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/847188","https://go.dev/cl/847313","https://go.dev/issue/81867","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://pkg.go.dev/vuln/GO-2026-6617"],"description":"HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-97032","epss":0.0049,"percentile":0.42162,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-97032","cwe":"CWE-362","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.58.0"}},"found":{"vulnerabilityID":"GO-2026-6617","versionConstraint":"<0.60.0 (go)"},"fix":{"suggestedVersion":"0.60.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.58.0?package-id=f556606ebb1221ee","name":"golang.org/x/net","version":"v0.58.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.58.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.58.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.58.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To="}}},{"vulnerability":{"id":"GHSA-mghh-pgcx-3jjj","dataSource":"https://github.com/advisories/GHSA-mghh-pgcx-3jjj","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-mghh-pgcx-3jjj","https://nvd.nist.gov/vuln/detail/CVE-2026-101906","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/releases/tag/v1.20.0"],"description":"Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101906","epss":0.00457,"percentile":0.39684,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101906","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-101906","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.20.0"],"state":"fixed","available":[{"version":"1.20.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.358745},"relatedVulnerabilities":[{"id":"CVE-2026-101906","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101906","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/axios/axios/security/advisories/GHSA-mghh-pgcx-3jjj"],"description":"Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy applies a quadratic trailing-dot regular expression to redirect hostnames. HTTP_PROXY or HTTPS_PROXY is configured, NO_PROXY or no_proxy is non-empty, redirects are followed, and a crafted redirect Location contains many dots followed by a non-dot character. Hostname.replace(/.+$/, '') backtracks quadratically while processing the crafted redirect hostname. Synchronous regular-expression processing can block the Node.js event loop and cause denial of service. This issue is fixed in version 1.20.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101906","epss":0.00457,"percentile":0.39684,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101906","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-101906","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.18.1"}},"found":{"vulnerabilityID":"GHSA-mghh-pgcx-3jjj","versionConstraint":">=1.15.0,<1.20.0 (semantic)"},"fix":{"suggestedVersion":"1.20.0"}}],"artifact":{"id":"pkg:npm/axios@1.18.1?package-id=7e4c2bd70000d786","name":"axios","version":"1.18.1","type":"npm","locations":[{"path":"/web/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.18.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.18.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-68fv-2mgg-jv7q","dataSource":"https://github.com/advisories/GHSA-68fv-2mgg-jv7q","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-93749","https://github.com/7rulnik/source-map-js/issues/76","https://github.com/7rulnik/source-map-js","https://github.com/7rulnik/source-map-js/blob/c1cd8904bb7bd0c7fb5879fcda48134d82a27934/lib/source-node.js#L115-L118","https://www.vulncheck.com/advisories/source-map-js-through-1.2.1-event-loop-denial-of-service","https://github.com/7rulnik/source-map-js/pull/79","https://github.com/7rulnik/source-map-js/commit/cf7658058ceeaa8619d5ae0ec90be6905209d016","https://github.com/7rulnik/source-map-js/releases/tag/v1.2.2"],"description":"source-map-js allows event-loop denial of service through indexed source-map section offsets","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-93749","epss":0.00455,"percentile":0.3952,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-93749","cwe":"CWE-1284","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["1.2.2"],"state":"fixed","available":[{"version":"1.2.2","date":"2026-10-06","kind":"first-observed"}]},"advisories":[],"risk":0.35490000000000005},"relatedVulnerabilities":[{"id":"CVE-2026-93749","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93749","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/7rulnik/source-map-js","https://github.com/7rulnik/source-map-js/blob/c1cd8904bb7bd0c7fb5879fcda48134d82a27934/lib/source-node.js#L115-L118","https://github.com/7rulnik/source-map-js/issues/76","https://www.vulncheck.com/advisories/source-map-js-through-1.2.1-event-loop-denial-of-service"],"description":"source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the service from handling other requests.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-93749","epss":0.00455,"percentile":0.3952,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-93749","cwe":"CWE-1284","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"source-map-js","version":"1.2.1"}},"found":{"vulnerabilityID":"GHSA-68fv-2mgg-jv7q","versionConstraint":">=1.0.0,<1.2.2 (semantic)"},"fix":{"suggestedVersion":"1.2.2"}}],"artifact":{"id":"pkg:npm/source-map-js@1.2.1?package-id=361340ba8f84cada","name":"source-map-js","version":"1.2.1","type":"npm","locations":[{"path":"/web/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:source-map-js:source-map-js:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:source-map-js:source_map_js:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:source_map_js:source-map-js:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:source_map_js:source_map_js:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:source-map:source-map-js:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:source-map:source_map_js:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:source_map:source-map-js:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:source_map:source_map_js:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:source:source-map-js:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:source:source_map_js:1.2.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/source-map-js@1.2.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-f2ph-cmg5-wxc8","dataSource":"https://github.com/advisories/GHSA-f2ph-cmg5-wxc8","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/storybookjs/storybook/security/advisories/GHSA-f2ph-cmg5-wxc8","https://github.com/storybookjs/storybook/pull/36726","https://github.com/storybookjs/storybook/commit/243c06bf8f1e2f09446c44868ea100261e1374da","https://github.com/storybookjs/storybook/commit/3be03ec6f11f4616471cebc3fc65c13e1bf8c178","https://github.com/storybookjs/storybook/commit/a9ef9345d73224c73e0b81dc2701ec5b465ea9bb","https://github.com/storybookjs/storybook/commit/d9b09e332510a88689c71ecc081bbbc2d072476e","https://github.com/storybookjs/storybook/commit/df3fed468c9b4830605f00068c4bc6b7e1e215ed","https://github.com/storybookjs/storybook/releases/tag/v10.6.2","https://github.com/storybookjs/storybook/releases/tag/v11.0.0-alpha.6","https://github.com/storybookjs/storybook/releases/tag/v8.6.19","https://github.com/storybookjs/storybook/releases/tag/v9.1.21"],"description":"Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","metrics":{"baseScore":9.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-114125","epss":0.00385,"percentile":0.3257,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-114125","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-114125","cwe":"CWE-346","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-114125","cwe":"CWE-1021","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["10.6.2"],"state":"fixed","available":[{"version":"10.6.2","date":"2026-10-22","kind":"first-observed"}]},"advisories":[],"risk":0.35420000000000007},"relatedVulnerabilities":[{"id":"CVE-2026-114125","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114125","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/storybookjs/storybook/commit/243c06bf8f1e2f09446c44868ea100261e1374da","https://github.com/storybookjs/storybook/commit/3be03ec6f11f4616471cebc3fc65c13e1bf8c178","https://github.com/storybookjs/storybook/commit/97513d999910d071c2b36830495dab63e17d9fe0","https://github.com/storybookjs/storybook/commit/d9b09e332510a88689c71ecc081bbbc2d072476e","https://github.com/storybookjs/storybook/commit/df3fed468c9b4830605f00068c4bc6b7e1e215ed","https://github.com/storybookjs/storybook/pull/36726","https://github.com/storybookjs/storybook/releases/tag/v10.6.2","https://github.com/storybookjs/storybook/releases/tag/v11.0.0-alpha.6","https://github.com/storybookjs/storybook/releases/tag/v8.6.19","https://github.com/storybookjs/storybook/releases/tag/v9.1.21","https://github.com/storybookjs/storybook/security/advisories/GHSA-f2ph-cmg5-wxc8"],"description":"Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook development server. Insufficient iframe embedding and message-origin restrictions can allow attacker-controlled events to reach the running preview. A developer must visit the malicious website and interact with the injected interface. The attack can cause unauthorized changes to story files and, if a changed file is later executed by a local runtime, arbitrary code execution with the developer's privileges. This issue is fixed in 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-114125","epss":0.00385,"percentile":0.3257,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-114125","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-114125","cwe":"CWE-346","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-114125","cwe":"CWE-1021","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"storybook","version":"10.6.0"}},"found":{"vulnerabilityID":"GHSA-f2ph-cmg5-wxc8","versionConstraint":">=10.0.0,<10.6.2 (semantic)"},"fix":{"suggestedVersion":"10.6.2"}}],"artifact":{"id":"pkg:npm/storybook@10.6.0?package-id=97e6e3f239cabd12","name":"storybook","version":"10.6.0","type":"npm","locations":[{"path":"/web/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:storybook:storybook:10.6.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/storybook@10.6.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-4528-x5fx-h6hg","dataSource":"https://github.com/advisories/GHSA-4528-x5fx-h6hg","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/hapijs/joi/security/advisories/GHSA-4528-x5fx-h6hg","https://nvd.nist.gov/vuln/detail/CVE-2026-118772","https://github.com/hapijs/joi/pull/3162","https://github.com/hapijs/joi/pull/3163","https://github.com/hapijs/joi/commit/03dc1d909818503b06240dadc81e9227ed2649cf","https://github.com/hapijs/joi/commit/807858d7480f5075b0610817e3e44230890fb18e","https://github.com/hapijs/joi/releases/tag/v17.13.9","https://github.com/hapijs/joi/releases/tag/v18.3.1"],"description":"joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118772","epss":0.00467,"percentile":0.40465,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118772","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["18.3.1"],"state":"fixed","available":[{"version":"18.3.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.35024999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-118772","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118772","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/hapijs/joi/commit/03dc1d909818503b06240dadc81e9227ed2649cf","https://github.com/hapijs/joi/commit/807858d7480f5075b0610817e3e44230890fb18e","https://github.com/hapijs/joi/pull/3162","https://github.com/hapijs/joi/pull/3163","https://github.com/hapijs/joi/releases/tag/v17.13.9","https://github.com/hapijs/joi/releases/tag/v18.3.1","https://github.com/hapijs/joi/security/advisories/GHSA-4528-x5fx-h6hg"],"description":"joi is a schema description language and data validator for JavaScript. From 17.1.1 until 17.13.9 and 18.3.1, the Joi.string().email({ multiple: true }) rule uses a separator regular expression whose leading whitespace quantifier is retried at every position in a long whitespace run that contains no separator, causing quadratic work during String.prototype.split. The behavior applies to the default separator and every custom separator. Applications that validate attacker-controlled values with the multiple option and no effective prior length limit can have the Node.js event loop blocked for seconds by one request, preventing other work. A .max() rule is not sufficient when abortEarly: false allows the email rule to run after the maximum-length check fails. This vulnerability is fixed in versions 17.13.9 and 18.3.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118772","epss":0.00467,"percentile":0.40465,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118772","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"joi","version":"18.2.8"}},"found":{"vulnerabilityID":"GHSA-4528-x5fx-h6hg","versionConstraint":">=18.0.0,<18.3.1 (semantic)"},"fix":{"suggestedVersion":"18.3.1"}}],"artifact":{"id":"pkg:npm/joi@18.2.8?package-id=3c123c2c55e2015f","name":"joi","version":"18.2.8","type":"npm","locations":[{"path":"/web/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:joi:joi:18.2.8:*:*:*:*:*:*:*"],"purl":"pkg:npm/joi@18.2.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-c29m-xwm3-cm6r","dataSource":"https://github.com/advisories/GHSA-c29m-xwm3-cm6r","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-c29m-xwm3-cm6r","https://nvd.nist.gov/vuln/detail/CVE-2026-101903","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/releases/tag/v1.20.0"],"description":"Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101903","epss":0.00436,"percentile":0.37884,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101903","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["1.20.0"],"state":"fixed","available":[{"version":"1.20.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.34225999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-101903","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101903","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/axios/axios/security/advisories/GHSA-c29m-xwm3-cm6r"],"description":"Axios is a promise-based HTTP client for the browser and Node.js. From 1.16.1 until 1.20.0, the RFC 2397 regular expression allows slash characters on both sides of the media-type separator. An application passes an attacker-controlled malformed data URL containing many slash characters and no comma. the JavaScript regular-expression engine explores many separator placements before rejecting the URL. Synchronous excessive backtracking can block the Node.js event loop and cause denial of service. The affected identifiers are fromDataURI, DATA_URL_PATTERN, data:. This issue is fixed in version 1.20.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101903","epss":0.00436,"percentile":0.37884,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101903","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.18.1"}},"found":{"vulnerabilityID":"GHSA-c29m-xwm3-cm6r","versionConstraint":">=1.16.1,<1.20.0 (semantic)"},"fix":{"suggestedVersion":"1.20.0"}}],"artifact":{"id":"pkg:npm/axios@1.18.1?package-id=7e4c2bd70000d786","name":"axios","version":"1.18.1","type":"npm","locations":[{"path":"/web/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.18.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.18.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-r4gj-5m52-g5wh","dataSource":"https://github.com/advisories/GHSA-r4gj-5m52-g5wh","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-r4gj-5m52-g5wh","https://nvd.nist.gov/vuln/detail/CVE-2026-101907","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/releases/tag/v1.20.0"],"description":"Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","metrics":{"baseScore":7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101907","epss":0.00471,"percentile":0.40796,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101907","cwe":"CWE-441","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-101907","cwe":"CWE-601","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.20.0"],"state":"fixed","available":[{"version":"1.20.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.341475},"relatedVulnerabilities":[{"id":"CVE-2026-101907","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101907","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/axios/axios/security/advisories/GHSA-r4gj-5m52-g5wh"],"description":"Axios is a promise-based HTTP client for the browser and Node.js. From 1.17.0 until 1.20.0, the fetch adapter bypasses the maxRedirects: 0 redirect policy. An Axios request uses the fetch adapter with maxRedirects set to zero and receives a redirect response. The underlying fetch implementation follows the redirect instead of returning the redirect response unchanged. The redirected request can access internal responses or reach state-changing internal endpoints despite redirects being disabled. This issue is fixed in version 1.20.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101907","epss":0.00471,"percentile":0.40796,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101907","cwe":"CWE-441","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-101907","cwe":"CWE-601","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.18.1"}},"found":{"vulnerabilityID":"GHSA-r4gj-5m52-g5wh","versionConstraint":">=1.17.0,<1.20.0 (semantic)"},"fix":{"suggestedVersion":"1.20.0"}}],"artifact":{"id":"pkg:npm/axios@1.18.1?package-id=7e4c2bd70000d786","name":"axios","version":"1.18.1","type":"npm","locations":[{"path":"/web/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.18.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.18.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-6j4f-fj2g-mc7p","dataSource":"https://github.com/advisories/GHSA-6j4f-fj2g-mc7p","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"],"description":"brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102276","epss":0.00455,"percentile":0.3952,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102276","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102276","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.1.5"],"state":"fixed","available":[{"version":"2.1.5","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.34125},"relatedVulnerabilities":[{"id":"CVE-2026-102276","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102276","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102276","epss":0.00455,"percentile":0.3952,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102276","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102276","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"2.1.4"}},"found":{"vulnerabilityID":"GHSA-6j4f-fj2g-mc7p","versionConstraint":">=2.0.0,<2.1.5 (semantic)"},"fix":{"suggestedVersion":"2.1.5"}}],"artifact":{"id":"pkg:npm/brace-expansion@2.1.4?package-id=67bb71a2992c722e","name":"brace-expansion","version":"2.1.4","type":"npm","locations":[{"path":"/.github/ga4-scripts/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:2.1.4:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@2.1.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-6j4f-fj2g-mc7p","dataSource":"https://github.com/advisories/GHSA-6j4f-fj2g-mc7p","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"],"description":"brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102276","epss":0.00455,"percentile":0.3952,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102276","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102276","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["5.0.10"],"state":"fixed","available":[{"version":"5.0.10","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.34125},"relatedVulnerabilities":[{"id":"CVE-2026-102276","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102276","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102276","epss":0.00455,"percentile":0.3952,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102276","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102276","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"5.0.9"}},"found":{"vulnerabilityID":"GHSA-6j4f-fj2g-mc7p","versionConstraint":">=4.0.0,<5.0.10 (semantic)"},"fix":{"suggestedVersion":"5.0.10"}}],"artifact":{"id":"pkg:npm/brace-expansion@5.0.9?package-id=da168845182b5f28","name":"brace-expansion","version":"5.0.9","type":"npm","locations":[{"path":"/web/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:5.0.9:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@5.0.9","upstreams":[]}},{"vulnerability":{"id":"GHSA-4hqw-qxg8-jxx2","dataSource":"https://github.com/advisories/GHSA-4hqw-qxg8-jxx2","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-4hqw-qxg8-jxx2","https://nvd.nist.gov/vuln/detail/CVE-2026-101900","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/releases/tag/v1.20.0"],"description":"Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101900","epss":0.00546,"percentile":0.45812,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101900","cwe":"CWE-74","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-101900","cwe":"CWE-693","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-101900","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["1.20.0"],"state":"fixed","available":[{"version":"1.20.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.32487},"relatedVulnerabilities":[{"id":"CVE-2026-101900","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101900","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/axios/axios/security/advisories/GHSA-4hqw-qxg8-jxx2"],"description":"Axios is a promise-based HTTP client for the browser and Node.js. From 1.12.0 until 1.20.0, ResolveConfig reads inherited Symbol.toStringTag, append, and getHeaders properties while resolving FormData headers. A separate same-process prototype-pollution flaw supplies an array or non-plain class instance whose inherited properties make it appear FormData-like; plain objects are blocked. The inherited getHeaders function can return attacker-controlled headers that resolveConfig merges into a fetch adapter request. Attacker-controlled headers can alter authorization, cache, metadata-service, or application-specific request behavior. This issue is fixed in version 1.20.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101900","epss":0.00546,"percentile":0.45812,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101900","cwe":"CWE-74","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-101900","cwe":"CWE-693","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-101900","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.18.1"}},"found":{"vulnerabilityID":"GHSA-4hqw-qxg8-jxx2","versionConstraint":">=1.12.0,<1.20.0 (semantic)"},"fix":{"suggestedVersion":"1.20.0"}}],"artifact":{"id":"pkg:npm/axios@1.18.1?package-id=7e4c2bd70000d786","name":"axios","version":"1.18.1","type":"npm","locations":[{"path":"/web/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.18.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.18.1","upstreams":[]}},{"vulnerability":{"id":"GO-2026-6610","dataSource":"https://go.dev/cl/835145","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/cl/836385","https://go.dev/issue/81115","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"description":"Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78660","epss":0.00425,"percentile":0.36847,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78660","cwe":"CWE-444","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.60.0"],"state":"fixed","available":[{"version":"0.60.0","date":"2026-10-08","kind":"release"}]},"advisories":[],"risk":0.31875000000000003},"relatedVulnerabilities":[{"id":"CVE-2026-78660","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78660","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/835145","https://go.dev/cl/836385","https://go.dev/issue/81115","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6610"],"description":"Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78660","epss":0.00425,"percentile":0.36847,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78660","cwe":"CWE-444","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.58.0"}},"found":{"vulnerabilityID":"GO-2026-6610","versionConstraint":"<0.60.0 (go)"},"fix":{"suggestedVersion":"0.60.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.58.0?package-id=f556606ebb1221ee","name":"golang.org/x/net","version":"v0.58.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.58.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.58.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.58.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To="}}},{"vulnerability":{"id":"GHSA-m8m8-qj5v-23w3","dataSource":"https://github.com/advisories/GHSA-m8m8-qj5v-23w3","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-m8m8-qj5v-23w3","https://nvd.nist.gov/vuln/detail/CVE-2026-101905","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/releases/tag/v1.20.0"],"description":"Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":7.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101905","epss":0.00418,"percentile":0.36131,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101905","cwe":"CWE-441","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-101905","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.20.0"],"state":"fixed","available":[{"version":"1.20.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.31559},"relatedVulnerabilities":[{"id":"CVE-2026-101905","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101905","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/axios/axios/security/advisories/GHSA-m8m8-qj5v-23w3"],"description":"Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.2 until 1.20.0, the Node HTTP adapter in lib/adapters/http.js supplies request options without an own createConnection value. A separate same-process prototype-pollution flaw places a function on Object.prototype.createConnection. Node resolves and invokes the inherited createConnection socket factory, allowing the attacker-controlled function to select the transport endpoint. The attacker endpoint can receive request headers and bodies, including credentials, and return attacker-controlled responses while the URL appears legitimate. This issue is fixed in version 1.20.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101905","epss":0.00418,"percentile":0.36131,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101905","cwe":"CWE-441","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-101905","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.18.1"}},"found":{"vulnerabilityID":"GHSA-m8m8-qj5v-23w3","versionConstraint":">=1.15.2,<1.20.0 (semantic)"},"fix":{"suggestedVersion":"1.20.0"}}],"artifact":{"id":"pkg:npm/axios@1.18.1?package-id=7e4c2bd70000d786","name":"axios","version":"1.18.1","type":"npm","locations":[{"path":"/web/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.18.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.18.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-44g4-m2mj-wpvx","dataSource":"https://github.com/advisories/GHSA-44g4-m2mj-wpvx","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-44g4-m2mj-wpvx","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/releases/tag/v1.20.0"],"description":"Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101899","epss":0.00512,"percentile":0.43695,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101899","cwe":"CWE-693","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.20.0"],"state":"fixed","available":[{"version":"1.20.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.30464},"relatedVulnerabilities":[{"id":"CVE-2026-101899","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101899","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/axios/axios/security/advisories/GHSA-44g4-m2mj-wpvx"],"description":"Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy treats the NO_PROXY CIDR form as a textual hostname suffix instead of evaluating the network range. A request targets an address covered by a CIDR entry in NO_PROXY while a proxy is configured. The CIDR bypass rule is not matched, so the request is sent through the configured proxy. For plaintext HTTP, the proxy can observe and modify URLs, headers, and bodies; for HTTPS, it can observe connection metadata and CONNECT requests. This issue is fixed in version 1.20.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101899","epss":0.00512,"percentile":0.43695,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101899","cwe":"CWE-693","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.18.1"}},"found":{"vulnerabilityID":"GHSA-44g4-m2mj-wpvx","versionConstraint":">=1.15.0,<1.20.0 (semantic)"},"fix":{"suggestedVersion":"1.20.0"}}],"artifact":{"id":"pkg:npm/axios@1.18.1?package-id=7e4c2bd70000d786","name":"axios","version":"1.18.1","type":"npm","locations":[{"path":"/web/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.18.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.18.