{"matches":[{"vulnerability":{"id":"GHSA-pjwm-pj3p-43mv","dataSource":"https://github.com/advisories/GHSA-pjwm-pj3p-43mv","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-pjwm-pj3p-43mv","https://nvd.nist.gov/vuln/detail/CVE-2025-62718","https://nvd.nist.gov/vuln/detail/CVE-2026-44492","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44492.json","https://bugzilla.redhat.com/show_bug.cgi?id=2487938","https://access.redhat.com/security/cve/CVE-2026-44492","https://access.redhat.com/errata/RHSA-2026:36108","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:33183","https://access.redhat.com/errata/RHSA-2026:33173","https://access.redhat.com/errata/RHSA-2026:33163","https://access.redhat.com/errata/RHSA-2026:33160","https://access.redhat.com/errata/RHSA-2026:33155","https://access.redhat.com/errata/RHSA-2026:33005","https://access.redhat.com/errata/RHSA-2026:30651","https://access.redhat.com/errata/RHSA-2026:30650","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:29082","https://access.redhat.com/errata/RHSA-2026:28964","https://access.redhat.com/errata/RHSA-2026:27063","https://access.redhat.com/errata/RHSA-2026:27044","https://access.redhat.com/errata/RHSA-2026:26234","https://access.redhat.com/errata/RHSA-2026:20938","https://access.redhat.com/errata/RHSA-2026:20889","https://access.redhat.com/errata/RHSA-2026:36883","https://access.redhat.com/errata/RHSA-2026:36882","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:36754","https://access.redhat.com/errata/RHSA-2026:34766","https://access.redhat.com/errata/RHSA-2026:36611","https://access.redhat.com/errata/RHSA-2026:40119","https://access.redhat.com/errata/RHSA-2026:40138","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:41055","https://access.redhat.com/errata/RHSA-2026:41064"],"description":"axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","metrics":{"baseScore":8.6,"exploitabilityScore":3.9,"impactScore":4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44492","epss":0.1228,"percentile":0.96184,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44492","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-44492","cwe":"CWE-289","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["0.32.0"],"state":"fixed","available":[{"version":"0.32.0","date":"2026-05-29","kind":"first-observed"}]},"advisories":[],"risk":9.8854},"relatedVulnerabilities":[{"id":"CVE-2026-44492","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44492","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-pjwm-pj3p-43mv","https://access.redhat.com/errata/RHSA-2026:20889","https://access.redhat.com/errata/RHSA-2026:20938","https://access.redhat.com/errata/RHSA-2026:27044","https://access.redhat.com/errata/RHSA-2026:27063","https://access.redhat.com/errata/RHSA-2026:28964","https://access.redhat.com/errata/RHSA-2026:29082","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:30650","https://access.redhat.com/errata/RHSA-2026:30651","https://access.redhat.com/errata/RHSA-2026:33005","https://access.redhat.com/errata/RHSA-2026:33155","https://access.redhat.com/errata/RHSA-2026:33160","https://access.redhat.com/errata/RHSA-2026:33163","https://access.redhat.com/errata/RHSA-2026:33173","https://access.redhat.com/errata/RHSA-2026:33183","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:34766","https://access.redhat.com/errata/RHSA-2026:36108","https://access.redhat.com/errata/RHSA-2026:36611","https://access.redhat.com/errata/RHSA-2026:36754","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:36882","https://access.redhat.com/errata/RHSA-2026:36883","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41055","https://access.redhat.com/errata/RHSA-2026:41064","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:42078","https://access.redhat.com/errata/RHSA-2026:42085","https://access.redhat.com/errata/RHSA-2026:42142","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:46885","https://access.redhat.com/errata/RHSA-2026:46903","https://access.redhat.com/errata/RHSA-2026:50300","https://access.redhat.com/errata/RHSA-2026:54188","https://access.redhat.com/errata/RHSA-2026:57191","https://access.redhat.com/errata/RHSA-2026:59833","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-44492","https://bugzilla.redhat.com/show_bug.cgi?id=2487938","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44492.json"],"description":"Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios does not normalise IPv4-mapped IPv6 addresses. When NO_PROXY lists an IPv4 address such as 127.0.0.1 or 169.254.169.254, a request URL using the IPv4-mapped IPv6 form (::ffff:7f00:1, ::ffff:a9fe:a9fe) still routes through the configured proxy. Node.js resolves these addresses to the underlying IPv4 host, so the request reaches the internal service via the proxy rather than being blocked. This vulnerability is fixed in 0.32.0 and 1.16.0.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","metrics":{"baseScore":8.6,"exploitabilityScore":3.9,"impactScore":4},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","metrics":{"baseScore":8.6,"exploitabilityScore":3.9,"impactScore":4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44492","epss":0.1228,"percentile":0.96184,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44492","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-44492","cwe":"CWE-289","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"0.25.0"}},"found":{"vulnerabilityID":"GHSA-pjwm-pj3p-43mv","versionConstraint":"<=0.31.1 (semantic)"},"fix":{"suggestedVersion":"0.32.0"}}],"artifact":{"id":"pkg:npm/axios@0.25.0?package-id=f91bce3cf8a711bf","name":"axios","version":"0.25.0","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:axios:axios:0.25.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@0.25.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-hfxv-24rg-xrqf","dataSource":"https://github.com/advisories/GHSA-hfxv-24rg-xrqf","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-hfxv-24rg-xrqf","https://github.com/axios/axios/releases/tag/v0.32.0","https://github.com/axios/axios/releases/tag/v1.16.0"],"description":"Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44496","epss":0.05405,"percentile":0.92685,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44496","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-44496","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-44496","cwe":"CWE-1333","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["0.32.0"],"state":"fixed","available":[{"version":"0.32.0","date":"2026-06-04","kind":"first-observed"}]},"advisories":[],"risk":4.053750000000001},"relatedVulnerabilities":[{"id":"CVE-2026-44496","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44496","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-hfxv-24rg-xrqf","https://access.redhat.com/errata/RHSA-2026:20889","https://access.redhat.com/errata/RHSA-2026:20938","https://access.redhat.com/errata/RHSA-2026:27044","https://access.redhat.com/errata/RHSA-2026:27063","https://access.redhat.com/errata/RHSA-2026:28571","https://access.redhat.com/errata/RHSA-2026:28964","https://access.redhat.com/errata/RHSA-2026:29082","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:30076","https://access.redhat.com/errata/RHSA-2026:30650","https://access.redhat.com/errata/RHSA-2026:30651","https://access.redhat.com/errata/RHSA-2026:33155","https://access.redhat.com/errata/RHSA-2026:33160","https://access.redhat.com/errata/RHSA-2026:33163","https://access.redhat.com/errata/RHSA-2026:33173","https://access.redhat.com/errata/RHSA-2026:33183","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:33683","https://access.redhat.com/errata/RHSA-2026:34766","https://access.redhat.com/errata/RHSA-2026:36611","https://access.redhat.com/errata/RHSA-2026:36754","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:36882","https://access.redhat.com/errata/RHSA-2026:36883","https://access.redhat.com/errata/RHSA-2026:41055","https://access.redhat.com/errata/RHSA-2026:41064","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:42078","https://access.redhat.com/errata/RHSA-2026:42085","https://access.redhat.com/errata/RHSA-2026:42142","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:46885","https://access.redhat.com/errata/RHSA-2026:46903","https://access.redhat.com/errata/RHSA-2026:50300","https://access.redhat.com/errata/RHSA-2026:56789","https://access.redhat.com/errata/RHSA-2026:57191","https://access.redhat.com/errata/RHSA-2026:59360","https://access.redhat.com/errata/RHSA-2026:59833","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-44496","https://bugzilla.redhat.com/show_bug.cgi?id=2487943","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44496.json"],"description":"Axios is a promise based HTTP client for the browser and Node.js. Axios versions before 0.32.0 on the 0.x line and before 1.16.0 on the 1.x line build a regular expression from the configured XSRF cookie name without escaping regex metacharacters. In standard browser environments, an attacker who can influence the cookie name passed to axios can cause expensive regex backtracking while axios reads document.cookie. The practical impact is client-side availability degradation, such as freezing the affected browser tab while axios prepares a request. The issue does not affect ordinary Node.js HTTP adapter usage, React Native, or web workers, where axios does not read document.cookie. This vulnerability is fixed in 0.32.0 and 1.16.0.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44496","epss":0.05405,"percentile":0.92685,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44496","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-44496","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-44496","cwe":"CWE-1333","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"0.25.0"}},"found":{"vulnerabilityID":"GHSA-hfxv-24rg-xrqf","versionConstraint":"<=0.31.1 (semantic)"},"fix":{"suggestedVersion":"0.32.0"}}],"artifact":{"id":"pkg:npm/axios@0.25.0?package-id=f91bce3cf8a711bf","name":"axios","version":"0.25.0","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:axios:axios:0.25.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@0.25.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-w5p7-h5w8-2hfq","dataSource":"https://github.com/advisories/GHSA-w5p7-h5w8-2hfq","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-7753","https://github.com/component/trim/pull/8","https://github.com/component/trim/blob/master/index.js","https://github.com/component/trim/blob/master/index.js%23L6","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1022132","https://snyk.io/vuln/SNYK-JS-TRIM-1017038","https://lists.apache.org/thread.html/r10faad1ef9166d37a1a5c9142b1af7099b8ecdc5ad05c51b8ea993d9@%3Ccommits.airflow.apache.org%3E","https://lists.apache.org/thread.html/r51ff3c2a4c7b8402f321eae7e624672cc2295c7bc8c12c8b871f6b0b@%3Ccommits.airflow.apache.org%3E","https://lists.apache.org/thread.html/r75b8d0b88833d7d96afcdce3ead65e212572ead4e7a9f34d21040196@%3Ccommits.airflow.apache.org%3E","https://lists.apache.org/thread.html/rb8462df3b6484e778905c09cd49a8912e1a302659860017ebe36da03@%3Ccommits.airflow.apache.org%3E","https://lists.apache.org/thread.html/rcc7c2865a52b544a8e49386c6880e9b9ab29bfce1052b5569d09ee4a@%3Ccommits.airflow.apache.org%3E"],"description":"Regular Expression Denial of Service in trim","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-7753","epss":0.03777,"percentile":0.89945,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-7753","cwe":"CWE-400","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["0.0.3"],"state":"fixed","available":[{"version":"0.0.3","date":"2021-05-12","kind":"first-observed"}]},"advisories":[],"risk":2.83275},"relatedVulnerabilities":[{"id":"CVE-2020-7753","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-7753","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/component/trim/blob/master/index.js%23L6","https://lists.apache.org/thread.html/r10faad1ef9166d37a1a5c9142b1af7099b8ecdc5ad05c51b8ea993d9%40%3Ccommits.airflow.apache.org%3E","https://lists.apache.org/thread.html/r51ff3c2a4c7b8402f321eae7e624672cc2295c7bc8c12c8b871f6b0b%40%3Ccommits.airflow.apache.org%3E","https://lists.apache.org/thread.html/r75b8d0b88833d7d96afcdce3ead65e212572ead4e7a9f34d21040196%40%3Ccommits.airflow.apache.org%3E","https://lists.apache.org/thread.html/rb8462df3b6484e778905c09cd49a8912e1a302659860017ebe36da03%40%3Ccommits.airflow.apache.org%3E","https://lists.apache.org/thread.html/rcc7c2865a52b544a8e49386c6880e9b9ab29bfce1052b5569d09ee4a%40%3Ccommits.airflow.apache.org%3E","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1022132","https://snyk.io/vuln/SNYK-JS-TRIM-1017038"],"description":"All versions of package trim are vulnerable to Regular Expression Denial of Service (ReDoS) via trim().","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-7753","epss":0.03777,"percentile":0.89945,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-7753","cwe":"CWE-400","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"trim","version":"0.0.1"}},"found":{"vulnerabilityID":"GHSA-w5p7-h5w8-2hfq","versionConstraint":"<0.0.3 (semantic)"},"fix":{"suggestedVersion":"0.0.3"}}],"artifact":{"id":"pkg:npm/trim@0.0.1?package-id=f9198dad98149f93","name":"trim","version":"0.0.1","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:trim:trim:0.0.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/trim@0.0.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-43fc-jf86-j433","dataSource":"https://github.com/advisories/GHSA-43fc-jf86-j433","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-43fc-jf86-j433","https://github.com/axios/axios/pull/7369","https://github.com/axios/axios/commit/28c721588c7a77e7503d0a434e016f852c597b57","https://github.com/axios/axios/releases/tag/v1.13.5","https://nvd.nist.gov/vuln/detail/CVE-2026-25639","https://github.com/axios/axios/pull/7388","https://github.com/axios/axios/commit/d7ff1409c68168d3057fc3891f911b2b92616f9e","https://github.com/axios/axios/releases/tag/v0.30.3"],"description":"Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-25639","epss":0.02799,"percentile":0.86462,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-25639","cwe":"CWE-754","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-25639","cwe":"CWE-1287","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["0.30.3"],"state":"fixed","available":[{"version":"0.30.3","date":"2026-03-04","kind":"first-observed"}]},"advisories":[],"risk":2.09925},"relatedVulnerabilities":[{"id":"CVE-2026-25639","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25639","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/axios/axios/commit/28c721588c7a77e7503d0a434e016f852c597b57","https://github.com/axios/axios/commit/d7ff1409c68168d3057fc3891f911b2b92616f9e","https://github.com/axios/axios/pull/7369","https://github.com/axios/axios/pull/7388","https://github.com/axios/axios/releases/tag/v0.30.3","https://github.com/axios/axios/releases/tag/v1.13.5","https://github.com/axios/axios/security/advisories/GHSA-43fc-jf86-j433","https://access.redhat.com/errata/RHSA-2026:10184","https://access.redhat.com/errata/RHSA-2026:11414","https://access.redhat.com/errata/RHSA-2026:13542","https://access.redhat.com/errata/RHSA-2026:13548","https://access.redhat.com/errata/RHSA-2026:19712","https://access.redhat.com/errata/RHSA-2026:25041","https://access.redhat.com/errata/RHSA-2026:2694","https://access.redhat.com/errata/RHSA-2026:3087","https://access.redhat.com/errata/RHSA-2026:3105","https://access.redhat.com/errata/RHSA-2026:3106","https://access.redhat.com/errata/RHSA-2026:3107","https://access.redhat.com/errata/RHSA-2026:3109","https://access.redhat.com/errata/RHSA-2026:36882","https://access.redhat.com/errata/RHSA-2026:41064","https://access.redhat.com/errata/RHSA-2026:4942","https://access.redhat.com/errata/RHSA-2026:5142","https://access.redhat.com/errata/RHSA-2026:5168","https://access.redhat.com/errata/RHSA-2026:5174","https://access.redhat.com/errata/RHSA-2026:5633","https://access.redhat.com/errata/RHSA-2026:5636","https://access.redhat.com/errata/RHSA-2026:5665","https://access.redhat.com/errata/RHSA-2026:5807","https://access.redhat.com/errata/RHSA-2026:6170","https://access.redhat.com/errata/RHSA-2026:6174","https://access.redhat.com/errata/RHSA-2026:6192","https://access.redhat.com/errata/RHSA-2026:6277","https://access.redhat.com/errata/RHSA-2026:6308","https://access.redhat.com/errata/RHSA-2026:6309","https://access.redhat.com/errata/RHSA-2026:6428","https://access.redhat.com/errata/RHSA-2026:6497","https://access.redhat.com/errata/RHSA-2026:6567","https://access.redhat.com/errata/RHSA-2026:6568","https://access.redhat.com/errata/RHSA-2026:6802","https://access.redhat.com/errata/RHSA-2026:7249","https://access.redhat.com/errata/RHSA-2026:8218","https://access.redhat.com/errata/RHSA-2026:8229","https://access.redhat.com/errata/RHSA-2026:8499","https://access.redhat.com/errata/RHSA-2026:8500","https://access.redhat.com/errata/RHSA-2026:8501","https://access.redhat.com/errata/RHSA-2026:9848","https://access.redhat.com/security/cve/CVE-2026-25639","https://bugzilla.redhat.com/show_bug.cgi?id=2438237","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25639.json"],"description":"Axios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can trigger this by providing a malicious configuration object created via JSON.parse(), causing complete denial of service. This vulnerability is fixed in versions 0.30.3 and 1.13.5.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-25639","epss":0.02799,"percentile":0.86462,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-25639","cwe":"CWE-754","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-25639","cwe":"CWE-1287","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"0.25.0"}},"found":{"vulnerabilityID":"GHSA-43fc-jf86-j433","versionConstraint":"<=0.30.2 (semantic)"},"fix":{"suggestedVersion":"0.30.3"}}],"artifact":{"id":"pkg:npm/axios@0.25.0?package-id=f91bce3cf8a711bf","name":"axios","version":"0.25.0","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:axios:axios:0.25.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@0.25.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-hhq3-ff78-jv3g","dataSource":"https://github.com/advisories/GHSA-hhq3-ff78-jv3g","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-37599","https://github.com/webpack/loader-utils/issues/211","https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/interpolateName.js#L38","https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/interpolateName.js#L83","https://github.com/webpack/loader-utils/issues/216","https://github.com/webpack/loader-utils/commit/17cbf8fa8989c1cb45bdd2997aa524729475f1fa","https://github.com/webpack/loader-utils/commit/ac09944dfacd7c4497ef692894b09e63e09a5eeb","https://github.com/webpack/loader-utils/commit/d2d752d59629daee38f34b24307221349c490eb1","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3HUE6ZR5SL73KHL7XUPAOEL6SB7HUDT2","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6PVVPNSAGSDS63HQ74PJ7MZ3MU5IYNVZ","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6PVVPNSAGSDS63HQ74PJ7MZ3MU5IYNVZ"],"description":"loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-37599","epss":0.02761,"percentile":0.86274,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-37599","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["3.2.1"],"state":"fixed","available":[{"version":"3.2.1","date":"2022-11-16","kind":"first-observed"}]},"advisories":[],"risk":2.07075},"relatedVulnerabilities":[{"id":"CVE-2022-37599","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-37599","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/interpolateName.js#L38","https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/interpolateName.js#L83","https://github.com/webpack/loader-utils/issues/211","https://github.com/webpack/loader-utils/issues/216","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3HUE6ZR5SL73KHL7XUPAOEL6SB7HUDT2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6PVVPNSAGSDS63HQ74PJ7MZ3MU5IYNVZ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6PVVPNSAGSDS63HQ74PJ7MZ3MU5IYNVZ/"],"description":"A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the resourcePath variable in interpolateName.js.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-37599","epss":0.02761,"percentile":0.86274,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-37599","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"loader-utils","version":"3.2.0"}},"found":{"vulnerabilityID":"GHSA-hhq3-ff78-jv3g","versionConstraint":">=3.0.0,<3.2.1 (semantic)"},"fix":{"suggestedVersion":"3.2.1"}}],"artifact":{"id":"pkg:npm/loader-utils@3.2.0?package-id=8b95be9c47efef1b","name":"loader-utils","version":"3.2.0","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:loader-utils:loader-utils:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:loader-utils:loader_utils:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:loader_utils:loader-utils:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:loader_utils:loader_utils:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:loader:loader-utils:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:loader:loader_utils:3.2.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/loader-utils@3.2.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-c2qf-rxjj-qqgw","dataSource":"https://github.com/advisories/GHSA-c2qf-rxjj-qqgw","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-25883","https://github.com/npm/node-semver/pull/564","https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441","https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795","https://github.com/npm/node-semver/blob/main/classes/range.js#L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js#L138","https://github.com/npm/node-semver/blob/main/internal/re.js#L160","https://github.com/npm/node-semver/pull/585","https://github.com/npm/node-semver/commit/928e56d21150da0413a3333a3148b20e741a920c","https://github.com/npm/node-semver/pull/593","https://github.com/npm/node-semver/commit/2f8fd41487acf380194579ecb6f8b1bbfe116be0","https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js%23L138","https://github.com/npm/node-semver/blob/main/internal/re.js%23L160","https://security.netapp.com/advisory/ntap-20241025-0004"],"description":"semver vulnerable to Regular Expression Denial of Service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-25883","epss":0.02761,"percentile":0.86272,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["7.5.2"],"state":"fixed","available":[{"version":"7.5.2","date":"2023-06-23","kind":"first-observed"}]},"advisories":[],"risk":2.07075},"relatedVulnerabilities":[{"id":"CVE-2022-25883","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-25883","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js%23L138","https://github.com/npm/node-semver/blob/main/internal/re.js%23L160","https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441","https://github.com/npm/node-semver/pull/564","https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795","https://security.netapp.com/advisory/ntap-20241025-0004/"],"description":"Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-25883","epss":0.02761,"percentile":0.86272,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"semver","version":"7.0.0"}},"found":{"vulnerabilityID":"GHSA-c2qf-rxjj-qqgw","versionConstraint":">=7.0.0,<7.5.2 (semantic)"},"fix":{"suggestedVersion":"7.5.2"}}],"artifact":{"id":"pkg:npm/semver@7.0.0?package-id=165a25e30b452ac4","name":"semver","version":"7.0.0","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:npmjs:semver:7.0.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/semver@7.0.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-3rfm-jhwj-7488","dataSource":"https://github.com/advisories/GHSA-3rfm-jhwj-7488","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-37603","https://github.com/webpack/loader-utils/issues/213","https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/interpolateName.js#L107","https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/interpolateName.js#L38","https://github.com/webpack/loader-utils/issues/216","https://github.com/webpack/loader-utils/commit/17cbf8fa8989c1cb45bdd2997aa524729475f1fa","https://github.com/webpack/loader-utils/commit/ac09944dfacd7c4497ef692894b09e63e09a5eeb","https://github.com/webpack/loader-utils/commit/d2d752d59629daee38f34b24307221349c490eb1","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ERN6YE3DS7NBW7UH44SCJBMNC2NWQ7SM/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KAC5KQ2SEWAMQ6UZAUBZ5KXKEOESH375/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VNV2GNZXOTEDAJRFH3ZYWRUBGIVL7BSU/"],"description":"loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS) via url variable","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-37603","epss":0.02702,"percentile":0.8594,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-37603","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-37603","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["3.2.1"],"state":"fixed","available":[{"version":"3.2.1","date":"2022-11-16","kind":"first-observed"}]},"advisories":[],"risk":2.0265},"relatedVulnerabilities":[{"id":"CVE-2022-37603","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-37603","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/interpolateName.js#L107","https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/interpolateName.js#L38","https://github.com/webpack/loader-utils/issues/213","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ERN6YE3DS7NBW7UH44SCJBMNC2NWQ7SM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KAC5KQ2SEWAMQ6UZAUBZ5KXKEOESH375/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VNV2GNZXOTEDAJRFH3ZYWRUBGIVL7BSU/"],"description":"A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-37603","epss":0.02702,"percentile":0.8594,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-37603","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-37603","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"loader-utils","version":"3.2.0"}},"found":{"vulnerabilityID":"GHSA-3rfm-jhwj-7488","versionConstraint":">=3.0.0,<3.2.1 (semantic)"},"fix":{"suggestedVersion":"3.2.1"}}],"artifact":{"id":"pkg:npm/loader-utils@3.2.0?package-id=8b95be9c47efef1b","name":"loader-utils","version":"3.2.0","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:loader-utils:loader-utils:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:loader-utils:loader_utils:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:loader_utils:loader-utils:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:loader_utils:loader_utils:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:loader:loader-utils:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:loader:loader_utils:3.2.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/loader-utils@3.2.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-f8q6-p94x-37v3","dataSource":"https://github.com/advisories/GHSA-f8q6-p94x-37v3","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-3517","https://github.com/grafana/grafana-image-renderer/issues/329","https://github.com/isaacs/minimatch/commit/a8763f4388e51956be62dc6025cec1126beeb5e6","https://github.com/nodejs/node/issues/42510","https://lists.debian.org/debian-lts-announce/2023/01/msg00011.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MTEUUTNIEBHGKUKKLNUZSV7IEP6IP3Q3","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UM6XJ73Q3NAM5KSGCOKJ2ZIA6GUWUJLK"],"description":"minimatch ReDoS vulnerability","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-3517","epss":0.02279,"percentile":0.83128,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-3517","cwe":"CWE-400","source":"secalert@redhat.com","type":"Secondary"},{"cve":"CVE-2022-3517","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["3.0.5"],"state":"fixed","available":[{"version":"3.0.5","date":"2022-10-21","kind":"first-observed"}]},"advisories":[],"risk":1.70925},"relatedVulnerabilities":[{"id":"CVE-2022-3517","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-3517","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/grafana/grafana-image-renderer/issues/329","https://github.com/isaacs/minimatch/commit/a8763f4388e51956be62dc6025cec1126beeb5e6","https://lists.debian.org/debian-lts-announce/2023/01/msg00011.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTEUUTNIEBHGKUKKLNUZSV7IEP6IP3Q3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UM6XJ73Q3NAM5KSGCOKJ2ZIA6GUWUJLK/"],"description":"A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-3517","epss":0.02279,"percentile":0.83128,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-3517","cwe":"CWE-400","source":"secalert@redhat.com","type":"Secondary"},{"cve":"CVE-2022-3517","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.0.4"}},"found":{"vulnerabilityID":"GHSA-f8q6-p94x-37v3","versionConstraint":"<3.0.5 (semantic)"},"fix":{"suggestedVersion":"3.0.5"}}],"artifact":{"id":"pkg:npm/minimatch@3.0.4?package-id=4657685090d0c0b4","name":"minimatch","version":"3.0.4","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.0.4:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.0.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-pfrx-2q88-qq97","dataSource":"https://github.com/advisories/GHSA-pfrx-2q88-qq97","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-33987","https://github.com/sindresorhus/got/pull/2047","https://github.com/sindresorhus/got/compare/v12.0.3...v12.1.0","https://github.com/sindresorhus/got/commit/861ccd9ac2237df762a9e2beed7edd88c60782dc","https://github.com/sindresorhus/got/releases/tag/v11.8.5","https://github.com/sindresorhus/got/releases/tag/v12.1.0"],"description":"Got allows a redirect to a UNIX socket","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-33987","epss":0.02416,"percentile":0.84145,"date":"2026-10-31"}],"fix":{"versions":["11.8.5"],"state":"fixed","available":[{"version":"11.8.5","date":"2022-06-22","kind":"first-observed"}]},"advisories":[],"risk":1.24424},"relatedVulnerabilities":[{"id":"CVE-2022-33987","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-33987","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/sindresorhus/got/compare/v12.0.3...v12.1.0","https://github.com/sindresorhus/got/pull/2047","https://github.com/sindresorhus/got/releases/tag/v11.8.5"],"description":"The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-33987","epss":0.02416,"percentile":0.84145,"date":"2026-10-31"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"got","version":"9.6.0"}},"found":{"vulnerabilityID":"GHSA-pfrx-2q88-qq97","versionConstraint":"<11.8.5 (semantic)"},"fix":{"suggestedVersion":"11.8.5"}}],"artifact":{"id":"pkg:npm/got@9.6.0?package-id=dc6615325dc56e61","name":"got","version":"9.6.0","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:got:got:9.6.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/got@9.6.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-96hv-2xvq-fx4p","dataSource":"https://github.com/advisories/GHSA-96hv-2xvq-fx4p","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/websockets/ws/security/advisories/GHSA-96hv-2xvq-fx4p","https://github.com/websockets/ws/commit/86d3e8a5fb0246ed373860c5fbb0de88824a27f7","https://github.com/websockets/ws/commit/b5372ac67bb97a773727b8e9f5035a8123556d53","https://github.com/websockets/ws/commit/bca91adf15677e47dbe4f959653452727be28b94","https://github.com/websockets/ws/commit/fd36cd864fcdf62a08273a99e19a7d975401fee8","https://nvd.nist.gov/vuln/detail/CVE-2026-48779","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48779.json","https://bugzilla.redhat.com/show_bug.cgi?id=2489661","https://access.redhat.com/security/cve/CVE-2026-48779","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:33183","https://access.redhat.com/errata/RHSA-2026:33173","https://access.redhat.com/errata/RHSA-2026:33163","https://access.redhat.com/errata/RHSA-2026:33160","https://access.redhat.com/errata/RHSA-2026:33155","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:36754","https://access.redhat.com/errata/RHSA-2026:37272","https://access.redhat.com/errata/RHSA-2026:27171","https://access.redhat.com/errata/RHSA-2026:26638"],"description":"ws: Memory exhaustion DoS from tiny fragments and data chunks","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-48779","epss":0.01426,"percentile":0.72944,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-48779","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-48779","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-48779","cwe":"CWE-1050","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["7.5.11"],"state":"fixed","available":[{"version":"7.5.11","date":"2026-06-15","kind":"first-observed"}]},"advisories":[],"risk":1.0695},"relatedVulnerabilities":[{"id":"CVE-2026-48779","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48779","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/websockets/ws/commit/86d3e8a5fb0246ed373860c5fbb0de88824a27f7","https://github.com/websockets/ws/commit/b5372ac67bb97a773727b8e9f5035a8123556d53","https://github.com/websockets/ws/commit/bca91adf15677e47dbe4f959653452727be28b94","https://github.com/websockets/ws/commit/fd36cd864fcdf62a08273a99e19a7d975401fee8","https://github.com/websockets/ws/security/advisories/GHSA-96hv-2xvq-fx4p","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:33155","https://access.redhat.com/errata/RHSA-2026:33160","https://access.redhat.com/errata/RHSA-2026:33163","https://access.redhat.com/errata/RHSA-2026:33173","https://access.redhat.com/errata/RHSA-2026:33183","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:36754","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37272","https://access.redhat.com/errata/RHSA-2026:40984","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41941","https://access.redhat.com/errata/RHSA-2026:41944","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:56366","https://access.redhat.com/errata/RHSA-2026:56431","https://access.redhat.com/errata/RHSA-2026:57013","https://access.redhat.com/errata/RHSA-2026:57590","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-48779","https://bugzilla.redhat.com/show_bug.cgi?id=2489661","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48779.json"],"description":"ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer can send a high volume of exceptionally small fragments and data chunks, with modest network traffic, to force the remote peer into allocating and holding structural wrappers that consume far more memory than the default documented message-size limit, leading to process termination due to OOM. This issue has been fixed in versions 5.2.5, 6.2.4, 7.5.11, and 8.21.0.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-48779","epss":0.01426,"percentile":0.72944,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-48779","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-48779","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-48779","cwe":"CWE-1050","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"ws","version":"7.5.10"}},"found":{"vulnerabilityID":"GHSA-96hv-2xvq-fx4p","versionConstraint":">=7.0.0,<7.5.11 (semantic)"},"fix":{"suggestedVersion":"7.5.11"}}],"artifact":{"id":"pkg:npm/ws@7.5.10?package-id=87bec23dea3ebc6c","name":"ws","version":"7.5.10","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:ws_project:ws:7.5.10:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/ws@7.5.10","upstreams":[]}},{"vulnerability":{"id":"GHSA-96hv-2xvq-fx4p","dataSource":"https://github.com/advisories/GHSA-96hv-2xvq-fx4p","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/websockets/ws/security/advisories/GHSA-96hv-2xvq-fx4p","https://github.com/websockets/ws/commit/86d3e8a5fb0246ed373860c5fbb0de88824a27f7","https://github.com/websockets/ws/commit/b5372ac67bb97a773727b8e9f5035a8123556d53","https://github.com/websockets/ws/commit/bca91adf15677e47dbe4f959653452727be28b94","https://github.com/websockets/ws/commit/fd36cd864fcdf62a08273a99e19a7d975401fee8","https://nvd.nist.gov/vuln/detail/CVE-2026-48779","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48779.json","https://bugzilla.redhat.com/show_bug.cgi?id=2489661","https://access.redhat.com/security/cve/CVE-2026-48779","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:33183","https://access.redhat.com/errata/RHSA-2026:33173","https://access.redhat.com/errata/RHSA-2026:33163","https://access.redhat.com/errata/RHSA-2026:33160","https://access.redhat.com/errata/RHSA-2026:33155","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:36754","https://access.redhat.com/errata/RHSA-2026:37272","https://access.redhat.com/errata/RHSA-2026:27171","https://access.redhat.com/errata/RHSA-2026:26638"],"description":"ws: Memory exhaustion DoS from tiny fragments and data chunks","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-48779","epss":0.01426,"percentile":0.72944,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-48779","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-48779","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-48779","cwe":"CWE-1050","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["8.21.0"],"state":"fixed","available":[{"version":"8.21.0","date":"2026-06-15","kind":"first-observed"}]},"advisories":[],"risk":1.0695},"relatedVulnerabilities":[{"id":"CVE-2026-48779","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48779","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/websockets/ws/commit/86d3e8a5fb0246ed373860c5fbb0de88824a27f7","https://github.com/websockets/ws/commit/b5372ac67bb97a773727b8e9f5035a8123556d53","https://github.com/websockets/ws/commit/bca91adf15677e47dbe4f959653452727be28b94","https://github.com/websockets/ws/commit/fd36cd864fcdf62a08273a99e19a7d975401fee8","https://github.com/websockets/ws/security/advisories/GHSA-96hv-2xvq-fx4p","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:33155","https://access.redhat.com/errata/RHSA-2026:33160","https://access.redhat.com/errata/RHSA-2026:33163","https://access.redhat.com/errata/RHSA-2026:33173","https://access.redhat.com/errata/RHSA-2026:33183","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:36754","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37272","https://access.redhat.com/errata/RHSA-2026:40984","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41941","https://access.redhat.com/errata/RHSA-2026:41944","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:56366","https://access.redhat.com/errata/RHSA-2026:56431","https://access.redhat.com/errata/RHSA-2026:57013","https://access.redhat.com/errata/RHSA-2026:57590","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-48779","https://bugzilla.redhat.com/show_bug.cgi?id=2489661","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48779.json"],"description":"ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer can send a high volume of exceptionally small fragments and data chunks, with modest network traffic, to force the remote peer into allocating and holding structural wrappers that consume far more memory than the default documented message-size limit, leading to process termination due to OOM. This issue has been fixed in versions 5.2.5, 6.2.4, 7.5.11, and 8.21.0.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-48779","epss":0.01426,"percentile":0.72944,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-48779","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-48779","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-48779","cwe":"CWE-1050","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"ws","version":"8.17.1"}},"found":{"vulnerabilityID":"GHSA-96hv-2xvq-fx4p","versionConstraint":">=8.0.0,<8.21.0 (semantic)"},"fix":{"suggestedVersion":"8.21.0"}}],"artifact":{"id":"pkg:npm/ws@8.17.1?package-id=e26dff1a6e55924f","name":"ws","version":"8.17.1","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:ws_project:ws:8.17.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/ws@8.17.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-fvcv-3m26-pcqx","dataSource":"https://github.com/advisories/GHSA-fvcv-3m26-pcqx","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-fvcv-3m26-pcqx","https://github.com/axios/axios/commit/363185461b90b1b78845dc8a99a1f103d9b122a1","https://github.com/axios/axios/releases/tag/v1.15.0","https://nvd.nist.gov/vuln/detail/CVE-2026-40175","https://github.com/axios/axios/pull/10660","https://github.com/axios/axios/pull/10660#issuecomment-4224168081","https://github.com/axios/axios/pull/10688","https://github.com/axios/axios/commit/03cdfc99e8db32a390e12128208b6778492cee9c","https://github.com/axios/axios/releases/tag/v0.31.0","https://cert-portal.siemens.com/productcert/html/ssa-876049.html"],"description":"Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-40175","epss":0.01949,"percentile":0.80219,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-40175","cwe":"CWE-113","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-40175","cwe":"CWE-444","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-40175","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-40175","cwe":"CWE-915","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["0.31.0"],"state":"fixed","available":[{"version":"0.31.0","date":"2026-04-14","kind":"first-observed"}]},"advisories":[],"risk":0.95501},"relatedVulnerabilities":[{"id":"CVE-2026-40175","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-40175","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/axios/axios/commit/03cdfc99e8db32a390e12128208b6778492cee9c","https://github.com/axios/axios/commit/363185461b90b1b78845dc8a99a1f103d9b122a1","https://github.com/axios/axios/pull/10660","https://github.com/axios/axios/pull/10688","https://github.com/axios/axios/releases/tag/v0.31.0","https://github.com/axios/axios/releases/tag/v1.15.0","https://github.com/axios/axios/security/advisories/GHSA-fvcv-3m26-pcqx","https://github.com/axios/axios/pull/10660#issuecomment-4224168081","https://access.redhat.com/errata/RHSA-2026:10104","https://access.redhat.com/errata/RHSA-2026:10153","https://access.redhat.com/errata/RHSA-2026:10172","https://access.redhat.com/errata/RHSA-2026:10175","https://access.redhat.com/errata/RHSA-2026:11414","https://access.redhat.com/errata/RHSA-2026:13542","https://access.redhat.com/errata/RHSA-2026:13548","https://access.redhat.com/errata/RHSA-2026:13571","https://access.redhat.com/errata/RHSA-2026:13826","https://access.redhat.com/errata/RHSA-2026:14774","https://access.redhat.com/errata/RHSA-2026:14937","https://access.redhat.com/errata/RHSA-2026:15091","https://access.redhat.com/errata/RHSA-2026:16874","https://access.redhat.com/errata/RHSA-2026:17468","https://access.redhat.com/errata/RHSA-2026:17474","https://access.redhat.com/errata/RHSA-2026:17657","https://access.redhat.com/errata/RHSA-2026:17699","https://access.redhat.com/errata/RHSA-2026:19712","https://access.redhat.com/errata/RHSA-2026:20041","https://access.redhat.com/errata/RHSA-2026:20938","https://access.redhat.com/errata/RHSA-2026:24762","https://access.redhat.com/errata/RHSA-2026:25041","https://access.redhat.com/errata/RHSA-2026:36882","https://access.redhat.com/errata/RHSA-2026:53661","https://access.redhat.com/errata/RHSA-2026:53676","https://access.redhat.com/errata/RHSA-2026:53735","https://access.redhat.com/errata/RHSA-2026:53736","https://access.redhat.com/errata/RHSA-2026:53752","https://access.redhat.com/errata/RHSA-2026:53778","https://access.redhat.com/errata/RHSA-2026:53789","https://access.redhat.com/errata/RHSA-2026:53799","https://access.redhat.com/errata/RHSA-2026:53835","https://access.redhat.com/errata/RHSA-2026:53840","https://access.redhat.com/errata/RHSA-2026:8483","https://access.redhat.com/errata/RHSA-2026:8484","https://access.redhat.com/errata/RHSA-2026:8490","https://access.redhat.com/errata/RHSA-2026:8491","https://access.redhat.com/errata/RHSA-2026:8493","https://access.redhat.com/errata/RHSA-2026:8499","https://access.redhat.com/errata/RHSA-2026:8500","https://access.redhat.com/errata/RHSA-2026:8501","https://access.redhat.com/errata/RHSA-2026:9742","https://access.redhat.com/security/cve/CVE-2026-40175","https://bugzilla.redhat.com/show_bug.cgi?id=2457432","https://cert-portal.siemens.com/productcert/html/ssa-876049.html","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40175.json"],"description":"Axios is a promise based HTTP client for the browser and Node.js. Versions prior to 1.15.0 and 0.3.1 are vulnerable to a specific gadget-style attack chain in which prototype pollution in a third-party dependency may be leveraged to inject unsanitized header values into outbound requests. This vulnerability is fixed in 1.15.0 and 0.3.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-40175","epss":0.01949,"percentile":0.80219,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-40175","cwe":"CWE-113","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-40175","cwe":"CWE-444","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-40175","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-40175","cwe":"CWE-915","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"0.25.0"}},"found":{"vulnerabilityID":"GHSA-fvcv-3m26-pcqx","versionConstraint":"<0.31.0 (semantic)"},"fix":{"suggestedVersion":"0.31.0"}}],"artifact":{"id":"pkg:npm/axios@0.25.0?package-id=f91bce3cf8a711bf","name":"axios","version":"0.25.0","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:axios:axios:0.25.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@0.25.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-9wv6-86v2-598j","dataSource":"https://github.com/advisories/GHSA-9wv6-86v2-598j","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-9wv6-86v2-598j","https://github.com/pillarjs/path-to-regexp/commit/29b96b4a1de52824e1ca0f49a701183cc4ed476f","https://github.com/pillarjs/path-to-regexp/commit/60f2121e9b66b7b622cc01080df0aabda9eedee6","https://nvd.nist.gov/vuln/detail/CVE-2024-45296","https://github.com/pillarjs/path-to-regexp/commit/925ac8e3c5780b02f58cbd4e52f95da8ad2ac485","https://github.com/pillarjs/path-to-regexp/commit/d31670ae8f6e69cbfd56e835742195b7d10942ef","https://github.com/pillarjs/path-to-regexp/commit/f1253b47b347dcb909e3e80b0eb2649109e59894","https://github.com/pillarjs/path-to-regexp/releases/tag/v6.3.0","https://security.netapp.com/advisory/ntap-20250124-0001"],"description":"path-to-regexp outputs backtracking regular expressions","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-45296","epss":0.00932,"percentile":0.60705,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-45296","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.9.0"],"state":"fixed","available":[{"version":"1.9.0","date":"2024-09-12","kind":"first-observed"}]},"advisories":[],"risk":0.7036600000000001},"relatedVulnerabilities":[{"id":"CVE-2024-45296","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-45296","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/pillarjs/path-to-regexp/commit/29b96b4a1de52824e1ca0f49a701183cc4ed476f","https://github.com/pillarjs/path-to-regexp/commit/60f2121e9b66b7b622cc01080df0aabda9eedee6","https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-9wv6-86v2-598j","https://security.netapp.com/advisory/ntap-20250124-0001/"],"description":"path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event loop and lead to a DoS. The bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (.). For users of 0.1, upgrade to 0.1.10. All other users should upgrade to 8.0.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-45296","epss":0.00932,"percentile":0.60705,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-45296","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"path-to-regexp","version":"1.8.0"}},"found":{"vulnerabilityID":"GHSA-9wv6-86v2-598j","versionConstraint":">=0.2.0,<1.9.0 (semantic)"},"fix":{"suggestedVersion":"1.9.0"}}],"artifact":{"id":"pkg:npm/path-to-regexp@1.8.0?package-id=9f92e512ef03f007","name":"path-to-regexp","version":"1.8.0","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:pillarjs:path-to-regexp:1.8.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/path-to-regexp@1.8.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-9wv6-86v2-598j","dataSource":"https://github.com/advisories/GHSA-9wv6-86v2-598j","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-9wv6-86v2-598j","https://github.com/pillarjs/path-to-regexp/commit/29b96b4a1de52824e1ca0f49a701183cc4ed476f","https://github.com/pillarjs/path-to-regexp/commit/60f2121e9b66b7b622cc01080df0aabda9eedee6","https://nvd.nist.gov/vuln/detail/CVE-2024-45296","https://github.com/pillarjs/path-to-regexp/commit/925ac8e3c5780b02f58cbd4e52f95da8ad2ac485","https://github.com/pillarjs/path-to-regexp/commit/d31670ae8f6e69cbfd56e835742195b7d10942ef","https://github.com/pillarjs/path-to-regexp/commit/f1253b47b347dcb909e3e80b0eb2649109e59894","https://github.com/pillarjs/path-to-regexp/releases/tag/v6.3.0","https://security.netapp.com/advisory/ntap-20250124-0001"],"description":"path-to-regexp outputs backtracking regular expressions","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-45296","epss":0.00932,"percentile":0.60705,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-45296","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.3.0"],"state":"fixed","available":[{"version":"3.3.0","date":"2024-09-12","kind":"first-observed"}]},"advisories":[],"risk":0.7036600000000001},"relatedVulnerabilities":[{"id":"CVE-2024-45296","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-45296","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/pillarjs/path-to-regexp/commit/29b96b4a1de52824e1ca0f49a701183cc4ed476f","https://github.com/pillarjs/path-to-regexp/commit/60f2121e9b66b7b622cc01080df0aabda9eedee6","https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-9wv6-86v2-598j","https://security.netapp.com/advisory/ntap-20250124-0001/"],"description":"path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event loop and lead to a DoS. The bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (.). For users of 0.1, upgrade to 0.1.10. All other users should upgrade to 8.0.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-45296","epss":0.00932,"percentile":0.60705,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-45296","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"path-to-regexp","version":"2.2.1"}},"found":{"vulnerabilityID":"GHSA-9wv6-86v2-598j","versionConstraint":">=2.0.0,<3.3.0 (semantic)"},"fix":{"suggestedVersion":"3.3.0"}}],"artifact":{"id":"pkg:npm/path-to-regexp@2.2.1?package-id=ecb16c81a33fbe7f","name":"path-to-regexp","version":"2.2.1","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:pillarjs:path-to-regexp:2.2.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/path-to-regexp@2.2.