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-w6j9-cwv2-h6wq","dataSource":"https://github.com/advisories/GHSA-w6j9-cwv2-h6wq","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w6j9-cwv2-h6wq","https://nvd.nist.gov/vuln/detail/CVE-2026-102274","https://github.com/jpadilla/pyjwt/commit/8915570a0bfda9f0ff0e34e7fb09bdb9d71580cf","https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"],"description":"PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102274","epss":0.00549,"percentile":0.45983,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102274","cwe":"CWE-755","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.14.0"],"state":"fixed","available":[{"version":"2.14.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.29920500000000005},"relatedVulnerabilities":[{"id":"CVE-2026-102274","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102274","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/jpadilla/pyjwt/commit/8915570a0bfda9f0ff0e34e7fb09bdb9d71580cf","https://github.com/jpadilla/pyjwt/releases/tag/2.14.0","https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w6j9-cwv2-h6wq"],"description":"PyJWT is a Python implementation of JSON Web Token standards. From 2.9.0 until 2.14.0, PyJWKSet does not catch the plain ValueError raised for malformed RSA JWK components by RSAAlgorithm.from_jwk in  jwt/api_jwk.py. This occurs when a JWK Set contains a malformed RSA key alongside otherwise usable keys. As a result, one malformed member aborts construction of the entire PyJWKSet. Consequently, applications can experience authentication failures or request-level denial of service. This issue is fixed in version 2.14.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102274","epss":0.00549,"percentile":0.45983,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102274","cwe":"CWE-755","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"pyjwt","version":"2.13.0"}},"found":{"vulnerabilityID":"GHSA-w6j9-cwv2-h6wq","versionConstraint":">=2.9.0,<=2.13.0 (python)"},"fix":{"suggestedVersion":"2.14.0"}}],"artifact":{"id":"pkg:pypi/pyjwt@2.13.0?package-id=30a0e1dffae8ae90","name":"pyjwt","version":"2.13.0","type":"python","locations":[{"path":"/.github/requirements-smoke.txt","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-pyjwt:python-pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pyjwt:python_pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:python-pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:python_pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:python-pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:python_pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pyjwt:pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python:pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:pyjwt:2.13.0:*:*:*:*:*:*:*"],"purl":"pkg:pypi/pyjwt@2.13.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-rfgv-xxqx-mfg5","dataSource":"https://github.com/advisories/GHSA-rfgv-xxqx-mfg5","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nodejs/undici/security/advisories/GHSA-rfgv-xxqx-mfg5","https://nvd.nist.gov/vuln/detail/CVE-2026-19534","https://github.com/nodejs/undici/commit/2af0faf88b906d3127a360c3ac75164c0f95e5a5","https://github.com/nodejs/undici/commit/6615e0175e9b635bcd2e3e87a47daa82f6f5b728","https://github.com/nodejs/undici/commit/66e12816064cf3068f63bd134748b7fc4e779bad","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v6.28.1","https://github.com/nodejs/undici/releases/tag/v7.29.1","https://github.com/nodejs/undici/releases/tag/v8.10.2"],"description":"undici vulnerable to Denial of Service via unrequested WebSocket subprotocol","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-19534","epss":0.00394,"percentile":0.33604,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-19534","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-19534","cwe":"CWE-252","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["8.10.2"],"state":"fixed","available":[{"version":"8.10.2","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.29550000000000004},"relatedVulnerabilities":[{"id":"CVE-2026-19534","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19534","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-rfgv-xxqx-mfg5"],"description":"undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes a Sec-WebSocket-Protocol header, undici dereferences a null value while checking it against the requested list and throws an uncaught TypeError. Because that code runs inside a microtask with no surrounding error handling, the exception propagates and terminates the process under Node's default behavior, instead of gracefully failing the connection as required by the WebSocket protocol. Any application that opens a WebSocket to an attacker-controlled or compromised server, or over a plaintext connection subject to a machine-in-the-middle, can be crashed remotely without authentication in the default configuration. This affects undici versions from 6.7.0 up to 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-19534","epss":0.00394,"percentile":0.33604,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-19534","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-19534","cwe":"CWE-252","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"undici","version":"8.9.0"}},"found":{"vulnerabilityID":"GHSA-rfgv-xxqx-mfg5","versionConstraint":">=8.0.0,<8.10.2 (semantic)"},"fix":{"suggestedVersion":"8.10.2"}}],"artifact":{"id":"pkg:npm/undici@8.9.0?package-id=c6a7a4da2332ffa7","name":"undici","version":"8.9.0","type":"npm","locations":[{"path":"/web/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodejs:undici:8.9.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/undici@8.9.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-xp26-3454-mjgp","dataSource":"https://github.com/advisories/GHSA-xp26-3454-mjgp","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/vitest-dev/vitest/security/advisories/GHSA-xp26-3454-mjgp","https://nvd.nist.gov/vuln/detail/CVE-2026-112950","https://github.com/vitest-dev/vitest/commit/15cc006aa9f8683dc5f7e895d011fa7dc751ce35","https://github.com/vitest-dev/vitest/commit/b825313243dc55757e8d7c0f9e7a792135e13473","https://github.com/vitest-dev/vitest/releases/tag/v4.1.12","https://github.com/vitest-dev/vitest/releases/tag/v5.0.3"],"description":"Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112950","epss":0.00542,"percentile":0.45574,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112950","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["5.0.3"],"state":"fixed","available":[{"version":"5.0.3","date":"2026-10-22","kind":"first-observed"}]},"advisories":[],"risk":0.29539000000000004},"relatedVulnerabilities":[{"id":"CVE-2026-112950","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112950","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/vitest-dev/vitest/commit/15cc006aa9f8683dc5f7e895d011fa7dc751ce35","https://github.com/vitest-dev/vitest/commit/b825313243dc55757e8d7c0f9e7a792135e13473","https://github.com/vitest-dev/vitest/releases/tag/v4.1.12","https://github.com/vitest-dev/vitest/releases/tag/v5.0.3","https://github.com/vitest-dev/vitest/security/advisories/GHSA-xp26-3454-mjgp"],"description":"Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 4.1.11 until 4.1.12 and 5.0.3, isFileLoadingAllowed and the filesystem read interpret backslashes differently on Windows in packages/mocker/src/node/interceptorPlugin.ts. When a client can reach the Vite dev server on Windows and register a redirect mock containing backslash traversal, POSIX joining preserves a Windows backslash traversal that the later filesystem read interprets as a path separator, so the client can read a file outside server.fs.allow that the Vitest process can access. This issue is fixed in versions 4.1.12 and 5.0.3.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112950","epss":0.00542,"percentile":0.45574,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112950","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@vitest/mocker","version":"5.0.1"}},"found":{"vulnerabilityID":"GHSA-xp26-3454-mjgp","versionConstraint":">=5.0.0-rc.2,<5.0.3 (semantic)"},"fix":{"suggestedVersion":"5.0.3"}}],"artifact":{"id":"pkg:npm/%40vitest/mocker@5.0.1?package-id=b415cffdcf584127","name":"@vitest/mocker","version":"5.0.1","type":"npm","locations":[{"path":"/web/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:\\@vitest\\/mocker:\\@vitest\\/mocker:5.0.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40vitest/mocker@5.0.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-j8rh-479h-cp32","dataSource":"https://github.com/advisories/GHSA-j8rh-479h-cp32","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-j8rh-479h-cp32","https://nvd.nist.gov/vuln/detail/CVE-2026-101904","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/releases/tag/v1.20.0"],"description":"Axios: Header Injection via Inherited headers After Minimal Interceptor","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101904","epss":0.00488,"percentile":0.42046,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101904","cwe":"CWE-74","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-101904","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["1.20.0"],"state":"fixed","available":[{"version":"1.20.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.29035999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-101904","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101904","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/axios/axios/security/advisories/GHSA-j8rh-479h-cp32"],"description":"Axios is a promise-based HTTP client for the browser and Node.js. From 1.0.0 until 1.20.0, the dispatchRequest function normalizes inherited Object.prototype.headers from a replacement request configuration. A separate same-process prototype-pollution flaw sets Object.prototype.headers, and trusted request interceptors return a new ordinary configuration without an own headers property. After the interceptor chain, dispatchRequest resolves the inherited headers during normalization. Downstream request processing can observe attacker-controlled headers, including authorization-related values. This issue is fixed in version 1.20.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101904","epss":0.00488,"percentile":0.42046,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101904","cwe":"CWE-74","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-101904","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.18.1"}},"found":{"vulnerabilityID":"GHSA-j8rh-479h-cp32","versionConstraint":">=1.0.0,<1.20.0 (semantic)"},"fix":{"suggestedVersion":"1.20.0"}}],"artifact":{"id":"pkg:npm/axios@1.18.1?package-id=7e4c2bd70000d786","name":"axios","version":"1.18.1","type":"npm","locations":[{"path":"/web/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.18.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.18.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-vfpm-58rq-9qcg","dataSource":"https://github.com/advisories/GHSA-vfpm-58rq-9qcg","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/vitejs/vite/security/advisories/GHSA-vfpm-58rq-9qcg","https://nvd.nist.gov/vuln/detail/CVE-2026-112947","https://github.com/vitejs/vite/pull/23655","https://github.com/vitejs/vite/commit/b6c6d2fb3f853aab4092dc25f0d6816a96c23dff","https://github.com/vitejs/vite/commit/ba8b7ab43b4afa5d0292ab4b6e3a7b5033cc9c73"],"description":"Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112947","epss":0.00502,"percentile":0.42987,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112947","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-112947","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-112947","cwe":"CWE-209","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["8.3.3"],"state":"fixed","available":[{"version":"8.3.3","date":"2026-10-22","kind":"first-observed"}]},"advisories":[],"risk":0.28363},"relatedVulnerabilities":[{"id":"CVE-2026-112947","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112947","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/vitejs/vite/commit/b6c6d2fb3f853aab4092dc25f0d6816a96c23dff","https://github.com/vitejs/vite/commit/ba8b7ab43b4afa5d0292ab4b6e3a7b5033cc9c73","https://github.com/vitejs/vite/pull/23655","https://github.com/vitejs/vite/security/advisories/GHSA-vfpm-58rq-9qcg"],"description":"Vite is a frontend tooling framework for JavaScript. From 8.2.0 until 8.2.4 and 8.3.3, the first 4 bytes of files outside of server.fs setting can be returned to the browser by a request containing ?vite-wasm-instance. Requests containing the ?vite-wasm-instance query are handled by the internal Wasm plugin's load hook. The hook removes the query and reads the resulting path directly from disk, but the server.fs checks were not applied. After reading the file, Vite attempts to parse it as WebAssembly. When that parse fails, Node and deno throws an error that contains the first 4 bytes of the file. This vulnerability is fixed in 8.2.4 and 8.3.3.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112947","epss":0.00502,"percentile":0.42987,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112947","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-112947","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-112947","cwe":"CWE-209","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"vite","version":"8.3.0"}},"found":{"vulnerabilityID":"GHSA-vfpm-58rq-9qcg","versionConstraint":">=8.3.0,<=8.3.2 (semantic)"},"fix":{"suggestedVersion":"8.3.3"}}],"artifact":{"id":"pkg:npm/vite@8.3.0?package-id=901eaa4e2288cc6e","name":"vite","version":"8.3.0","type":"npm","locations":[{"path":"/web/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vitejs:vite:8.3.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/vite@8.3.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-vh66-26gq-q6x8","dataSource":"https://github.com/advisories/GHSA-vh66-26gq-q6x8","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-vh66-26gq-q6x8","https://nvd.nist.gov/vuln/detail/CVE-2026-101908","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/releases/tag/v1.20.0"],"description":"Axios: Prototype pollution gadget in fetch adapter can alter outbound requests","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101908","epss":0.00471,"percentile":0.40719,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101908","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.20.0"],"state":"fixed","available":[{"version":"1.20.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.28024499999999997},"relatedVulnerabilities":[{"id":"CVE-2026-101908","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101908","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/axios/axios/security/advisories/GHSA-vh66-26gq-q6x8"],"description":"Axios is a promise-based HTTP client for the browser and Node.js. From 1.7.0 until 1.20.0, the fetch adapter constructs a Request with sanitized resolvedOptions but then calls fetch with the original fetchOptions. A separate same-process prototype-pollution flaw populates Object.prototype.headers so fetchOptions.headers resolves through inheritance. The inherited fetchOptions.headers value overrides the sanitized Request headers through the second argument to fetch after Request construction. Attacker-controlled request headers can alter authorization, caching, metadata-service access, or application-specific behavior. This issue is fixed in version 1.20.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101908","epss":0.00471,"percentile":0.40719,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101908","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.18.1"}},"found":{"vulnerabilityID":"GHSA-vh66-26gq-q6x8","versionConstraint":">=1.7.0,<1.20.0 (semantic)"},"fix":{"suggestedVersion":"1.20.0"}}],"artifact":{"id":"pkg:npm/axios@1.18.1?package-id=7e4c2bd70000d786","name":"axios","version":"1.18.1","type":"npm","locations":[{"path":"/web/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.18.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.18.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-vxq7-64xx-v4gw","dataSource":"https://github.com/advisories/GHSA-vxq7-64xx-v4gw","namespace":"github:language:python","severity":"High","urls":["https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw","https://nvd.nist.gov/vuln/detail/CVE-2026-97689","https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed","https://github.com/urllib3/urllib3/releases/tag/2.8.0"],"description":"urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","metrics":{"baseScore":8.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-97689","epss":0.00335,"percentile":0.26859,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-97689","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.8.0"],"state":"fixed","available":[{"version":"2.8.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.27470000000000006},"relatedVulnerabilities":[{"id":"CVE-2026-97689","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97689","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed","https://github.com/urllib3/urllib3/releases/tag/2.8.0","https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw"],"description":"urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a length bound. The trigger is that a malicious server returns Transfer-Encoding: chunked followed by a very long run of bytes without a newline. The attack mechanism is that a malicious HTTP server sends a very long unterminated chunk-size line. The impact is that unbounded memory allocation can exhaust the client process. This issue is fixed in version 2.8.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-97689","epss":0.00335,"percentile":0.26859,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-97689","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"urllib3","version":"2.7.0"}},"found":{"vulnerabilityID":"GHSA-vxq7-64xx-v4gw","versionConstraint":">=1.10.3,<2.8.0 (python)"},"fix":{"suggestedVersion":"2.8.0"}}],"artifact":{"id":"pkg:pypi/urllib3@2.7.0?package-id=f33c78390a520e8b","name":"urllib3","version":"2.7.0","type":"python","locations":[{"path":"/.github/requirements-nightly.txt","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python:urllib3:2.7.0:*:*:*:*:*:*:*"],"purl":"pkg:pypi/urllib3@2.7.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-pmjh-fq2x-6v4x","dataSource":"https://github.com/advisories/GHSA-pmjh-fq2x-6v4x","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/nodejs/undici/security/advisories/GHSA-pmjh-fq2x-6v4x","https://nvd.nist.gov/vuln/detail/CVE-2026-18149","https://github.com/nodejs/undici/commit/3c6726599cea8646384dde846c97d630da472a74","https://github.com/nodejs/undici/commit/e905b5b87e6953bcc542af90557b2fee5b7b5974","https://hackerone.com/reports/3892751","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v7.29.1","https://github.com/nodejs/undici/releases/tag/v8.10.2"],"description":"undici vulnerable to Denial of Service via orphaned RetryHandler response body","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-18149","epss":0.00481,"percentile":0.41502,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-18149","cwe":"CWE-772","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["8.10.2"],"state":"fixed","available":[{"version":"8.10.2","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.262145},"relatedVulnerabilities":[{"id":"CVE-2026-18149","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18149","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-pmjh-fq2x-6v4x"],"description":"undici's retry handler can leave an already-exposed response body pending forever. When a server returns a successful response that declares a Content-Length, sends only part of the body, and closes the connection, the retry handler retries the request. If the retry returns a non-retryable status such as 400, the handler forwards that new response downstream and replaces its internal response stream, but the original response body that the application still holds is never ended or destroyed. As a result calls that read that body never settle, and the configured body timeout does not fire because its timer is tied to the connection parser rather than the orphaned body. An attacker-controlled server can trigger this with two short responses without keeping a connection open, and repeated requests accumulate pending promises and streams that can exhaust application concurrency or memory. This affects undici versions from 7.11.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-18149","epss":0.00481,"percentile":0.41502,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-18149","cwe":"CWE-772","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"undici","version":"8.9.0"}},"found":{"vulnerabilityID":"GHSA-pmjh-fq2x-6v4x","versionConstraint":">=8.0.0,<8.10.2 (semantic)"},"fix":{"suggestedVersion":"8.10.2"}}],"artifact":{"id":"pkg:npm/undici@8.9.0?package-id=c6a7a4da2332ffa7","name":"undici","version":"8.9.0","type":"npm","locations":[{"path":"/web/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodejs:undici:8.9.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/undici@8.9.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-xjj6-f33q-929c","dataSource":"https://github.com/advisories/GHSA-xjj6-f33q-929c","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nodejs/undici/security/advisories/GHSA-xjj6-f33q-929c","https://nvd.nist.gov/vuln/detail/CVE-2026-109869","https://github.com/nodejs/undici/commit/07ded4941b1e72afec862958c3b8ddf468f3b429","https://github.com/nodejs/undici/commit/1325a87dfb3492f8e87e6b0a84b3bda4e82e3436","https://github.com/nodejs/undici/commit/b5084c7dc239172d75c336b1cd51ddac023938a5","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v6.29.1","https://github.com/nodejs/undici/releases/tag/v7.30.1","https://github.com/nodejs/undici/releases/tag/v8.12.2"],"description":"undici vulnerable to Denial of Service via unhandled error on excessive content-encodings","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-109869","epss":0.00344,"percentile":0.27941,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-109869","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-109869","cwe":"CWE-459","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["8.12.2"],"state":"fixed","available":[{"version":"8.12.2","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.258},"relatedVulnerabilities":[{"id":"CVE-2026-109869","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109869","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-xjj6-f33q-929c"],"description":"undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1, its fetch() implementation crashes the Node.js process when a malicious server returns a response with more than five content codings and closes the connection before sending the body. undici rejects such responses because of a content-encoding limit, but it created the internal response stream before that check and returned without attaching an error listener or aborting the request, so the early close surfaces a content-length mismatch on the orphaned stream, which Node.js treats as an unhandled error and terminates the process. A remote, unauthenticated server can trigger this with a single response, even when the application correctly catches the fetch() rejection, resulting in a denial of service. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, and users should upgrade to one of those versions or later. There is no workaround.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-109869","epss":0.00344,"percentile":0.27941,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-109869","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-109869","cwe":"CWE-459","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"undici","version":"8.9.0"}},"found":{"vulnerabilityID":"GHSA-xjj6-f33q-929c","versionConstraint":">=8.0.0,<8.12.2 (semantic)"},"fix":{"suggestedVersion":"8.12.2"}}],"artifact":{"id":"pkg:npm/undici@8.9.0?package-id=c6a7a4da2332ffa7","name":"undici","version":"8.9.0","type":"npm","locations":[{"path":"/web/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodejs:undici:8.9.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/undici@8.9.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-xcq7-p3pf-p88h","dataSource":"https://github.com/advisories/GHSA-xcq7-p3pf-p88h","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/open-telemetry/opentelemetry-python/security/advisories/GHSA-xcq7-p3pf-p88h","https://github.com/open-telemetry/opentelemetry-python/pull/5749","https://github.com/open-telemetry/opentelemetry-python/commit/d5224bf4ffdf2aee1b592ad238dcc32ca957f26b","https://github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md#version-1451066b1-2026-10-06","https://github.com/open-telemetry/opentelemetry-python/releases/tag/v1.45.1"],"description":"OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-114603","epss":0.00487,"percentile":0.41954,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-114603","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-114603","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.45.1"],"state":"fixed","available":[{"version":"1.45.1","date":"2026-10-23","kind":"first-observed"}]},"advisories":[],"risk":0.250805},"relatedVulnerabilities":[{"id":"CVE-2026-114603","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114603","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md#version-1451066b1-2026-10-06","https://github.com/open-telemetry/opentelemetry-python/commit/d5224bf4ffdf2aee1b592ad238dcc32ca957f26b","https://github.com/open-telemetry/opentelemetry-python/pull/5749","https://github.com/open-telemetry/opentelemetry-python/releases/tag/v1.45.1","https://github.com/open-telemetry/opentelemetry-python/security/advisories/GHSA-xcq7-p3pf-p88h"],"description":"OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.1, the opentelemetry-api function TraceState.from_header in opentelemetry/trace/span.py, reached through TraceContextTextMapPropagator.extract, parses inbound W3C tracestate headers with an unbounded optional-whitespace regular expression. A malformed header containing a long run of spaces or tabs without a following comma causes quadratic backtracking before the member-count limit is applied. Services using the default W3C Trace Context propagator can therefore spend excessive CPU time on one unauthenticated request when the HTTP server, parser, gateway, or custom carrier accepts a sufficiently large header. The processing can occupy a synchronous worker or delay unrelated requests on the same asynchronous event loop. The impact is limited to availability and does not expose or modify telemetry data or allow code execution. This issue is fixed in version 1.45.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-114603","epss":0.00487,"percentile":0.41954,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-114603","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-114603","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"opentelemetry-api","version":"1.44.0"}},"found":{"vulnerabilityID":"GHSA-xcq7-p3pf-p88h","versionConstraint":"<=1.45.0 (python)"},"fix":{"suggestedVersion":"1.45.1"}}],"artifact":{"id":"pkg:pypi/opentelemetry-api@1.44.0?package-id=c32deaff249cf7ae","name":"opentelemetry-api","version":"1.44.0","type":"python","locations":[{"path":"/.github/requirements-nightly.txt","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-opentelemetry-api:python-opentelemetry-api:1.44.0:*:*:*:*:*:*:*","cpe:2.3:a:python-opentelemetry-api:python_opentelemetry_api:1.44.0:*:*:*:*:*:*:*","cpe:2.3:a:python_opentelemetry_api:python-opentelemetry-api:1.44.0:*:*:*:*:*:*:*","cpe:2.3:a:python_opentelemetry_api:python_opentelemetry_api:1.44.0:*:*:*:*:*:*:*","cpe:2.3:a:python-opentelemetry:python-opentelemetry-api:1.44.0:*:*:*:*:*:*:*","cpe:2.3:a:python-opentelemetry:python_opentelemetry_api:1.44.0:*:*:*:*:*:*:*","cpe:2.3:a:python_opentelemetry:python-opentelemetry-api:1.44.0:*:*:*:*:*:*:*","cpe:2.3:a:python_opentelemetry:python_opentelemetry_api:1.44.0:*:*:*:*:*:*:*","cpe:2.3:a:opentelemetry-api:python-opentelemetry-api:1.44.0:*:*:*:*:*:*:*","cpe:2.3:a:opentelemetry-api:python_opentelemetry_api:1.44.0:*:*:*:*:*:*:*","cpe:2.3:a:opentelemetry_api:python-opentelemetry-api:1.44.0:*:*:*:*:*:*:*","cpe:2.3:a:opentelemetry_api:python_opentelemetry_api:1.44.0:*:*:*:*:*:*:*","cpe:2.3:a:python-opentelemetry-api:opentelemetry-api:1.44.0:*:*:*:*:*:*:*","cpe:2.3:a:python-opentelemetry-api:opentelemetry_api:1.44.0:*:*:*:*:*:*:*","cpe:2.3:a:python_opentelemetry_api:opentelemetry-api:1.44.0:*:*:*:*:*:*:*","cpe:2.3:a:python_opentelemetry_api:opentelemetry_api:1.44.0:*:*:*:*:*:*:*","cpe:2.3:a:opentelemetry:python-opentelemetry-api:1.44.0:*:*:*:*:*:*:*","cpe:2.3:a:opentelemetry:python_opentelemetry_api:1.44.0:*:*:*:*:*:*:*","cpe:2.3:a:python-opentelemetry:opentelemetry-api:1.44.0:*:*:*:*:*:*:*","cpe:2.3:a:python-opentelemetry:opentelemetry_api:1.44.0:*:*:*:*:*:*:*","cpe:2.3:a:python_opentelemetry:opentelemetry-api:1.44.0:*:*:*:*:*:*:*","cpe:2.3:a:python_opentelemetry:opentelemetry_api:1.44.0:*:*:*:*:*:*:*","cpe:2.3:a:opentelemetry-api:opentelemetry-api:1.44.0:*:*:*:*:*:*:*","cpe:2.3:a:opentelemetry-api:opentelemetry_api:1.44.0:*:*:*:*:*:*:*","cpe:2.3:a:opentelemetry_api:opentelemetry-api:1.44.0:*:*:*:*:*:*:*","cpe:2.3:a:opentelemetry_api:opentelemetry_api:1.44.0:*:*:*:*:*:*:*","cpe:2.3:a:opentelemetry:opentelemetry-api:1.44.0:*:*:*:*:*:*:*","cpe:2.3:a:opentelemetry:opentelemetry_api:1.44.