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-pf86-5x62-jrwf","dataSource":"https://github.com/advisories/GHSA-pf86-5x62-jrwf","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-pf86-5x62-jrwf","https://nvd.nist.gov/vuln/detail/CVE-2026-42033"],"description":"Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42033","epss":0.00867,"percentile":0.58737,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42033","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-42033","cwe":"CWE-915","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["0.31.1"],"state":"fixed","available":[{"version":"0.31.1","date":"2026-05-05","kind":"first-observed"}]},"advisories":[],"risk":0.645915},"relatedVulnerabilities":[{"id":"CVE-2026-42033","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42033","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-pf86-5x62-jrwf","https://access.redhat.com/errata/RHSA-2026:14937","https://access.redhat.com/errata/RHSA-2026:16476","https://access.redhat.com/errata/RHSA-2026:16532","https://access.redhat.com/errata/RHSA-2026:16534","https://access.redhat.com/errata/RHSA-2026:16535","https://access.redhat.com/errata/RHSA-2026:16542","https://access.redhat.com/errata/RHSA-2026:16874","https://access.redhat.com/errata/RHSA-2026:17468","https://access.redhat.com/errata/RHSA-2026:17474","https://access.redhat.com/errata/RHSA-2026:17657","https://access.redhat.com/errata/RHSA-2026:17699","https://access.redhat.com/errata/RHSA-2026:19109","https://access.redhat.com/errata/RHSA-2026:19375","https://access.redhat.com/errata/RHSA-2026:20889","https://access.redhat.com/errata/RHSA-2026:20938","https://access.redhat.com/errata/RHSA-2026:21017","https://access.redhat.com/errata/RHSA-2026:21338","https://access.redhat.com/errata/RHSA-2026:21772","https://access.redhat.com/errata/RHSA-2026:22465","https://access.redhat.com/errata/RHSA-2026:22619","https://access.redhat.com/errata/RHSA-2026:22629","https://access.redhat.com/errata/RHSA-2026:22840","https://access.redhat.com/errata/RHSA-2026:23361","https://access.redhat.com/errata/RHSA-2026:24536","https://access.redhat.com/errata/RHSA-2026:24539","https://access.redhat.com/errata/RHSA-2026:24853","https://access.redhat.com/errata/RHSA-2026:24977","https://access.redhat.com/errata/RHSA-2026:25041","https://access.redhat.com/errata/RHSA-2026:25089","https://access.redhat.com/errata/RHSA-2026:25271","https://access.redhat.com/errata/RHSA-2026:25273","https://access.redhat.com/errata/RHSA-2026:26214","https://access.redhat.com/errata/RHSA-2026:26225","https://access.redhat.com/errata/RHSA-2026:26232","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:36882","https://access.redhat.com/errata/RHSA-2026:48670","https://access.redhat.com/security/cve/CVE-2026-42033","https://bugzilla.redhat.com/show_bug.cgi?id=2461607","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42033.json"],"description":"Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when Object.prototype has been polluted by any co-dependency with keys that axios reads without a hasOwnProperty guard, an attacker can (a) silently intercept and modify every JSON response before the application sees it, or (b) fully hijack the underlying HTTP transport, gaining access to request credentials, headers, and body. The precondition is prototype pollution from a separate source in the same process. This vulnerability is fixed in 1.15.1 and 0.31.1.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42033","epss":0.00867,"percentile":0.58737,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42033","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-42033","cwe":"CWE-915","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"0.25.0"}},"found":{"vulnerabilityID":"GHSA-pf86-5x62-jrwf","versionConstraint":"<=0.31.0 (semantic)"},"fix":{"suggestedVersion":"0.31.1"}}],"artifact":{"id":"pkg:npm/axios@0.25.0?package-id=f91bce3cf8a711bf","name":"axios","version":"0.25.0","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:axios:axios:0.25.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@0.25.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-3p68-rc4w-qgx5","dataSource":"https://github.com/advisories/GHSA-3p68-rc4w-qgx5","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-3p68-rc4w-qgx5","https://nvd.nist.gov/vuln/detail/CVE-2025-62718","https://github.com/axios/axios/pull/10661","https://github.com/axios/axios/commit/fb3befb6daac6cad26b2e54094d0f2d9e47f24df","https://datatracker.ietf.org/doc/html/rfc1034#section-3.1","https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2","https://github.com/axios/axios/releases/tag/v1.15.0","https://github.com/axios/axios/pull/10688","https://github.com/axios/axios/commit/03cdfc99e8db32a390e12128208b6778492cee9c","https://github.com/axios/axios/releases/tag/v0.31.0"],"description":"Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-62718","epss":0.01186,"percentile":0.67866,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-62718","cwe":"CWE-441","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2025-62718","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2025-62718","cwe":"CWE-1289","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["0.31.0"],"state":"fixed","available":[{"version":"0.31.0","date":"2026-04-16","kind":"first-observed"}]},"advisories":[],"risk":0.625615},"relatedVulnerabilities":[{"id":"CVE-2025-62718","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-62718","namespace":"nvd:cpe","severity":"Critical","urls":["https://datatracker.ietf.org/doc/html/rfc1034#section-3.1","https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2","https://github.com/axios/axios/commit/03cdfc99e8db32a390e12128208b6778492cee9c","https://github.com/axios/axios/commit/fb3befb6daac6cad26b2e54094d0f2d9e47f24df","https://github.com/axios/axios/pull/10661","https://github.com/axios/axios/pull/10688","https://github.com/axios/axios/releases/tag/v0.31.0","https://github.com/axios/axios/releases/tag/v1.15.0","https://github.com/axios/axios/security/advisories/GHSA-3p68-rc4w-qgx5","https://access.redhat.com/errata/RHSA-2026:10175","https://access.redhat.com/errata/RHSA-2026:13571","https://access.redhat.com/errata/RHSA-2026:13826","https://access.redhat.com/errata/RHSA-2026:14937","https://access.redhat.com/errata/RHSA-2026:16874","https://access.redhat.com/errata/RHSA-2026:17657","https://access.redhat.com/errata/RHSA-2026:17699","https://access.redhat.com/errata/RHSA-2026:19375","https://access.redhat.com/errata/RHSA-2026:19712","https://access.redhat.com/errata/RHSA-2026:20889","https://access.redhat.com/errata/RHSA-2026:20938","https://access.redhat.com/errata/RHSA-2026:21017","https://access.redhat.com/errata/RHSA-2026:22465","https://access.redhat.com/errata/RHSA-2026:22629","https://access.redhat.com/errata/RHSA-2026:22840","https://access.redhat.com/errata/RHSA-2026:23361","https://access.redhat.com/errata/RHSA-2026:24471","https://access.redhat.com/errata/RHSA-2026:24761","https://access.redhat.com/errata/RHSA-2026:24766","https://access.redhat.com/errata/RHSA-2026:24853","https://access.redhat.com/errata/RHSA-2026:24866","https://access.redhat.com/errata/RHSA-2026:24977","https://access.redhat.com/errata/RHSA-2026:26010","https://access.redhat.com/errata/RHSA-2026:36882","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:59155","https://access.redhat.com/errata/RHSA-2026:8483","https://access.redhat.com/errata/RHSA-2026:8484","https://access.redhat.com/errata/RHSA-2026:8490","https://access.redhat.com/errata/RHSA-2026:8491","https://access.redhat.com/errata/RHSA-2026:8493","https://access.redhat.com/errata/RHSA-2026:9742","https://access.redhat.com/security/cve/CVE-2025-62718","https://bugzilla.redhat.com/show_bug.cgi?id=2456913","https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-62718.json"],"description":"Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname normalization when checking NO_PROXY rules. Requests to loopback addresses like localhost. (with a trailing dot) or [::1] (IPv6 literal) skip NO_PROXY matching and go through the configured proxy. This goes against what developers expect and lets attackers force requests through a proxy, even if NO_PROXY is set up to protect loopback or internal services. This issue leads to the possibility of proxy bypass and SSRF vulnerabilities allowing attackers to reach sensitive loopback or internal services despite the configured protections. This vulnerability is fixed in 1.15.0 and 0.31.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L","metrics":{"baseScore":9.9,"exploitabilityScore":3.9,"impactScore":5.3},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L","metrics":{"baseScore":7,"exploitabilityScore":2.3,"impactScore":4.8},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-62718","epss":0.01186,"percentile":0.67866,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-62718","cwe":"CWE-441","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2025-62718","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2025-62718","cwe":"CWE-1289","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"0.25.0"}},"found":{"vulnerabilityID":"GHSA-3p68-rc4w-qgx5","versionConstraint":"<0.31.0 (semantic)"},"fix":{"suggestedVersion":"0.31.0"}}],"artifact":{"id":"pkg:npm/axios@0.25.0?package-id=f91bce3cf8a711bf","name":"axios","version":"0.25.0","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:axios:axios:0.25.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@0.25.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-3g43-6gmg-66jw","dataSource":"https://github.com/advisories/GHSA-3g43-6gmg-66jw","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-3g43-6gmg-66jw","https://nvd.nist.gov/vuln/detail/CVE-2026-44495"],"description":"axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L","metrics":{"baseScore":7,"exploitabilityScore":2.3,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44495","epss":0.00854,"percentile":0.58327,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44495","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-44495","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-44495","cwe":"CWE-915","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["0.31.1"],"state":"fixed","available":[{"version":"0.31.1","date":"2026-05-29","kind":"first-observed"}]},"advisories":[],"risk":0.61915},"relatedVulnerabilities":[{"id":"CVE-2026-44495","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44495","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-3g43-6gmg-66jw","https://access.redhat.com/errata/RHSA-2026:20889","https://access.redhat.com/errata/RHSA-2026:20938","https://access.redhat.com/errata/RHSA-2026:27044","https://access.redhat.com/errata/RHSA-2026:27063","https://access.redhat.com/errata/RHSA-2026:27944","https://access.redhat.com/errata/RHSA-2026:28964","https://access.redhat.com/errata/RHSA-2026:29082","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:30650","https://access.redhat.com/errata/RHSA-2026:30651","https://access.redhat.com/errata/RHSA-2026:33155","https://access.redhat.com/errata/RHSA-2026:33160","https://access.redhat.com/errata/RHSA-2026:33163","https://access.redhat.com/errata/RHSA-2026:33173","https://access.redhat.com/errata/RHSA-2026:33183","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:34160","https://access.redhat.com/errata/RHSA-2026:34374","https://access.redhat.com/errata/RHSA-2026:36108","https://access.redhat.com/errata/RHSA-2026:36611","https://access.redhat.com/errata/RHSA-2026:36754","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:36882","https://access.redhat.com/errata/RHSA-2026:36883","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:40768","https://access.redhat.com/errata/RHSA-2026:40792","https://access.redhat.com/errata/RHSA-2026:40795","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41055","https://access.redhat.com/errata/RHSA-2026:41064","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:42078","https://access.redhat.com/errata/RHSA-2026:42142","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:46885","https://access.redhat.com/errata/RHSA-2026:46903","https://access.redhat.com/errata/RHSA-2026:50300","https://access.redhat.com/errata/RHSA-2026:53840","https://access.redhat.com/errata/RHSA-2026:54188","https://access.redhat.com/errata/RHSA-2026:54555","https://access.redhat.com/errata/RHSA-2026:57191","https://access.redhat.com/errata/RHSA-2026:59833","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-44495","https://bugzilla.redhat.com/show_bug.cgi?id=2487937","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44495.json"],"description":"Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in request config processing. If another vulnerability in the same JavaScript process has already polluted Object.prototype.transformResponse, affected Axios versions may treat that inherited value as request configuration or as an option validator. Axios does not itself create the prototype pollution. Exploitability requires a separate prototype-pollution vulnerability or equivalent attacker control over Object.prototype before Axios creates a request. This vulnerability is fixed in 0.31.1 and 1.15.2.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H","metrics":{"baseScore":7.7,"exploitabilityScore":2.3,"impactScore":5.5},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L","metrics":{"baseScore":7,"exploitabilityScore":2.3,"impactScore":4.8},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L","metrics":{"baseScore":7,"exploitabilityScore":2.3,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44495","epss":0.00854,"percentile":0.58327,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44495","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-44495","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-44495","cwe":"CWE-915","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"0.25.0"}},"found":{"vulnerabilityID":"GHSA-3g43-6gmg-66jw","versionConstraint":">=0.19.0,<0.31.1 (semantic)"},"fix":{"suggestedVersion":"0.31.1"}}],"artifact":{"id":"pkg:npm/axios@0.25.0?package-id=f91bce3cf8a711bf","name":"axios","version":"0.25.0","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:axios:axios:0.25.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@0.25.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-jr5f-v2jv-69x6","dataSource":"https://github.com/advisories/GHSA-jr5f-v2jv-69x6","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-jr5f-v2jv-69x6","https://github.com/axios/axios/issues/6463","https://github.com/axios/axios/commit/fb8eec214ce7744b5ca787f2c3b8339b2f54b00f","https://github.com/axios/axios/releases/tag/v1.8.2","https://nvd.nist.gov/vuln/detail/CVE-2025-27152","https://github.com/axios/axios/pull/6829","https://github.com/axios/axios/commit/02c3c69ced0f8fd86407c23203835892313d7fde"],"description":"axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-27152","epss":0.00792,"percentile":0.56327,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-27152","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.30.0"],"state":"fixed","available":[{"version":"0.30.0","date":"2025-03-29","kind":"first-observed"}]},"advisories":[],"risk":0.60192},"relatedVulnerabilities":[{"id":"CVE-2025-27152","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-27152","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/axios/axios/issues/6463","https://github.com/axios/axios/security/advisories/GHSA-jr5f-v2jv-69x6"],"description":"axios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rather than protocol-relative URLs to axios. Even if ⁠baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF and credential leakage. This issue impacts both server-side and client-side usage of axios. This issue is fixed in 1.8.2.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-27152","epss":0.00792,"percentile":0.56327,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-27152","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"0.25.0"}},"found":{"vulnerabilityID":"GHSA-jr5f-v2jv-69x6","versionConstraint":"<0.30.0 (semantic)"},"fix":{"suggestedVersion":"0.30.0"}}],"artifact":{"id":"pkg:npm/axios@0.25.0?package-id=f91bce3cf8a711bf","name":"axios","version":"0.25.0","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:axios:axios:0.25.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@0.25.0","upstreams":[]}},{"vulnerability":{"id":"GO-2026-6612","dataSource":"https://go.dev/cl/847187","namespace":"govulndb:language:go","severity":"Critical","urls":["https://go.dev/cl/847310","https://go.dev/issue/81743","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"],"description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78663","epss":0.00622,"percentile":0.49817,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78663","cwe":"CWE-675","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.60.0"],"state":"fixed","available":[{"version":"0.60.0","date":"2026-10-08","kind":"release"}]},"advisories":[],"risk":0.56291},"relatedVulnerabilities":[{"id":"CVE-2026-78663","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78663","namespace":"nvd:cpe","severity":"Critical","urls":["https://go.dev/cl/847187","https://go.dev/cl/847310","https://go.dev/issue/81743","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://pkg.go.dev/vuln/GO-2026-6612"],"description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78663","epss":0.00622,"percentile":0.49817,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78663","cwe":"CWE-675","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.56.0"}},"found":{"vulnerabilityID":"GO-2026-6612","versionConstraint":"<0.60.0 (go)"},"fix":{"suggestedVersion":"0.60.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.56.0?package-id=4ad2b62edbe56c92","name":"golang.org/x/net","version":"v0.56.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.56.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.56.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.56.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o="}}},{"vulnerability":{"id":"GHSA-p92q-9vqr-4j8v","dataSource":"https://github.com/advisories/GHSA-p92q-9vqr-4j8v","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-p92q-9vqr-4j8v","https://github.com/axios/axios/releases/tag/v0.32.0","https://github.com/axios/axios/releases/tag/v1.16.0","https://nvd.nist.gov/vuln/detail/CVE-2026-44487"],"description":"Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44487","epss":0.00689,"percentile":0.52756,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44487","cwe":"CWE-201","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-44487","cwe":"CWE-201","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["0.32.0"],"state":"fixed","available":[{"version":"0.32.0","date":"2026-06-04","kind":"first-observed"}]},"advisories":[],"risk":0.540865},"relatedVulnerabilities":[{"id":"CVE-2026-44487","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44487","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-p92q-9vqr-4j8v","https://access.redhat.com/errata/RHSA-2026:20889","https://access.redhat.com/errata/RHSA-2026:20938","https://access.redhat.com/errata/RHSA-2026:27044","https://access.redhat.com/errata/RHSA-2026:27063","https://access.redhat.com/errata/RHSA-2026:28964","https://access.redhat.com/errata/RHSA-2026:29082","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:29864","https://access.redhat.com/errata/RHSA-2026:30650","https://access.redhat.com/errata/RHSA-2026:30651","https://access.redhat.com/errata/RHSA-2026:33155","https://access.redhat.com/errata/RHSA-2026:33160","https://access.redhat.com/errata/RHSA-2026:33163","https://access.redhat.com/errata/RHSA-2026:33173","https://access.redhat.com/errata/RHSA-2026:33183","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:34374","https://access.redhat.com/errata/RHSA-2026:34525","https://access.redhat.com/errata/RHSA-2026:34527","https://access.redhat.com/errata/RHSA-2026:34530","https://access.redhat.com/errata/RHSA-2026:36611","https://access.redhat.com/errata/RHSA-2026:36754","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:36882","https://access.redhat.com/errata/RHSA-2026:36883","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:40768","https://access.redhat.com/errata/RHSA-2026:40792","https://access.redhat.com/errata/RHSA-2026:40795","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41055","https://access.redhat.com/errata/RHSA-2026:41064","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:42078","https://access.redhat.com/errata/RHSA-2026:42085","https://access.redhat.com/errata/RHSA-2026:42142","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:46885","https://access.redhat.com/errata/RHSA-2026:46903","https://access.redhat.com/errata/RHSA-2026:50300","https://access.redhat.com/errata/RHSA-2026:54188","https://access.redhat.com/errata/RHSA-2026:54206","https://access.redhat.com/errata/RHSA-2026:57191","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-44487","https://bugzilla.redhat.com/show_bug.cgi?id=2487948","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44487.json"],"description":"Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’s Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected origin during specific proxy-to-direct redirect flows. This affects Node.js usage, where an initial HTTP request is sent through an authenticated HTTP proxy, redirects are followed, and the redirected URL is no longer proxied. Under affected redirect shapes, the final origin can receive the proxy credential that was intended only for the outbound proxy. This vulnerability is fixed in 0.32.0 and 1.16.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44487","epss":0.00689,"percentile":0.52756,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44487","cwe":"CWE-201","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-44487","cwe":"CWE-201","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"0.25.0"}},"found":{"vulnerabilityID":"GHSA-p92q-9vqr-4j8v","versionConstraint":"<=0.31.1 (semantic)"},"fix":{"suggestedVersion":"0.32.0"}}],"artifact":{"id":"pkg:npm/axios@0.25.0?package-id=f91bce3cf8a711bf","name":"axios","version":"0.25.0","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:axios:axios:0.25.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@0.25.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-pmwg-cvhr-8vh7","dataSource":"https://github.com/advisories/GHSA-pmwg-cvhr-8vh7","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-pmwg-cvhr-8vh7","https://nvd.nist.gov/vuln/detail/CVE-2026-42043"],"description":"Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":7.2,"exploitabilityScore":3.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42043","epss":0.00711,"percentile":0.53586,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42043","cwe":"CWE-183","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-42043","cwe":"CWE-441","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-42043","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-42043","cwe":"CWE-918","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["0.31.1"],"state":"fixed","available":[{"version":"0.31.1","date":"2026-05-05","kind":"first-observed"}]},"advisories":[],"risk":0.522585},"relatedVulnerabilities":[{"id":"CVE-2026-42043","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42043","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/axios/axios/security/advisories/GHSA-pmwg-cvhr-8vh7","https://access.redhat.com/errata/RHSA-2026:14937","https://access.redhat.com/errata/RHSA-2026:16476","https://access.redhat.com/errata/RHSA-2026:16532","https://access.redhat.com/errata/RHSA-2026:16534","https://access.redhat.com/errata/RHSA-2026:16535","https://access.redhat.com/errata/RHSA-2026:16542","https://access.redhat.com/errata/RHSA-2026:16874","https://access.redhat.com/errata/RHSA-2026:17468","https://access.redhat.com/errata/RHSA-2026:17474","https://access.redhat.com/errata/RHSA-2026:17657","https://access.redhat.com/errata/RHSA-2026:17699","https://access.redhat.com/errata/RHSA-2026:19109","https://access.redhat.com/errata/RHSA-2026:19375","https://access.redhat.com/errata/RHSA-2026:20889","https://access.redhat.com/errata/RHSA-2026:20938","https://access.redhat.com/errata/RHSA-2026:21017","https://access.redhat.com/errata/RHSA-2026:21338","https://access.redhat.com/errata/RHSA-2026:21772","https://access.redhat.com/errata/RHSA-2026:22465","https://access.redhat.com/errata/RHSA-2026:22619","https://access.redhat.com/errata/RHSA-2026:22629","https://access.redhat.com/errata/RHSA-2026:22840","https://access.redhat.com/errata/RHSA-2026:23361","https://access.redhat.com/errata/RHSA-2026:24536","https://access.redhat.com/errata/RHSA-2026:24539","https://access.redhat.com/errata/RHSA-2026:24853","https://access.redhat.com/errata/RHSA-2026:24977","https://access.redhat.com/errata/RHSA-2026:25041","https://access.redhat.com/errata/RHSA-2026:25089","https://access.redhat.com/errata/RHSA-2026:25271","https://access.redhat.com/errata/RHSA-2026:25273","https://access.redhat.com/errata/RHSA-2026:26214","https://access.redhat.com/errata/RHSA-2026:26225","https://access.redhat.com/errata/RHSA-2026:26232","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:36882","https://access.redhat.com/errata/RHSA-2026:48670","https://access.redhat.com/security/cve/CVE-2026-42043","https://bugzilla.redhat.com/show_bug.cgi?id=2461626","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42043.json"],"description":"Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, an attacker who can influence the target URL of an Axios request can use any address in the 127.0.0.0/8 range (other than 127.0.0.1) to completely bypass the NO_PROXY protection. This vulnerability is due to an incomplete for CVE-2025-62718, This vulnerability is fixed in 1.15.1 and 0.31.