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-opentelemetry-api:1.44.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_opentelemetry_api:1.44.0:*:*:*:*:*:*:*","cpe:2.3:a:python:opentelemetry-api:1.44.0:*:*:*:*:*:*:*","cpe:2.3:a:python:opentelemetry_api:1.44.0:*:*:*:*:*:*:*"],"purl":"pkg:pypi/opentelemetry-api@1.44.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-9fr6-4gfg-395g","dataSource":"https://github.com/advisories/GHSA-9fr6-4gfg-395g","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0"],"description":"Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101902","epss":0.00414,"percentile":0.35676,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101902","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.20.0"],"state":"fixed","available":[{"version":"1.20.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.24632999999999994},"relatedVulnerabilities":[{"id":"CVE-2026-101902","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101902","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g"],"description":"Axios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vulnerability in the same process pollutes Object.prototype.method, calls such as axios.request({ url }) and axios({ url }) can send a state-changing HTTP method instead of the expected default GET. Axios does not create the prototype pollution source. This is a read-side gadget in axios request dispatch. This issue is fixed in version 0.34.0 and 1.20.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101902","epss":0.00414,"percentile":0.35676,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101902","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.18.1"}},"found":{"vulnerabilityID":"GHSA-9fr6-4gfg-395g","versionConstraint":">=1.0.0,<1.20.0 (semantic)"},"fix":{"suggestedVersion":"1.20.0"}}],"artifact":{"id":"pkg:npm/axios@1.18.1?package-id=7e4c2bd70000d786","name":"axios","version":"1.18.1","type":"npm","locations":[{"path":"/web/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:axios:axios:1.18.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.18.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-698v-4r3x-3vcv","dataSource":"https://github.com/advisories/GHSA-698v-4r3x-3vcv","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/vitejs/launch-editor/security/advisories/GHSA-698v-4r3x-3vcv","https://nvd.nist.gov/vuln/detail/CVE-2026-112943","https://github.com/vitejs/launch-editor/pull/155","https://github.com/vitejs/launch-editor/commit/3c2f9bf2ff8fe63d056a8f9cc52d825b66ca79fc","https://github.com/vitejs/launch-editor/releases/tag/v2.14.2"],"description":"launch-editor: escapeCmdArgs() omits % escaping on Windows","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112943","epss":0.00414,"percentile":0.35746,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112943","cwe":"CWE-78","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["8.3.3"],"state":"fixed","available":[{"version":"8.3.3","date":"2026-10-21","kind":"first-observed"}]},"advisories":[],"risk":0.23390999999999992},"relatedVulnerabilities":[{"id":"CVE-2026-112943","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112943","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/vitejs/launch-editor/commit/3c2f9bf2ff8fe63d056a8f9cc52d825b66ca79fc","https://github.com/vitejs/launch-editor/pull/155","https://github.com/vitejs/launch-editor/releases/tag/v2.14.2","https://github.com/vitejs/launch-editor/security/advisories/GHSA-698v-4r3x-3vcv"],"description":"launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. This vulnerability is fixed in 2.14.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112943","epss":0.00414,"percentile":0.35746,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112943","cwe":"CWE-78","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"vite","version":"8.3.0"}},"found":{"vulnerabilityID":"GHSA-698v-4r3x-3vcv","versionConstraint":">=8.3.0,<=8.3.2 (semantic)"},"fix":{"suggestedVersion":"8.3.3"}}],"artifact":{"id":"pkg:npm/vite@8.3.0?package-id=901eaa4e2288cc6e","name":"vite","version":"8.3.0","type":"npm","locations":[{"path":"/web/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vitejs:vite:8.3.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/vite@8.3.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-p458-7748-mcp3","dataSource":"https://github.com/advisories/GHSA-p458-7748-mcp3","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/vitest-dev/vitest/security/advisories/GHSA-p458-7748-mcp3","https://nvd.nist.gov/vuln/detail/CVE-2026-112948","https://github.com/vitest-dev/vitest/pull/11578","https://github.com/vitest-dev/vitest/commit/28dc1edfb6ba5a181fe208576989063795aeadb3","https://github.com/vitest-dev/vitest/releases/tag/v5.0.5"],"description":"Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112948","epss":0.004,"percentile":0.34315,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112948","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-112948","cwe":"CWE-552","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["5.0.5"],"state":"fixed","available":[{"version":"5.0.5","date":"2026-10-22","kind":"first-observed"}]},"advisories":[],"risk":0.22999999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-112948","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112948","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/vitest-dev/vitest/commit/28dc1edfb6ba5a181fe208576989063795aeadb3","https://github.com/vitest-dev/vitest/pull/11578","https://github.com/vitest-dev/vitest/releases/tag/v5.0.5","https://github.com/vitest-dev/vitest/security/advisories/GHSA-p458-7748-mcp3"],"description":"Vitest is a testing framework powered by Vite. From 5.0.0-beta.6 until 5.0.5, Vitest dev servers can misapply server.fs.deny because project servers replace Vite's defaults and the root server adds .vitest-secret-token after Vite compiles its matcher. An attacker who can reach an affected UI, Browser Mode, or API server can read denied project files or the fallback API token at node_modules/.vitest/.vitest-secret-token, and Browser Mode with test.projects can expose JavaScript-compatible .env values through a malicious website. This issue is fixed in version 5.0.5.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112948","epss":0.004,"percentile":0.34315,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112948","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-112948","cwe":"CWE-552","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@vitest/ui","version":"5.0.0"}},"found":{"vulnerabilityID":"GHSA-p458-7748-mcp3","versionConstraint":">=5.0.0-beta.6,<5.0.5 (semantic)"},"fix":{"suggestedVersion":"5.0.5"}}],"artifact":{"id":"pkg:npm/%40vitest/ui@5.0.0?package-id=c2332eb5d61927d8","name":"@vitest/ui","version":"5.0.0","type":"npm","locations":[{"path":"/web/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:\\@vitest\\/ui:\\@vitest\\/ui:5.0.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40vitest/ui@5.0.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-3xpg-4rpp-hhhm","dataSource":"https://github.com/advisories/GHSA-3xpg-4rpp-hhhm","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/nodejs/undici/security/advisories/GHSA-3xpg-4rpp-hhhm","https://nvd.nist.gov/vuln/detail/CVE-2026-84890","https://github.com/nodejs/undici/commit/2c7d7e1227043c644c4c32cfd1e276f4fd4fcb11","https://github.com/nodejs/undici/commit/7aac7f12f757844763c8b8f1ab6e305e80d55838","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v7.29.1","https://github.com/nodejs/undici/releases/tag/v8.10.2"],"description":"undici vulnerable to Denial of Service via unbounded decompression of compressed responses","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84890","epss":0.00412,"percentile":0.35501,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84890","cwe":"CWE-770","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["8.10.2"],"state":"fixed","available":[{"version":"8.10.2","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.22454000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-84890","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84890","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-3xpg-4rpp-hhhm"],"description":"undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header. While the number of content-encoding layers is capped, the total decompressed output size is unbounded and there is no configuration option to limit it. A malicious or faulty upstream can therefore return a small compressed payload, a compression bomb, that expands to hundreds of megabytes or more in client memory, an asymmetric resource consumption that can exhaust memory and crash the process. This affects undici versions from 7.15.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84890","epss":0.00412,"percentile":0.35501,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84890","cwe":"CWE-770","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"undici","version":"8.9.0"}},"found":{"vulnerabilityID":"GHSA-3xpg-4rpp-hhhm","versionConstraint":">=8.0.0,<8.10.2 (semantic)"},"fix":{"suggestedVersion":"8.10.2"}}],"artifact":{"id":"pkg:npm/undici@8.9.0?package-id=c6a7a4da2332ffa7","name":"undici","version":"8.9.0","type":"npm","locations":[{"path":"/web/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodejs:undici:8.9.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/undici@8.9.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-3wwx-pv8p-q78v","dataSource":"https://github.com/advisories/GHSA-3wwx-pv8p-q78v","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/nodejs/undici/security/advisories/GHSA-3wwx-pv8p-q78v","https://nvd.nist.gov/vuln/detail/CVE-2026-85024","https://github.com/nodejs/undici/commit/07c60d9c7099a910451244afe42861bbdbdd974c","https://github.com/nodejs/undici/commit/4411a238a98e8791da5fff10cc9e3578a7668ed6","https://github.com/nodejs/undici/commit/63cf698b611fecc6ee0a17b185b930051e4b982f","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v6.28.1","https://github.com/nodejs/undici/releases/tag/v7.29.1","https://github.com/nodejs/undici/releases/tag/v8.10.2"],"description":"undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-85024","epss":0.00412,"percentile":0.355,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-85024","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["8.10.2"],"state":"fixed","available":[{"version":"8.10.2","date":"2026-09-29","kind":"first-observed"}]},"advisories":[],"risk":0.22454000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-85024","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85024","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-3wwx-pv8p-q78v"],"description":"undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error listener, while that stream can still emit. When a remote peer sends a compressed payload that crosses the built-in 128 MiB decompressed-payload limit and then contains a malformed DEFLATE byte, the inflate stream emits a data error with no listener attached, which Node.js treats as a fatal unhandled error and terminates the entire process. Exploitation is remote and unauthenticated, requires no application mistake, and is asymmetric, since roughly 130 KB on the wire expands past the limit and crashes the process, and reconnecting can repeat the crash. This affects undici versions from 6.25.0 up to 6.28.1, from 7.28.0 up to 7.29.1, and from 8.1.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-85024","epss":0.00412,"percentile":0.355,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-85024","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"undici","version":"8.9.0"}},"found":{"vulnerabilityID":"GHSA-3wwx-pv8p-q78v","versionConstraint":">=8.1.0,<8.10.2 (semantic)"},"fix":{"suggestedVersion":"8.10.2"}}],"artifact":{"id":"pkg:npm/undici@8.9.0?package-id=c6a7a4da2332ffa7","name":"undici","version":"8.9.0","type":"npm","locations":[{"path":"/web/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodejs:undici:8.9.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/undici@8.9.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-q2hr-2g5m-vwhr","dataSource":"https://github.com/advisories/GHSA-q2hr-2g5m-vwhr","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr","https://nvd.nist.gov/vuln/detail/CVE-2026-102277","https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e"],"description":"brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102277","epss":0.00428,"percentile":0.37125,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102277","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102277","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.1.7"],"state":"fixed","available":[{"version":"2.1.7","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.22042},"relatedVulnerabilities":[{"id":"CVE-2026-102277","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102277","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-input rescans with linear working-string growth cause quadratic CPU time and memory pressure that can block the Node.js event loop. The process eventually recovers, making the impact a recoverable CPU denial of service. This issue is fixed in versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102277","epss":0.00428,"percentile":0.37125,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102277","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102277","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"2.1.4"}},"found":{"vulnerabilityID":"GHSA-q2hr-2g5m-vwhr","versionConstraint":">=2.0.0,<2.1.7 (semantic)"},"fix":{"suggestedVersion":"2.1.7"}}],"artifact":{"id":"pkg:npm/brace-expansion@2.1.4?package-id=67bb71a2992c722e","name":"brace-expansion","version":"2.1.4","type":"npm","locations":[{"path":"/.github/ga4-scripts/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:2.1.4:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@2.1.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-q2hr-2g5m-vwhr","dataSource":"https://github.com/advisories/GHSA-q2hr-2g5m-vwhr","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr","https://nvd.nist.gov/vuln/detail/CVE-2026-102277","https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e"],"description":"brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102277","epss":0.00428,"percentile":0.37125,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102277","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102277","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["5.0.12"],"state":"fixed","available":[{"version":"5.0.12","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.22042},"relatedVulnerabilities":[{"id":"CVE-2026-102277","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102277","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-input rescans with linear working-string growth cause quadratic CPU time and memory pressure that can block the Node.js event loop. The process eventually recovers, making the impact a recoverable CPU denial of service. This issue is fixed in versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102277","epss":0.00428,"percentile":0.37125,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102277","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102277","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"5.0.9"}},"found":{"vulnerabilityID":"GHSA-q2hr-2g5m-vwhr","versionConstraint":">=4.0.0,<5.0.12 (semantic)"},"fix":{"suggestedVersion":"5.0.12"}}],"artifact":{"id":"pkg:npm/brace-expansion@5.0.9?package-id=da168845182b5f28","name":"brace-expansion","version":"5.0.9","type":"npm","locations":[{"path":"/web/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:5.0.9:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@5.0.9","upstreams":[]}},{"vulnerability":{"id":"GHSA-2gx3-rcp4-g85q","dataSource":"https://github.com/advisories/GHSA-2gx3-rcp4-g85q","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/jpadilla/pyjwt/security/advisories/GHSA-2gx3-rcp4-g85q","https://nvd.nist.gov/vuln/detail/CVE-2026-101917","https://github.com/jpadilla/pyjwt/commit/ba4853a75fb9676362da17f67d0f64bd18afd4e1","https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"],"description":"PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101917","epss":0.00428,"percentile":0.37048,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101917","cwe":"CWE-770","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["2.14.0"],"state":"fixed","available":[{"version":"2.14.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.22042},"relatedVulnerabilities":[{"id":"CVE-2026-101917","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101917","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/jpadilla/pyjwt/commit/ba4853a75fb9676362da17f67d0f64bd18afd4e1","https://github.com/jpadilla/pyjwt/releases/tag/2.14.0","https://github.com/jpadilla/pyjwt/security/advisories/GHSA-2gx3-rcp4-g85q"],"description":"PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT get_signing_key_from_jwt is affected because unknown kid misses force refreshes without a negative cache or minimum refresh interval. This occurs when unauthenticated tokens repeatedly use the same unknown kid or varying kid values absent from the cached JWKS. As a result, each cache miss causes PyJWKClient to refresh the JWKS. Consequently, attacker traffic can amplify outbound requests to the configured JWKS endpoint. This issue is fixed in version 2.14.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101917","epss":0.00428,"percentile":0.37048,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101917","cwe":"CWE-770","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"pyjwt","version":"2.13.0"}},"found":{"vulnerabilityID":"GHSA-2gx3-rcp4-g85q","versionConstraint":"<=2.13.0 (python)"},"fix":{"suggestedVersion":"2.14.0"}}],"artifact":{"id":"pkg:pypi/pyjwt@2.13.0?package-id=30a0e1dffae8ae90","name":"pyjwt","version":"2.13.0","type":"python","locations":[{"path":"/.github/requirements-smoke.txt","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-pyjwt:python-pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pyjwt:python_pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:python-pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:python_pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:python-pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:python_pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pyjwt:pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python:pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:pyjwt:2.13.0:*:*:*:*:*:*:*"],"purl":"pkg:pypi/pyjwt@2.13.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-ffc3-869f-jxw9","dataSource":"https://github.com/advisories/GHSA-ffc3-869f-jxw9","namespace":"github:language:python","severity":"Critical","urls":["https://github.com/jpadilla/pyjwt/security/advisories/GHSA-ffc3-869f-jxw9","https://nvd.nist.gov/vuln/detail/CVE-2026-102268","https://github.com/jpadilla/pyjwt/commit/8b4e233a22206b34ec1186e912e75c0b2396ac07","https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"],"description":"PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102268","epss":0.00236,"percentile":0.14623,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102268","cwe":"CWE-347","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.14.0"],"state":"fixed","available":[{"version":"2.14.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.21358000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-102268","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102268","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/jpadilla/pyjwt/commit/8b4e233a22206b34ec1186e912e75c0b2396ac07","https://github.com/jpadilla/pyjwt/releases/tag/2.14.0","https://github.com/jpadilla/pyjwt/security/advisories/GHSA-ffc3-869f-jxw9"],"description":"PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, is_pem_format in jwt/utils.py is affected because is_pem_format does not recognize every PEM representation accepted by the cryptography loader. This occurs when an application mixes HMAC and asymmetric algorithms and supplies a mutated public-key PEM as raw key bytes. As a result, HMACAlgorithm.prepare_key treats the unrecognized asymmetric public key as an HMAC secret. Consequently, an attacker who knows the public key can forge authenticated HMAC tokens. This issue is fixed in version 2.14.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102268","epss":0.00236,"percentile":0.14623,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102268","cwe":"CWE-347","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"pyjwt","version":"2.13.0"}},"found":{"vulnerabilityID":"GHSA-ffc3-869f-jxw9","versionConstraint":"<=2.13.0 (python)"},"fix":{"suggestedVersion":"2.14.0"}}],"artifact":{"id":"pkg:pypi/pyjwt@2.13.0?package-id=30a0e1dffae8ae90","name":"pyjwt","version":"2.13.0","type":"python","locations":[{"path":"/.github/requirements-smoke.txt","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-pyjwt:python-pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pyjwt:python_pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:python-pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:python_pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:python-pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:python_pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pyjwt:pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python:pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:pyjwt:2.13.0:*:*:*:*:*:*:*"],"purl":"pkg:pypi/pyjwt@2.13.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-42vr-xj54-vc7v","dataSource":"https://github.com/advisories/GHSA-42vr-xj54-vc7v","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/jpadilla/pyjwt/security/advisories/GHSA-42vr-xj54-vc7v","https://nvd.nist.gov/vuln/detail/CVE-2026-101918","https://github.com/jpadilla/pyjwt/commit/5fde08a6cf906aa7698de2d6391d88b73006b17b","https://github.com/jpadilla/pyjwt/releases/tag/2.15.0"],"description":"PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101918","epss":0.00413,"percentile":0.35602,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101918","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.15.0"],"state":"fixed","available":[{"version":"2.15.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.212695},"relatedVulnerabilities":[{"id":"CVE-2026-101918","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101918","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/jpadilla/pyjwt/commit/5fde08a6cf906aa7698de2d6391d88b73006b17b","https://github.com/jpadilla/pyjwt/releases/tag/2.15.0","https://github.com/jpadilla/pyjwt/security/advisories/GHSA-42vr-xj54-vc7v"],"description":"PyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWKClient.get_signing_key_from_jwt is affected because payload parser catches ValueError but not RecursionError. This occurs when an attacker-controlled recursively nested payload reaches json.loads. As a result, documented PyJWT exception handling does not contain the failure. Consequently, an unauthenticated request can raise an exception that may produce an HTTP 500 response. The advisory-defined affected implementation also includes jwt/api_jwt.py, verify_signature=False. This issue is fixed in version 2.15.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101918","epss":0.00413,"percentile":0.35602,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101918","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"pyjwt","version":"2.13.0"}},"found":{"vulnerabilityID":"GHSA-42vr-xj54-vc7v","versionConstraint":">=2.0.0a1,<=2.14.0 (python)"},"fix":{"suggestedVersion":"2.15.0"}}],"artifact":{"id":"pkg:pypi/pyjwt@2.13.0?package-id=30a0e1dffae8ae90","name":"pyjwt","version":"2.13.0","type":"python","locations":[{"path":"/.github/requirements-smoke.txt","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-pyjwt:python-pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pyjwt:python_pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:python-pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:python_pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:python-pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:python_pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pyjwt:pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python:pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:pyjwt:2.13.0:*:*:*:*:*:*:*"],"purl":"pkg:pypi/pyjwt@2.13.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-rx4f-c7p8-82vq","dataSource":"https://github.com/advisories/GHSA-rx4f-c7p8-82vq","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/nodejs/undici/security/advisories/GHSA-rx4f-c7p8-82vq","https://nvd.nist.gov/vuln/detail/CVE-2026-85014","https://github.com/nodejs/undici/commit/1858656ebb1e919311c1f31613dfd581b7214349","https://github.com/nodejs/undici/commit/662d0ea671fe64139e79533c913fce412765e1d7","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v7.29.1","https://github.com/nodejs/undici/releases/tag/v8.10.2"],"description":"undici vulnerable to Denial of Service via WebSocketStream unclean close","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-85014","epss":0.00368,"percentile":0.3066,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-85014","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-85014","cwe":"CWE-754","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["8.10.2"],"state":"fixed","available":[{"version":"8.10.2","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.20056000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-85014","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85014","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-rx4f-c7p8-82vq"],"description":"undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection without a WebSocket close handshake. On an unclean close the internal socket-close handler calls abort on the writable stream unconditionally and discards the returned promise, but per the WHATWG Streams standard aborting a locked writable returns a promise that rejects with a TypeError. Because the application holds a writer on that writable, which is the only way to write, the rejection is never observed and Node's default unhandled-rejection behavior terminates the process. An untrusted server can therefore crash a client with a single abrupt disconnect, with no authentication and no application mistake. This affects undici versions from 7.0.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-85014","epss":0.00368,"percentile":0.3066,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-85014","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-85014","cwe":"CWE-754","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"undici","version":"8.9.0"}},"found":{"vulnerabilityID":"GHSA-rx4f-c7p8-82vq","versionConstraint":">=8.0.0,<8.10.2 (semantic)"},"fix":{"suggestedVersion":"8.10.2"}}],"artifact":{"id":"pkg:npm/undici@8.9.0?package-id=c6a7a4da2332ffa7","name":"undici","version":"8.9.0","type":"npm","locations":[{"path":"/web/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodejs:undici:8.9.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/undici@8.9.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-6pq8-jhm2-2vcw","dataSource":"https://github.com/advisories/GHSA-6pq8-jhm2-2vcw","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw","https://nvd.nist.gov/vuln/detail/CVE-2026-110816","https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727","https://github.com/ljharb/qs/releases/tag/v6.16.1"],"description":"qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110816","epss":0.00368,"percentile":0.30715,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110816","cwe":"CWE-248","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-110816","cwe":"CWE-704","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}],"fix":{"versions":["6.16.1"],"state":"fixed","available":[{"version":"6.16.1","date":"2026-10-27","kind":"first-observed"}]},"advisories":[],"risk":0.19872},"relatedVulnerabilities":[{"id":"CVE-2026-110816","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110816","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727","https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw"],"description":"### Summary\n\n\n\n`qs.stringify` with `arrayFormat: 'comma'` throws `TypeError: Cannot convert object to primitive value` when an array element cannot be coerced to a string, such as an object with an own non-callable `toString` (`{ \"toString\": \"x\" }`) or a null-prototype object. The comma format joins array elements with `Array.prototype.join` and, under `encodeValuesOnly`, first passes each element through `String()` in `utils.encode`; neither guards against an element whose string coercion fails.\n\n\n\n### Details\n\n\n\nIn `lib/stringify.js`, the comma branch collapses the array with `obj.join(',')`. For an element whose own `toString` is not callable, `ToPrimitive` skips it, falls through to `Object.prototype.valueOf` (which returns the object itself), and throws. Under `encodeValuesOnly: true`, the same element first reaches `String(str)` in `utils.encode` (`lib/utils.js`) and throws there. Nested arrays (`{ \"a\": [[{ \"toString\": \"x\" }]] }`) throw the same way, through `Array.prototype.toString`. The `indices`, `brackets`, and `repeat` formats walk into object elements instead of coercing them, and are not affected.\n\n\n\nSuch elements can come from untrusted input. `JSON.parse` produces `{ \"a\": [{ \"toString\": \"x\" }] }` with no qs option involved. `qs.parse(\"a[0][toString]=x\", { allowPrototypes: true })` keeps the `toString` key, and `qs.parse(\"a[][b]=c\", { plainObjects: true })` produces a null-prototype element; the default parse options drop `toString` and produce ordinary objects, which do not throw. Express 4's default `query parser`, Express 5's `extended` query parser, and body-parser's `urlencoded({ extended: true })` all call `qs.parse` with `allowPrototypes: true`.\n\n\n\n#### PoC\n\n\n\n```js\n\n\n\nvar qs = require(\"qs\");\n\n\n\nqs.stringify(JSON.parse(\"{\\\"a\\\":[{\\\"toString\\\":\\\"x\\\"}]}\"), { arrayFormat: \"comma\" });\n\n\n\nqs.stringify(qs.parse(\"a[0][toString]=x\", { allowPrototypes: true }), { arrayFormat: \"comma\" });\n\n\n\nqs.stringify(qs.parse(\"a[][b]=c\", { plainObjects: true }), { arrayFormat: \"comma\", encodeValuesOnly: true });\n\n\n\n// TypeError: Cannot convert object to primitive value\n\n\n\n```\n\n\n\n#### Fix\n\n\n\nApplied in a952e75 on `main` and released as v6.16.1: an element whose string coercion would fail is coerced to its primitive `valueOf`, if any, or else to `Object.prototype.toString`, so it renders as `[object Object]`, the same as any other object element already does under the comma format. Nested arrays are walked the way `join` walks them. Every input that did not previously throw serializes exactly as before, and a `toString` or `valueOf` that itself throws still propagates.\n\n\n\n### Affected versions\n\n\n\n`>=6.7.0 <6.16.1`, fixed in v6.16.1.\n\n\n\nThe `join` path was introduced with the comma format in b84acba and first shipped in v6.7.0; v6.6.x and earlier ignore `arrayFormat: 'comma'` and are not affected. The `encodeValuesOnly` `String()` site was introduced in 4c4b23d (v6.11.1); before that, the same input throws at `join`. Every release from v6.7.0 through v6.16.0 is affected.\n\n\n\n### Impact\n\n\n\nAn unauthenticated request can make any code path that re-serializes attacker-influenced data with `qs.stringify` and `arrayFormat: 'comma'` (for example, rebuilding a query string from `req.query` for a redirect or an upstream request, or serializing a parsed JSON body) throw synchronously. In a typical Node.js HTTP framework the throw is caught by the framework error boundary and the affected request returns a 500; the process survives and other requests are unaffected. Where the call runs outside an error boundary, such as an `async` Express 4 handler (where the throw becomes an unhandled promise rejection) or a bare `http` request handler, the process exits, so the impact in that case depends on the application error handling rather than on qs. The default `arrayFormat` (`indices`) is not affected.","cvss":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110816","epss":0.00368,"percentile":0.30715,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110816","cwe":"CWE-248","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-110816","cwe":"CWE-704","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"qs","version":"6.16.0"}},"found":{"vulnerabilityID":"GHSA-6pq8-jhm2-2vcw","versionConstraint":">=6.7.0,<=6.16.0 (semantic)"},"fix":{"suggestedVersion":"6.16.1"}}],"artifact":{"id":"pkg:npm/qs@6.16.0?package-id=727d6cc33e830c82","name":"qs","version":"6.16.0","type":"npm","locations":[{"path":"/.github/ga4-scripts/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:qs_project:qs:6.16.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/qs@6.16.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-3g3m-2fjr-6pw4","dataSource":"https://github.com/advisories/GHSA-3g3m-2fjr-6pw4","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/node-glob/security/advisories/GHSA-3g3m-2fjr-6pw4","https://nvd.nist.gov/vuln/detail/CVE-2026-118773","https://github.com/isaacs/node-glob/commit/4682e8c9babee1b385202ede36389634e12076d7","https://github.com/isaacs/node-glob/releases/tag/v14.0.2"],"description":"Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118773","epss":0.0035,"percentile":0.28709,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118773","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["14.0.2"],"state":"fixed","available":[{"version":"14.0.2","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.19774999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-118773","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118773","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-glob/commit/4682e8c9babee1b385202ede36389634e12076d7","https://github.com/isaacs/node-glob/releases/tag/v14.0.2","https://github.com/isaacs/node-glob/security/advisories/GHSA-3g3m-2fjr-6pw4"],"description":"Glob matches files using patterns the shell uses. From 9.0.0 until 14.0.2, abort branches in src/walker.ts, including GlobUtil.walkCB(), GlobUtil.walkCB2(), GlobUtil.walkCBSync(), and GlobUtil.walkCB2Sync(), invoke the callbacks without returning. After AbortSignal or AbortSignal.timeout() rejects or emits an error, execution can continue into processor.processPatterns(), readdirCB(), and recursive traversal. The issue affects glob() and globStream() when applications expose attacker-influenced patterns or directory trees and rely on cancellation as a traversal budget. Repeated timed-out requests can stack background filesystem operations and CPU work, degrading worker throughput or service availability; no confidentiality or integrity impact was observed. This issue is fixed in 14.0.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118773","epss":0.0035,"percentile":0.28709,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118773","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"glob","version":"10.5.0"}},"found":{"vulnerabilityID":"GHSA-3g3m-2fjr-6pw4","versionConstraint":">=9.0.0,<=14.0.1 (semantic)"},"fix":{"suggestedVersion":"14.0.2"}}],"artifact":{"id":"pkg:npm/glob@10.5.0?package-id=6f7f08f3f7791d2e","name":"glob","version":"10.5.0","type":"npm","locations":[{"path":"/.github/ga4-scripts/package-lock.json","accessPath":""}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:isaacs:glob:10.5.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/glob@10.5.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-3g3m-2fjr-6pw4","dataSource":"https://github.com/advisories/GHSA-3g3m-2fjr-6pw4","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/node-glob/security/advisories/GHSA-3g3m-2fjr-6pw4","https://nvd.nist.gov/vuln/detail/CVE-2026-118773","https://github.com/isaacs/node-glob/commit/4682e8c9babee1b385202ede36389634e12076d7","https://github.com/isaacs/node-glob/releases/tag/v14.0.2"],"description":"Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118773","epss":0.0035,"percentile":0.28709,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118773","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["14.0.2"],"state":"fixed","available":[{"version":"14.0.2","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.19774999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-118773","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118773","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-glob/commit/4682e8c9babee1b385202ede36389634e12076d7","https://github.com/isaacs/node-glob/releases/tag/v14.0.2","https://github.com/isaacs/node-glob/security/advisories/GHSA-3g3m-2fjr-6pw4"],"description":"Glob matches files using patterns the shell uses. From 9.0.0 until 14.0.2, abort branches in src/walker.ts, including GlobUtil.walkCB(), GlobUtil.walkCB2(), GlobUtil.walkCBSync(), and GlobUtil.walkCB2Sync(), invoke the callbacks without returning. After AbortSignal or AbortSignal.timeout() rejects or emits an error, execution can continue into processor.processPatterns(), readdirCB(), and recursive traversal. The issue affects glob() and globStream() when applications expose attacker-influenced patterns or directory trees and rely on cancellation as a traversal budget. Repeated timed-out requests can stack background filesystem operations and CPU work, degrading worker throughput or service availability; no confidentiality or integrity impact was observed. This issue is fixed in 14.0.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118773","epss":0.0035,"percentile":0.28709,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118773","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"glob","version":"13.0.6"}},"found":{"vulnerabilityID":"GHSA-3g3m-2fjr-6pw4","versionConstraint":">=9.0.0,<=14.0.1 (semantic)"},"fix":{"suggestedVersion":"14.0.2"}}],"artifact":{"id":"pkg:npm/glob@13.0.6?package-id=7cca4ba2b3328937","name":"glob","version":"13.0.6","type":"npm","locations":[{"path":"/web/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BlueOak-1.0.0"],"cpes":["cpe:2.3:a:isaacs:glob:13.0.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/glob@13.0.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-wr44-6hxh-3jwq","dataSource":"https://github.com/advisories/GHSA-wr44-6hxh-3jwq","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-90771","https://github.com/hapijs/joi/issues/3150","https://github.com/hapijs/joi/commit/5b8333c9177e08b4ef4ed02903c2d657084e7afb","https://github.com/hapijs/joi","https://github.com/hapijs/joi/blob/v18.2.8/lib/messages.js","https://www.vulncheck.com/advisories/joi-before-17.13.8-and-18.2.9-prototype-pollution-via-messages","https://github.com/hapijs/joi/pull/3151","https://github.com/hapijs/joi/pull/3153","https://github.com/hapijs/joi/commit/1d2001cad9971327a62c9fd8eb1afec20cd784d2","https://github.com/hapijs/joi/releases/tag/v17.13.8","https://github.com/hapijs/joi/releases/tag/v18.2.9"],"description":"joi messages compilation allows prototype replacement through __proto__ error codes","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-90771","epss":0.00389,"percentile":0.33034,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-90771","cwe":"CWE-1321","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["18.2.9"],"state":"fixed","available":[{"version":"18.2.9","date":"2026-10-06","kind":"first-observed"}]},"advisories":[],"risk":0.19449999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-90771","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-90771","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/hapijs/joi","https://github.com/hapijs/joi/blob/v18.2.8/lib/messages.js","https://github.com/hapijs/joi/commit/5b8333c9177e08b4ef4ed02903c2d657084e7afb","https://github.com/hapijs/joi/issues/3150","https://www.vulncheck.com/advisories/joi-before-17.13.8-and-18.2.9-prototype-pollution-via-messages"],"description":"joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts __proto__ as an error code. Attackers can supply __proto__ keys in custom messages to replace the returned object's prototype, breaking downstream code relying on Object.prototype methods.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-90771","epss":0.00389,"percentile":0.33034,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-90771","cwe":"CWE-1321","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"joi","version":"18.2.8"}},"found":{"vulnerabilityID":"GHSA-wr44-6hxh-3jwq","versionConstraint":">=18.0.0,<18.2.9 (semantic)"},"fix":{"suggestedVersion":"18.2.9"}}],"artifact":{"id":"pkg:npm/joi@18.2.8?package-id=3c123c2c55e2015f","name":"joi","version":"18.2.8","type":"npm","locations":[{"path":"/web/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:joi:joi:18.2.8:*:*:*:*:*:*:*"],"purl":"pkg:npm/joi@18.2.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-mrwp-f3q8-3g9p","dataSource":"https://github.com/advisories/GHSA-mrwp-f3q8-3g9p","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-mrwp-f3q8-3g9p","https://nvd.nist.gov/vuln/detail/CVE-2026-116689","https://github.com/follow-redirects/follow-redirects/commit/b0a7751e9cd64cd8eeb6ec67d2f206a9cc88d3f8","https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.2"],"description":"follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-116689","epss":0.00266,"percentile":0.18805,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-116689","cwe":"CWE-201","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.16.2"],"state":"fixed","available":[{"version":"1.16.2","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.193515},"relatedVulnerabilities":[{"id":"CVE-2026-116689","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116689","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/follow-redirects/follow-redirects/commit/b0a7751e9cd64cd8eeb6ec67d2f206a9cc88d3f8","https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.2","https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-mrwp-f3q8-3g9p"],"description":"follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.2, the documented sensitiveHeaders option is checked with value instanceof Array, so an array created in another JavaScript realm is replaced with an empty list even though Array.isArray recognizes it. When a request then follows an attacker-controlled cross-origin redirect, a custom credential header named in that discarded list can be forwarded to the redirect destination. This issue is fixed in version 1.16.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-116689","epss":0.00266,"percentile":0.18805,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-116689","cwe":"CWE-201","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"follow-redirects","version":"1.16.0"}},"found":{"vulnerabilityID":"GHSA-mrwp-f3q8-3g9p","versionConstraint":">=1.16.0,<=1.16.1 (semantic)"},"fix":{"suggestedVersion":"1.16.2"}}],"artifact":{"id":"pkg:npm/follow-redirects@1.16.0?package-id=9e867f7e3523a285","name":"follow-redirects","version":"1.16.0","type":"npm","locations":[{"path":"/web/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:follow-redirects:follow_redirects:1.16.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/follow-redirects@1.16.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-8wjv-2p76-3863","dataSource":"https://github.com/advisories/GHSA-8wjv-2p76-3863","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/jpadilla/pyjwt/security/advisories/GHSA-8wjv-2p76-3863","https://nvd.nist.gov/vuln/detail/CVE-2026-102265","https://github.com/jpadilla/pyjwt/commit/06573692ebcdec8831c3927513b3e87c31fbbb62","https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"],"description":"PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102265","epss":0.00343,"percentile":0.2786,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102265","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.14.0"],"state":"fixed","available":[{"version":"2.14.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.176645},"relatedVulnerabilities":[{"id":"CVE-2026-102265","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102265","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/jpadilla/pyjwt/commit/06573692ebcdec8831c3927513b3e87c31fbbb62","https://github.com/jpadilla/pyjwt/releases/tag/2.14.0","https://github.com/jpadilla/pyjwt/security/advisories/GHSA-8wjv-2p76-3863"],"description":"PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWS._load in jwt/api_jws.py is affected because parser catches ValueError but not RecursionError. This occurs when a deeply nested token header reaches json.loads. As a result, RecursionError escapes the documented PyJWT error hierarchy. Consequently, an unauthenticated malformed token can cause a request-level failure and HTTP 500. This issue is fixed in version 2.14.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102265","epss":0.00343,"percentile":0.2786,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102265","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"pyjwt","version":"2.13.0"}},"found":{"vulnerabilityID":"GHSA-8wjv-2p76-3863","versionConstraint":">=2.13.0,<2.14.0 (python)"},"fix":{"suggestedVersion":"2.14.0"}}],"artifact":{"id":"pkg:pypi/pyjwt@2.13.0?package-id=30a0e1dffae8ae90","name":"pyjwt","version":"2.13.0","type":"python","locations":[{"path":"/.github/requirements-smoke.txt","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-pyjwt:python-pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pyjwt:python_pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:python-pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:python_pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:python-pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:python_pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pyjwt:pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python:pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:pyjwt:2.13.0:*:*:*:*:*:*:*"],"purl":"pkg:pypi/pyjwt@2.13.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-gxm5-99cw-xjw9","dataSource":"https://github.com/advisories/GHSA-gxm5-99cw-xjw9","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/fastify/busboy/security/advisories/GHSA-gxm5-99cw-xjw9","https://nvd.nist.gov/vuln/detail/CVE-2026-74866","https://github.com/fastify/busboy/commit/cc7da17c5c88d79c314a9e149a79e5a00a6c23be","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/busboy/releases/tag/v3.2.2"],"description":"@fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","metrics":{"baseScore":5.8,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-74866","epss":0.00326,"percentile":0.25728,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-74866","cwe":"CWE-93","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["3.2.2"],"state":"fixed","available":[{"version":"3.2.2","date":"2026-10-06","kind":"first-observed"}]},"advisories":[],"risk":0.17604},"relatedVulnerabilities":[{"id":"CVE-2026-74866","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-74866","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/busboy/security/advisories/GHSA-gxm5-99cw-xjw9"],"description":"@fastify/busboy is a multipart form-data parser for Node.js. Its multipart part-header parser splits header lines only on the two-byte carriage-return line-feed sequence, so a lone carriage return or line feed embedded in a part header is not treated as a line break and is carried verbatim into the parsed Content-Disposition filename and field name handed to the application. An attacker who uploads a file whose filename or field name contains a bare carriage return or line feed can inject control characters into consumers that trust the parser to return clean values, enabling filesystem filename pollution, log forging, or header injection when the value is forwarded to a carriage-return-sensitive sink. All versions of @fastify/busboy up to and including 3.2.1 are affected. The issue is fixed in version 3.2.2, which rejects any header line that still contains a bare carriage return or line feed. Users should upgrade to 3.2.2, and consumers such as @fastify/multipart should bump their @fastify/busboy dependency to pull in the fix.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","metrics":{"baseScore":5.8,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-74866","epss":0.00326,"percentile":0.25728,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-74866","cwe":"CWE-93","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@fastify/busboy","version":"3.2.0"}},"found":{"vulnerabilityID":"GHSA-gxm5-99cw-xjw9","versionConstraint":"<3.2.2 (semantic)"},"fix":{"suggestedVersion":"3.2.2"}}],"artifact":{"id":"pkg:npm/%40fastify/busboy@3.2.0?package-id=b983dcf7d5513432","name":"@fastify/busboy","version":"3.2.0","type":"npm","locations":[{"path":"/web/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:fastify:fastify\\/busyboy:3.2.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/%40fastify/busboy@3.2.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-4qv8-2p9j-2685","dataSource":"https://github.com/advisories/GHSA-4qv8-2p9j-2685","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/nodejs/undici/security/advisories/GHSA-4qv8-2p9j-2685","https://nvd.nist.gov/vuln/detail/CVE-2026-109924","https://github.com/nodejs/undici/commit/299162740d5f39120092277e70efacb4d151c1c6","https://github.com/nodejs/undici/commit/789ef26461c648480433846607154f52d74ec9ab","https://github.com/nodejs/undici/commit/c43b23fdc6b37e1283d4347408bb16800f867d9e","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v6.29.1","https://github.com/nodejs/undici/releases/tag/v7.30.1","https://github.com/nodejs/undici/releases/tag/v8.12.2"],"description":"undici vulnerable to Denial of Service via unbounded memory in the EventSource parser","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-109924","epss":0.00321,"percentile":0.2513,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-109924","cwe":"CWE-770","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["8.12.2"],"state":"fixed","available":[{"version":"8.12.2","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.17494500000000002},"relatedVulnerabilities":[{"id":"CVE-2026-109924","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109924","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-4qv8-2p9j-2685"],"description":"undici is an HTTP client library for Node.js. In versions 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its EventSource client can be driven to exhaust process memory by a malicious or compromised Server-Sent Events peer. By sending millions of tiny completed data fields with no blank event separator, or a single unfinished line split across many chunks, the parser retains a growing amount of per-field and per-chunk state that the byte-based maxEventSize and maxResponseSize limits do not bound, and because maxResponseSize is enforced on the compressed body before decompression, a small compressed response can expand into enough retained memory to terminate the process. An application only needs to maintain an EventSource connection to an untrusted peer, which controls only the response, and availability is the only impact. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, which bound the retained parser state independently of the byte limits, and users should upgrade to one of those versions or later. There is no workaround.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-109924","epss":0.00321,"percentile":0.2513,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-109924","cwe":"CWE-770","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"undici","version":"8.9.0"}},"found":{"vulnerabilityID":"GHSA-4qv8-2p9j-2685","versionConstraint":">=8.0.0,<8.12.2 (semantic)"},"fix":{"suggestedVersion":"8.12.2"}}],"artifact":{"id":"pkg:npm/undici@8.9.0?package-id=c6a7a4da2332ffa7","name":"undici","version":"8.9.0","type":"npm","locations":[{"path":"/web/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodejs:undici:8.9.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/undici@8.9.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-9fm3-97px-rjf6","dataSource":"https://github.com/advisories/GHSA-9fm3-97px-rjf6","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/nodejs/undici/security/advisories/GHSA-9fm3-97px-rjf6","https://nvd.nist.gov/vuln/detail/CVE-2026-109932","https://github.com/nodejs/undici/commit/39f93e142df03e559fe7c3d1fc7fba9beee2c185","https://github.com/nodejs/undici/commit/53944624462b6797560288c55dbd8c66857bb495","https://github.com/nodejs/undici/commit/b217373bb024cd93f85eb5b3ffd25684855f60f8","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v6.29.1","https://github.com/nodejs/undici/releases/tag/v7.30.1","https://github.com/nodejs/undici/releases/tag/v8.12.2"],"description":"undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-109932","epss":0.00321,"percentile":0.2513,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-109932","cwe":"CWE-400","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-109932","cwe":"CWE-405","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-109932","cwe":"CWE-770","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["8.12.2"],"state":"fixed","available":[{"version":"8.12.2","date":"2026-10-28","kind":"first-observed"}]},"advisories":[],"risk":0.17494500000000002},"relatedVulnerabilities":[{"id":"CVE-2026-109932","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109932","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-9fm3-97px-rjf6"],"description":"undici is an HTTP client library for Node.js. In versions 5.15.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its WebSocket client, including the bundled WebSocket exposed by Node.js, can be driven to exhaust process memory by a malicious or compromised WebSocket server. For every PING frame received, the client automatically writes a PONG response and ignores the backpressure signal from the socket write, so a server that streams small PING frames while never reading the client's PONGs makes the outbound write queue and heap grow without bound until the Node.js process runs out of memory and terminates. The attack is remote and unauthenticated, needs only a normal WebSocket connection, and is asymmetric, since small inbound PINGs produce a much larger retained outbound queue, with availability the only impact. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, which pause WebSocket frame parsing when the automatic PONG response hits socket backpressure and resume on drain, bounding the outbound queue, and users should upgrade to one of those versions or later. There is no workaround.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-109932","epss":0.00321,"percentile":0.2513,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-109932","cwe":"CWE-400","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-109932","cwe":"CWE-405","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-109932","cwe":"CWE-770","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"undici","version":"8.9.0"}},"found":{"vulnerabilityID":"GHSA-9fm3-97px-rjf6","versionConstraint":">=8.0.0,<8.12.2 (semantic)"},"fix":{"suggestedVersion":"8.12.2"}}],"artifact":{"id":"pkg:npm/undici@8.9.0?package-id=c6a7a4da2332ffa7","name":"undici","version":"8.9.0","type":"npm","locations":[{"path":"/web/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodejs:undici:8.9.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/undici@8.9.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-2jfj-6hjv-fm6j","dataSource":"https://github.com/advisories/GHSA-2jfj-6hjv-fm6j","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/nodejs/undici/security/advisories/GHSA-2jfj-6hjv-fm6j","https://nvd.nist.gov/vuln/detail/CVE-2026-84933","https://github.com/nodejs/undici/commit/b6c5a00252c37da9dd2db9bead053bb843e1f988","https://github.com/nodejs/undici/commit/cb75bbb34224a968b4ad80cab8b7aba5e0b3b28a","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v7.29.1","https://github.com/nodejs/undici/releases/tag/v8.10.2"],"description":"undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.3,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84933","epss":0.00303,"percentile":0.23067,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84933","cwe":"CWE-200","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-84933","cwe":"CWE-524","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["8.10.2"],"state":"fixed","available":[{"version":"8.10.2","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.174225},"relatedVulnerabilities":[{"id":"CVE-2026-84933","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84933","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-2jfj-6hjv-fm6j"],"description":"undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. In shared cache mode, which is the default, an otherwise cacheable response that carries a Set-Cookie header, for example one marked with a public and max-age directive, is stored and then re-served to a later caller that matches the same cache key. As a result one caller's cookie is disclosed to a different caller, and an untrusted server can inject cookies into cached responses served to all subsequent callers. This violates the requirement that a shared cache must not store cookies. This affects undici versions from 7.0.