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","metrics":{"baseScore":10,"exploitabilityScore":3.9,"impactScore":5.8},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":7.2,"exploitabilityScore":3.9,"impactScore":2.8},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":7.2,"exploitabilityScore":3.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42043","epss":0.00711,"percentile":0.53586,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42043","cwe":"CWE-183","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-42043","cwe":"CWE-441","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-42043","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-42043","cwe":"CWE-918","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"0.25.0"}},"found":{"vulnerabilityID":"GHSA-pmwg-cvhr-8vh7","versionConstraint":"<=0.31.0 (semantic)"},"fix":{"suggestedVersion":"0.31.1"}}],"artifact":{"id":"pkg:npm/axios@0.25.0?package-id=f91bce3cf8a711bf","name":"axios","version":"0.25.0","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:axios:axios:0.25.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@0.25.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-2v4p-qf9q-27wj","dataSource":"https://github.com/advisories/GHSA-2v4p-qf9q-27wj","namespace":"github:language:go","severity":"High","urls":["https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj","https://github.com/grpc/grpc-go/issues/9354","https://github.com/grpc/grpc-go/pull/9365","https://github.com/grpc/grpc-go/pull/9366","https://github.com/grpc/grpc-go/pull/9367","https://github.com/grpc/grpc-go/commit/3822494d8ea03b992c089fd2a195f041762fffb7","https://github.com/grpc/grpc-go/commit/8668b69c167df908b6b3666dcbf40992b9e932a4","https://github.com/grpc/grpc-go/commit/93e31b48545e2a8aaeb6e06b47fb249f94e6297f","https://github.com/grpc/grpc-go/releases/tag/v1.82.2","https://github.com/grpc/grpc-go/releases/tag/v1.83.2","https://nvd.nist.gov/vuln/detail/CVE-2026-84445"],"description":"gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84445","epss":0.00641,"percentile":0.50726,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84445","cwe":"CWE-129","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-84445","cwe":"CWE-248","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["1.82.2"],"state":"fixed","available":[{"version":"1.82.2","date":"2026-09-09","kind":"first-observed"}]},"advisories":[],"risk":0.51921},"relatedVulnerabilities":[{"id":"CVE-2026-84445","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84445","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/grpc/grpc-go/commit/3822494d8ea03b992c089fd2a195f041762fffb7","https://github.com/grpc/grpc-go/commit/8668b69c167df908b6b3666dcbf40992b9e932a4","https://github.com/grpc/grpc-go/commit/93e31b48545e2a8aaeb6e06b47fb249f94e6297f","https://github.com/grpc/grpc-go/issues/9354","https://github.com/grpc/grpc-go/pull/9365","https://github.com/grpc/grpc-go/pull/9366","https://github.com/grpc/grpc-go/pull/9367","https://github.com/grpc/grpc-go/releases/tag/v1.82.2","https://github.com/grpc/grpc-go/releases/tag/v1.83.2","https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj"],"description":"gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow internal/transport/http2_server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in internal/xds/server/routing.go assumes that an authority value exists and indexes the empty slice. A remote client that can complete transport connection establishment can trigger an index-out-of-bounds panic that is not recovered by the per-RPC goroutine and terminates the entire server process. In insecure or ordinary TLS deployments the request can be unauthenticated, while strict mTLS or ALTS deployments require valid transport credentials before the malformed RPC can reach the interceptor. This issue is fixed in versions 1.82.2 and 1.83.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84445","epss":0.00641,"percentile":0.50726,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84445","cwe":"CWE-129","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-84445","cwe":"CWE-248","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"google.golang.org/grpc","version":"v1.82.1"}},"found":{"vulnerabilityID":"GHSA-2v4p-qf9q-27wj","versionConstraint":"<1.82.2 (go)"},"fix":{"suggestedVersion":"1.82.2"}}],"artifact":{"id":"pkg:golang/google.golang.org/grpc@v1.82.1?package-id=2caab00b35c7e04a","name":"google.golang.org/grpc","version":"v1.82.1","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:google:grpc:v1.82.1:*:*:*:*:*:*:*"],"purl":"pkg:golang/google.golang.org/grpc@v1.82.1","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:NnAxzGRA0677vCa4BUkOAnO5+FfQqVl9iUXeD0IqcGE="}}},{"vulnerability":{"id":"GHSA-4c8g-83qw-93j6","dataSource":"https://github.com/advisories/GHSA-4c8g-83qw-93j6","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6","https://nvd.nist.gov/vuln/detail/CVE-2026-13676","https://github.com/fastify/fast-uri/pull/188","https://github.com/fastify/fast-uri/commit/2a6d357a18a68e6d812824379fd3388a1ae50d05","https://github.com/fastify/fast-uri/commit/21ea1f9d70495c931f55dff893a8fa38f4f2e6bd","https://github.com/fastify/fast-uri/commit/01db48010f594b98f7b323be18b393791c66ed1d","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-13676.json","https://github.com/fastify/fast-uri/releases/tag/v4.0.1","https://github.com/fastify/fast-uri/releases/tag/v3.1.3","https://github.com/fastify/fast-uri/releases/tag/v2.4.2","https://cna.openjsf.org/security-advisories.html","https://bugzilla.redhat.com/show_bug.cgi?id=2494197","https://access.redhat.com/security/cve/CVE-2026-13676","https://access.redhat.com/errata/RHSA-2026:41929","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:37628","https://access.redhat.com/errata/RHSA-2026:37585","https://access.redhat.com/errata/RHSA-2026:37186","https://access.redhat.com/errata/RHSA-2026:43038","https://access.redhat.com/errata/RHSA-2026:42815","https://access.redhat.com/errata/RHSA-2026:40765","https://access.redhat.com/errata/RHSA-2026:44239","https://access.redhat.com/errata/RHSA-2026:44268","https://access.redhat.com/errata/RHSA-2026:48126","https://access.redhat.com/errata/RHSA-2026:48124","https://access.redhat.com/errata/RHSA-2026:49642","https://access.redhat.com/errata/RHSA-2026:50479","https://access.redhat.com/errata/RHSA-2026:50340","https://access.redhat.com/errata/RHSA-2026:47728","https://access.redhat.com/errata/RHSA-2026:51196","https://access.redhat.com/errata/RHSA-2026:51197","https://access.redhat.com/errata/RHSA-2026:51342","https://access.redhat.com/errata/RHSA-2026:51348","https://access.redhat.com/errata/RHSA-2026:51349","https://access.redhat.com/errata/RHSA-2026:50758","https://access.redhat.com/errata/RHSA-2026:54760","https://access.redhat.com/errata/RHSA-2026:56366","https://access.redhat.com/errata/RHSA-2026:56431","https://access.redhat.com/errata/RHSA-2026:57013","https://access.redhat.com/errata/RHSA-2026:57191","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:57590","https://access.redhat.com/errata/RHSA-2026:59593","https://access.redhat.com/errata/RHSA-2026:60386","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61314","https://access.redhat.com/errata/RHSA-2026:63371","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545"],"description":"fast-uri vulnerable to host confusion via failed IDN canonicalization","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-13676","epss":0.00692,"percentile":0.52908,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-13676","cwe":"CWE-436","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-13676","cwe":"CWE-551","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["3.1.3"],"state":"fixed","available":[{"version":"3.1.3","date":"2026-07-22","kind":"first-observed"}]},"advisories":[],"risk":0.519},"relatedVulnerabilities":[{"id":"CVE-2026-13676","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13676","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6","https://access.redhat.com/errata/RHSA-2026:37186","https://access.redhat.com/errata/RHSA-2026:37585","https://access.redhat.com/errata/RHSA-2026:37628","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:40765","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41929","https://access.redhat.com/errata/RHSA-2026:42815","https://access.redhat.com/errata/RHSA-2026:43038","https://access.redhat.com/errata/RHSA-2026:44239","https://access.redhat.com/errata/RHSA-2026:44268","https://access.redhat.com/errata/RHSA-2026:47728","https://access.redhat.com/errata/RHSA-2026:48124","https://access.redhat.com/errata/RHSA-2026:48126","https://access.redhat.com/errata/RHSA-2026:49642","https://access.redhat.com/errata/RHSA-2026:50340","https://access.redhat.com/errata/RHSA-2026:50479","https://access.redhat.com/errata/RHSA-2026:50758","https://access.redhat.com/errata/RHSA-2026:51196","https://access.redhat.com/errata/RHSA-2026:51197","https://access.redhat.com/errata/RHSA-2026:51342","https://access.redhat.com/errata/RHSA-2026:51348","https://access.redhat.com/errata/RHSA-2026:51349","https://access.redhat.com/errata/RHSA-2026:54760","https://access.redhat.com/errata/RHSA-2026:56366","https://access.redhat.com/errata/RHSA-2026:56431","https://access.redhat.com/errata/RHSA-2026:57013","https://access.redhat.com/errata/RHSA-2026:57191","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:57590","https://access.redhat.com/errata/RHSA-2026:59593","https://access.redhat.com/errata/RHSA-2026:60386","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61314","https://access.redhat.com/errata/RHSA-2026:63371","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-13676","https://bugzilla.redhat.com/show_bug.cgi?id=2494197","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-13676.json"],"description":"fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, silently leaving the host in its original Unicode form while normalize() and equal() still return values that differ from a WHATWG-compatible URL parser. Applications that use fast-uri to enforce host-based policy (denylists, loopback filtering, redirect validation, outbound proxy routing) before passing the same URL to Node's URL or fetch can be bypassed when the two implementations resolve the same input to different hosts. Patches: upgrade to fast-uri 3.1.3 for the 3.x line or 4.0.1 for the 4.x line. Workarounds: enforce host policy using the same URL parser used for the actual request, or reject non-ASCII hosts before policy checks.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-13676","epss":0.00692,"percentile":0.52908,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-13676","cwe":"CWE-436","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-13676","cwe":"CWE-551","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-4c8g-83qw-93j6","versionConstraint":">=3.0.0,<3.1.3 (semantic)"},"fix":{"suggestedVersion":"3.1.3"}}],"artifact":{"id":"pkg:npm/fast-uri@3.1.2?package-id=2988e6ba3a1ed377","name":"fast-uri","version":"3.1.2","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:openjsf:fast-uri:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-73wf-gq98-2v4g","dataSource":"https://github.com/advisories/GHSA-73wf-gq98-2v4g","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g","https://nvd.nist.gov/vuln/detail/CVE-2026-73088","https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51","https://github.com/browserslist/browserslist/releases/tag/4.28.7"],"description":"Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73088","epss":0.00658,"percentile":0.51501,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73088","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-73088","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.28.7"],"state":"fixed","available":[{"version":"4.28.7","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.4935},"relatedVulnerabilities":[{"id":"CVE-2026-73088","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-73088","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51","https://github.com/browserslist/browserslist/releases/tag/4.28.7","https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g"],"description":"Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, reached unconditionally through getStat() and loadStat() on every browserslist() call, processes untrusted browserslist-stats.json, opts.stats, and CLI --stats data with an unguarded for...in loop and plain-object bracket access and assignment, allowing inherited Object.prototype keys including __proto__, toString, valueOf, constructor, hasOwnProperty, and isPrototypeOf to cause an uncaught TypeError or modify the prototype of the returned normalized object. This issue is fixed in version 4.28.7.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73088","epss":0.00658,"percentile":0.51501,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73088","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-73088","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"browserslist","version":"4.20.2"}},"found":{"vulnerabilityID":"GHSA-73wf-gq98-2v4g","versionConstraint":"<=4.28.6 (semantic)"},"fix":{"suggestedVersion":"4.28.7"}}],"artifact":{"id":"pkg:npm/browserslist@4.20.2?package-id=67e5010cc5c9b9ae","name":"browserslist","version":"4.20.2","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:browserslist_project:browserslist:4.20.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/browserslist@4.20.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-73wf-gq98-2v4g","dataSource":"https://github.com/advisories/GHSA-73wf-gq98-2v4g","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g","https://nvd.nist.gov/vuln/detail/CVE-2026-73088","https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51","https://github.com/browserslist/browserslist/releases/tag/4.28.7"],"description":"Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73088","epss":0.00658,"percentile":0.51501,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73088","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-73088","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.28.7"],"state":"fixed","available":[{"version":"4.28.7","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.4935},"relatedVulnerabilities":[{"id":"CVE-2026-73088","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-73088","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51","https://github.com/browserslist/browserslist/releases/tag/4.28.7","https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g"],"description":"Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, reached unconditionally through getStat() and loadStat() on every browserslist() call, processes untrusted browserslist-stats.json, opts.stats, and CLI --stats data with an unguarded for...in loop and plain-object bracket access and assignment, allowing inherited Object.prototype keys including __proto__, toString, valueOf, constructor, hasOwnProperty, and isPrototypeOf to cause an uncaught TypeError or modify the prototype of the returned normalized object. This issue is fixed in version 4.28.7.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73088","epss":0.00658,"percentile":0.51501,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73088","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-73088","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"browserslist","version":"4.20.3"}},"found":{"vulnerabilityID":"GHSA-73wf-gq98-2v4g","versionConstraint":"<=4.28.6 (semantic)"},"fix":{"suggestedVersion":"4.28.7"}}],"artifact":{"id":"pkg:npm/browserslist@4.20.3?package-id=4dcad3d3228d4f30","name":"browserslist","version":"4.20.3","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:browserslist_project:browserslist:4.20.3:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/browserslist@4.20.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-73wf-gq98-2v4g","dataSource":"https://github.com/advisories/GHSA-73wf-gq98-2v4g","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g","https://nvd.nist.gov/vuln/detail/CVE-2026-73088","https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51","https://github.com/browserslist/browserslist/releases/tag/4.28.7"],"description":"Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73088","epss":0.00658,"percentile":0.51501,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73088","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-73088","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.28.7"],"state":"fixed","available":[{"version":"4.28.7","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.4935},"relatedVulnerabilities":[{"id":"CVE-2026-73088","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-73088","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51","https://github.com/browserslist/browserslist/releases/tag/4.28.7","https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g"],"description":"Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, reached unconditionally through getStat() and loadStat() on every browserslist() call, processes untrusted browserslist-stats.json, opts.stats, and CLI --stats data with an unguarded for...in loop and plain-object bracket access and assignment, allowing inherited Object.prototype keys including __proto__, toString, valueOf, constructor, hasOwnProperty, and isPrototypeOf to cause an uncaught TypeError or modify the prototype of the returned normalized object. This issue is fixed in version 4.28.7.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73088","epss":0.00658,"percentile":0.51501,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73088","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-73088","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"browserslist","version":"4.28.1"}},"found":{"vulnerabilityID":"GHSA-73wf-gq98-2v4g","versionConstraint":"<=4.28.6 (semantic)"},"fix":{"suggestedVersion":"4.28.7"}}],"artifact":{"id":"pkg:npm/browserslist@4.28.1?package-id=78e3bb7d7e07a7eb","name":"browserslist","version":"4.28.1","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:browserslist_project:browserslist:4.28.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/browserslist@4.28.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-vp52-pcj8-j9qc","dataSource":"https://github.com/advisories/GHSA-vp52-pcj8-j9qc","namespace":"github:language:go","severity":"High","urls":["https://github.com/grpc/grpc-go/security/advisories/GHSA-vp52-pcj8-j9qc","https://nvd.nist.gov/vuln/detail/CVE-2026-84304","https://github.com/grpc/grpc-go/pull/9331","https://github.com/grpc/grpc-go/pull/9333","https://github.com/grpc/grpc-go/commit/7354d9c8debb4bcf2225bf429857078de310c176","https://github.com/grpc/grpc-go/commit/8cfeca0e1ee5ea0980dcc320e20240fa1079ec77","https://github.com/grpc/grpc-go/releases/tag/v1.83.1"],"description":"gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84304","epss":0.00609,"percentile":0.49155,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84304","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.83.1"],"state":"fixed","available":[{"version":"1.83.1","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.49328999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-84304","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84304","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/grpc/grpc-go/commit/7354d9c8debb4bcf2225bf429857078de310c176","https://github.com/grpc/grpc-go/commit/8cfeca0e1ee5ea0980dcc320e20240fa1079ec77","https://github.com/grpc/grpc-go/pull/9331","https://github.com/grpc/grpc-go/pull/9333","https://github.com/grpc/grpc-go/releases/tag/v1.83.1","https://github.com/grpc/grpc-go/security/advisories/GHSA-vp52-pcj8-j9qc"],"description":"gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connection and stream flow-control windows. An unauthenticated remote attacker can use concurrent multiplexed streams to exhaust process memory and cause a runtime panic or out-of-memory termination. Receive-buffer compaction is enabled by default and can be controlled temporarily with GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION. This issue is fixed in version 1.83.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84304","epss":0.00609,"percentile":0.49155,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84304","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"google.golang.org/grpc","version":"v1.82.1"}},"found":{"vulnerabilityID":"GHSA-vp52-pcj8-j9qc","versionConstraint":"<=1.83.0 (go)"},"fix":{"suggestedVersion":"1.83.1"}}],"artifact":{"id":"pkg:golang/google.golang.org/grpc@v1.82.1?package-id=2caab00b35c7e04a","name":"google.golang.org/grpc","version":"v1.82.1","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:google:grpc:v1.82.1:*:*:*:*:*:*:*"],"purl":"pkg:golang/google.golang.org/grpc@v1.82.1","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:NnAxzGRA0677vCa4BUkOAnO5+FfQqVl9iUXeD0IqcGE="}}},{"vulnerability":{"id":"GHSA-c83g-rgw3-j3cx","dataSource":"https://github.com/advisories/GHSA-c83g-rgw3-j3cx","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx","https://nvd.nist.gov/vuln/detail/CVE-2026-73089","https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405","https://github.com/browserslist/browserslist/releases/tag/4.28.7"],"description":"Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73089","epss":0.00655,"percentile":0.51388,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73089","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.28.7"],"state":"fixed","available":[{"version":"4.28.7","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.49125},"relatedVulnerabilities":[{"id":"CVE-2026-73089","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-73089","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405","https://github.com/browserslist/browserslist/releases/tag/4.28.7","https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx"],"description":"Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct `(queries, context)` result in cache and every parseQueries() AST in parseCache without a size cap, TTL, or eviction, allowing an attacker who can influence repeated browserslist() query values, including valid since `<year>-<month>-<day>` queries, to bypass the caller-controlled BROWSERSLIST_DISABLE_CACHE mitigation and cause linear memory growth followed by an out-of-memory process crash. This issue is fixed in version 4.28.7.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73089","epss":0.00655,"percentile":0.51388,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73089","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"browserslist","version":"4.20.2"}},"found":{"vulnerabilityID":"GHSA-c83g-rgw3-j3cx","versionConstraint":"<=4.28.6 (semantic)"},"fix":{"suggestedVersion":"4.28.7"}}],"artifact":{"id":"pkg:npm/browserslist@4.20.2?package-id=67e5010cc5c9b9ae","name":"browserslist","version":"4.20.2","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:browserslist_project:browserslist:4.20.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/browserslist@4.20.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-c83g-rgw3-j3cx","dataSource":"https://github.com/advisories/GHSA-c83g-rgw3-j3cx","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx","https://nvd.nist.gov/vuln/detail/CVE-2026-73089","https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405","https://github.com/browserslist/browserslist/releases/tag/4.28.7"],"description":"Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73089","epss":0.00655,"percentile":0.51388,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73089","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.28.7"],"state":"fixed","available":[{"version":"4.28.7","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.49125},"relatedVulnerabilities":[{"id":"CVE-2026-73089","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-73089","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405","https://github.com/browserslist/browserslist/releases/tag/4.28.7","https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx"],"description":"Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct `(queries, context)` result in cache and every parseQueries() AST in parseCache without a size cap, TTL, or eviction, allowing an attacker who can influence repeated browserslist() query values, including valid since `<year>-<month>-<day>` queries, to bypass the caller-controlled BROWSERSLIST_DISABLE_CACHE mitigation and cause linear memory growth followed by an out-of-memory process crash. This issue is fixed in version 4.28.7.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73089","epss":0.00655,"percentile":0.51388,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73089","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"browserslist","version":"4.20.3"}},"found":{"vulnerabilityID":"GHSA-c83g-rgw3-j3cx","versionConstraint":"<=4.28.6 (semantic)"},"fix":{"suggestedVersion":"4.28.7"}}],"artifact":{"id":"pkg:npm/browserslist@4.20.3?package-id=4dcad3d3228d4f30","name":"browserslist","version":"4.20.3","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:browserslist_project:browserslist:4.20.3:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/browserslist@4.20.