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":3.9,"impactScore":4.3},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.3,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84933","epss":0.00303,"percentile":0.23067,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84933","cwe":"CWE-200","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-84933","cwe":"CWE-524","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"undici","version":"8.9.0"}},"found":{"vulnerabilityID":"GHSA-2jfj-6hjv-fm6j","versionConstraint":">=8.0.0,<8.10.2 (semantic)"},"fix":{"suggestedVersion":"8.10.2"}}],"artifact":{"id":"pkg:npm/undici@8.9.0?package-id=c6a7a4da2332ffa7","name":"undici","version":"8.9.0","type":"npm","locations":[{"path":"/web/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodejs:undici:8.9.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/undici@8.9.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-gh4c-6fx4-qh6g","dataSource":"https://github.com/advisories/GHSA-gh4c-6fx4-qh6g","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g","https://nvd.nist.gov/vuln/detail/CVE-2026-97688","https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f","https://github.com/urllib3/urllib3/releases/tag/2.8.0"],"description":"urllib3: Chunked Deflate streaming can enter an infinite loop","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-97688","epss":0.00292,"percentile":0.21778,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-97688","cwe":"CWE-835","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["2.8.0"],"state":"fixed","available":[{"version":"2.8.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.17373999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-97688","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97688","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f","https://github.com/urllib3/urllib3/releases/tag/2.8.0","https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g"],"description":"urllib3 is an HTTP client library for Python. From 2.6.2 until 2.8.0, HTTPResponse.stream and HTTPResponse.read_chunked can enter an infinite loop because the Deflate decoder retains trailing bytes as unconsumed input after reaching end-of-stream and repeatedly decodes them without progress. The issue occurs when an untrusted server sends a chunked Deflate response whose decoded body exceeds a positive finite chunk size and whose encoded body has trailing bytes, specifically a response with Transfer-Encoding: chunked and Content-Encoding: deflate, content decoding enabled, and the positive finite amt=N streaming chunk size. The attack mechanism is that a malicious server returns a compressed chunked response with trailing bytes after the Deflate stream. The impact is excessive CPU usage and a request that does not complete, and network read timeouts do not interrupt the loop because no further socket read occurs. This issue is fixed in version 2.8.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-97688","epss":0.00292,"percentile":0.21778,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-97688","cwe":"CWE-835","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"urllib3","version":"2.7.0"}},"found":{"vulnerabilityID":"GHSA-gh4c-6fx4-qh6g","versionConstraint":">=2.6.2,<2.8.0 (python)"},"fix":{"suggestedVersion":"2.8.0"}}],"artifact":{"id":"pkg:pypi/urllib3@2.7.0?package-id=f33c78390a520e8b","name":"urllib3","version":"2.7.0","type":"python","locations":[{"path":"/.github/requirements-nightly.txt","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python:urllib3:2.7.0:*:*:*:*:*:*:*"],"purl":"pkg:pypi/urllib3@2.7.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-g3hv-75wg-m249","dataSource":"https://github.com/advisories/GHSA-g3hv-75wg-m249","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249","https://nvd.nist.gov/vuln/detail/CVE-2026-118764","https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1"],"description":"minimatch has potential denial of service via globparts amplification","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["11.0.1"],"state":"fixed","available":[{"version":"11.0.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.173145},"relatedVulnerabilities":[{"id":"CVE-2026-118764","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118764","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1","https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"10.2.5"}},"found":{"vulnerabilityID":"GHSA-g3hv-75wg-m249","versionConstraint":"<11.0.1 (semantic)"},"fix":{"suggestedVersion":"11.0.1"}}],"artifact":{"id":"pkg:npm/minimatch@10.2.5?package-id=ec43ca1de057b5fc","name":"minimatch","version":"10.2.5","type":"npm","locations":[{"path":"/web/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BlueOak-1.0.0"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:10.2.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@10.2.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-g3hv-75wg-m249","dataSource":"https://github.com/advisories/GHSA-g3hv-75wg-m249","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249","https://nvd.nist.gov/vuln/detail/CVE-2026-118764","https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1"],"description":"minimatch has potential denial of service via globparts amplification","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["11.0.1"],"state":"fixed","available":[{"version":"11.0.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.173145},"relatedVulnerabilities":[{"id":"CVE-2026-118764","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118764","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1","https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"9.0.9"}},"found":{"vulnerabilityID":"GHSA-g3hv-75wg-m249","versionConstraint":"<11.0.1 (semantic)"},"fix":{"suggestedVersion":"11.0.1"}}],"artifact":{"id":"pkg:npm/minimatch@9.0.9?package-id=4a9715ba356bbd85","name":"minimatch","version":"9.0.9","type":"npm","locations":[{"path":"/.github/ga4-scripts/package-lock.json","accessPath":""}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:9.0.9:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@9.0.9","upstreams":[]}},{"vulnerability":{"id":"GHSA-9jrq-w75r-8gcw","dataSource":"https://github.com/advisories/GHSA-9jrq-w75r-8gcw","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/vitejs/vite/security/advisories/GHSA-9jrq-w75r-8gcw","https://nvd.nist.gov/vuln/detail/CVE-2026-112945","https://github.com/vitejs/vite/pull/23653","https://github.com/vitejs/vite/commit/7dafd8e56f152403a3230608fa4005273c2e9e17"],"description":"Vite: Cross origin script execution through Vite custom middleware","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":2.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112945","epss":0.00672,"percentile":0.52077,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112945","cwe":"CWE-80","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["8.3.3"],"state":"fixed","available":[{"version":"8.3.3","date":"2026-10-22","kind":"first-observed"}]},"advisories":[],"risk":0.17136},"relatedVulnerabilities":[{"id":"CVE-2026-112945","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112945","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/vitejs/vite/commit/7dafd8e56f152403a3230608fa4005273c2e9e17","https://github.com/vitejs/vite/pull/23653","https://github.com/vitejs/vite/security/advisories/GHSA-9jrq-w75r-8gcw"],"description":"Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, applications using custom middleware are vulnerable when they pass an unchanged browser request URL to server.transformIndexHtml. getHtmlFilename uses the query-bearing request URL to resolve an existing local file while preserving attacker-supplied leading slashes in the generated proxy module URL. If the transformed HTML contains an inline module script and a victim browser loads the crafted development-server page, the leading double slash makes the browser fetch and execute an attacker-controlled module in the Vite-served page. This execution can expose sensitive page data or permit critical actions available to the affected application. This issue is fixed in versions 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112945","epss":0.00672,"percentile":0.52077,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112945","cwe":"CWE-80","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"vite","version":"8.3.0"}},"found":{"vulnerabilityID":"GHSA-9jrq-w75r-8gcw","versionConstraint":">=8.3.0,<=8.3.2 (semantic)"},"fix":{"suggestedVersion":"8.3.3"}}],"artifact":{"id":"pkg:npm/vite@8.3.0?package-id=901eaa4e2288cc6e","name":"vite","version":"8.3.0","type":"npm","locations":[{"path":"/web/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vitejs:vite:8.3.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/vite@8.3.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-9j54-fg26-wv3r","dataSource":"https://github.com/advisories/GHSA-9j54-fg26-wv3r","namespace":"github:language:python","severity":"High","urls":["https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9j54-fg26-wv3r","https://nvd.nist.gov/vuln/detail/CVE-2026-102266","https://github.com/jpadilla/pyjwt/commit/f91ed44dd65baaf457f4b3353ed35e98a753934c","https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"],"description":"PyJWT: PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102266","epss":0.00225,"percentile":0.13179,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102266","cwe":"CWE-347","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.14.0"],"state":"fixed","available":[{"version":"2.14.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.16762499999999997},"relatedVulnerabilities":[{"id":"CVE-2026-102266","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102266","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/jpadilla/pyjwt/commit/f91ed44dd65baaf457f4b3353ed35e98a753934c","https://github.com/jpadilla/pyjwt/releases/tag/2.14.0","https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9j54-fg26-wv3r"],"description":"PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.from_jwk is affected because PyJWK verification path used the decoded key without applying prepare_key validation. This occurs when a trusted JWK Set contains an oct entry with an empty k value. As a result, an attacker signs an HMAC token with the same zero-length key accepted by PyJWT. Consequently, forged token can carry arbitrary authenticated claims. This issue is fixed in version 2.14.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102266","epss":0.00225,"percentile":0.13179,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102266","cwe":"CWE-347","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"pyjwt","version":"2.13.0"}},"found":{"vulnerabilityID":"GHSA-9j54-fg26-wv3r","versionConstraint":">=2.13.0,<2.14.0 (python)"},"fix":{"suggestedVersion":"2.14.0"}}],"artifact":{"id":"pkg:pypi/pyjwt@2.13.0?package-id=30a0e1dffae8ae90","name":"pyjwt","version":"2.13.0","type":"python","locations":[{"path":"/.github/requirements-smoke.txt","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-pyjwt:python-pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pyjwt:python_pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:python-pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:python_pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:python-pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:python_pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pyjwt:pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python:pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:pyjwt:2.13.0:*:*:*:*:*:*:*"],"purl":"pkg:pypi/pyjwt@2.13.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-qxg6-89mg-rqv8","dataSource":"https://github.com/advisories/GHSA-qxg6-89mg-rqv8","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/vitest-dev/vitest/security/advisories/GHSA-qxg6-89mg-rqv8","https://nvd.nist.gov/vuln/detail/CVE-2026-112949","https://github.com/vitest-dev/vitest/commit/15cc006aa9f8683dc5f7e895d011fa7dc751ce35","https://github.com/vitest-dev/vitest/commit/b825313243dc55757e8d7c0f9e7a792135e13473","https://github.com/vitest-dev/vitest/releases/tag/v4.1.12","https://github.com/vitest-dev/vitest/releases/tag/v5.0.3"],"description":"Vitest: Code injection via unauthenticated manual mock registration","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":1.7,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112949","epss":0.00336,"percentile":0.27047,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112949","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-112949","cwe":"CWE-116","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-112949","cwe":"CWE-306","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["5.0.3"],"state":"fixed","available":[{"version":"5.0.3","date":"2026-10-22","kind":"first-observed"}]},"advisories":[],"risk":0.16296},"relatedVulnerabilities":[{"id":"CVE-2026-112949","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112949","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/vitest-dev/vitest/commit/15cc006aa9f8683dc5f7e895d011fa7dc751ce35","https://github.com/vitest-dev/vitest/commit/b825313243dc55757e8d7c0f9e7a792135e13473","https://github.com/vitest-dev/vitest/releases/tag/v4.1.12","https://github.com/vitest-dev/vitest/releases/tag/v5.0.3","https://github.com/vitest-dev/vitest/security/advisories/GHSA-qxg6-89mg-rqv8"],"description":"Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 2.1.0-beta.7 until 4.1.12 and 5.0.3, an unauthenticated non-browser WebSocket client that can reach a development server using interceptorPlugin can register a manual mock whose attacker-controlled url createManualModuleSource inserts unescaped into generated module source. When the developer browser loads the affected module, attacker-controlled JavaScript executes on the development-server origin. This issue is fixed in versions 4.1.12 and 5.0.3.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":1.7,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112949","epss":0.00336,"percentile":0.27047,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112949","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-112949","cwe":"CWE-116","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-112949","cwe":"CWE-306","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@vitest/mocker","version":"5.0.1"}},"found":{"vulnerabilityID":"GHSA-qxg6-89mg-rqv8","versionConstraint":">=5.0.0-beta.1,<5.0.3 (semantic)"},"fix":{"suggestedVersion":"5.0.3"}}],"artifact":{"id":"pkg:npm/%40vitest/mocker@5.0.1?package-id=b415cffdcf584127","name":"@vitest/mocker","version":"5.0.1","type":"npm","locations":[{"path":"/web/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:\\@vitest\\/mocker:\\@vitest\\/mocker:5.0.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40vitest/mocker@5.0.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-r6x4-923q-g947","dataSource":"https://github.com/advisories/GHSA-r6x4-923q-g947","namespace":"github:language:python","severity":"High","urls":["https://github.com/jpadilla/pyjwt/security/advisories/GHSA-r6x4-923q-g947","https://nvd.nist.gov/vuln/detail/CVE-2026-102272","https://github.com/jpadilla/pyjwt/commit/180783930de91876bc0d601f826a1f2956057291","https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"],"description":"PyJWT BOM Bypass","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102272","epss":0.00216,"percentile":0.12152,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102272","cwe":"CWE-347","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.14.0"],"state":"fixed","available":[{"version":"2.14.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.16092},"relatedVulnerabilities":[{"id":"CVE-2026-102272","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102272","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/jpadilla/pyjwt/commit/180783930de91876bc0d601f826a1f2956057291","https://github.com/jpadilla/pyjwt/releases/tag/2.14.0","https://github.com/jpadilla/pyjwt/security/advisories/GHSA-r6x4-923q-g947"],"description":"PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.prepare_key in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON. This occurs when a public JWK is prefixed with a UTF-8 BOM and used in a mixed-algorithm verification path. As a result, public JWK bypasses asymmetric-key detection and becomes the HMAC secret. Consequently, an attacker who knows the public key can forge authenticated tokens. This issue is fixed in version 2.14.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102272","epss":0.00216,"percentile":0.12152,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102272","cwe":"CWE-347","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"pyjwt","version":"2.13.0"}},"found":{"vulnerabilityID":"GHSA-r6x4-923q-g947","versionConstraint":"=2.13.0 (python)"},"fix":{"suggestedVersion":"2.14.0"}}],"artifact":{"id":"pkg:pypi/pyjwt@2.13.0?package-id=30a0e1dffae8ae90","name":"pyjwt","version":"2.13.0","type":"python","locations":[{"path":"/.github/requirements-smoke.txt","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-pyjwt:python-pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pyjwt:python_pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:python-pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:python_pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:python-pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:python_pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pyjwt:pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python:pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:pyjwt:2.13.0:*:*:*:*:*:*:*"],"purl":"pkg:pypi/pyjwt@2.13.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-p4g4-x82p-q773","dataSource":"https://github.com/advisories/GHSA-p4g4-x82p-q773","namespace":"github:language:python","severity":"High","urls":["https://github.com/jpadilla/pyjwt/security/advisories/GHSA-p4g4-x82p-q773","https://nvd.nist.gov/vuln/detail/CVE-2026-102271","https://github.com/jpadilla/pyjwt/commit/2798504fa2663364573cf2d1043d8d7fef389499","https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"],"description":"PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102271","epss":0.00215,"percentile":0.11901,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102271","cwe":"CWE-347","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.14.0"],"state":"fixed","available":[{"version":"2.14.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.160175},"relatedVulnerabilities":[{"id":"CVE-2026-102271","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102271","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/jpadilla/pyjwt/commit/2798504fa2663364573cf2d1043d8d7fef389499","https://github.com/jpadilla/pyjwt/releases/tag/2.14.0","https://github.com/jpadilla/pyjwt/security/advisories/GHSA-p4g4-x82p-q773"],"description":"PyJWT is a Python implementation of JSON Web Token standards. From 2.4.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because asymmetric-key guard relies on textual markers that are absent from DER encoding. This occurs when an application mixes HMAC and asymmetric algorithms and supplies a DER public key as the shared verification key. As a result, PyJWT uses public DER bytes as an HMAC secret. Consequently, an attacker who knows the public key can forge authenticated HMAC tokens. This issue is fixed in version 2.14.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102271","epss":0.00215,"percentile":0.11901,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102271","cwe":"CWE-347","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"pyjwt","version":"2.13.0"}},"found":{"vulnerabilityID":"GHSA-p4g4-x82p-q773","versionConstraint":">=2.4.0,<2.14.0 (python)"},"fix":{"suggestedVersion":"2.14.0"}}],"artifact":{"id":"pkg:pypi/pyjwt@2.13.0?package-id=30a0e1dffae8ae90","name":"pyjwt","version":"2.13.0","type":"python","locations":[{"path":"/.github/requirements-smoke.txt","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-pyjwt:python-pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pyjwt:python_pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:python-pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:python_pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:python-pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:python_pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pyjwt:pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python:pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:pyjwt:2.13.0:*:*:*:*:*:*:*"],"purl":"pkg:pypi/pyjwt@2.13.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-8988-9cw3-xx77","dataSource":"https://github.com/advisories/GHSA-8988-9cw3-xx77","namespace":"github:language:python","severity":"High","urls":["https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77","https://nvd.nist.gov/vuln/detail/CVE-2026-97687","https://github.com/urllib3/urllib3/pull/5093","https://github.com/urllib3/urllib3/commit/07408cec79d1856d81bb42c74a904a24fdb9e465","https://github.com/urllib3/urllib3/commit/b6447295fff7b38fdffc67e0df9712d60cef3cc3","https://github.com/urllib3/urllib3/releases/tag/2.8.0"],"description":"urllib3: HTTPS proxy TLS configuration may be ignored or overridden","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":7.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-97687","epss":0.00206,"percentile":0.10662,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-97687","cwe":"CWE-295","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-97687","cwe":"CWE-440","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.8.0"],"state":"fixed","available":[{"version":"2.8.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.15553},"relatedVulnerabilities":[{"id":"CVE-2026-97687","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97687","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/urllib3/urllib3/commit/07408cec79d1856d81bb42c74a904a24fdb9e465","https://github.com/urllib3/urllib3/commit/b6447295fff7b38fdffc67e0df9712d60cef3cc3","https://github.com/urllib3/urllib3/pull/5093","https://github.com/urllib3/urllib3/releases/tag/2.8.0","https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77"],"description":"urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mode, use_forwarding_for_https=True, and CERT_NONE configuration paths fail to remain separated because target-server TLS settings are incorrectly applied to the HTTPS proxy connection. The trigger is that an application uses an HTTPS proxy and configures target-server TLS settings that must remain separate from the proxy TLS handshake, including HTTPS forwarding with target-specific identity or credentials. Applying cert_reqs=CERT_NONE can overwrite proxy_ssl_context.verify_mode in place, and the mutation persists so later connections reusing the same context may connect to the HTTPS proxy without certificate verification. The attack mechanism is that an attacker intercepts and impersonates the HTTPS proxy after the effective proxy policy accepts the attacker's certificate. The impact is that the attacker can observe or modify forwarded traffic or receive a target TLS client certificate, while CONNECT tunneling still preserves the separate end-to-end target TLS connection. This issue is fixed in version 2.8.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"exploitabilityScore":2.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-97687","epss":0.00206,"percentile":0.10662,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-97687","cwe":"CWE-295","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-97687","cwe":"CWE-440","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"urllib3","version":"2.7.0"}},"found":{"vulnerabilityID":"GHSA-8988-9cw3-xx77","versionConstraint":">=1.26.0,<2.8.0 (python)"},"fix":{"suggestedVersion":"2.8.0"}}],"artifact":{"id":"pkg:pypi/urllib3@2.7.0?package-id=f33c78390a520e8b","name":"urllib3","version":"2.7.0","type":"python","locations":[{"path":"/.github/requirements-nightly.txt","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python:urllib3:2.7.0:*:*:*:*:*:*:*"],"purl":"pkg:pypi/urllib3@2.7.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-gvp8-978c-rx2q","dataSource":"https://github.com/advisories/GHSA-gvp8-978c-rx2q","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/jpadilla/pyjwt/security/advisories/GHSA-gvp8-978c-rx2q","https://github.com/jpadilla/pyjwt/commit/0c87c8c8b1a74cac99ad8115f3050efcb7fbed35"],"description":"PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.3,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-103001","epss":0.00257,"percentile":0.17393,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-103001","cwe":"CWE-471","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.14777499999999996},"relatedVulnerabilities":[{"id":"CVE-2026-103001","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-103001","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/jpadilla/pyjwt/commit/0c87c8c8b1a74cac99ad8115f3050efcb7fbed35","https://github.com/jpadilla/pyjwt/issues/679","https://github.com/jpadilla/pyjwt/security/advisories/GHSA-gvp8-978c-rx2q"],"description":"PyJWT is a Python implementation of JSON Web Token standards. From 2.11.0 through 2.13.0, PyJWT's PyJWT._merge_options() method can modify a caller-supplied mutable options mapping when verify_signature is false. If an application reuses that same mapping for a later decode() or decode_complete() call and changes verify_signature to true, the mapping can retain false values for expiration, not-before, issued-at, audience, issuer, subject, and JWT ID checks. A signed token with invalid registered claims can then be accepted without disabling signature verification, but applications that create a fresh options mapping for each call are not affected.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.3,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-103001","epss":0.00257,"percentile":0.17393,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-103001","cwe":"CWE-471","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"pyjwt","version":"2.13.0"}},"found":{"vulnerabilityID":"GHSA-gvp8-978c-rx2q","versionConstraint":">=2.11.0,<=2.13.0 (python)"}}],"artifact":{"id":"pkg:pypi/pyjwt@2.13.0?package-id=30a0e1dffae8ae90","name":"pyjwt","version":"2.13.0","type":"python","locations":[{"path":"/.github/requirements-smoke.txt","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-pyjwt:python-pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pyjwt:python_pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:python-pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:python_pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:python-pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:python_pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pyjwt:pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python:pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:pyjwt:2.13.0:*:*:*:*:*:*:*"],"purl":"pkg:pypi/pyjwt@2.13.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-55wc-3pg8-jfw6","dataSource":"https://github.com/advisories/GHSA-55wc-3pg8-jfw6","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/nodejs/undici/security/advisories/GHSA-55wc-3pg8-jfw6","https://nvd.nist.gov/vuln/detail/CVE-2026-87029","https://github.com/nodejs/undici/commit/63cba7712ca012b2603c6aeeb4c72d8692332cd0","https://github.com/nodejs/undici/commit/f851f315db1f2acce0ea668f88d9d0fa61c8420c","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v7.30.1","https://github.com/nodejs/undici/releases/tag/v8.12.2"],"description":"undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-87029","epss":0.0026,"percentile":0.17806,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-87029","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["8.12.2"],"state":"fixed","available":[{"version":"8.12.2","date":"2026-10-28","kind":"first-observed"}]},"advisories":[],"risk":0.14170000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-87029","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87029","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-55wc-3pg8-jfw6"],"description":"undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its decompress interceptor forwards decompressed response data to the downstream handler from zlib stream event callbacks without catching exceptions those callbacks may throw, and while undici's engine converts a synchronous throw from a downstream handler into a per-request failure, that protection is absent when the throw happens asynchronously from a zlib callback. As a result, a downstream handler that throws by design, such as the built-in dump interceptor which throws when a response exceeds its configured maximum size, escapes as an uncaught exception that terminates the Node.js process. A malicious or compromised HTTP server can crash any client that composes the decompress interceptor with such a handler by returning a small compressed body that decompresses to more than the configured limit, so only the decompressed size matters and the bytes on the wire stay tiny. The issue is fixed in undici 7.30.1 and 8.12.2, and users should upgrade to one of those versions or later. As a workaround, avoid composing the decompress interceptor with a response handler that throws during response processing until upgrading.