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-c83g-rgw3-j3cx","dataSource":"https://github.com/advisories/GHSA-c83g-rgw3-j3cx","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx","https://nvd.nist.gov/vuln/detail/CVE-2026-73089","https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405","https://github.com/browserslist/browserslist/releases/tag/4.28.7"],"description":"Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73089","epss":0.00655,"percentile":0.51388,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73089","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.28.7"],"state":"fixed","available":[{"version":"4.28.7","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.49125},"relatedVulnerabilities":[{"id":"CVE-2026-73089","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-73089","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405","https://github.com/browserslist/browserslist/releases/tag/4.28.7","https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx"],"description":"Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct `(queries, context)` result in cache and every parseQueries() AST in parseCache without a size cap, TTL, or eviction, allowing an attacker who can influence repeated browserslist() query values, including valid since `<year>-<month>-<day>` queries, to bypass the caller-controlled BROWSERSLIST_DISABLE_CACHE mitigation and cause linear memory growth followed by an out-of-memory process crash. This issue is fixed in version 4.28.7.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73089","epss":0.00655,"percentile":0.51388,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73089","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"browserslist","version":"4.28.1"}},"found":{"vulnerabilityID":"GHSA-c83g-rgw3-j3cx","versionConstraint":"<=4.28.6 (semantic)"},"fix":{"suggestedVersion":"4.28.7"}}],"artifact":{"id":"pkg:npm/browserslist@4.28.1?package-id=78e3bb7d7e07a7eb","name":"browserslist","version":"4.28.1","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:browserslist_project:browserslist:4.28.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/browserslist@4.28.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-rgw5-rvv9-x895","dataSource":"https://github.com/advisories/GHSA-rgw5-rvv9-x895","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895","https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d","https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac","https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf","https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031","https://nvd.nist.gov/vuln/detail/CVE-2026-69152"],"description":"brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69152","epss":0.00647,"percentile":0.51007,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69152","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69152","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.1.18"],"state":"fixed","available":[{"version":"1.1.18","date":"2026-08-03","kind":"first-observed"}]},"advisories":[],"risk":0.48525},"relatedVulnerabilities":[{"id":"CVE-2026-69152","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-69152","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d","https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac","https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf","https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop. The fix for CVE-2026-14257 is bypassed by the vulnerability. This issue is fixed in versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69152","epss":0.00647,"percentile":0.51007,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69152","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69152","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.13"}},"found":{"vulnerabilityID":"GHSA-rgw5-rvv9-x895","versionConstraint":"<1.1.18 (semantic)"},"fix":{"suggestedVersion":"1.1.18"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.13?package-id=3a0d56dc8df5e29f","name":"brace-expansion","version":"1.1.13","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-mh99-v99m-4gvg","dataSource":"https://github.com/advisories/GHSA-mh99-v99m-4gvg","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-mh99-v99m-4gvg","https://nvd.nist.gov/vuln/detail/CVE-2026-14257","https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5","https://github.com/juliangruber/brace-expansion","https://www.npmjs.com/package/brace-expansion","https://github.com/juliangruber/brace-expansion/pull/129","https://github.com/juliangruber/brace-expansion/pull/130","https://github.com/juliangruber/brace-expansion/pull/136","https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d","https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031","https://github.com/juliangruber/brace-expansion/commit/d13ff455a58b0d56704f0111e3c2a0b16ceb06eb"],"description":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-14257","epss":0.00643,"percentile":0.5082,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-14257","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-14257","cwe":"CWE-770","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}],"fix":{"versions":["1.1.17"],"state":"fixed","available":[{"version":"1.1.17","date":"2026-08-01","kind":"first-observed"}]},"advisories":[],"risk":0.48225000000000007},"relatedVulnerabilities":[{"id":"CVE-2026-14257","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-14257","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion","https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5","https://www.npmjs.com/package/brace-expansion"],"description":"brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays.","cvss":[{"source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-14257","epss":0.00643,"percentile":0.5082,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-14257","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-14257","cwe":"CWE-770","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.13"}},"found":{"vulnerabilityID":"GHSA-mh99-v99m-4gvg","versionConstraint":"<1.1.17 (semantic)"},"fix":{"suggestedVersion":"1.1.17"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.13?package-id=3a0d56dc8df5e29f","name":"brace-expansion","version":"1.1.13","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-62hf-57xw-28j9","dataSource":"https://github.com/advisories/GHSA-62hf-57xw-28j9","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-62hf-57xw-28j9","https://nvd.nist.gov/vuln/detail/CVE-2026-42039","https://github.com/axios/axios/commit/85132ffba1a77609ea5d101c8a413dea7174932f","https://github.com/axios/axios/releases/tag/v1.15.1"],"description":"Axios: unbounded recursion in toFormData causes DoS via deeply nested request data","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42039","epss":0.00772,"percentile":0.55694,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42039","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-42039","cwe":"CWE-770","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["0.31.1"],"state":"fixed","available":[{"version":"0.31.1","date":"2026-05-05","kind":"first-observed"}]},"advisories":[],"risk":0.47092},"relatedVulnerabilities":[{"id":"CVE-2026-42039","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42039","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-62hf-57xw-28j9","https://access.redhat.com/errata/RHSA-2026:14937","https://access.redhat.com/errata/RHSA-2026:16476","https://access.redhat.com/errata/RHSA-2026:16532","https://access.redhat.com/errata/RHSA-2026:16534","https://access.redhat.com/errata/RHSA-2026:16535","https://access.redhat.com/errata/RHSA-2026:16542","https://access.redhat.com/errata/RHSA-2026:16874","https://access.redhat.com/errata/RHSA-2026:17468","https://access.redhat.com/errata/RHSA-2026:17474","https://access.redhat.com/errata/RHSA-2026:17657","https://access.redhat.com/errata/RHSA-2026:17699","https://access.redhat.com/errata/RHSA-2026:19109","https://access.redhat.com/errata/RHSA-2026:19375","https://access.redhat.com/errata/RHSA-2026:20889","https://access.redhat.com/errata/RHSA-2026:20938","https://access.redhat.com/errata/RHSA-2026:21017","https://access.redhat.com/errata/RHSA-2026:21338","https://access.redhat.com/errata/RHSA-2026:21772","https://access.redhat.com/errata/RHSA-2026:22465","https://access.redhat.com/errata/RHSA-2026:22619","https://access.redhat.com/errata/RHSA-2026:22629","https://access.redhat.com/errata/RHSA-2026:22840","https://access.redhat.com/errata/RHSA-2026:23361","https://access.redhat.com/errata/RHSA-2026:24473","https://access.redhat.com/errata/RHSA-2026:24536","https://access.redhat.com/errata/RHSA-2026:24539","https://access.redhat.com/errata/RHSA-2026:24853","https://access.redhat.com/errata/RHSA-2026:24977","https://access.redhat.com/errata/RHSA-2026:25041","https://access.redhat.com/errata/RHSA-2026:25089","https://access.redhat.com/errata/RHSA-2026:25271","https://access.redhat.com/errata/RHSA-2026:25273","https://access.redhat.com/errata/RHSA-2026:26214","https://access.redhat.com/errata/RHSA-2026:26225","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:36882","https://access.redhat.com/errata/RHSA-2026:48085","https://access.redhat.com/errata/RHSA-2026:48670","https://access.redhat.com/errata/RHSA-2026:50300","https://access.redhat.com/security/cve/CVE-2026-42039","https://bugzilla.redhat.com/show_bug.cgi?id=2461630","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42039.json"],"description":"Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects with no depth limit, so a deeply nested value passed as request data crashes the Node.js process with a RangeError. This vulnerability is fixed in 1.15.1 and 0.31.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42039","epss":0.00772,"percentile":0.55694,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42039","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-42039","cwe":"CWE-770","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"0.25.0"}},"found":{"vulnerabilityID":"GHSA-62hf-57xw-28j9","versionConstraint":"<=0.31.0 (semantic)"},"fix":{"suggestedVersion":"0.31.1"}}],"artifact":{"id":"pkg:npm/axios@0.25.0?package-id=f91bce3cf8a711bf","name":"axios","version":"0.25.0","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:axios:axios:0.25.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@0.25.0","upstreams":[]}},{"vulnerability":{"id":"GO-2026-6603","dataSource":"https://go.dev/cl/847185","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/cl/847314","https://go.dev/issue/81857","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"],"description":"When \"Trailer\" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a \"Trailer\" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78659","epss":0.00627,"percentile":0.50086,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78659","cwe":"CWE-405","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.60.0"],"state":"fixed","available":[{"version":"0.60.0","date":"2026-10-08","kind":"release"}]},"advisories":[],"risk":0.47025},"relatedVulnerabilities":[{"id":"CVE-2026-78659","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78659","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/847185","https://go.dev/cl/847314","https://go.dev/issue/81857","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://pkg.go.dev/vuln/GO-2026-6603"],"description":"When \"Trailer\" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a \"Trailer\" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78659","epss":0.00627,"percentile":0.50086,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78659","cwe":"CWE-405","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.56.0"}},"found":{"vulnerabilityID":"GO-2026-6603","versionConstraint":"<0.60.0 (go)"},"fix":{"suggestedVersion":"0.60.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.56.0?package-id=4ad2b62edbe56c92","name":"golang.org/x/net","version":"v0.56.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.56.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.56.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.56.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o="}}},{"vulnerability":{"id":"GHSA-3ppc-4f35-3m26","dataSource":"https://github.com/advisories/GHSA-3ppc-4f35-3m26","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26","https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://nvd.nist.gov/vuln/detail/CVE-2026-26996"],"description":"minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.00577,"percentile":0.47578,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.1.3"],"state":"fixed","available":[{"version":"3.1.3","date":"2026-03-04","kind":"first-observed"}]},"advisories":[],"risk":0.46736999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-26996","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26996","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.00577,"percentile":0.47578,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.0.4"}},"found":{"vulnerabilityID":"GHSA-3ppc-4f35-3m26","versionConstraint":"<3.1.3 (semantic)"},"fix":{"suggestedVersion":"3.1.3"}}],"artifact":{"id":"pkg:npm/minimatch@3.0.4?package-id=4657685090d0c0b4","name":"minimatch","version":"3.0.4","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.0.4:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.0.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-3ppc-4f35-3m26","dataSource":"https://github.com/advisories/GHSA-3ppc-4f35-3m26","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26","https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://nvd.nist.gov/vuln/detail/CVE-2026-26996"],"description":"minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.00577,"percentile":0.47578,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.1.3"],"state":"fixed","available":[{"version":"3.1.3","date":"2026-03-04","kind":"first-observed"}]},"advisories":[],"risk":0.46736999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-26996","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26996","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.00577,"percentile":0.47578,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-3ppc-4f35-3m26","versionConstraint":"<3.1.3 (semantic)"},"fix":{"suggestedVersion":"3.1.3"}}],"artifact":{"id":"pkg:npm/minimatch@3.1.2?package-id=0d0adedb8aec12d6","name":"minimatch","version":"3.1.2","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GO-2026-6611","dataSource":"https://go.dev/cl/847186","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/cl/847308","https://go.dev/issue/81742","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"],"description":"A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78669","epss":0.00614,"percentile":0.49429,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78669","cwe":"CWE-405","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.60.0"],"state":"fixed","available":[{"version":"0.60.0","date":"2026-10-08","kind":"release"}]},"advisories":[],"risk":0.46049999999999996},"relatedVulnerabilities":[{"id":"CVE-2026-78669","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78669","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/847186","https://go.dev/cl/847308","https://go.dev/issue/81742","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://pkg.go.dev/vuln/GO-2026-6611"],"description":"A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78669","epss":0.00614,"percentile":0.49429,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78669","cwe":"CWE-405","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.56.0"}},"found":{"vulnerabilityID":"GO-2026-6611","versionConstraint":"<0.60.0 (go)"},"fix":{"suggestedVersion":"0.60.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.56.0?package-id=4ad2b62edbe56c92","name":"golang.org/x/net","version":"v0.56.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.56.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.56.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.56.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o="}}},{"vulnerability":{"id":"GHSA-6h2x-m376-mqjq","dataSource":"https://github.com/advisories/GHSA-6h2x-m376-mqjq","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/hapijs/joi/security/advisories/GHSA-6h2x-m376-mqjq","https://github.com/hapijs/joi/pull/3143","https://github.com/hapijs/joi/pull/3145","https://github.com/hapijs/joi/commit/115e7b58d5eaaecc5e9b7093d41899ad6fb053ec","https://github.com/hapijs/joi/commit/e70df424c367f2976db63b089504413744a21245","https://nvd.nist.gov/vuln/detail/CVE-2026-92599","https://www.vulncheck.com/advisories/joi-before-17.13.7-and-18.2.6-redos-via-isodate"],"description":"joi: Quadratic regular-expression backtracking in `Joi.string().isoDate()`","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-92599","epss":0.00582,"percentile":0.47802,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-92599","cwe":"CWE-1333","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["17.13.7"],"state":"fixed","available":[{"version":"17.13.7","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.45396},"relatedVulnerabilities":[{"id":"CVE-2026-92599","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92599","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/hapijs/joi/security/advisories/GHSA-6h2x-m376-mqjq","https://www.vulncheck.com/advisories/joi-before-17.13.7-and-18.2.6-redos-via-isodate"],"description":"joi (npm package `joi`, hapi.js) versions >=17.2.0 <17.13.7 and >=18.0.0 <18.2.6 are vulnerable to regular expression denial of service in the `Joi.string().isoDate()` validation rule. One of the regular expressions the rule applies to the input is unanchored, so a valid ISO date followed by a long run of fractional-second digits causes the regex engine to restart its search from every position in the string, yielding time proportional to the square of the input length (about 1.4 s for 64 KB of digits and about 22 s for 256 KB). A remote attacker who can supply a string to an isoDate validation can stall the application with a single request. Fixed in 17.13.7 and 18.2.6; as a workaround, cap the length of the string before it reaches joi.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-92599","epss":0.00582,"percentile":0.47802,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-92599","cwe":"CWE-1333","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"joi","version":"17.13.4"}},"found":{"vulnerabilityID":"GHSA-6h2x-m376-mqjq","versionConstraint":">=17.2.0,<17.13.7 (semantic)"},"fix":{"suggestedVersion":"17.13.7"}}],"artifact":{"id":"pkg:npm/joi@17.13.4?package-id=72e4936d944f22ba","name":"joi","version":"17.13.4","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:joi:joi:17.13.4:*:*:*:*:*:*:*"],"purl":"pkg:npm/joi@17.13.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-g84c-rxfj-3j2c","dataSource":"https://github.com/advisories/GHSA-g84c-rxfj-3j2c","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/webpack/webpack-dev-middleware/security/advisories/GHSA-g84c-rxfj-3j2c","https://nvd.nist.gov/vuln/detail/CVE-2026-76844","https://github.com/webpack/webpack-dev-middleware/pull/2404","https://github.com/webpack/webpack-dev-middleware/commit/13344e78b26d88fe9b7c8381a3860e248a52359b","https://github.com/webpack/webpack-dev-middleware/commit/cefccbac330c29052fc6dffe85fd292ea2ac782b","https://github.com/advisories/GHSA-wr3j-pwj9-hqq6","https://github.com/webpack/webpack-dev-middleware/blob/v8.1.1/src/middleware.js","https://github.com/webpack/webpack-dev-middleware/releases/tag/v7.4.6","https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.3.0","https://www.vulncheck.com/advisories/webpack-dev-middleware-path-traversal-via-offset-slice-on-a-non-slash-terminated-publicpath"],"description":"webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.9,"impactScore":4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-76844","epss":0.00592,"percentile":0.48318,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-76844","cwe":"CWE-787","source":"disclosure@vulncheck.com","type":"Primary"}],"fix":{"versions":["7.4.6"],"state":"fixed","available":[{"version":"7.4.6","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.44104},"relatedVulnerabilities":[{"id":"CVE-2026-76844","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76844","namespace":"nvd:cpe","severity":"High","urls":["https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490","https://github.com/madler/zlib","https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393","https://github.com/madler/zlib/commit/df84af25dc1942490e1d1c899a07619152a46148","https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate"],"description":"zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write() fails, gz_write() returns without resetting strm.next_in, leaving it pointed at the caller's buffer. A later gz* write call then derives a position from the stale pointer and writes past a heap allocation; any write() failure reaches it, including EPIPE on a blocking descriptor, and in versions before 1.3.1.2 the failed write must be followed by a gzclearerr() call.","cvss":[{"source":"disclosure@vulncheck.com","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-76844","epss":0.00592,"percentile":0.48318,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-76844","cwe":"CWE-787","source":"disclosure@vulncheck.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"webpack-dev-middleware","version":"5.3.4"}},"found":{"vulnerabilityID":"GHSA-g84c-rxfj-3j2c","versionConstraint":"<7.4.5 (semantic)"},"fix":{"suggestedVersion":"7.4.6"}}],"artifact":{"id":"pkg:npm/webpack-dev-middleware@5.3.4?package-id=4091b076b779b8ca","name":"webpack-dev-middleware","version":"5.3.4","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:webpack-dev-middleware:webpack-dev-middleware:5.3.4:*:*:*:*:*:*:*","cpe:2.3:a:webpack-dev-middleware:webpack_dev_middleware:5.3.4:*:*:*:*:*:*:*","cpe:2.3:a:webpack_dev_middleware:webpack-dev-middleware:5.3.4:*:*:*:*:*:*:*","cpe:2.3:a:webpack_dev_middleware:webpack_dev_middleware:5.3.4:*:*:*:*:*:*:*","cpe:2.3:a:webpack-dev:webpack-dev-middleware:5.3.4:*:*:*:*:*:*:*","cpe:2.3:a:webpack-dev:webpack_dev_middleware:5.3.4:*:*:*:*:*:*:*","cpe:2.3:a:webpack_dev:webpack-dev-middleware:5.3.4:*:*:*:*:*:*:*","cpe:2.3:a:webpack_dev:webpack_dev_middleware:5.3.4:*:*:*:*:*:*:*","cpe:2.3:a:webpack:webpack-dev-middleware:5.3.4:*:*:*:*:*:*:*","cpe:2.3:a:webpack:webpack_dev_middleware:5.3.4:*:*:*:*:*:*:*"],"purl":"pkg:npm/webpack-dev-middleware@5.3.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-52cp-r559-cp3m","dataSource":"https://github.com/advisories/GHSA-52cp-r559-cp3m","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m","https://nvd.nist.gov/vuln/detail/CVE-2026-59869","https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7","https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4","https://github.com/nodeca/js-yaml/releases/tag/3.15.0","https://github.com/nodeca/js-yaml/releases/tag/4.3.0"],"description":"js-yaml: YAML merge-key chains can force quadratic CPU consumption","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59869","epss":0.00585,"percentile":0.47999,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59869","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.15.0"],"state":"fixed","available":[{"version":"3.15.0","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.43875},"relatedVulnerabilities":[{"id":"CVE-2026-59869","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59869","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7","https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4","https://github.com/nodeca/js-yaml/releases/tag/3.15.0","https://github.com/nodeca/js-yaml/releases/tag/4.3.0","https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m"],"description":"js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in versions 3.15.0 and 4.3.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59869","epss":0.00585,"percentile":0.47999,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59869","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"3.14.1"}},"found":{"vulnerabilityID":"GHSA-52cp-r559-cp3m","versionConstraint":">=3.0.0,<3.15.0 (semantic)"},"fix":{"suggestedVersion":"3.15.0"}}],"artifact":{"id":"pkg:npm/js-yaml@3.14.1?package-id=311bc8b23a1591c7","name":"js-yaml","version":"3.14.1","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:nodeca:js-yaml:3.14.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@3.14.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-52cp-r559-cp3m","dataSource":"https://github.com/advisories/GHSA-52cp-r559-cp3m","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m","https://nvd.nist.gov/vuln/detail/CVE-2026-59869","https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7","https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4","https://github.com/nodeca/js-yaml/releases/tag/3.15.0","https://github.com/nodeca/js-yaml/releases/tag/4.3.0"],"description":"js-yaml: YAML merge-key chains can force quadratic CPU consumption","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59869","epss":0.00585,"percentile":0.47999,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59869","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.3.0"],"state":"fixed","available":[{"version":"4.3.0","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.43875},"relatedVulnerabilities":[{"id":"CVE-2026-59869","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59869","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7","https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4","https://github.com/nodeca/js-yaml/releases/tag/3.15.0","https://github.com/nodeca/js-yaml/releases/tag/4.3.0","https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m"],"description":"js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in versions 3.15.0 and 4.3.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59869","epss":0.00585,"percentile":0.47999,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59869","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"4.1.0"}},"found":{"vulnerabilityID":"GHSA-52cp-r559-cp3m","versionConstraint":">=4.0.0,<4.3.0 (semantic)"},"fix":{"suggestedVersion":"4.3.0"}}],"artifact":{"id":"pkg:npm/js-yaml@4.1.0?package-id=27f207f3c57cf9f3","name":"js-yaml","version":"4.1.0","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:nodeca:js-yaml:4.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@4.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-7r86-cg39-jmmj","dataSource":"https://github.com/advisories/GHSA-7r86-cg39-jmmj","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj","https://nvd.nist.gov/vuln/detail/CVE-2026-27903","https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748"],"description":"minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27903","epss":0.00576,"percentile":0.47498,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27903","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.1.3"],"state":"fixed","available":[{"version":"3.1.3","date":"2026-02-27","kind":"first-observed"}]},"advisories":[],"risk":0.432},"relatedVulnerabilities":[{"id":"CVE-2026-27903","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27903","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent `**` (GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where `n` is the number of path segments and `k` is the number of globstars. With k=11 and n=30, a call to the default `minimatch()` API stalls for roughly 5 seconds. With k=13, it exceeds 15 seconds. No memoization or call budget exists to bound this behavior. Any application where an attacker can influence the glob pattern passed to `minimatch()` is vulnerable. The realistic attack surface includes build tools and task runners that accept user-supplied glob arguments (ESLint, Webpack, Rollup config), multi-tenant systems where one tenant configures glob-based rules that run in a shared process, admin or developer interfaces that accept ignore-rule or filter configuration as globs, and CI/CD pipelines that evaluate user-submitted config files containing glob patterns. An attacker who can place a crafted pattern into any of these paths can stall the Node.js event loop for tens of seconds per invocation. The pattern is 56 bytes for a 5-second stall and does not require authentication in contexts where pattern input is part of the feature. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3 fix the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27903","epss":0.00576,"percentile":0.47498,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27903","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.0.4"}},"found":{"vulnerabilityID":"GHSA-7r86-cg39-jmmj","versionConstraint":"<3.1.3 (semantic)"},"fix":{"suggestedVersion":"3.1.3"}}],"artifact":{"id":"pkg:npm/minimatch@3.0.4?package-id=4657685090d0c0b4","name":"minimatch","version":"3.0.4","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.0.4:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.0.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-7r86-cg39-jmmj","dataSource":"https://github.com/advisories/GHSA-7r86-cg39-jmmj","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj","https://nvd.nist.gov/vuln/detail/CVE-2026-27903","https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748"],"description":"minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27903","epss":0.00576,"percentile":0.47498,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27903","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.1.3"],"state":"fixed","available":[{"version":"3.1.3","date":"2026-02-27","kind":"first-observed"}]},"advisories":[],"risk":0.432},"relatedVulnerabilities":[{"id":"CVE-2026-27903","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27903","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent `**` (GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where `n` is the number of path segments and `k` is the number of globstars. With k=11 and n=30, a call to the default `minimatch()` API stalls for roughly 5 seconds. With k=13, it exceeds 15 seconds. No memoization or call budget exists to bound this behavior. Any application where an attacker can influence the glob pattern passed to `minimatch()` is vulnerable. The realistic attack surface includes build tools and task runners that accept user-supplied glob arguments (ESLint, Webpack, Rollup config), multi-tenant systems where one tenant configures glob-based rules that run in a shared process, admin or developer interfaces that accept ignore-rule or filter configuration as globs, and CI/CD pipelines that evaluate user-submitted config files containing glob patterns. An attacker who can place a crafted pattern into any of these paths can stall the Node.js event loop for tens of seconds per invocation. The pattern is 56 bytes for a 5-second stall and does not require authentication in contexts where pattern input is part of the feature. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3 fix the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27903","epss":0.00576,"percentile":0.47498,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27903","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-7r86-cg39-jmmj","versionConstraint":"<3.1.3 (semantic)"},"fix":{"suggestedVersion":"3.1.3"}}],"artifact":{"id":"pkg:npm/minimatch@3.1.2?package-id=0d0adedb8aec12d6","name":"minimatch","version":"3.1.2","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-wf5p-g6vw-rhxx","dataSource":"https://github.com/advisories/GHSA-wf5p-g6vw-rhxx","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2023-45857","https://github.com/axios/axios/issues/6006","https://github.com/axios/axios/issues/6022","https://github.com/axios/axios/pull/6028","https://github.com/axios/axios/commit/96ee232bd3ee4de2e657333d4d2191cd389e14d0","https://github.com/axios/axios/releases/tag/v1.6.0","https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459","https://github.com/axios/axios/pull/6091","https://github.com/axios/axios/commit/2755df562b9c194fba6d8b609a383443f6a6e967","https://github.com/axios/axios/releases/tag/v0.28.0","https://security.netapp.com/advisory/ntap-20240621-0006"],"description":"Axios Cross-Site Request Forgery Vulnerability","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-45857","epss":0.00729,"percentile":0.54252,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2023-45857","cwe":"CWE-352","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["0.28.0"],"state":"fixed","available":[{"version":"0.28.0","date":"2024-02-21","kind":"first-observed"}]},"advisories":[],"risk":0.4191749999999999},"relatedVulnerabilities":[{"id":"CVE-2023-45857","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-45857","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/axios/axios/issues/6006","https://security.netapp.com/advisory/ntap-20240621-0006/"],"description":"An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-45857","epss":0.00729,"percentile":0.54252,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2023-45857","cwe":"CWE-352","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"0.25.0"}},"found":{"vulnerabilityID":"GHSA-wf5p-g6vw-rhxx","versionConstraint":">=0.8.1,<0.28.0 (semantic)"},"fix":{"suggestedVersion":"0.28.0"}}],"artifact":{"id":"pkg:npm/axios@0.25.0?package-id=f91bce3cf8a711bf","name":"axios","version":"0.25.0","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:axios:axios:0.25.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@0.25.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-7wch-p9px-956x","dataSource":"https://github.com/advisories/GHSA-7wch-p9px-956x","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/digitalbazaar/forge/security/advisories/GHSA-7wch-p9px-956x","https://nvd.nist.gov/vuln/detail/CVE-2026-118779","https://github.com/digitalbazaar/forge/commit/412345db583cd28a9d23636d0d93e9f751b935f3","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1"],"description":"Forge: Regular expression denial of service in PEM decoding (pem.decode)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118779","epss":0.00556,"percentile":0.46406,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118779","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-118779","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.4.1"],"state":"fixed","available":[{"version":"1.4.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.41700000000000004},"relatedVulnerabilities":[{"id":"CVE-2026-118779","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118779","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/digitalbazaar/forge/commit/412345db583cd28a9d23636d0d93e9f751b935f3","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","https://github.com/digitalbazaar/forge/security/advisories/GHSA-7wch-p9px-956x"],"description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used pem.decode(), lib/pem.js, missing END line to process the relevant input or security decision. node-forge used polynomial-time regular expressions in pem.decode(), including when searching for a matching END line and parsing encapsulated headers. An unauthenticated attacker able to supply PEM input to any high-level parser could consume excessive CPU with a long malformed message and cause denial of service. This issue is fixed in version 1.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118779","epss":0.00556,"percentile":0.46406,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118779","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-118779","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"node-forge","version":"1.4.0"}},"found":{"vulnerabilityID":"GHSA-7wch-p9px-956x","versionConstraint":"<=1.4.0 (semantic)"},"fix":{"suggestedVersion":"1.4.1"}}],"artifact":{"id":"pkg:npm/node-forge@1.4.0?package-id=256486d336435126","name":"node-forge","version":"1.4.0","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:digitalbazaar:forge:1.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/node-forge@1.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-j5f8-grm9-p9fc","dataSource":"https://github.com/advisories/GHSA-j5f8-grm9-p9fc","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-j5f8-grm9-p9fc","https://github.com/axios/axios/pull/10794","https://github.com/axios/axios/commit/afca61a070728e717203c2bc21e7b589b59b858b","https://github.com/axios/axios/releases/tag/v0.32.0","https://github.com/axios/axios/releases/tag/v1.16.0","https://nvd.nist.gov/vuln/detail/CVE-2026-44486"],"description":"Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44486","epss":0.00552,"percentile":0.46149,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44486","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-44486","cwe":"CWE-201","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["0.32.0"],"state":"fixed","available":[{"version":"0.32.0","date":"2026-06-04","kind":"first-observed"}]},"advisories":[],"risk":0.414},"relatedVulnerabilities":[{"id":"CVE-2026-44486","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44486","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-j5f8-grm9-p9fc","https://access.redhat.com/errata/RHSA-2026:20889","https://access.redhat.com/errata/RHSA-2026:20938","https://access.redhat.com/errata/RHSA-2026:27044","https://access.redhat.com/errata/RHSA-2026:27063","https://access.redhat.com/errata/RHSA-2026:28964","https://access.redhat.com/errata/RHSA-2026:29082","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:30650","https://access.redhat.com/errata/RHSA-2026:30651","https://access.redhat.com/errata/RHSA-2026:33155","https://access.redhat.com/errata/RHSA-2026:33160","https://access.redhat.com/errata/RHSA-2026:33163","https://access.redhat.com/errata/RHSA-2026:33173","https://access.redhat.com/errata/RHSA-2026:33183","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:34766","https://access.redhat.com/errata/RHSA-2026:36611","https://access.redhat.com/errata/RHSA-2026:36754","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:36882","https://access.redhat.com/errata/RHSA-2026:36883","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41055","https://access.redhat.com/errata/RHSA-2026:41064","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:42078","https://access.redhat.com/errata/RHSA-2026:42085","https://access.redhat.com/errata/RHSA-2026:42142","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:46885","https://access.redhat.com/errata/RHSA-2026:46903","https://access.redhat.com/errata/RHSA-2026:50300","https://access.redhat.com/errata/RHSA-2026:50681","https://access.redhat.com/errata/RHSA-2026:54188","https://access.redhat.com/errata/RHSA-2026:54206","https://access.redhat.com/errata/RHSA-2026:57191","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-44486","https://bugzilla.redhat.com/show_bug.cgi?id=2487947","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44486.json"],"description":"Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a request is sent through an authenticated proxy, Axios may add a Proxy-Authorization header. If Axios then follows a redirect and the redirected request is no longer sent through that proxy, the stale Proxy-Authorization header can remain on the redirected request and be sent to the redirect target. This affects Node.js's use of Axios with automatic redirects enabled and an authenticated proxy configuration. Browser adapters are not affected. This vulnerability is fixed in 0.32.0 and 1.16.0.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44486","epss":0.00552,"percentile":0.46149,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44486","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-44486","cwe":"CWE-201","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"0.25.0"}},"found":{"vulnerabilityID":"GHSA-j5f8-grm9-p9fc","versionConstraint":"<=0.31.1 (semantic)"},"fix":{"suggestedVersion":"0.32.0"}}],"artifact":{"id":"pkg:npm/axios@0.25.0?package-id=f91bce3cf8a711bf","name":"axios","version":"0.25.0","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:axios:axios:0.25.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@0.25.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-w27v-7q3p-w38r","dataSource":"https://github.com/advisories/GHSA-w27v-7q3p-w38r","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/svg/svgo/security/advisories/GHSA-w27v-7q3p-w38r","https://nvd.nist.gov/vuln/detail/CVE-2026-84370","https://github.com/svg/svgo/pull/2268","https://github.com/svg/svgo/pull/2269","https://github.com/svg/svgo/pull/2272","https://github.com/svg/svgo/commit/0557385564a5c6c11d76cd934a6cff94451e532c","https://github.com/svg/svgo/commit/3db3ef33e409a0bc0fdaf255e46c908b00e93bc2","https://github.com/svg/svgo/commit/994a9f00d79ddec68ce19a1ce9eb8ca08d747e4f","https://github.com/svg/svgo/releases/tag/v2.8.4","https://github.com/svg/svgo/releases/tag/v3.3.5","https://github.com/svg/svgo/releases/tag/v4.1.0"],"description":"SVGO: removeScripts allows executable links through namespace and control-character bypasses","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":2.9,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84370","epss":0.00525,"percentile":0.4452,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84370","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-84370","cwe":"CWE-184","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.8.4"],"state":"fixed","available":[{"version":"2.8.4","date":"2026-09-09","kind":"first-observed"}]},"advisories":[],"risk":0.41212499999999996},"relatedVulnerabilities":[{"id":"CVE-2026-84370","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84370","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/svg/svgo/commit/0557385564a5c6c11d76cd934a6cff94451e532c","https://github.com/svg/svgo/commit/3db3ef33e409a0bc0fdaf255e46c908b00e93bc2","https://github.com/svg/svgo/commit/994a9f00d79ddec68ce19a1ce9eb8ca08d747e4f","https://github.com/svg/svgo/pull/2268","https://github.com/svg/svgo/pull/2269","https://github.com/svg/svgo/pull/2272","https://github.com/svg/svgo/releases/tag/v2.8.4","https://github.com/svg/svgo/releases/tag/v3.3.5","https://github.com/svg/svgo/releases/tag/v4.1.0","https://github.com/svg/svgo/security/advisories/GHSA-w27v-7q3p-w38r"],"description":"SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3, incompletely filters executable links in plugins/removeScripts.js and lib/svgo/tools.js. The plugin does not recognize namespace-prefixed SVG anchor elements such as svg:a with href or namespaced *:href values, and it does not remove ASCII tab, line-feed, or carriage-return characters before checking URL schemes. Browsers remove those characters before parsing a scheme, allowing an executable link to pass the plugin's check. When an application processes attacker-controlled SVG input and serves the result in an active browser context, a victim who activates the surviving link can execute script in the SVG's origin, expose data, modify content, or perform actions as the victim. This issue is fixed in versions 2.8.4, 3.3.5, and 4.1.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":2.9,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84370","epss":0.00525,"percentile":0.4452,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84370","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-84370","cwe":"CWE-184","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"svgo","version":"2.8.2"}},"found":{"vulnerabilityID":"GHSA-w27v-7q3p-w38r","versionConstraint":">=1.0.0,<2.8.4 (semantic)"},"fix":{"suggestedVersion":"2.8.4"}}],"artifact":{"id":"pkg:npm/svgo@2.8.2?package-id=12d712458b674253","name":"svgo","version":"2.8.2","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:svgo:svgo:2.8.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/svgo@2.8.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-2883-xcg3-v3hh","dataSource":"https://github.com/advisories/GHSA-2883-xcg3-v3hh","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh","https://nvd.nist.gov/vuln/detail/CVE-2026-84375","https://github.com/nodeca/js-yaml/pull/797","https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639","https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480","https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b","https://github.com/nodeca/js-yaml/releases/tag/3.15.2","https://github.com/nodeca/js-yaml/releases/tag/4.3.2"],"description":"js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84375","epss":0.00541,"percentile":0.45507,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84375","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-84375","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.15.2"],"state":"fixed","available":[{"version":"3.15.2","date":"2026-09-09","kind":"first-observed"}]},"advisories":[],"risk":0.40575000000000006},"relatedVulnerabilities":[{"id":"CVE-2026-84375","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84375","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639","https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480","https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b","https://github.com/nodeca/js-yaml/pull/797","https://github.com/nodeca/js-yaml/releases/tag/3.15.2","https://github.com/nodeca/js-yaml/releases/tag/4.3.2","https://github.com/nodeca/js-yaml/releases/tag/5.4.1","https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh"],"description":"js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2, 4.3.2, and 5.4.1, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key <<. An attacker can alias a large sequence of empty mappings into many merge targets, causing O(N * K) processing while totalMergeKeys remains unchanged and the configured resource limit is never reached. A relatively small YAML document can therefore cause prolonged CPU consumption in applications that parse untrusted YAML, and merge processing is enabled by default on these release lines. In v3 & v4, merge is enabled by default so the severity score is higher. This issue is fixed in versions 3.15.2, 4.3.2, and 5.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84375","epss":0.00541,"percentile":0.45507,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84375","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-84375","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"3.14.1"}},"found":{"vulnerabilityID":"GHSA-2883-xcg3-v3hh","versionConstraint":">=3.0.0,<3.15.2 (semantic)"},"fix":{"suggestedVersion":"3.15.2"}}],"artifact":{"id":"pkg:npm/js-yaml@3.14.1?package-id=311bc8b23a1591c7","name":"js-yaml","version":"3.14.1","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:nodeca:js-yaml:3.14.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@3.14.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-2883-xcg3-v3hh","dataSource":"https://github.com/advisories/GHSA-2883-xcg3-v3hh","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh","https://nvd.nist.gov/vuln/detail/CVE-2026-84375","https://github.com/nodeca/js-yaml/pull/797","https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639","https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480","https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b","https://github.com/nodeca/js-yaml/releases/tag/3.15.2","https://github.com/nodeca/js-yaml/releases/tag/4.3.2"],"description":"js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84375","epss":0.00541,"percentile":0.45507,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84375","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-84375","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.3.2"],"state":"fixed","available":[{"version":"4.3.2","date":"2026-09-09","kind":"first-observed"}]},"advisories":[],"risk":0.40575000000000006},"relatedVulnerabilities":[{"id":"CVE-2026-84375","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84375","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639","https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480","https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b","https://github.com/nodeca/js-yaml/pull/797","https://github.com/nodeca/js-yaml/releases/tag/3.15.2","https://github.com/nodeca/js-yaml/releases/tag/4.3.2","https://github.com/nodeca/js-yaml/releases/tag/5.4.1","https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh"],"description":"js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2, 4.3.2, and 5.4.1, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key <<. An attacker can alias a large sequence of empty mappings into many merge targets, causing O(N * K) processing while totalMergeKeys remains unchanged and the configured resource limit is never reached. A relatively small YAML document can therefore cause prolonged CPU consumption in applications that parse untrusted YAML, and merge processing is enabled by default on these release lines. In v3 & v4, merge is enabled by default so the severity score is higher. This issue is fixed in versions 3.15.2, 4.3.2, and 5.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84375","epss":0.00541,"percentile":0.45507,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84375","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-84375","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"4.1.0"}},"found":{"vulnerabilityID":"GHSA-2883-xcg3-v3hh","versionConstraint":">=4.0.0,<4.3.2 (semantic)"},"fix":{"suggestedVersion":"4.3.2"}}],"artifact":{"id":"pkg:npm/js-yaml@4.1.0?package-id=27f207f3c57cf9f3","name":"js-yaml","version":"4.1.0","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:nodeca:js-yaml:4.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@4.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-r28c-9q8g-f849","dataSource":"https://github.com/advisories/GHSA-r28c-9q8g-f849","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/postcss/postcss/security/advisories/GHSA-r28c-9q8g-f849","https://github.com/postcss/postcss/commit/95663d3eb7ba26f4854dd19d3b4f4425760cf56c","https://github.com/postcss/postcss/releases/tag/8.5.18"],"description":"PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73646","epss":0.0053,"percentile":0.44819,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73646","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["8.5.18"],"state":"fixed","available":[{"version":"8.5.18","date":"2026-07-24","kind":"first-observed"}]},"advisories":[],"risk":0.3975},"relatedVulnerabilities":[{"id":"CVE-2026-73646","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-73646","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/postcss/postcss/commit/95663d3eb7ba26f4854dd19d3b4f4425760cf56c","https://github.com/postcss/postcss/releases/tag/8.5.18","https://github.com/postcss/postcss/security/advisories/GHSA-r28c-9q8g-f849"],"description":"PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute .map paths, allowing untrusted CSS processed without map: false to disclose sourcesContent from arbitrary reachable .map files through result.map. This issue is fixed in version 8.5.18.