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-87029","epss":0.0026,"percentile":0.17806,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-87029","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"undici","version":"8.9.0"}},"found":{"vulnerabilityID":"GHSA-55wc-3pg8-jfw6","versionConstraint":">=8.0.0,<8.12.2 (semantic)"},"fix":{"suggestedVersion":"8.12.2"}}],"artifact":{"id":"pkg:npm/undici@8.9.0?package-id=c6a7a4da2332ffa7","name":"undici","version":"8.9.0","type":"npm","locations":[{"path":"/web/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodejs:undici:8.9.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/undici@8.9.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-qrxm-fqhp-jwvm","dataSource":"https://github.com/advisories/GHSA-qrxm-fqhp-jwvm","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nodejs/undici/security/advisories/GHSA-qrxm-fqhp-jwvm","https://nvd.nist.gov/vuln/detail/CVE-2026-87018","https://github.com/nodejs/undici/commit/12cfd96c3f430897656e3edc1c5e02be8c1cd309","https://github.com/nodejs/undici/commit/b40fbfc0651703cf9fa9f6ced68b679f28d8bb28","https://github.com/nodejs/undici/commit/e257e9f8fb42eedd50727b9cf65e548c8925e4a8","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v6.29.1","https://github.com/nodejs/undici/releases/tag/v7.30.1","https://github.com/nodejs/undici/releases/tag/v8.12.2"],"description":"undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-87018","epss":0.00187,"percentile":0.08364,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-87018","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-87018","cwe":"CWE-617","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["8.12.2"],"state":"fixed","available":[{"version":"8.12.2","date":"2026-10-28","kind":"first-observed"}]},"advisories":[],"risk":0.14024999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-87018","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87018","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-qrxm-fqhp-jwvm"],"description":"undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trusted certificate whose hostname does not match the requested host. Node.js re-runs hostname verification on the renegotiated handshake and destroys the socket with a certificate-altname error, but undici's established-socket error handler asserted that this error code could never occur, so the peer-controlled error became an uncaught assertion that terminates the Node.js process, affecting both the HTTP/1.1 and HTTP/2 paths. A malicious or compromised HTTPS endpoint reached through undici or the global fetch() can crash the client with a single server-initiated renegotiation, taking down all in-flight requests and background work in the process, and exploitation needs no CA compromise because the attacker controls the endpoint and can present two ordinary valid certificates. Only TLS 1.2 is affected, since TLS 1.3 does not support renegotiation. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, and users should upgrade to one of those versions or later. As a workaround, restrict outbound connections to TLS 1.3 so renegotiation cannot occur, when the target endpoints support it.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-87018","epss":0.00187,"percentile":0.08364,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-87018","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-87018","cwe":"CWE-617","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"undici","version":"8.9.0"}},"found":{"vulnerabilityID":"GHSA-qrxm-fqhp-jwvm","versionConstraint":">=8.0.0,<8.12.2 (semantic)"},"fix":{"suggestedVersion":"8.12.2"}}],"artifact":{"id":"pkg:npm/undici@8.9.0?package-id=c6a7a4da2332ffa7","name":"undici","version":"8.9.0","type":"npm","locations":[{"path":"/web/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodejs:undici:8.9.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/undici@8.9.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-w74x-v6f9-j3xg","dataSource":"https://github.com/advisories/GHSA-w74x-v6f9-j3xg","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-w74x-v6f9-j3xg","https://nvd.nist.gov/vuln/detail/CVE-2026-110306","https://github.com/fastify/fast-uri/commit/39933a1f1422986f14e2d844f552238feb40f5d4","https://github.com/fastify/fast-uri/commit/597f254c86d151568511eeb9a1df761fd12520b3","https://github.com/fastify/fast-uri/commit/e60e716f41d1d73717e2d803d20b68d2c6d20a0f","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v2.4.8","https://github.com/fastify/fast-uri/releases/tag/v3.1.9","https://github.com/fastify/fast-uri/releases/tag/v4.2.3"],"description":"fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110306","epss":0.0025,"percentile":0.16356,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110306","cwe":"CWE-172","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-110306","cwe":"CWE-180","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["4.2.3"],"state":"fixed","available":[{"version":"4.2.3","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.13874999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-110306","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110306","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-w74x-v6f9-j3xg"],"description":"fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, fast-uri percent-decodes the scheme component with the legacy global unescape() function before validating it, so an input whose decoded scheme is a dangerous token is emitted as a live scheme even though RFC 3986 does not allow percent-encoding in a scheme and no other parser accepts it. An application that screens dangerous schemes on the raw input and then stores or renders the normalized or resolved result can turn an inert string into an executable javascript, data, or vbscript URL, producing a stored or reflected cross-site scripting vector, and the equal() comparison treats an encoded and a plain scheme as the same, which can bypass equality-based allowlists. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to one of these versions or later. As a workaround, reject input whose scheme part contains a percent sign, or check the parsed scheme against an allowlist after normalization and use that same parsed result rather than the raw string.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110306","epss":0.0025,"percentile":0.16356,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110306","cwe":"CWE-172","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-110306","cwe":"CWE-180","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"4.1.4"}},"found":{"vulnerabilityID":"GHSA-w74x-v6f9-j3xg","versionConstraint":">=4.0.0,<4.2.3 (semantic)"},"fix":{"suggestedVersion":"4.2.3"}}],"artifact":{"id":"pkg:npm/fast-uri@4.1.4?package-id=f8441082801aeb5a","name":"fast-uri","version":"4.1.4","type":"npm","locations":[{"path":"/.github/kb-scripts/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:openjsf:fast-uri:4.1.4:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@4.1.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-f72v-6w45-q472","dataSource":"https://github.com/advisories/GHSA-f72v-6w45-q472","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/nodejs/undici/security/advisories/GHSA-f72v-6w45-q472","https://nvd.nist.gov/vuln/detail/CVE-2026-109841","https://github.com/nodejs/undici/commit/18bc8a1e09d15bc45815154a289dcf6fd5254d00","https://github.com/nodejs/undici/commit/4f7ef6806e532ab9e29ccd6229b1b9d241e1b1f0","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v7.30.1","https://github.com/nodejs/undici/releases/tag/v8.12.2"],"description":"undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-109841","epss":0.00252,"percentile":0.16692,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-109841","cwe":"CWE-178","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["8.12.2"],"state":"fixed","available":[{"version":"8.12.2","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.13734000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-109841","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109841","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-f72v-6w45-q472"],"description":"undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch() implementation verifies Subresource Integrity metadata by matching the algorithm token against a lowercase-only set, even though the SRI specification defines the token by its ASCII-lowercase form, so a valid but non-lowercase token such as an uppercase or mixed-case SHA256 is treated as unknown and skipped. When no recognized algorithm remains, undici treats the integrity list as empty and accepts the response, so a server returning a body that does not match the pinned digest passes the check. An attacker who controls only the response body can therefore deliver attacker-controlled bytes to an application that pinned a valid uppercase or mixed-case SRI token, with no integrity error, affecting response integrity only. The issue is fixed in undici 7.30.1 and 8.12.2, which normalize the algorithm token to ASCII lowercase before validation, and users should upgrade to one of those versions or later. As a workaround, use lowercase algorithm tokens such as sha256, sha384, or sha512 in integrity metadata.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-109841","epss":0.00252,"percentile":0.16692,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-109841","cwe":"CWE-178","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"undici","version":"8.9.0"}},"found":{"vulnerabilityID":"GHSA-f72v-6w45-q472","versionConstraint":">=8.0.0,<8.12.2 (semantic)"},"fix":{"suggestedVersion":"8.12.2"}}],"artifact":{"id":"pkg:npm/undici@8.9.0?package-id=c6a7a4da2332ffa7","name":"undici","version":"8.9.0","type":"npm","locations":[{"path":"/web/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodejs:undici:8.9.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/undici@8.9.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-2m5v-pch6-74hx","dataSource":"https://github.com/advisories/GHSA-2m5v-pch6-74hx","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nodejs/undici/security/advisories/GHSA-2m5v-pch6-74hx","https://nvd.nist.gov/vuln/detail/CVE-2026-109383","https://github.com/nodejs/undici/commit/04cb74b1db131ff8f5b4557dce811cbf5f4664b4","https://github.com/nodejs/undici/commit/8c59f6b302898cb2e9b0f7962cd7212b6e597c9f","https://github.com/nodejs/undici/commit/f75eac00ac177f7b2e6c8bfbd52d4113164286e6","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v6.29.1","https://github.com/nodejs/undici/releases/tag/v7.30.1","https://github.com/nodejs/undici/releases/tag/v8.12.2"],"description":"undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-109383","epss":0.00184,"percentile":0.08023,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-109383","cwe":"CWE-295","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["8.12.2"],"state":"fixed","available":[{"version":"8.12.2","date":"2026-10-28","kind":"first-observed"}]},"advisories":[],"risk":0.13707999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-109383","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109383","namespace":"nvd:cpe","severity":"Critical","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-2m5v-pch6-74hx"],"description":"undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before forwarding them to each per-origin pool, and because JSON cannot represent functions, a caller-supplied tls option containing a checkServerIdentity callback is silently dropped before it reaches the TLS layer. As a result, a TLS peer whose certificate a custom checkServerIdentity was written to reject, but which passes Node's default hostname and chain checks, is silently accepted. Because Agent is the default dispatcher behind request, fetch, and setGlobalDispatcher, this affects the path most applications use, and EnvHttpProxyAgent is affected on its direct and no-proxy routes as well, while only applications that pass a function-valued tls option such as a custom checkServerIdentity for certificate or public-key pinning are at risk. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, which preserve the tls option outside the JSON clone so custom verification callbacks are forwarded unchanged, and users should upgrade to one of those versions or later. As a workaround, pass the TLS options through connect instead of tls, or for proxied destinations use requestTls and proxyTls.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-109383","epss":0.00184,"percentile":0.08023,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-109383","cwe":"CWE-295","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"undici","version":"8.9.0"}},"found":{"vulnerabilityID":"GHSA-2m5v-pch6-74hx","versionConstraint":">=8.0.0,<8.12.2 (semantic)"},"fix":{"suggestedVersion":"8.12.2"}}],"artifact":{"id":"pkg:npm/undici@8.9.0?package-id=c6a7a4da2332ffa7","name":"undici","version":"8.9.0","type":"npm","locations":[{"path":"/web/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodejs:undici:8.9.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/undici@8.9.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-w293-vg96-wgc3","dataSource":"https://github.com/advisories/GHSA-w293-vg96-wgc3","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nodejs/undici/security/advisories/GHSA-w293-vg96-wgc3","https://nvd.nist.gov/vuln/detail/CVE-2026-84961","https://github.com/nodejs/undici/commit/8f5868fbdbc8f1146dfc1bcd1f2d117790141390","https://github.com/nodejs/undici/commit/f690157d728508652fef14673630c71515123e96","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v7.29.1","https://github.com/nodejs/undici/releases/tag/v8.10.2"],"description":"undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84961","epss":0.00178,"percentile":0.0739,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84961","cwe":"CWE-295","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["8.10.2"],"state":"fixed","available":[{"version":"8.10.2","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.13261},"relatedVulnerabilities":[{"id":"CVE-2026-84961","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84961","namespace":"nvd:cpe","severity":"Critical","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-w293-vg96-wgc3"],"description":"undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied checkServerIdentity callback or a custom connector inside the connect option, is silently discarded before it reaches the TLS layer. As a result a peer whose certificate the application's custom checkServerIdentity was written to reject, but which still passes Node's default hostname and chain checks, is accepted when reached through BalancedPool. The Client, Pool, and Agent dispatchers are not affected because they extract the connect and tls options before cloning. This affects undici versions from 7.24.1 up to 7.29.1 and from 8.0.0 up to 8.10.2, and only when the application supplies a function-valued connect or tls option to BalancedPool. Users should upgrade to undici 7.29.1 or 8.10.2.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84961","epss":0.00178,"percentile":0.0739,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84961","cwe":"CWE-295","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"undici","version":"8.9.0"}},"found":{"vulnerabilityID":"GHSA-w293-vg96-wgc3","versionConstraint":">=8.0.0,<8.10.2 (semantic)"},"fix":{"suggestedVersion":"8.10.2"}}],"artifact":{"id":"pkg:npm/undici@8.9.0?package-id=c6a7a4da2332ffa7","name":"undici","version":"8.9.0","type":"npm","locations":[{"path":"/web/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodejs:undici:8.9.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/undici@8.9.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-w2cx-738m-mc7w","dataSource":"https://github.com/advisories/GHSA-w2cx-738m-mc7w","namespace":"github:language:python","severity":"High","urls":["https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w2cx-738m-mc7w","https://nvd.nist.gov/vuln/detail/CVE-2026-102273","https://github.com/jpadilla/pyjwt/commit/801cd128528c62d9b23fcd161d1a2e1c17982f95","https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"],"description":"PyJWT accepts public JWK containers as HMAC secrets","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102273","epss":0.00175,"percentile":0.06931,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102273","cwe":"CWE-347","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.14.0"],"state":"fixed","available":[{"version":"2.14.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.130375},"relatedVulnerabilities":[{"id":"CVE-2026-102273","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102273","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/jpadilla/pyjwt/commit/801cd128528c62d9b23fcd161d1a2e1c17982f95","https://github.com/jpadilla/pyjwt/releases/tag/2.14.0","https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w2cx-738m-mc7w"],"description":"PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because HMAC key guard only recognizes top-level public JWK forms and misses container representations. This occurs when an application allows HMAC and asymmetric algorithms and passes a public JWK container as the raw key. As a result, public asymmetric key material is accepted as the HMAC secret. Consequently, an attacker who knows the public key can forge a token with arbitrary authenticated claims. This issue is fixed in version 2.14.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102273","epss":0.00175,"percentile":0.06931,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102273","cwe":"CWE-347","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"pyjwt","version":"2.13.0"}},"found":{"vulnerabilityID":"GHSA-w2cx-738m-mc7w","versionConstraint":"=2.13.0 (python)"},"fix":{"suggestedVersion":"2.14.0"}}],"artifact":{"id":"pkg:pypi/pyjwt@2.13.0?package-id=30a0e1dffae8ae90","name":"pyjwt","version":"2.13.0","type":"python","locations":[{"path":"/.github/requirements-smoke.txt","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-pyjwt:python-pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pyjwt:python_pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:python-pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:python_pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:python-pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:python_pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pyjwt:pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python:pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:pyjwt:2.13.0:*:*:*:*:*:*:*"],"purl":"pkg:pypi/pyjwt@2.13.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-wjr9-j795-jxcr","dataSource":"https://github.com/advisories/GHSA-wjr9-j795-jxcr","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-wjr9-j795-jxcr","https://nvd.nist.gov/vuln/detail/CVE-2026-110180","https://github.com/fastify/fast-uri/commit/58c183d0b168ad87f98773266444ce1f6375803a","https://github.com/fastify/fast-uri/commit/ddfc6a51122dfce0365655f04479fc3adb7f6b3c","https://github.com/fastify/fast-uri/commit/f6d46dfeab025d0c440485f4ae29fa4f14707646","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v2.4.8","https://github.com/fastify/fast-uri/releases/tag/v3.1.9","https://github.com/fastify/fast-uri/releases/tag/v4.2.3"],"description":"fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110180","epss":0.00255,"percentile":0.17126,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110180","cwe":"CWE-20","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-110180","cwe":"CWE-436","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["4.2.3"],"state":"fixed","available":[{"version":"4.2.3","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.12494999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-110180","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110180","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-wjr9-j795-jxcr"],"description":"fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions from 2.4.2 through 2.4.7, from 3.1.3 through 3.1.8, and from 4.0.1 through 4.2.2, for HTTP-family schemes the canonicalizeHost() function passes the parsed host to the WHATWG URL parser and adopts its hostname without checking that the parser consumed the entire input as a host, so the authority can be silently rewritten: data before an at-sign is dropped and tab, carriage-return, and line-feed characters are stripped, with no error reported. An application that enforces host-based policy such as denylists, loopback filtering, redirect validation, or outbound proxy routing on one representation can then see the canonical host diverge from what it checked, allowing traffic to be steered to an unintended destination. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to one of these versions or later. As a workaround, reject an authority that contains more than one at-sign or any tab, carriage-return, or line-feed before calling fast-uri, or treat any non-empty parse error as fatal and compare hosts only from the same parse result.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110180","epss":0.00255,"percentile":0.17126,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110180","cwe":"CWE-20","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-110180","cwe":"CWE-436","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"4.1.4"}},"found":{"vulnerabilityID":"GHSA-wjr9-j795-jxcr","versionConstraint":">=4.0.1,<4.2.3 (semantic)"},"fix":{"suggestedVersion":"4.2.3"}}],"artifact":{"id":"pkg:npm/fast-uri@4.1.4?package-id=f8441082801aeb5a","name":"fast-uri","version":"4.1.4","type":"npm","locations":[{"path":"/.github/kb-scripts/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:openjsf:fast-uri:4.1.4:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@4.1.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-hrr3-gc8f-f4qj","dataSource":"https://github.com/advisories/GHSA-hrr3-gc8f-f4qj","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-hrr3-gc8f-f4qj","https://nvd.nist.gov/vuln/detail/CVE-2026-86472","https://github.com/fastify/fast-uri/commit/5dabb86732aa2a7655e258719970e61e12b6b4d1","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v2.4.7","https://github.com/fastify/fast-uri/releases/tag/v3.1.8","https://github.com/fastify/fast-uri/releases/tag/v4.1.5"],"description":"fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-86472","epss":0.00253,"percentile":0.16802,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-86472","cwe":"CWE-178","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["4.1.5"],"state":"fixed","available":[{"version":"4.1.5","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.12397000000000001},"relatedVulnerabilities":[{"id":"CVE-2026-86472","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86472","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-hrr3-gc8f-f4qj"],"description":"fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv. In versions before 2.4.7, from 3.0.0 through 3.1.7, and from 4.0.0 through 4.1.4, fast-uri folds the host to lowercase before it percent-decodes the host, so a percent-encoded uppercase octet such as %41 decodes to a literal A that is never folded. For a scheme-relative reference such as //host there is no scheme, so the host canonicalization that would normally repair this does not run, and parse, normalize, and equal then disagree on the same host. An application that makes a case-sensitive host decision on fast-uri output, for example a host allowlist or denylist that compares the parsed host or uses equal, can be steered past the check with a percent-encoded uppercase octet, and because hostnames are case-insensitive in DNS and HTTP the evading spelling still reaches the host the check meant to gate. The issue is fixed in fast-uri 2.4.7, 3.1.8, and 4.1.5, and users should upgrade to one of those versions or later. As a workaround, compare hosts case-insensitively by lowercasing the parsed host before any allowlist or denylist decision.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-86472","epss":0.00253,"percentile":0.16802,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-86472","cwe":"CWE-178","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"4.1.4"}},"found":{"vulnerabilityID":"GHSA-hrr3-gc8f-f4qj","versionConstraint":">=4.0.0,<4.1.5 (semantic)"},"fix":{"suggestedVersion":"4.1.5"}}],"artifact":{"id":"pkg:npm/fast-uri@4.1.4?package-id=f8441082801aeb5a","name":"fast-uri","version":"4.1.4","type":"npm","locations":[{"path":"/.github/kb-scripts/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:openjsf:fast-uri:4.1.4:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@4.1.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-jvvf-x445-j334","dataSource":"https://github.com/advisories/GHSA-jvvf-x445-j334","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-jvvf-x445-j334","https://nvd.nist.gov/vuln/detail/CVE-2026-86818","https://github.com/fastify/fast-uri/commit/f40a88f33e684a46faec3f5b820bcbb1e85add64","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v4.1.5"],"description":"fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-86818","epss":0.00253,"percentile":0.16802,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-86818","cwe":"CWE-172","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-86818","cwe":"CWE-436","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["4.1.5"],"state":"fixed","available":[{"version":"4.1.5","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.12397000000000001},"relatedVulnerabilities":[{"id":"CVE-2026-86818","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86818","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-jvvf-x445-j334"],"description":"fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv, that added a mailto scheme parser in version 4.1.3. In versions 4.1.3 and 4.1.4, the mailto parser compares each query field name to the reserved names to, subject, and body while the name is still percent-encoded, and decodes it only when storing it as a generic header, so a percent-encoded spelling of a reserved field name is not recognized as that field at parse time but is re-emitted as the literal field name when the parsed URI is serialized. An application that validates, logs, or displays the recipient list from the first parse and then serializes the URI and sends it can silently gain an attacker-chosen recipient, and the subject and body fields can be smuggled across the same roundtrip. The issue is fixed in fast-uri 4.1.5, and users should upgrade to 4.1.5 or later. As a workaround, do not act on a mailto URI that fast-uri has re-serialized without first decoding and re-validating its recipient, subject, and body fields.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-86818","epss":0.00253,"percentile":0.16802,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-86818","cwe":"CWE-172","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-86818","cwe":"CWE-436","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"4.1.4"}},"found":{"vulnerabilityID":"GHSA-jvvf-x445-j334","versionConstraint":">=4.1.3,<4.1.5 (semantic)"},"fix":{"suggestedVersion":"4.1.5"}}],"artifact":{"id":"pkg:npm/fast-uri@4.1.4?package-id=f8441082801aeb5a","name":"fast-uri","version":"4.1.4","type":"npm","locations":[{"path":"/.github/kb-scripts/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:openjsf:fast-uri:4.1.4:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@4.1.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-9v7f-9g4p-ffgj","dataSource":"https://github.com/advisories/GHSA-9v7f-9g4p-ffgj","namespace":"github:language:python","severity":"High","urls":["https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9v7f-9g4p-ffgj","https://nvd.nist.gov/vuln/detail/CVE-2026-102267","https://github.com/jpadilla/pyjwt/commit/0a795b8e1f6ef08f634aa7086fc41cc6d5ce3e56","https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"],"description":"PyJWT: PyJWKClient follows redirects when fetching JWKS","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102267","epss":0.00159,"percentile":0.05004,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102267","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102267","cwe":"CWE-345","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102267","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.14.0"],"state":"fixed","available":[{"version":"2.14.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.11845499999999999},"relatedVulnerabilities":[{"id":"CVE-2026-102267","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102267","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/jpadilla/pyjwt/commit/0a795b8e1f6ef08f634aa7086fc41cc6d5ce3e56","https://github.com/jpadilla/pyjwt/releases/tag/2.14.0","https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9v7f-9g4p-ffgj"],"description":"PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an attacker-influenced redirect. As a result, PyJWKClient follows the redirect and consumes the redirected response as key material. Consequently, forwarded credentials may be disclosed or verification keys may be substituted. This issue is fixed in version 2.14.