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73646","epss":0.0053,"percentile":0.44819,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73646","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"postcss","version":"8.5.12"}},"found":{"vulnerabilityID":"GHSA-r28c-9q8g-f849","versionConstraint":"<=8.5.17 (semantic)"},"fix":{"suggestedVersion":"8.5.18"}}],"artifact":{"id":"pkg:npm/postcss@8.5.12?package-id=c33291281cf2cbae","name":"postcss","version":"8.5.12","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:postcss:postcss:8.5.12:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/postcss@8.5.12","upstreams":[]}},{"vulnerability":{"id":"GHSA-23c5-xmqv-rm74","dataSource":"https://github.com/advisories/GHSA-23c5-xmqv-rm74","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74","https://nvd.nist.gov/vuln/detail/CVE-2026-27904","https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce"],"description":"minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27904","epss":0.00525,"percentile":0.4453,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27904","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.1.4"],"state":"fixed","available":[{"version":"3.1.4","date":"2026-02-27","kind":"first-observed"}]},"advisories":[],"risk":0.39375},"relatedVulnerabilities":[{"id":"CVE-2026-27904","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27904","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default `minimatch()` API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects `+()` extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27904","epss":0.00525,"percentile":0.4453,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27904","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.0.4"}},"found":{"vulnerabilityID":"GHSA-23c5-xmqv-rm74","versionConstraint":"<3.1.4 (semantic)"},"fix":{"suggestedVersion":"3.1.4"}}],"artifact":{"id":"pkg:npm/minimatch@3.0.4?package-id=4657685090d0c0b4","name":"minimatch","version":"3.0.4","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.0.4:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.0.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-23c5-xmqv-rm74","dataSource":"https://github.com/advisories/GHSA-23c5-xmqv-rm74","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74","https://nvd.nist.gov/vuln/detail/CVE-2026-27904","https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce"],"description":"minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27904","epss":0.00525,"percentile":0.4453,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27904","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.1.4"],"state":"fixed","available":[{"version":"3.1.4","date":"2026-02-27","kind":"first-observed"}]},"advisories":[],"risk":0.39375},"relatedVulnerabilities":[{"id":"CVE-2026-27904","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27904","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default `minimatch()` API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects `+()` extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27904","epss":0.00525,"percentile":0.4453,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27904","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-23c5-xmqv-rm74","versionConstraint":"<3.1.4 (semantic)"},"fix":{"suggestedVersion":"3.1.4"}}],"artifact":{"id":"pkg:npm/minimatch@3.1.2?package-id=0d0adedb8aec12d6","name":"minimatch","version":"3.1.2","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-37ch-88jc-xwx2","dataSource":"https://github.com/advisories/GHSA-37ch-88jc-xwx2","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-37ch-88jc-xwx2","https://nvd.nist.gov/vuln/detail/CVE-2026-4867","https://blakeembrey.com/posts/2024-09-web-redos","https://cna.openjsf.org/security-advisories.html","https://github.com/advisories/GHSA-9wv6-86v2-598j","https://github.com/pillarjs/path-to-regexp/releases/tag/v.0.1.13"],"description":"path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-4867","epss":0.00515,"percentile":0.43912,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-4867","cwe":"CWE-1333","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["0.1.13"],"state":"fixed","available":[{"version":"0.1.13","date":"2026-03-28","kind":"first-observed"}]},"advisories":[],"risk":0.38625},"relatedVulnerabilities":[{"id":"CVE-2026-4867","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4867","namespace":"nvd:cpe","severity":"High","urls":["https://blakeembrey.com/posts/2024-09-web-redos","https://cna.openjsf.org/security-advisories.html","https://github.com/advisories/GHSA-9wv6-86v2-598j"],"description":"Impact:\n\nA bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period (.). For example, /:a-:b-:c or /:a-:b-:c-:d. The backtrack protection added in path-to-regexp@0.1.12 only prevents ambiguity for two parameters. With three or more, the generated lookahead does not block single separator characters, so capture groups overlap and cause catastrophic backtracking.\n\nPatches:\n\nUpgrade to path-to-regexp@0.1.13\n\nCustom regex patterns in route definitions (e.g., /:a-:b([^-/]+)-:c([^-/]+)) are not affected because they override the default capture group.\n\nWorkarounds:\n\nAll versions can be patched by providing a custom regular expression for parameters after the first in a single segment. As long as the custom regular expression does not match the text before the parameter, you will be safe. For example, change /:a-:b-:c to /:a-:b([^-/]+)-:c([^-/]+).\n\nIf paths cannot be rewritten and versions cannot be upgraded, another alternative is to limit the URL length.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-4867","epss":0.00515,"percentile":0.43912,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-4867","cwe":"CWE-1333","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"path-to-regexp","version":"0.1.12"}},"found":{"vulnerabilityID":"GHSA-37ch-88jc-xwx2","versionConstraint":"<0.1.13 (semantic)"},"fix":{"suggestedVersion":"0.1.13"}}],"artifact":{"id":"pkg:npm/path-to-regexp@0.1.12?package-id=4a606e4fc7d5f851","name":"path-to-regexp","version":"0.1.12","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:pillarjs:path-to-regexp:0.1.12:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/path-to-regexp@0.1.12","upstreams":[]}},{"vulnerability":{"id":"GO-2026-6355","dataSource":"https://go.dev/issue/81317","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/cl/826524","https://groups.google.com/g/golang-announce/c/1y3fb2np35U"],"description":"Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection.\n\nNow, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-56855","epss":0.005,"percentile":0.4287,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-56855","cwe":"CWE-770","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.56.0"],"state":"fixed","available":[{"version":"0.56.0","date":"2026-09-02","kind":"release"}]},"advisories":[],"risk":0.375},"relatedVulnerabilities":[{"id":"CVE-2026-56855","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56855","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/826524","https://go.dev/issue/81317","https://groups.google.com/g/golang-announce/c/1y3fb2np35U","https://pkg.go.dev/vuln/GO-2026-6355"],"description":"Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-56855","epss":0.005,"percentile":0.4287,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-56855","cwe":"CWE-770","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/crypto","version":"v0.53.0"}},"found":{"vulnerabilityID":"GO-2026-6355","versionConstraint":"<0.56.0 (go)"},"fix":{"suggestedVersion":"0.56.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.53.0?package-id=0a9169df163c853a","name":"golang.org/x/crypto","version":"v0.53.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:crypto:v0.53.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.53.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.53.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto="}}},{"vulnerability":{"id":"GHSA-8r9p-f939-6h3c","dataSource":"https://github.com/advisories/GHSA-8r9p-f939-6h3c","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-8r9p-f939-6h3c","https://nvd.nist.gov/vuln/detail/CVE-2026-111755","https://github.com/follow-redirects/follow-redirects/commit/080a76d0e125b37bf81717368a61d5dc37aa56c8","https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1"],"description":"follow-redirects sensitiveHeaders regex escaping can expose credential headers","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111755","epss":0.00471,"percentile":0.40769,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111755","cwe":"CWE-185","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-111755","cwe":"CWE-200","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["1.16.1"],"state":"fixed","available":[{"version":"1.16.1","date":"2026-10-21","kind":"first-observed"}]},"advisories":[],"risk":0.3697349999999999},"relatedVulnerabilities":[{"id":"CVE-2026-111755","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111755","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/follow-redirects/follow-redirects/commit/080a76d0e125b37bf81717368a61d5dc37aa56c8","https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1","https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-8r9p-f939-6h3c"],"description":"follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.1, escapeRegex leaves valid header-name metacharacters unescaped in sensitiveHeaders. When an application declares a sensitive header whose name contains ^ or | and follows a cross-origin or HTTPS-to-HTTP redirect, unescaped regular-expression metacharacters prevent the generated filter from matching the declared header name, and the credential header is forwarded to an attacker-controlled redirect target. This issue is fixed in version 1.16.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111755","epss":0.00471,"percentile":0.40769,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111755","cwe":"CWE-185","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-111755","cwe":"CWE-200","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"follow-redirects","version":"1.16.0"}},"found":{"vulnerabilityID":"GHSA-8r9p-f939-6h3c","versionConstraint":">=1.16.0,<1.16.1 (semantic)"},"fix":{"suggestedVersion":"1.16.1"}}],"artifact":{"id":"pkg:npm/follow-redirects@1.16.0?package-id=253204e466e2b8c0","name":"follow-redirects","version":"1.16.0","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:follow-redirects:follow_redirects:1.16.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/follow-redirects@1.16.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-q3jh-wrc6-jgq8","dataSource":"https://github.com/advisories/GHSA-q3jh-wrc6-jgq8","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-q3jh-wrc6-jgq8","https://github.com/follow-redirects/follow-redirects/commit/9865ca45490e4d0f7b6944870318408344570aff","https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1"],"description":"follow-redirects array-form headers bypass cross-origin credential stripping","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111756","epss":0.00471,"percentile":0.40769,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111756","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-111756","cwe":"CWE-212","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.16.1"],"state":"fixed","available":[{"version":"1.16.1","date":"2026-10-21","kind":"first-observed"}]},"advisories":[],"risk":0.3697349999999999},"relatedVulnerabilities":[{"id":"CVE-2026-111756","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111756","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/follow-redirects/follow-redirects/commit/9865ca45490e4d0f7b6944870318408344570aff","https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1","https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-q3jh-wrc6-jgq8"],"description":"follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to before version 1.16.1, follow-redirects removes sensitive credential headers (Authorization, Proxy-Authorization, Cookie, and any caller-declared sensitiveHeaders) before following a redirect that crosses to a different host or downgrades to a less secure protocol. The removal routine iterates the caller's headers container with for...in and matches header names against a filter. This assumes the headers container is a plain object keyed by header names. Node's underlying http.request, which follow-redirects is a drop-in replacement for, also accepts headers as an alternating array of names and values. For an array, for...in yields the numeric indices \"0\", \"1\", \"2\" and so on, which never match a header-name filter, so nothing is removed. An application that sends array-form headers and follows an attacker-controlled cross-origin redirect therefore forwards its Authorization, Cookie, and Proxy-Authorization headers verbatim to the attacker-controlled destination, with no error or warning. The sensitiveHeaders option added to fix CVE-2026-40895 / GHSA-r4q5-vmmm-2653 is equally ineffective, because it relies on the same helper. This is an unauthenticated confidentiality vulnerability: any remote server the victim application contacts can harvest the victim's credential headers by responding with a cross-origin redirect. This issue has been patched in version 1.16.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111756","epss":0.00471,"percentile":0.40769,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111756","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-111756","cwe":"CWE-212","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"follow-redirects","version":"1.16.0"}},"found":{"vulnerabilityID":"GHSA-q3jh-wrc6-jgq8","versionConstraint":">=1.16.0,<1.16.1 (semantic)"},"fix":{"suggestedVersion":"1.16.1"}}],"artifact":{"id":"pkg:npm/follow-redirects@1.16.0?package-id=253204e466e2b8c0","name":"follow-redirects","version":"1.16.0","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:follow-redirects:follow_redirects:1.16.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/follow-redirects@1.16.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-qhr7-859c-m2p7","dataSource":"https://github.com/advisories/GHSA-qhr7-859c-m2p7","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7","https://nvd.nist.gov/vuln/detail/CVE-2026-102278","https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db"],"description":"brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102278","epss":0.00491,"percentile":0.42217,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102278","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102278","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.1.20"],"state":"fixed","available":[{"version":"1.1.20","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.36825},"relatedVulnerabilities":[{"id":"CVE-2026-102278","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102278","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102278","epss":0.00491,"percentile":0.42217,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102278","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102278","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.13"}},"found":{"vulnerabilityID":"GHSA-qhr7-859c-m2p7","versionConstraint":"<1.1.20 (semantic)"},"fix":{"suggestedVersion":"1.1.20"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.13?package-id=3a0d56dc8df5e29f","name":"brace-expansion","version":"1.1.13","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.13","upstreams":[]}},{"vulnerability":{"id":"GO-2026-6617","dataSource":"https://go.dev/cl/847188","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/cl/847313","https://go.dev/issue/81867","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"],"description":"HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-97032","epss":0.0049,"percentile":0.42162,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-97032","cwe":"CWE-362","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.60.0"],"state":"fixed","available":[{"version":"0.60.0","date":"2026-10-08","kind":"release"}]},"advisories":[],"risk":0.3675},"relatedVulnerabilities":[{"id":"CVE-2026-97032","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97032","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/847188","https://go.dev/cl/847313","https://go.dev/issue/81867","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://pkg.go.dev/vuln/GO-2026-6617"],"description":"HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-97032","epss":0.0049,"percentile":0.42162,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-97032","cwe":"CWE-362","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.56.0"}},"found":{"vulnerabilityID":"GO-2026-6617","versionConstraint":"<0.60.0 (go)"},"fix":{"suggestedVersion":"0.60.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.56.0?package-id=4ad2b62edbe56c92","name":"golang.org/x/net","version":"v0.56.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.56.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.56.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.56.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o="}}},{"vulnerability":{"id":"GHSA-vc2v-76pw-4v95","dataSource":"https://github.com/advisories/GHSA-vc2v-76pw-4v95","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/expressjs/compression/security/advisories/GHSA-vc2v-76pw-4v95","https://nvd.nist.gov/vuln/detail/CVE-2026-87776","https://github.com/expressjs/compression/commit/151f63e91e1b64f8fb0b064e19321a4f28db6bff","https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/compression/releases/tag/v1.8.2"],"description":"compression vulnerable to Denial of Service via memory leak on premature response close","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-87776","epss":0.00477,"percentile":0.41243,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-87776","cwe":"CWE-401","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-87776","cwe":"CWE-459","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["1.8.2"],"state":"fixed","available":[{"version":"1.8.2","date":"2026-10-06","kind":"first-observed"}]},"advisories":[],"risk":0.35775},"relatedVulnerabilities":[{"id":"CVE-2026-87776","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87776","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/compression/security/advisories/GHSA-vc2v-76pw-4v95"],"description":"compression is a Node.js and Express compression middleware. In versions before 1.8.2, when a client aborts the connection while a compressed response is still being sent, the zlib stream created to compress that response is never destroyed, so each aborted compressed response leaks its native zlib memory. A remote unauthenticated attacker can repeatedly open requests and disconnect early, exhausting the available memory and crashing the server. All applications using compression are affected. The issue is fixed in compression 1.8.2, and users should upgrade to 1.8.2 or later.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-87776","epss":0.00477,"percentile":0.41243,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-87776","cwe":"CWE-401","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-87776","cwe":"CWE-459","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"compression","version":"1.7.4"}},"found":{"vulnerabilityID":"GHSA-vc2v-76pw-4v95","versionConstraint":"<1.8.2 (semantic)"},"fix":{"suggestedVersion":"1.8.2"}}],"artifact":{"id":"pkg:npm/compression@1.7.4?package-id=abec9731d43dfd95","name":"compression","version":"1.7.4","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:compression:compression:1.7.4:*:*:*:*:*:*:*"],"purl":"pkg:npm/compression@1.7.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-68fv-2mgg-jv7q","dataSource":"https://github.com/advisories/GHSA-68fv-2mgg-jv7q","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-93749","https://github.com/7rulnik/source-map-js/issues/76","https://github.com/7rulnik/source-map-js","https://github.com/7rulnik/source-map-js/blob/c1cd8904bb7bd0c7fb5879fcda48134d82a27934/lib/source-node.js#L115-L118","https://www.vulncheck.com/advisories/source-map-js-through-1.2.1-event-loop-denial-of-service","https://github.com/7rulnik/source-map-js/pull/79","https://github.com/7rulnik/source-map-js/commit/cf7658058ceeaa8619d5ae0ec90be6905209d016","https://github.com/7rulnik/source-map-js/releases/tag/v1.2.2"],"description":"source-map-js allows event-loop denial of service through indexed source-map section offsets","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-93749","epss":0.00455,"percentile":0.3952,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-93749","cwe":"CWE-1284","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["1.2.2"],"state":"fixed","available":[{"version":"1.2.2","date":"2026-10-06","kind":"first-observed"}]},"advisories":[],"risk":0.35490000000000005},"relatedVulnerabilities":[{"id":"CVE-2026-93749","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93749","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/7rulnik/source-map-js","https://github.com/7rulnik/source-map-js/blob/c1cd8904bb7bd0c7fb5879fcda48134d82a27934/lib/source-node.js#L115-L118","https://github.com/7rulnik/source-map-js/issues/76","https://www.vulncheck.com/advisories/source-map-js-through-1.2.1-event-loop-denial-of-service"],"description":"source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the service from handling other requests.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-93749","epss":0.00455,"percentile":0.3952,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-93749","cwe":"CWE-1284","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"source-map-js","version":"1.2.1"}},"found":{"vulnerabilityID":"GHSA-68fv-2mgg-jv7q","versionConstraint":">=1.0.0,<1.2.2 (semantic)"},"fix":{"suggestedVersion":"1.2.2"}}],"artifact":{"id":"pkg:npm/source-map-js@1.2.1?package-id=a01872f2b48e56cd","name":"source-map-js","version":"1.2.1","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:source-map-js:source-map-js:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:source-map-js:source_map_js:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:source_map_js:source-map-js:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:source_map_js:source_map_js:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:source-map:source-map-js:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:source-map:source_map_js:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:source_map:source-map-js:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:source_map:source_map_js:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:source:source-map-js:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:source:source_map_js:1.2.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/source-map-js@1.2.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-4528-x5fx-h6hg","dataSource":"https://github.com/advisories/GHSA-4528-x5fx-h6hg","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/hapijs/joi/security/advisories/GHSA-4528-x5fx-h6hg","https://nvd.nist.gov/vuln/detail/CVE-2026-118772","https://github.com/hapijs/joi/pull/3162","https://github.com/hapijs/joi/pull/3163","https://github.com/hapijs/joi/commit/03dc1d909818503b06240dadc81e9227ed2649cf","https://github.com/hapijs/joi/commit/807858d7480f5075b0610817e3e44230890fb18e","https://github.com/hapijs/joi/releases/tag/v17.13.9","https://github.com/hapijs/joi/releases/tag/v18.3.1"],"description":"joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118772","epss":0.00467,"percentile":0.40465,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118772","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["17.13.9"],"state":"fixed","available":[{"version":"17.13.9","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.35024999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-118772","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118772","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/hapijs/joi/commit/03dc1d909818503b06240dadc81e9227ed2649cf","https://github.com/hapijs/joi/commit/807858d7480f5075b0610817e3e44230890fb18e","https://github.com/hapijs/joi/pull/3162","https://github.com/hapijs/joi/pull/3163","https://github.com/hapijs/joi/releases/tag/v17.13.9","https://github.com/hapijs/joi/releases/tag/v18.3.1","https://github.com/hapijs/joi/security/advisories/GHSA-4528-x5fx-h6hg"],"description":"joi is a schema description language and data validator for JavaScript. From 17.1.1 until 17.13.9 and 18.3.1, the Joi.string().email({ multiple: true }) rule uses a separator regular expression whose leading whitespace quantifier is retried at every position in a long whitespace run that contains no separator, causing quadratic work during String.prototype.split. The behavior applies to the default separator and every custom separator. Applications that validate attacker-controlled values with the multiple option and no effective prior length limit can have the Node.js event loop blocked for seconds by one request, preventing other work. A .max() rule is not sufficient when abortEarly: false allows the email rule to run after the maximum-length check fails. This vulnerability is fixed in versions 17.13.9 and 18.3.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118772","epss":0.00467,"percentile":0.40465,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118772","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"joi","version":"17.13.4"}},"found":{"vulnerabilityID":"GHSA-4528-x5fx-h6hg","versionConstraint":">=17.1.1,<17.13.9 (semantic)"},"fix":{"suggestedVersion":"17.13.9"}}],"artifact":{"id":"pkg:npm/joi@17.13.4?package-id=72e4936d944f22ba","name":"joi","version":"17.13.4","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:joi:joi:17.13.4:*:*:*:*:*:*:*"],"purl":"pkg:npm/joi@17.13.