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102267","epss":0.00159,"percentile":0.05004,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102267","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102267","cwe":"CWE-345","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102267","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"pyjwt","version":"2.13.0"}},"found":{"vulnerabilityID":"GHSA-9v7f-9g4p-ffgj","versionConstraint":"<=2.13.0 (python)"},"fix":{"suggestedVersion":"2.14.0"}}],"artifact":{"id":"pkg:pypi/pyjwt@2.13.0?package-id=30a0e1dffae8ae90","name":"pyjwt","version":"2.13.0","type":"python","locations":[{"path":"/.github/requirements-smoke.txt","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-pyjwt:python-pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pyjwt:python_pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:python-pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:python_pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:python-pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:python_pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pyjwt:pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python:pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:pyjwt:2.13.0:*:*:*:*:*:*:*"],"purl":"pkg:pypi/pyjwt@2.13.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-jwrc-g2q2-pq5p","dataSource":"https://github.com/advisories/GHSA-jwrc-g2q2-pq5p","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jwrc-g2q2-pq5p","https://nvd.nist.gov/vuln/detail/CVE-2026-102270","https://github.com/jpadilla/pyjwt/commit/8b4e233a22206b34ec1186e912e75c0b2396ac07","https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"],"description":"PyJWT: ReDoS vulnerability when calling the `is_pem_format` function.","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"exploitabilityScore":0.8,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102270","epss":0.00246,"percentile":0.15856,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102270","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.14.0"],"state":"fixed","available":[{"version":"2.14.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.11562},"relatedVulnerabilities":[{"id":"CVE-2026-102270","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102270","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/jpadilla/pyjwt/commit/8b4e233a22206b34ec1186e912e75c0b2396ac07","https://github.com/jpadilla/pyjwt/releases/tag/2.14.0","https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jwrc-g2q2-pq5p"],"description":"PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT is_pem_format is affected because lazy PEM regular expression backtracks extensively. This occurs when a certificate-like input contains repeated BEGIN markers without a matching END marker. As a result, is_pem_format performs unbounded backtracking while searching for a PEM end marker. Consequently, an attacker can cause intensive CPU consumption. This issue is fixed in version 2.14.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"exploitabilityScore":1.3,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"exploitabilityScore":0.8,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102270","epss":0.00246,"percentile":0.15856,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102270","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"pyjwt","version":"2.13.0"}},"found":{"vulnerabilityID":"GHSA-jwrc-g2q2-pq5p","versionConstraint":"<=2.13.0 (python)"},"fix":{"suggestedVersion":"2.14.0"}}],"artifact":{"id":"pkg:pypi/pyjwt@2.13.0?package-id=30a0e1dffae8ae90","name":"pyjwt","version":"2.13.0","type":"python","locations":[{"path":"/.github/requirements-smoke.txt","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-pyjwt:python-pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pyjwt:python_pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:python-pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:python_pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:python-pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:python_pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pyjwt:pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python:pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:pyjwt:2.13.0:*:*:*:*:*:*:*"],"purl":"pkg:pypi/pyjwt@2.13.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-4w7w-5xrc-9h26","dataSource":"https://github.com/advisories/GHSA-4w7w-5xrc-9h26","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nodejs/undici/security/advisories/GHSA-4w7w-5xrc-9h26","https://nvd.nist.gov/vuln/detail/CVE-2026-109829","https://github.com/nodejs/undici/commit/26c2bfb3def0b67241ce878e80657ed5d6c3efa8","https://github.com/nodejs/undici/commit/b20b82ad80a405a12b6ce1f341bcd418de390aa0","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v7.30.1","https://github.com/nodejs/undici/releases/tag/v8.12.2"],"description":"undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-109829","epss":0.00149,"percentile":0.0406,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-109829","cwe":"CWE-346","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-109829","cwe":"CWE-524","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["8.12.2"],"state":"fixed","available":[{"version":"8.12.2","date":"2026-10-28","kind":"first-observed"}]},"advisories":[],"risk":0.111005},"relatedVulnerabilities":[{"id":"CVE-2026-109829","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109829","namespace":"nvd:cpe","severity":"Critical","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-4w7w-5xrc-9h26"],"description":"undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a shared cache store, the cache builds its key from the original request URL before the redirect handler changes the origin, so a response produced after a cross-origin redirect is stored under the original key. An attacker who controls the target of a redirect from a trusted URL can have their response cached under that trusted URL and served to later callers, allowing persistent cache poisoning, and the same key confusion lets a private, non-stored redirect response to a user-specific resource be stored under the original URL and served to a later unauthenticated caller, disclosing private data. Applications are affected only when an originless Agent, a shared cache store, and the redirect-then-cache composition are all used. The issue is fixed in undici 7.30.1 and 8.12.2, which verify the producing origin still matches the cache key and preserve each redirect hop's cache-control policy before storing, and users should upgrade to one of those versions or later. As a workaround, compose the cache interceptor before the redirect interceptor, use per-origin dispatchers and cache stores, or disable shared caching on redirect-capable requests.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-109829","epss":0.00149,"percentile":0.0406,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-109829","cwe":"CWE-346","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-109829","cwe":"CWE-524","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"undici","version":"8.9.0"}},"found":{"vulnerabilityID":"GHSA-4w7w-5xrc-9h26","versionConstraint":">=8.0.0,<8.12.2 (semantic)"},"fix":{"suggestedVersion":"8.12.2"}}],"artifact":{"id":"pkg:npm/undici@8.9.0?package-id=c6a7a4da2332ffa7","name":"undici","version":"8.9.0","type":"npm","locations":[{"path":"/web/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodejs:undici:8.9.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/undici@8.9.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-hxm8-2xgr-2p9m","dataSource":"https://github.com/advisories/GHSA-hxm8-2xgr-2p9m","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/jpadilla/pyjwt/security/advisories/GHSA-hxm8-2xgr-2p9m","https://nvd.nist.gov/vuln/detail/CVE-2026-102269","https://github.com/jpadilla/pyjwt/commit/e6f48401001609a8f99e71fcaf355fb895d508a8","https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"],"description":"PyJWT: Non-canonical signature segments enable raw-token revocation bypass","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102269","epss":0.00224,"percentile":0.1302,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102269","cwe":"CWE-180","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.14.0"],"state":"fixed","available":[{"version":"2.14.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.10975999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-102269","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102269","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/jpadilla/pyjwt/commit/e6f48401001609a8f99e71fcaf355fb895d508a8","https://github.com/jpadilla/pyjwt/releases/tag/2.14.0","https://github.com/jpadilla/pyjwt/security/advisories/GHSA-hxm8-2xgr-2p9m"],"description":"PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT signature segment is affected because signature segment decoding accepts characters outside the canonical Base64URL representation. This occurs when non-Base64URL characters are appended to a valid compact JWS signature segment. As a result, base64url_decode produces the same signature bytes for different serialized segments. Consequently, raw-token revocation checks can fail to recognize an equivalent modified token. This issue is fixed in version 2.14.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"exploitabilityScore":2.9,"impactScore":2.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102269","epss":0.00224,"percentile":0.1302,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102269","cwe":"CWE-180","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"pyjwt","version":"2.13.0"}},"found":{"vulnerabilityID":"GHSA-hxm8-2xgr-2p9m","versionConstraint":"<=2.13.0 (python)"},"fix":{"suggestedVersion":"2.14.0"}}],"artifact":{"id":"pkg:pypi/pyjwt@2.13.0?package-id=30a0e1dffae8ae90","name":"pyjwt","version":"2.13.0","type":"python","locations":[{"path":"/.github/requirements-smoke.txt","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-pyjwt:python-pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pyjwt:python_pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:python-pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:python_pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:python-pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:python_pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pyjwt:pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python:pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:pyjwt:2.13.0:*:*:*:*:*:*:*"],"purl":"pkg:pypi/pyjwt@2.13.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-r53p-7pc4-xj5r","dataSource":"https://github.com/advisories/GHSA-r53p-7pc4-xj5r","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/nodejs/undici/security/advisories/GHSA-r53p-7pc4-xj5r","https://nvd.nist.gov/vuln/detail/CVE-2026-18540","https://github.com/nodejs/undici/commit/0160a719063fb0a77f4fdf9500b9166b91e14329","https://github.com/nodejs/undici/commit/cd8af90b38ae33c2838d54a2d629774122effe95","https://github.com/nodejs/undici/commit/ce31bc824b578008faae5d3350da66c1b5f71548","https://hackerone.com/reports/3900104","https://hackerone.com/reports/3900615","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v6.28.1","https://github.com/nodejs/undici/releases/tag/v7.29.1","https://github.com/nodejs/undici/releases/tag/v8.10.2"],"description":"undici vulnerable to downstream response splitting via retry interceptor","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-18540","epss":0.00309,"percentile":0.23786,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-18540","cwe":"CWE-444","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["8.10.2"],"state":"fixed","available":[{"version":"8.10.2","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.10351499999999998},"relatedVulnerabilities":[{"id":"CVE-2026-18540","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18540","namespace":"nvd:cpe","severity":"Low","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-r53p-7pc4-xj5r"],"description":"undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers. This happens when an upstream server delivers part of a body without a trustworthy resume checkpoint, for example a non-success response whose headers were already sent or a partial-content response with an unusable content range, then closes the connection and answers the resumed range request with more bytes. As a result the response body can be longer than the Content-Length that the application observes. An application that relays such a response to a downstream HTTP/1.1 peer without normalizing the framing can emit a body that exceeds the forwarded Content-Length, and the excess bytes can be interpreted as the start of a following response, which enables downstream response splitting or desynchronization. Exploitation requires an attacker-controlled upstream server and an application that forwards the response through a framing-sensitive path. This affects undici versions before 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-18540","epss":0.00309,"percentile":0.23786,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-18540","cwe":"CWE-444","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"undici","version":"8.9.0"}},"found":{"vulnerabilityID":"GHSA-r53p-7pc4-xj5r","versionConstraint":">=8.0.0,<8.10.2 (semantic)"},"fix":{"suggestedVersion":"8.10.2"}}],"artifact":{"id":"pkg:npm/undici@8.9.0?package-id=c6a7a4da2332ffa7","name":"undici","version":"8.9.0","type":"npm","locations":[{"path":"/web/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodejs:undici:8.9.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/undici@8.9.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-333x-w4r6-6crp","dataSource":"https://github.com/advisories/GHSA-333x-w4r6-6crp","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-333x-w4r6-6crp","https://nvd.nist.gov/vuln/detail/CVE-2026-110725","https://github.com/fastify/fast-uri/commit/39e6493c1356f30a0084171627eb266786e1620e","https://github.com/fastify/fast-uri/commit/a9b8d67353630aab053cd727cf629023dd018d2b","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v2.4.8","https://github.com/fastify/fast-uri/releases/tag/v3.1.9","https://github.com/fastify/fast-uri/releases/tag/v4.2.3"],"description":"fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110725","epss":0.00302,"percentile":0.23001,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110725","cwe":"CWE-41","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-110725","cwe":"CWE-116","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["4.2.3"],"state":"fixed","available":[{"version":"4.2.3","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.10117},"relatedVulnerabilities":[{"id":"CVE-2026-110725","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110725","namespace":"nvd:cpe","severity":"Low","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-333x-w4r6-6crp"],"description":"fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, when serialize(), normalize(), or resolve() are called with the non-default option reference set to suffix on a reference that has no authority, the emitted relative reference can contain a bare colon in its first path segment without escaping it, even though RFC 3986 forbids that because it makes the string reparse as an absolute URI with a scheme. An application that serializes or normalizes a relative reference with the suffix option and then treats the result as a URI can turn inert input into a live javascript, data, or vbscript URL, a cross-site scripting vector, and the equal() comparison can conflate a scheme-bearing reference with a relative one. Exposure is limited to applications using the non-default suffix reference option. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to one of these versions or later. As a workaround, avoid the suffix reference option on untrusted input, or percent-encode a colon in the first path segment of the result before treating it as a URI.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110725","epss":0.00302,"percentile":0.23001,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110725","cwe":"CWE-41","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-110725","cwe":"CWE-116","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"4.1.4"}},"found":{"vulnerabilityID":"GHSA-333x-w4r6-6crp","versionConstraint":">=4.0.0,<4.2.3 (semantic)"},"fix":{"suggestedVersion":"4.2.3"}}],"artifact":{"id":"pkg:npm/fast-uri@4.1.4?package-id=f8441082801aeb5a","name":"fast-uri","version":"4.1.4","type":"npm","locations":[{"path":"/.github/kb-scripts/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:openjsf:fast-uri:4.1.4:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@4.1.4","upstreams":[]}},{"vulnerability":{"id":"GO-2026-6866","dataSource":"https://go.dev/cl/855121","namespace":"govulndb:language:go","severity":"Unknown","urls":["https://go.dev/issue/82622","https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs"],"description":"In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as <mglyph> or <malignmark> fostered under <mtext>), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output.\n\nContinue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text.","cvss":[],"epss":[{"cve":"CVE-2026-97045","epss":0.00202,"percentile":0.10121,"date":"2026-10-31"}],"fix":{"versions":["0.62.0"],"state":"fixed","available":[{"version":"0.62.0","date":"2026-10-27","kind":"release"}]},"advisories":[],"risk":0.101},"relatedVulnerabilities":[{"id":"CVE-2026-97045","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97045","namespace":"nvd:cpe","severity":"Unknown","urls":["https://go.dev/cl/855121","https://go.dev/issue/82622","https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs","https://pkg.go.dev/vuln/GO-2026-6866"],"description":"In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as <mglyph> or <malignmark> fostered under <mtext>), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output. Continue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text.","cvss":[],"epss":[{"cve":"CVE-2026-97045","epss":0.00202,"percentile":0.10121,"date":"2026-10-31"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.58.0"}},"found":{"vulnerabilityID":"GO-2026-6866","versionConstraint":"<0.62.0 (go)"},"fix":{"suggestedVersion":"0.62.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.58.0?package-id=f556606ebb1221ee","name":"golang.org/x/net","version":"v0.58.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.58.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.58.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.58.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To="}}},{"vulnerability":{"id":"GHSA-xhq7-xmqj-769h","dataSource":"https://github.com/advisories/GHSA-xhq7-xmqj-769h","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-xhq7-xmqj-769h","https://nvd.nist.gov/vuln/detail/CVE-2026-110095","https://github.com/fastify/fast-uri/commit/048bbd0a252971be86d6579f0dfc87f8de5b9c47","https://github.com/fastify/fast-uri/commit/52774a5c35df36b0bbe439cd4c12c3dc0e50e3b9","https://github.com/fastify/fast-uri/commit/7c19f8b97ec51f1f20b4e3d9d5820cb8d5176058","https://github.com/fastify/fast-uri/commit/9eb8759a9825c046f57f7f695f1944bc39b88abd","https://github.com/fastify/fast-uri/commit/acc5c5d60c4209571789496e1732468911c7e12a","https://github.com/fastify/fast-uri/commit/b110a3571c37dfcf9d1c72ce2e2e178c78d1a424","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v2.4.8","https://github.com/fastify/fast-uri/releases/tag/v3.1.9","https://github.com/fastify/fast-uri/releases/tag/v4.2.3"],"description":"fast-uri vulnerable to improper path equivalence in relative reference normalization","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110095","epss":0.00289,"percentile":0.21549,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110095","cwe":"CWE-41","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["4.2.3"],"state":"fixed","available":[{"version":"4.2.3","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.096815},"relatedVulnerabilities":[{"id":"CVE-2026-110095","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110095","namespace":"nvd:cpe","severity":"Low","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-xhq7-xmqj-769h"],"description":"fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, the normalize() and serialize() functions apply RFC 3986 dot-segment removal to the path of a relative-path reference, even though that algorithm is defined only for the merged target path during resolution, so a leading parent-directory segment can be dropped and a document-relative reference can become root-relative. An application that normalizes an attacker-supplied or user-supplied relative reference and then resolves it, or uses it as a cache, deduplication, or authorization key, can have the reference escape its intended directory and point at a different resource. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to one of these versions or later. As a workaround, resolve a relative reference against its absolute base first and normalize the absolute result instead of normalizing the reference beforehand.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110095","epss":0.00289,"percentile":0.21549,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110095","cwe":"CWE-41","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"4.1.4"}},"found":{"vulnerabilityID":"GHSA-xhq7-xmqj-769h","versionConstraint":">=4.0.0,<4.2.3 (semantic)"},"fix":{"suggestedVersion":"4.2.3"}}],"artifact":{"id":"pkg:npm/fast-uri@4.1.4?package-id=f8441082801aeb5a","name":"fast-uri","version":"4.1.4","type":"npm","locations":[{"path":"/.github/kb-scripts/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:openjsf:fast-uri:4.1.4:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@4.1.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-x33g-cr3x-6449","dataSource":"https://github.com/advisories/GHSA-x33g-cr3x-6449","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/jpadilla/pyjwt/security/advisories/GHSA-x33g-cr3x-6449","https://nvd.nist.gov/vuln/detail/CVE-2026-102275","https://github.com/jpadilla/pyjwt/commit/3cd9ceec33ced359decbad75b413ad668ae6332c","https://github.com/jpadilla/pyjwt/releases/tag/2.15.0"],"description":"PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.3,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102275","epss":0.00167,"percentile":0.05937,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102275","cwe":"CWE-345","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102275","cwe":"CWE-348","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.15.0"],"state":"fixed","available":[{"version":"2.15.0","date":"2026-10-06","kind":"first-observed"}]},"advisories":[],"risk":0.096025},"relatedVulnerabilities":[{"id":"CVE-2026-102275","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102275","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/jpadilla/pyjwt/commit/3cd9ceec33ced359decbad75b413ad668ae6332c","https://github.com/jpadilla/pyjwt/releases/tag/2.15.0","https://github.com/jpadilla/pyjwt/security/advisories/GHSA-x33g-cr3x-6449"],"description":"PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.from_jwk in  jwt/algorithms.py is affected because private-JWK import path does not compare the public key derived from d with x. This occurs when an OKP private JWK supplies non-corresponding x and d components. As a result, identity derived from x can differ from operations performed with d. Consequently, if an integration also accepts private key parameters from a proof header without rejecting them, an attacker may use a stolen sender-constrained token without the legitimate private key. This issue is fixed in version 2.15.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":3.9,"impactScore":4.3},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.3,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102275","epss":0.00167,"percentile":0.05937,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102275","cwe":"CWE-345","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102275","cwe":"CWE-348","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"pyjwt","version":"2.13.0"}},"found":{"vulnerabilityID":"GHSA-x33g-cr3x-6449","versionConstraint":">=2.1.0,<=2.14.0 (python)"},"fix":{"suggestedVersion":"2.15.0"}}],"artifact":{"id":"pkg:pypi/pyjwt@2.13.0?package-id=30a0e1dffae8ae90","name":"pyjwt","version":"2.13.0","type":"python","locations":[{"path":"/.github/requirements-smoke.txt","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-pyjwt:python-pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pyjwt:python_pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:python-pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:python_pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:python-pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:python_pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pyjwt:pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python:pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:pyjwt:2.13.0:*:*:*:*:*:*:*"],"purl":"pkg:pypi/pyjwt@2.13.0","upstreams":[]}},{"vulnerability":{"id":"GO-2026-6860","dataSource":"https://go.dev/cl/849365","namespace":"govulndb:language:go","severity":"Unknown","urls":["https://go.dev/issue/82224","https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs"],"description":"When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as \"a</x>\") caused O(n^2) allocations and byte copies.\n\nAccumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.","cvss":[],"epss":[{"cve":"CVE-2026-78661","epss":0.00185,"percentile":0.08066,"date":"2026-10-31"}],"fix":{"versions":["0.62.0"],"state":"fixed","available":[{"version":"0.62.0","date":"2026-10-27","kind":"release"}]},"advisories":[],"risk":0.0925},"relatedVulnerabilities":[{"id":"CVE-2026-78661","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78661","namespace":"nvd:cpe","severity":"Unknown","urls":["https://go.dev/cl/849365","https://go.dev/issue/82224","https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs","https://pkg.go.dev/vuln/GO-2026-6860"],"description":"When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as \"a</x>\") caused O(n^2) allocations and byte copies. Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.","cvss":[],"epss":[{"cve":"CVE-2026-78661","epss":0.00185,"percentile":0.08066,"date":"2026-10-31"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.58.0"}},"found":{"vulnerabilityID":"GO-2026-6860","versionConstraint":"<0.62.0 (go)"},"fix":{"suggestedVersion":"0.62.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.58.0?package-id=f556606ebb1221ee","name":"golang.org/x/net","version":"v0.58.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.58.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.58.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.58.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To="}}},{"vulnerability":{"id":"GHSA-8wmf-6v46-5gfg","dataSource":"https://github.com/advisories/GHSA-8wmf-6v46-5gfg","namespace":"github:language:go","severity":"Low","urls":["https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg","https://nvd.nist.gov/vuln/detail/CVE-2026-81870","https://github.com/open-telemetry/opentelemetry-go/pull/8438","https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38","https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0"],"description":"OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-81870","epss":0.00266,"percentile":0.1856,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-81870","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-81870","cwe":"CWE-532","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.45.0"],"state":"fixed","available":[{"version":"1.45.0","date":"2026-09-18","kind":"first-observed"}]},"advisories":[],"risk":0.0665},"relatedVulnerabilities":[{"id":"CVE-2026-81870","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-81870","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38","https://github.com/open-telemetry/opentelemetry-go/pull/8438","https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg"],"description":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.5.0 to 1.44.0, sdk/trace.NewTracerProvider emits a TracerProvider created internal Info-level diagnostic event whose MarshalLog implementations recursively include span processor, exporter, and client configuration. Applications that call otel.SetLogger to enable OpenTelemetry internal Info logging can therefore record OTLP gRPC and HTTP collector endpoints, the OTLP HTTP Insecure flag, and complete Zipkin collector URLs. A person or system with access to those logs can learn internal collector topology and can recover credentials or tokens embedded in Zipkin URL user information or query strings. The default OpenTelemetry logger does not emit the event, and this path does not log OTLP authentication headers, TLS key material, or span payloads. This issue is fixed in version 1.45.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-81870","epss":0.00266,"percentile":0.1856,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-81870","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-81870","cwe":"CWE-532","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"go.opentelemetry.io/otel/exporters/otlp/otlptrace","version":"v1.44.0"}},"found":{"vulnerabilityID":"GHSA-8wmf-6v46-5gfg","versionConstraint":">=1.5.0,<=1.44.0 (go)"},"fix":{"suggestedVersion":"1.45.0"}}],"artifact":{"id":"pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace@v1.44.0?package-id=7e34dbb654c3cdde","name":"go.opentelemetry.io/otel/exporters/otlp/otlptrace","version":"v1.44.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:otel:exporters\\/otlp\\/otlptrace:v1.44.0:*:*:*:*:*:*:*"],"purl":"pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace@v1.44.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:4YsVu3B8+3qtWYYrsUYgn0OG78pN0rnNPRGX4SbokQI="}}},{"vulnerability":{"id":"GHSA-8wmf-6v46-5gfg","dataSource":"https://github.com/advisories/GHSA-8wmf-6v46-5gfg","namespace":"github:language:go","severity":"Low","urls":["https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg","https://nvd.nist.gov/vuln/detail/CVE-2026-81870","https://github.com/open-telemetry/opentelemetry-go/pull/8438","https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38","https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0"],"description":"OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-81870","epss":0.00266,"percentile":0.1856,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-81870","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-81870","cwe":"CWE-532","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.45.0"],"state":"fixed","available":[{"version":"1.45.0","date":"2026-09-18","kind":"first-observed"}]},"advisories":[],"risk":0.0665},"relatedVulnerabilities":[{"id":"CVE-2026-81870","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-81870","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38","https://github.com/open-telemetry/opentelemetry-go/pull/8438","https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg"],"description":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.5.0 to 1.44.0, sdk/trace.NewTracerProvider emits a TracerProvider created internal Info-level diagnostic event whose MarshalLog implementations recursively include span processor, exporter, and client configuration. Applications that call otel.SetLogger to enable OpenTelemetry internal Info logging can therefore record OTLP gRPC and HTTP collector endpoints, the OTLP HTTP Insecure flag, and complete Zipkin collector URLs. A person or system with access to those logs can learn internal collector topology and can recover credentials or tokens embedded in Zipkin URL user information or query strings. The default OpenTelemetry logger does not emit the event, and this path does not log OTLP authentication headers, TLS key material, or span payloads. This issue is fixed in version 1.45.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-81870","epss":0.00266,"percentile":0.1856,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-81870","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-81870","cwe":"CWE-532","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp","version":"v1.44.0"}},"found":{"vulnerabilityID":"GHSA-8wmf-6v46-5gfg","versionConstraint":">=1.5.0,<=1.44.0 (go)"},"fix":{"suggestedVersion":"1.45.0"}}],"artifact":{"id":"pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.44.0?package-id=288b7ac6957376a5","name":"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp","version":"v1.44.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:otel:exporters\\/otlp\\/otlptrace\\/otlptracehttp:v1.44.0:*:*:*:*:*:*:*"],"purl":"pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.44.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:lgh3PiVrRUWMLOVSkQicxzZll5NjF1r+AtsX1XRIHw0="}}},{"vulnerability":{"id":"GHSA-8wmf-6v46-5gfg","dataSource":"https://github.com/advisories/GHSA-8wmf-6v46-5gfg","namespace":"github:language:go","severity":"Low","urls":["https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg","https://nvd.nist.gov/vuln/detail/CVE-2026-81870","https://github.com/open-telemetry/opentelemetry-go/pull/8438","https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38","https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0"],"description":"OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-81870","epss":0.00266,"percentile":0.1856,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-81870","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-81870","cwe":"CWE-532","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.45.0"],"state":"fixed","available":[{"version":"1.45.0","date":"2026-09-18","kind":"first-observed"}]},"advisories":[],"risk":0.0665},"relatedVulnerabilities":[{"id":"CVE-2026-81870","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-81870","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38","https://github.com/open-telemetry/opentelemetry-go/pull/8438","https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg"],"description":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.5.0 to 1.44.0, sdk/trace.NewTracerProvider emits a TracerProvider created internal Info-level diagnostic event whose MarshalLog implementations recursively include span processor, exporter, and client configuration. Applications that call otel.SetLogger to enable OpenTelemetry internal Info logging can therefore record OTLP gRPC and HTTP collector endpoints, the OTLP HTTP Insecure flag, and complete Zipkin collector URLs. A person or system with access to those logs can learn internal collector topology and can recover credentials or tokens embedded in Zipkin URL user information or query strings. The default OpenTelemetry logger does not emit the event, and this path does not log OTLP authentication headers, TLS key material, or span payloads. This issue is fixed in version 1.45.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-81870","epss":0.00266,"percentile":0.1856,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-81870","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-81870","cwe":"CWE-532","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"go.opentelemetry.io/otel/sdk","version":"v1.43.0"}},"found":{"vulnerabilityID":"GHSA-8wmf-6v46-5gfg","versionConstraint":">=1.5.0,<=1.44.0 (go)"},"fix":{"suggestedVersion":"1.45.0"}}],"artifact":{"id":"pkg:golang/go.opentelemetry.io/otel/sdk@v1.43.0?package-id=c653efad8cf07d80","name":"go.opentelemetry.io/otel/sdk","version":"v1.43.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:otel:sdk:v1.43.0:*:*:*:*:*:*:*"],"purl":"pkg:golang/go.opentelemetry.io/otel/sdk@v1.43.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg="}}},{"vulnerability":{"id":"GHSA-2gqq-gqf2-x968","dataSource":"https://github.com/advisories/GHSA-2gqq-gqf2-x968","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/nodejs/undici/security/advisories/GHSA-2gqq-gqf2-x968","https://nvd.nist.gov/vuln/detail/CVE-2026-84947","https://github.com/nodejs/undici/commit/21693f406f0142f3504192e9f9b022dcf84782ae","https://github.com/nodejs/undici/commit/6d583124e7cf60b640097d64144ed633cc450584","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v7.29.1","https://github.com/nodejs/undici/releases/tag/v8.10.2"],"description":"undici vulnerable to response truncation via oversized chunked responses in the dump interceptor","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84947","epss":0.00196,"percentile":0.094,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84947","cwe":"CWE-20","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-84947","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["8.10.2"],"state":"fixed","available":[{"version":"8.10.2","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.06566},"relatedVulnerabilities":[{"id":"CVE-2026-84947","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84947","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-2gqq-gqf2-x968"],"description":"undici's dump interceptor reads and discards a response body up to a configurable maximum size. When a response declares a Content-Length that exceeds the maximum, the interceptor aborts cleanly, but when a response has no Content-Length and is chunked, the interceptor instead signals completion early once the accumulated size reaches the maximum, without pausing or aborting the request. Because the underlying parser keeps delivering body bytes, a second completion signal fires and trips an internal assertion, which aborts the request and tears down the connection. The application is left observing a misleading successful status with an empty or truncated body while the connection has actually been disconnected. This affects undici versions from 7.1.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84947","epss":0.00196,"percentile":0.094,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84947","cwe":"CWE-20","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-84947","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"undici","version":"8.9.0"}},"found":{"vulnerabilityID":"GHSA-2gqq-gqf2-x968","versionConstraint":">=8.0.0,<8.10.2 (semantic)"},"fix":{"suggestedVersion":"8.10.2"}}],"artifact":{"id":"pkg:npm/undici@8.9.0?package-id=c6a7a4da2332ffa7","name":"undici","version":"8.9.0","type":"npm","locations":[{"path":"/web/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodejs:undici:8.9.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/undici@8.9.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-8436-99hf-9mmv","dataSource":"https://github.com/advisories/GHSA-8436-99hf-9mmv","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/nodejs/undici/security/advisories/GHSA-8436-99hf-9mmv","https://nvd.nist.gov/vuln/detail/CVE-2026-85008","https://github.com/nodejs/undici/commit/2be07bf97b3022e0324142d31f99f6e019d815e3","https://github.com/nodejs/undici/commit/b61d9432bac7caac51273ad209862e4c0bf935ae","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v7.29.1","https://github.com/nodejs/undici/releases/tag/v8.10.2"],"description":"undici vulnerable to caching and replay of unsafe HTTP method responses","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-85008","epss":0.00118,"percentile":0.0169,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-85008","cwe":"CWE-345","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["8.10.2"],"state":"fixed","available":[{"version":"8.10.2","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.039529999999999996},"relatedVulnerabilities":[{"id":"CVE-2026-85008","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85008","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-8436-99hf-9mmv"],"description":"undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is built by subtracting the configured methods from the set of safe methods, so an unsafe method such as POST, PUT, or DELETE is never placed in the skip list and instead falls through to the full cache-read path. The response-storage gate also lacked a method check, so a response to an unsafe request that is heuristically cacheable or carries an explicit Cache-Control directive is stored and later replayed from cache. Because response headers from a remote origin are untrusted, an origin can answer once with a cacheable status and then have the client's own subsequent state-changing requests to that path served from the stale cache entry without ever reaching the origin, an integrity failure that occurs under the interceptor's default configuration. This affects undici versions from 7.0.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-85008","epss":0.00118,"percentile":0.0169,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-85008","cwe":"CWE-345","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"undici","version":"8.9.0"}},"found":{"vulnerabilityID":"GHSA-8436-99hf-9mmv","versionConstraint":">=8.0.0,<8.10.2 (semantic)"},"fix":{"suggestedVersion":"8.10.2"}}],"artifact":{"id":"pkg:npm/undici@8.9.0?package-id=c6a7a4da2332ffa7","name":"undici","version":"8.9.0","type":"npm","locations":[{"path":"/web/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodejs:undici:8.9.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/undici@8.9.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-6q48-6c7w-9gw2","dataSource":"https://github.com/advisories/GHSA-6q48-6c7w-9gw2","namespace":"github:language:python","severity":"Critical","urls":["https://github.com/certifi/python-certifi/security/advisories/GHSA-6q48-6c7w-9gw2","https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576","https://emudhra.we-have-a-problem.com"],"description":"certifi bundles emSign root CAs with compromised intermediate CA keys","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":9.1},"vendorMetadata":{}}],"fix":{"versions":["2026.10.18"],"state":"fixed","available":[{"version":"2026.10.18","date":"2026-10-26","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"certifi","version":"2026.6.17"}},"found":{"vulnerabilityID":"GHSA-6q48-6c7w-9gw2","versionConstraint":">=2019.03.09,<2026.10.18 (python)"},"fix":{"suggestedVersion":"2026.10.18"}}],"artifact":{"id":"pkg:pypi/certifi@2026.6.17?package-id=bc293be6afda76f8","name":"certifi","version":"2026.6.17","type":"python","locations":[{"path":"/.github/requirements-nightly.txt","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:certifi:certifi:2026.6.17:*:*:*:*:python:*:*"],"purl":"pkg:pypi/certifi@2026.6.17","upstreams":[]}},{"vulnerability":{"id":"GHSA-cg2g-xh64-v4q7","dataSource":"https://github.com/advisories/GHSA-cg2g-xh64-v4q7","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/cure53/DOMPurify/security/advisories/GHSA-cg2g-xh64-v4q7","https://github.com/cure53/DOMPurify/pull/1672","https://github.com/cure53/DOMPurify/commit/a77a3e78b59f72fa4d1c83f22e121ad9cc7d3575","https://github.com/cure53/DOMPurify/releases/tag/3.4.17"],"description":"DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":9.2},"vendorMetadata":{}}],"fix":{"versions":["3.4.17"],"state":"fixed","available":[{"version":"3.4.17","date":"2026-10-23","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"dompurify","version":"3.4.15"}},"found":{"vulnerabilityID":"GHSA-cg2g-xh64-v4q7","versionConstraint":">=3.4.4,<=3.4.16 (semantic)"},"fix":{"suggestedVersion":"3.4.17"}}],"artifact":{"id":"pkg:npm/dompurify@3.4.15?package-id=dc8c2e9341a25ff8","name":"dompurify","version":"3.4.15","type":"npm","locations":[{"path":"/web/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MPL-2.0 OR Apache-2.0"],"cpes":["cpe:2.3:a:dompurify:dompurify:3.4.15:*:*:*:*:*:*:*"],"purl":"pkg:npm/dompurify@3.4.15","upstreams":[]}},{"vulnerability":{"id":"GHSA-mrv2-3pqr-j5jr","dataSource":"https://github.com/advisories/GHSA-mrv2-3pqr-j5jr","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/cure53/DOMPurify/security/advisories/GHSA-mrv2-3pqr-j5jr","https://github.com/cure53/DOMPurify/pull/1672","https://github.com/cure53/DOMPurify/commit/a77a3e78b59f72fa4d1c83f22e121ad9cc7d3575","https://github.com/cure53/DOMPurify/releases/tag/3.4.17"],"description":"DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":7.6},"vendorMetadata":{}}],"fix":{"versions":["3.4.17"],"state":"fixed","available":[{"version":"3.4.17","date":"2026-10-23","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"dompurify","version":"3.4.15"}},"found":{"vulnerabilityID":"GHSA-mrv2-3pqr-j5jr","versionConstraint":"<=3.4.16 (semantic)"},"fix":{"suggestedVersion":"3.4.17"}}],"artifact":{"id":"pkg:npm/dompurify@3.4.15?package-id=dc8c2e9341a25ff8","name":"dompurify","version":"3.4.15","type":"npm","locations":[{"path":"/web/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MPL-2.0 OR Apache-2.0"],"cpes":["cpe:2.3:a:dompurify:dompurify:3.4.15:*:*:*:*:*:*:*"],"purl":"pkg:npm/dompurify@3.4.15","upstreams":[]}},{"vulnerability":{"id":"GHSA-pxh4-856f-4h89","dataSource":"https://github.com/advisories/GHSA-pxh4-856f-4h89","namespace":"github:language:python","severity":"High","urls":["https://github.com/jpadilla/pyjwt/security/advisories/GHSA-pxh4-856f-4h89","https://github.com/jpadilla/pyjwt/commit/af8181ca0bec5e6b372fbba9afbe23702b787ceb","https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"],"description":"PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"fix":{"versions":["2.14.0"],"state":"fixed","available":[{"version":"2.14.0","date":"2026-10-22","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"pyjwt","version":"2.13.0"}},"found":{"vulnerabilityID":"GHSA-pxh4-856f-4h89","versionConstraint":"<=2.13.0 (python)"},"fix":{"suggestedVersion":"2.14.0"}}],"artifact":{"id":"pkg:pypi/pyjwt@2.13.0?package-id=30a0e1dffae8ae90","name":"pyjwt","version":"2.13.0","type":"python","locations":[{"path":"/.github/requirements-smoke.txt","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-pyjwt:python-pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pyjwt:python_pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:python-pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:python_pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:python-pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:python_pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pyjwt:pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:python:pyjwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:pyjwt:2.13.0:*:*:*:*:*:*:*"],"purl":"pkg:pypi/pyjwt@2.13.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-mrhx-c7xc-m3w5","dataSource":"https://github.com/advisories/GHSA-mrhx-c7xc-m3w5","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2023-54404","https://github.com/colinhacks/zod/issues/1872","https://github.com/colinhacks/zod/pull/6475","https://www.vulncheck.com/advisories/zod-uncontrolled-resource-consumption-via-array-validation","https://github.com/colinhacks/zod/pull/6652","https://github.com/colinhacks/zod/commit/a0ebf970f2d752e5f58527cd2942ff48be4f46bd"],"description":"Zod can exhaust memory while validating oversized constrained collections","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"fix":{"versions":["4.6.6"],"state":"fixed","available":[{"version":"4.6.6","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[{"id":"CVE-2023-54404","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-54404","namespace":"nvd:cpe","severity":"Unknown","urls":[],"description":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. The described memory use only grows in proportion to input already allocated by JSON.parse before Zod runs, is reachable only without an application request-size limit, and reflects expected validator behavior rather than a defect in Zod.","cvss":[]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"zod","version":"4.6.5"}},"found":{"vulnerabilityID":"GHSA-mrhx-c7xc-m3w5","versionConstraint":"<4.6.6 (semantic)"},"fix":{"suggestedVersion":"4.6.6"}}],"artifact":{"id":"pkg:npm/zod@4.6.5?package-id=ceec65291395e7f3","name":"zod","version":"4.6.5","type":"npm","locations":[{"path":"/web/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:zod:zod:4.6.5:*:*:*:*:*:*:*"],"purl":"pkg:npm/zod@4.6.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-6688-9rhm-gjv2","dataSource":"https://github.com/advisories/GHSA-6688-9rhm-gjv2","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/cure53/DOMPurify/security/advisories/GHSA-6688-9rhm-gjv2","https://github.com/cure53/DOMPurify/pull/1636","https://github.com/cure53/DOMPurify/commit/b9b9d80f7e401771c2ccaef5f45def7eec8f27d7","https://github.com/cure53/DOMPurify/releases/tag/3.4.16"],"description":"DOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup — pure HTML reparse executes","cvss":[],"fix":{"versions":["3.4.16"],"state":"fixed","available":[{"version":"3.4.16","date":"2026-10-06","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"dompurify","version":"3.4.15"}},"found":{"vulnerabilityID":"GHSA-6688-9rhm-gjv2","versionConstraint":"<=3.4.15 (semantic)"},"fix":{"suggestedVersion":"3.4.16"}}],"artifact":{"id":"pkg:npm/dompurify@3.4.15?package-id=dc8c2e9341a25ff8","name":"dompurify","version":"3.4.15","type":"npm","locations":[{"path":"/web/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MPL-2.0 OR Apache-2.0"],"cpes":["cpe:2.3:a:dompurify:dompurify:3.4.15:*:*:*:*:*:*:*"],"purl":"pkg:npm/dompurify@3.4.15","upstreams":[]}},{"vulnerability":{"id":"GHSA-c6gr-qvv4-5v3f","dataSource":"https://github.com/advisories/GHSA-c6gr-qvv4-5v3f","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/cure53/DOMPurify/security/advisories/GHSA-c6gr-qvv4-5v3f","https://github.com/cure53/DOMPurify/pull/1672","https://github.com/cure53/DOMPurify/commit/a77a3e78b59f72fa4d1c83f22e121ad9cc7d3575","https://github.com/cure53/DOMPurify/releases/tag/3.4.17"],"description":"DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml","cvss":[],"fix":{"versions":["3.4.17"],"state":"fixed","available":[{"version":"3.4.17","date":"2026-10-23","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"dompurify","version":"3.4.15"}},"found":{"vulnerabilityID":"GHSA-c6gr-qvv4-5v3f","versionConstraint":"<=3.4.16 (semantic)"},"fix":{"suggestedVersion":"3.4.17"}}],"artifact":{"id":"pkg:npm/dompurify@3.4.15?package-id=dc8c2e9341a25ff8","name":"dompurify","version":"3.4.15","type":"npm","locations":[{"path":"/web/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MPL-2.0 OR Apache-2.0"],"cpes":["cpe:2.3:a:dompurify:dompurify:3.4.15:*:*:*:*:*:*:*"],"purl":"pkg:npm/dompurify@3.4.15","upstreams":[]}},{"vulnerability":{"id":"GHSA-p98j-92pf-mc4p","dataSource":"https://github.com/advisories/GHSA-p98j-92pf-mc4p","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/cure53/DOMPurify/security/advisories/GHSA-p98j-92pf-mc4p","https://github.com/cure53/DOMPurify/pull/1636","https://github.com/cure53/DOMPurify/commit/b9b9d80f7e401771c2ccaef5f45def7eec8f27d7","https://github.com/cure53/DOMPurify/releases/tag/3.4.16"],"description":"DOMPurify: IN_PLACE: node-removing afterSanitize hook leaves detached subtree event handlers armed, causing DOM XSS","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":2.3},"vendorMetadata":{}}],"fix":{"versions":["3.4.16"],"state":"fixed","available":[{"version":"3.4.16","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"dompurify","version":"3.4.15"}},"found":{"vulnerabilityID":"GHSA-p98j-92pf-mc4p","versionConstraint":">=3.4.13,<=3.4.15 (semantic)"},"fix":{"suggestedVersion":"3.4.16"}}],"artifact":{"id":"pkg:npm/dompurify@3.4.15?package-id=dc8c2e9341a25ff8","name":"dompurify","version":"3.4.15","type":"npm","locations":[{"path":"/web/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MPL-2.0 OR Apache-2.0"],"cpes":["cpe:2.3:a:dompurify:dompurify:3.4.15:*:*:*:*:*:*:*"],"purl":"pkg:npm/dompurify@3.4.15","upstreams":[]}},{"vulnerability":{"id":"GHSA-xmj3-9gf7-h52w","dataSource":"https://github.com/advisories/GHSA-xmj3-9gf7-h52w","namespace":"github:language:python","severity":"Low","urls":["https://github.com/pypa/setuptools/security/advisories/GHSA-xmj3-9gf7-h52w","https://github.com/pypa/setuptools/pull/5329","https://github.com/pypa/setuptools/commit/6d07b8d17890dda58d944ac51e58f54af92d52af","https://github.com/pypa/setuptools/releases/tag/v84.1.0"],"description":"setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation  Description","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":1},"vendorMetadata":{}}],"fix":{"versions":["84.1.0"],"state":"fixed","available":[{"version":"84.1.0","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"setuptools","version":"84.0.0"}},"found":{"vulnerabilityID":"GHSA-xmj3-9gf7-h52w","versionConstraint":">=38.2.2,<84.1.0 (python)"},"fix":{"suggestedVersion":"84.1.0"}}],"artifact":{"id":"pkg:pypi/setuptools@84.0.0?package-id=51c8e2a0f39d9640","name":"setuptools","version":"84.0.0","type":"python","locations":[{"path":"/.github/requirements-nightly.txt","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python:setuptools:84.0.0:*:*:*:*:*:*:*"],"purl":"pkg:pypi/setuptools@84.0.0","upstreams":[]}}],"source":{"type":"file","target":"kubestellar/console"},"distro":{"name":"","version":"","idLike":null},"descriptor":{"name":"grype","version":"0.121.0","configuration":{"output":["json"],"file":"./grype.json","pretty":false,"distro":"","add-cpes-if-none":false,"output-template-file":"","check-for-app-update":true,"only-fixed":false,"only-notfixed":false,"ignore-wontfix":"","platform":"","search":{"scope":"squashed","unindexed-archives":false,"indexed-archives":true},"ignore":[{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"kernel-headers","version":"","language":"","type":"rpm","location":"","upstream-name":"kernel"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux(-.*)?-headers-.*","version":"","language":"","type":"deb","location":"","upstream-name":"linux.*"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux-libc-dev","version":"","language":"","type":"deb","location":"","upstream-name":"linux"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux-kbuild-.*","version":"","language":"","type":"deb","location":"","upstream-name":"linux.*"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"}],"exclude":[],"externalSources":{"enable":false,"maven":{"searchUpstreamBySha1":true,"baseUrl":"https://search.maven.org/solrsearch/select","rateLimit":300000000}},"match":{"java":{"using-cpes":false},"jvm":{"using-cpes":true},"dotnet":{"using-cpes":false},"golang":{"using-cpes":false,"always-use-cpe-for-stdlib":false,"allow-main-module-pseudo-version-comparison":false},"javascript":{"using-cpes":false},"python":{"using-cpes":false},"ruby":{"using-cpes":false},"rust":{"using-cpes":false},"hex":{"using-cpes":false},"stock":{"using-cpes":true},"dpkg":{"using-cpes":false,"missing-epoch-strategy":"zero","use-cpes-for-eol":false},"rpm":{"using-cpes":false,"missing-epoch-strategy":"auto","use-cpes-for-eol":false}},"fail-on-severity":"","registry":{"insecure-skip-tls-verify":false,"insecure-use-http":false,"ca-cert":""},"show-suppressed":false,"include-matcher-suppressions":false,"by-cve":false,"SortBy":{"sort-by":"risk"},"name":"","default-image-pull-source":"","from":null,"vex-documents":[],"vex-add":[],"match-upstream-kernel-headers":false,"fix-channel":{"redhat-eus":{"apply":"auto","versions":">= 8.0"},"ubuntu-esm":{"apply":"auto","versions":""}},"timestamp":true,"alerts":{"enable-eol-distro-warnings":true},"db":{"cache-dir":"$HOME/.cache/grype/db","update-url":"https://grype.anchore.io/databases","ca-cert":"","auto-update":true,"validate-by-hash-on-start":true,"validate-age":true,"max-allowed-built-age":432000000000000,"require-update-check":false,"update-available-timeout":30000000000,"update-download-timeout":300000000000,"max-update-check-frequency":7200000000000},"exp":{},"dev":{"db":{"debug":false}}},"db":{"status":{"schemaVersion":"v6.1.10","from":"https://grype.anchore.io/databases/v6/vulnerability-db_v6.1.10_2026-11-01T00:24:34Z_1793514012.tar.zst?checksum=sha256%3Ad0e1af9e6491440e1a671d0a0aafc32c5c7cb5cda787dcec3482799ef298f31c","built":"2026-11-01T06:20:12Z","path":"$HOME/.cache/grype/db/6/vulnerability.db","valid":true},"providers":{"alma":{"captured":"2026-11-01T00:24:39Z","input":"xxh64:d398731e6455b022"},"alpine":{"captured":"2026-11-01T00:24:47Z","input":"xxh64:c40c8985935df81b"},"amazon":{"captured":"2026-11-01T00:24:37Z","input":"xxh64:ee129200b14d5c8a"},"arch":{"captured":"2026-11-01T00:24:47Z","input":"xxh64:14f6c24dd6cd12c8"},"bitnami":{"captured":"2026-11-01T00:24:34Z","input":"xxh64:971619846357ae10"},"chainguard":{"captured":"2026-11-01T00:24:48Z","input":"xxh64:dfbf78c7fc58a603"},"chainguard-libraries":{"captured":"2026-11-01T00:24:50Z","input":"xxh64:db9c34dd1b7bc8d0"},"debian":{"captured":"2026-11-01T00:24:52Z","input":"xxh64:078c82a49c8cb529"},"echo":{"captured":"2026-11-01T00:24:41Z","input":"xxh64:1d0df98736854a48"},"eol":{"captured":"2026-11-01T00:24:59Z","input":"xxh64:0f2164b3e62ba44b"},"epss":{"captured":"2026-11-01T00:25:00Z","input":"xxh64:0d4c3b8d2c2e5188"},"fedora":{"captured":"2026-11-01T00:24:40Z","input":"xxh64:28fe3d1d8ae41f9b"},"github":{"captured":"2026-11-01T00:24:57Z","input":"xxh64:076a86d2dc5c9e83"},"govulndb":{"captured":"2026-11-01T00:24:45Z","input":"xxh64:56e169604e12196e"},"hummingbird":{"captured":"2026-11-01T00:27:26Z","input":"xxh64:e86abd0466410fb6"},"kev":{"captured":"2026-11-01T00:25:06Z","input":"xxh64:cb0f4041bd51c379"},"mariner":{"captured":"2026-11-01T00:24:56Z","input":"xxh64:003337efdc7e1888"},"minimos":{"captured":"2026-11-01T00:24:56Z","input":"xxh64:219c30ffded7a12c"},"nvd":{"captured":"2026-11-01T00:25:41Z","input":"xxh64:75e41eec415fdb0a"},"oracle":{"captured":"2026-11-01T00:24:42Z","input":"xxh64:0546c2dd11a85c07"},"photon":{"captured":"2026-11-01T00:24:37Z","input":"xxh64:8dbfd0c521fd470a"},"rhel":{"captured":"2026-11-01T01:08:40Z","input":"xxh64:57c5e6a7f9f134ff"},"secureos":{"captured":"2026-11-01T00:24:34Z","input":"xxh64:ac7fa7f44e8ed7dd"},"sles":{"captured":"2026-11-01T00:26:56Z","input":"xxh64:025a1565b2cc7cdf"},"ubuntu":{"captured":"2026-11-01T00:25:58Z","input":"xxh64:9ab4d29f0ea6275d"},"wolfi":{"captured":"2026-11-01T00:25:02Z","input":"xxh64:d27b08e998baab8e"}}},"timestamp":"2026-11-02T03:07:32.088192152Z"}}