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-58qx-3vcg-4xpx","dataSource":"https://github.com/advisories/GHSA-58qx-3vcg-4xpx","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/websockets/ws/security/advisories/GHSA-58qx-3vcg-4xpx","https://nvd.nist.gov/vuln/detail/CVE-2026-45736","https://github.com/websockets/ws/commit/c0327ec15a54d701eb6ccefaa8bef328cfc03086"],"description":"ws: Uninitialized memory disclosure","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.4,"exploitabilityScore":0.8,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-45736","epss":0.00745,"percentile":0.54803,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-45736","cwe":"CWE-908","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-45736","cwe":"CWE-824","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["8.20.1"],"state":"fixed","available":[{"version":"8.20.1","date":"2026-05-19","kind":"first-observed"}]},"advisories":[],"risk":0.35015},"relatedVulnerabilities":[{"id":"CVE-2026-45736","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45736","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/websockets/ws/commit/c0327ec15a54d701eb6ccefaa8bef328cfc03086","https://github.com/websockets/ws/security/advisories/GHSA-58qx-3vcg-4xpx","https://access.redhat.com/errata/RHSA-2026:26638","https://access.redhat.com/errata/RHSA-2026:26994","https://access.redhat.com/errata/RHSA-2026:27171","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:34374","https://access.redhat.com/errata/RHSA-2026:36754","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37272","https://access.redhat.com/errata/RHSA-2026:40768","https://access.redhat.com/errata/RHSA-2026:40792","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:44235","https://access.redhat.com/errata/RHSA-2026:44263","https://access.redhat.com/errata/RHSA-2026:44267","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:48693","https://access.redhat.com/errata/RHSA-2026:56366","https://access.redhat.com/errata/RHSA-2026:56431","https://access.redhat.com/errata/RHSA-2026:56928","https://access.redhat.com/errata/RHSA-2026:57013","https://access.redhat.com/errata/RHSA-2026:57590","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/errata/RHSA-2026:7655","https://access.redhat.com/security/cve/CVE-2026-45736","https://bugzilla.redhat.com/show_bug.cgi?id=2477914","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45736.json"],"description":"ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.4,"exploitabilityScore":0.8,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-45736","epss":0.00745,"percentile":0.54803,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-45736","cwe":"CWE-908","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-45736","cwe":"CWE-824","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"ws","version":"8.17.1"}},"found":{"vulnerabilityID":"GHSA-58qx-3vcg-4xpx","versionConstraint":">=8.0.0,<8.20.1 (semantic)"},"fix":{"suggestedVersion":"8.20.1"}}],"artifact":{"id":"pkg:npm/ws@8.17.1?package-id=e26dff1a6e55924f","name":"ws","version":"8.17.1","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:ws_project:ws:8.17.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/ws@8.17.1","upstreams":[]}},{"vulnerability":{"id":"GO-2026-6629","dataSource":"https://go.dev/cl/793360","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/issue/80112"],"description":"The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-56851","epss":0.00466,"percentile":0.40322,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-56851","cwe":"CWE-787","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.41.0"],"state":"fixed","available":[{"version":"0.41.0","date":"2026-08-11","kind":"release"}]},"advisories":[],"risk":0.3495},"relatedVulnerabilities":[{"id":"CVE-2026-56851","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56851","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/793360","https://go.dev/issue/80112","https://pkg.go.dev/vuln/GO-2026-6629"],"description":"The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-56851","epss":0.00466,"percentile":0.40322,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-56851","cwe":"CWE-787","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/text","version":"v0.39.0"}},"found":{"vulnerabilityID":"GO-2026-6629","versionConstraint":"<0.41.0 (go)"},"fix":{"suggestedVersion":"0.41.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/text@v0.39.0?package-id=834486224b22487e","name":"golang.org/x/text","version":"v0.39.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:text:v0.39.0:*:*:*:*:*:*:*"],"purl":"pkg:golang/golang.org/x/text@v0.39.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:UbZz4pLOvn600D6Oh6GGEI6VAmndrEBLv8/6BEXzyus="}}},{"vulnerability":{"id":"GHSA-xv26-6w52-cph6","dataSource":"https://github.com/advisories/GHSA-xv26-6w52-cph6","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/faye/websocket-driver-node/security/advisories/GHSA-xv26-6w52-cph6","https://github.com/faye/websocket-driver-node/releases/tag/0.7.5"],"description":"websocket-driver: Message corruption via abuse of protocol length headers","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N","metrics":{"baseScore":9.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-54466","epss":0.0038,"percentile":0.32008,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-54466","cwe":"CWE-130","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.7.5"],"state":"fixed","available":[{"version":"0.7.5","date":"2026-07-16","kind":"first-observed"}]},"advisories":[],"risk":0.3458},"relatedVulnerabilities":[{"id":"CVE-2026-54466","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54466","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/faye/websocket-driver-node/commit/5b197ca874dab58e96cacad8a3c256797d804680","https://github.com/faye/websocket-driver-node/security/advisories/GHSA-xv26-6w52-cph6"],"description":"websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, the frame format in draft versions of the WebSocket protocol includes a length header that allows an arbitrarily large integer to be encoded as a sequence of bytes with the high bit set. By sending an indefinite sequence of bytes with values 0x80 or above, a client can make the server parse these bytes into an ever-growing integer in lib/websocket/driver/draft75.js; because JavaScript numbers are 64-bit floating point values, this number will eventually lose precision and lead to the subsequent payload being parsed incorrectly. This issue is fixed in version 0.7.5.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-54466","epss":0.0038,"percentile":0.32008,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-54466","cwe":"CWE-130","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"websocket-driver","version":"0.7.4"}},"found":{"vulnerabilityID":"GHSA-xv26-6w52-cph6","versionConstraint":"<0.7.5 (semantic)"},"fix":{"suggestedVersion":"0.7.5"}}],"artifact":{"id":"pkg:npm/websocket-driver@0.7.4?package-id=1d15158e820d512f","name":"websocket-driver","version":"0.7.4","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:websocket-driver:websocket-driver:0.7.4:*:*:*:*:*:*:*","cpe:2.3:a:websocket-driver:websocket_driver:0.7.4:*:*:*:*:*:*:*","cpe:2.3:a:websocket_driver:websocket-driver:0.7.4:*:*:*:*:*:*:*","cpe:2.3:a:websocket_driver:websocket_driver:0.7.4:*:*:*:*:*:*:*","cpe:2.3:a:websocket:websocket-driver:0.7.4:*:*:*:*:*:*:*","cpe:2.3:a:websocket:websocket_driver:0.7.4:*:*:*:*:*:*:*"],"purl":"pkg:npm/websocket-driver@0.7.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-2p49-hgcm-8545","dataSource":"https://github.com/advisories/GHSA-2p49-hgcm-8545","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/svg/svgo/security/advisories/GHSA-2p49-hgcm-8545","https://github.com/svg/svgo/commit/628e3bc7336625a30365d0a9b60185307d852466","https://github.com/svg/svgo/commit/72a23886b4698b27624b936f3a15a80afd36d75f","https://github.com/svg/svgo/commit/f529cfccc6c154d6f6eabe276ec637a8c5db6763","https://github.com/svg/svgo/releases/tag/v2.8.3","https://github.com/svg/svgo/releases/tag/v3.3.4","https://github.com/svg/svgo/releases/tag/v4.0.2"],"description":"SVGO removeScripts plugin leaves some executable scripts intact","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":2.9,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73650","epss":0.00435,"percentile":0.37768,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73650","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-73650","cwe":"CWE-184","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.8.3"],"state":"fixed","available":[{"version":"2.8.3","date":"2026-07-22","kind":"first-observed"}]},"advisories":[],"risk":0.3414749999999999},"relatedVulnerabilities":[{"id":"CVE-2026-73650","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-73650","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/svg/svgo/commit/628e3bc7336625a30365d0a9b60185307d852466","https://github.com/svg/svgo/commit/72a23886b4698b27624b936f3a15a80afd36d75f","https://github.com/svg/svgo/commit/f529cfccc6c154d6f6eabe276ec637a8c5db6763","https://github.com/svg/svgo/releases/tag/v2.8.3","https://github.com/svg/svgo/releases/tag/v3.3.4","https://github.com/svg/svgo/releases/tag/v4.0.2","https://github.com/svg/svgo/security/advisories/GHSA-2p49-hgcm-8545"],"description":"SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.3, 3.3.4, and 4.0.2, the removeScripts plugin, named removeScriptElement in versions 1 through 3, can leave executable content in optimized SVGs because it does not remove namespaced or prefixed script elements such as <svg:script> and, in versions 3 and 4, matches JavaScript URIs case sensitively. Applications that process untrusted SVG input with this plugin enabled and serve the result can allow scripts to execute when another user opens the SVG, exposing local storage or cookies. This issue is fixed in versions 2.8.3, 3.3.4, and 4.0.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":2.9,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73650","epss":0.00435,"percentile":0.37768,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73650","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-73650","cwe":"CWE-184","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"svgo","version":"2.8.2"}},"found":{"vulnerabilityID":"GHSA-2p49-hgcm-8545","versionConstraint":">=1.0.0,<2.8.3 (semantic)"},"fix":{"suggestedVersion":"2.8.3"}}],"artifact":{"id":"pkg:npm/svgo@2.8.2?package-id=12d712458b674253","name":"svgo","version":"2.8.2","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:svgo:svgo:2.8.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/svgo@2.8.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-6j4f-fj2g-mc7p","dataSource":"https://github.com/advisories/GHSA-6j4f-fj2g-mc7p","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"],"description":"brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102276","epss":0.00455,"percentile":0.3952,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102276","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102276","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.1.19"],"state":"fixed","available":[{"version":"1.1.19","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.34125},"relatedVulnerabilities":[{"id":"CVE-2026-102276","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102276","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102276","epss":0.00455,"percentile":0.3952,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102276","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102276","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.13"}},"found":{"vulnerabilityID":"GHSA-6j4f-fj2g-mc7p","versionConstraint":"<1.1.19 (semantic)"},"fix":{"suggestedVersion":"1.1.19"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.13?package-id=3a0d56dc8df5e29f","name":"brace-expansion","version":"1.1.13","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-w3rx-r6r6-pgpr","dataSource":"https://github.com/advisories/GHSA-w3rx-r6r6-pgpr","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-71330","https://joshua.hu/image-size-infinite-loop-dos-vulnerabilities","https://web.archive.org/web/20260224152152/https://github.com/image-size/image-size/pull/439","https://www.vulncheck.com/advisories/image-size-denial-of-service-via-malformed-icns-image-parsing","https://codeberg.org/image-size/image-size/commit/e6e83a5578961de81f6d5834d90fb7430d8f29a5"],"description":"image-size: ICNS parser allows denial of service through an infinite loop","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-71330","epss":0.0043,"percentile":0.37292,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-71330","cwe":"CWE-835","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["2.0.3"],"state":"fixed","available":[{"version":"2.0.3","date":"2026-09-25","kind":"first-observed"}]},"advisories":[],"risk":0.33540000000000003},"relatedVulnerabilities":[{"id":"CVE-2025-71330","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-71330","namespace":"nvd:cpe","severity":"High","urls":["https://joshua.hu/image-size-infinite-loop-dos-vulnerabilities","https://web.archive.org/web/20260224152152/https://github.com/image-size/image-size/pull/439","https://www.vulncheck.com/advisories/image-size-denial-of-service-via-malformed-icns-image-parsing"],"description":"image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted ICNS image buffer. Attackers can craft an ICNS buffer containing valid magic bytes and a zero-valued entry length field to trigger an infinite loop in the ICNS parser, as the offset is never incremented when the entry length field is 0, causing the while loop condition to remain true indefinitely.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-71330","epss":0.0043,"percentile":0.37292,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-71330","cwe":"CWE-835","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"image-size","version":"1.0.1"}},"found":{"vulnerabilityID":"GHSA-w3rx-r6r6-pgpr","versionConstraint":">=0.6.3,<=2.0.2 (semantic)"},"fix":{"suggestedVersion":"2.0.3"}}],"artifact":{"id":"pkg:npm/image-size@1.0.1?package-id=ad3fed886c74ccb0","name":"image-size","version":"1.0.1","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:image-size:image-size:1.0.1:*:*:*:*:*:*:*","cpe:2.3:a:image-size:image_size:1.0.1:*:*:*:*:*:*:*","cpe:2.3:a:image_size:image-size:1.0.1:*:*:*:*:*:*:*","cpe:2.3:a:image_size:image_size:1.0.1:*:*:*:*:*:*:*","cpe:2.3:a:image:image-size:1.0.1:*:*:*:*:*:*:*","cpe:2.3:a:image:image_size:1.0.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/image-size@1.0.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-pqg4-j6r4-53mv","dataSource":"https://github.com/advisories/GHSA-pqg4-j6r4-53mv","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/ljharb/shell-quote/security/advisories/GHSA-pqg4-j6r4-53mv","https://nvd.nist.gov/vuln/detail/CVE-2026-102422","https://github.com/ljharb/shell-quote/commit/6002b2ed90c6b83095eb272b6b0adaf3a172b0bc"],"description":"shell-quote: `quote()` command injection via a line terminator in a token after a `{ comment }` token","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":9.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102422","epss":0.00378,"percentile":0.31768,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102422","cwe":"CWE-78","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}],"fix":{"versions":["1.11.0"],"state":"fixed","available":[{"version":"1.11.0","date":"2026-10-06","kind":"first-observed"}]},"advisories":[],"risk":0.33358499999999996},"relatedVulnerabilities":[{"id":"CVE-2026-102422","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102422","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/ljharb/shell-quote","https://github.com/ljharb/shell-quote/commit/6002b2ed90c6b83095eb272b6b0adaf3a172b0bc","https://github.com/ljharb/shell-quote/security/advisories/GHSA-pqg4-j6r4-53mv","https://www.npmjs.com/package/shell-quote"],"description":"shell-quote's `quote()` function emits a `{ comment }` token as `#` followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator (\\n, \\r, U+2028, U+2029) in that later string therefore ends the comment, and the rest of the string is parsed as shell input: `quote(['echo', 'ok', { comment: 'x' }, 'a\\nid;#'])` runs `id` in sh, bash, dash, ksh and zsh. `parse()` emits a comment token for a `#` in the middle of a word (for example `http://example.com/#frag`), so callers that combine `parse()` output with another untrusted string, such as `quote(parse(untrustedCommand).concat(untrustedArg))`, are affected. The fix for CVE-2026-9277 rejected line terminators in the comment's own text, but not in the tokens after it. Fixed in 1.11.0: `quote()` throws a `TypeError` when a string after a `{ comment }` token contains a line terminator.","cvss":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102422","epss":0.00378,"percentile":0.31768,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102422","cwe":"CWE-78","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"shell-quote","version":"1.8.4"}},"found":{"vulnerabilityID":"GHSA-pqg4-j6r4-53mv","versionConstraint":">=1.8.4,<1.11.0 (semantic)"},"fix":{"suggestedVersion":"1.11.0"}}],"artifact":{"id":"pkg:npm/shell-quote@1.8.4?package-id=3e49c091fe9371c3","name":"shell-quote","version":"1.8.4","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:shell-quote_project:shell-quote:1.8.4:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/shell-quote@1.8.4","upstreams":[]}},{"vulnerability":{"id":"GO-2026-6303","dataSource":"https://go.dev/issue/80213","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/cl/797040"],"description":"The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-56854","epss":0.00437,"percentile":0.38031,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-56854","cwe":"CWE-863","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.55.0"],"state":"fixed","available":[{"version":"0.55.0","date":"2026-08-11","kind":"release"}]},"advisories":[],"risk":0.32775},"relatedVulnerabilities":[{"id":"CVE-2026-56854","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56854","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/797040","https://go.dev/issue/80213","https://pkg.go.dev/vuln/GO-2026-6303"],"description":"The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-56854","epss":0.00437,"percentile":0.38031,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-56854","cwe":"CWE-863","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/crypto","version":"v0.53.0"}},"found":{"vulnerabilityID":"GO-2026-6303","versionConstraint":"<0.55.0 (go)"},"fix":{"suggestedVersion":"0.55.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.53.0?package-id=0a9169df163c853a","name":"golang.org/x/crypto","version":"v0.53.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:crypto:v0.53.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.53.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.53.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto="}}},{"vulnerability":{"id":"GHSA-v2hh-gcrm-f6hx","dataSource":"https://github.com/advisories/GHSA-v2hh-gcrm-f6hx","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-v2hh-gcrm-f6hx","https://nvd.nist.gov/vuln/detail/CVE-2026-16221","https://github.com/fastify/fast-uri/commit/0542a216860fd70c062a4730e620576f62ded057","https://github.com/fastify/fast-uri/commit/2d50fbabc80e4d0884fe0f6a98fe118ce6faa353","https://github.com/fastify/fast-uri/commit/9438266d6a7ded688c8bc7c4ba506da17f44a17b","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v2.4.3","https://github.com/fastify/fast-uri/releases/tag/v3.1.4","https://github.com/fastify/fast-uri/releases/tag/v4.1.1"],"description":"fast-uri vulnerable to host confusion via literal backslash authority delimiter","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-16221","epss":0.00436,"percentile":0.37868,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-16221","cwe":"CWE-436","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["3.1.4"],"state":"fixed","available":[{"version":"3.1.4","date":"2026-07-22","kind":"first-observed"}]},"advisories":[],"risk":0.327},"relatedVulnerabilities":[{"id":"CVE-2026-16221","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16221","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-v2hh-gcrm-f6hx"],"description":"Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Node's http and https clients, normalizes the backslash to a forward slash for special schemes such as http, https, ws, wss, ftp, and file. As a result, the two parsers extract different hosts from the same input string. Applications that use fast-uri to enforce host-based policy such as allowlists, denylists, loopback or SSRF filtering, redirect validation, or outbound proxy routing before passing the same URL into Node's URL or fetch consumers can be steered to an unintended destination, including cloud metadata endpoints, loopback, or internal hosts. \n\nPatches: upgrade to fast-uri 4.1.1, 3.1.4, or 2.4.3.\n\nWorkarounds: none.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-16221","epss":0.00436,"percentile":0.37868,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-16221","cwe":"CWE-436","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-v2hh-gcrm-f6hx","versionConstraint":">=3.0.0,<=3.1.3 (semantic)"},"fix":{"suggestedVersion":"3.1.4"}}],"artifact":{"id":"pkg:npm/fast-uri@3.1.2?package-id=2988e6ba3a1ed377","name":"fast-uri","version":"3.1.2","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:openjsf:fast-uri:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GO-2026-6354","dataSource":"https://go.dev/issue/81316","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/cl/826504","https://groups.google.com/g/golang-announce/c/1y3fb2np35U"],"description":"Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection.\n\nNow, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78662","epss":0.00431,"percentile":0.37397,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78662","cwe":"CWE-770","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.56.0"],"state":"fixed","available":[{"version":"0.56.0","date":"2026-09-02","kind":"release"}]},"advisories":[],"risk":0.32325},"relatedVulnerabilities":[{"id":"CVE-2026-78662","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78662","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/826504","https://go.dev/issue/81316","https://groups.google.com/g/golang-announce/c/1y3fb2np35U","https://pkg.go.dev/vuln/GO-2026-6354"],"description":"Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78662","epss":0.00431,"percentile":0.37397,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78662","cwe":"CWE-770","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/crypto","version":"v0.53.0"}},"found":{"vulnerabilityID":"GO-2026-6354","versionConstraint":"<0.56.0 (go)"},"fix":{"suggestedVersion":"0.56.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.53.0?package-id=0a9169df163c853a","name":"golang.org/x/crypto","version":"v0.53.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:crypto:v0.53.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.53.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.53.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto="}}},{"vulnerability":{"id":"GHSA-w9j2-pvgh-6h63","dataSource":"https://github.com/advisories/GHSA-w9j2-pvgh-6h63","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-w9j2-pvgh-6h63","https://nvd.nist.gov/vuln/detail/CVE-2026-42041"],"description":"Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42041","epss":0.00656,"percentile":0.51428,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42041","cwe":"CWE-287","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-42041","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-42041","cwe":"CWE-915","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["0.31.1"],"state":"fixed","available":[{"version":"0.31.1","date":"2026-05-05","kind":"first-observed"}]},"advisories":[],"risk":0.32144},"relatedVulnerabilities":[{"id":"CVE-2026-42041","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42041","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-w9j2-pvgh-6h63","https://access.redhat.com/errata/RHSA-2026:14937","https://access.redhat.com/errata/RHSA-2026:16476","https://access.redhat.com/errata/RHSA-2026:16532","https://access.redhat.com/errata/RHSA-2026:16534","https://access.redhat.com/errata/RHSA-2026:16535","https://access.redhat.com/errata/RHSA-2026:16542","https://access.redhat.com/errata/RHSA-2026:16874","https://access.redhat.com/errata/RHSA-2026:17468","https://access.redhat.com/errata/RHSA-2026:17474","https://access.redhat.com/errata/RHSA-2026:17657","https://access.redhat.com/errata/RHSA-2026:17699","https://access.redhat.com/errata/RHSA-2026:19109","https://access.redhat.com/errata/RHSA-2026:19375","https://access.redhat.com/errata/RHSA-2026:20889","https://access.redhat.com/errata/RHSA-2026:20938","https://access.redhat.com/errata/RHSA-2026:21017","https://access.redhat.com/errata/RHSA-2026:21338","https://access.redhat.com/errata/RHSA-2026:21772","https://access.redhat.com/errata/RHSA-2026:22465","https://access.redhat.com/errata/RHSA-2026:22619","https://access.redhat.com/errata/RHSA-2026:22629","https://access.redhat.com/errata/RHSA-2026:22840","https://access.redhat.com/errata/RHSA-2026:23361","https://access.redhat.com/errata/RHSA-2026:24536","https://access.redhat.com/errata/RHSA-2026:24539","https://access.redhat.com/errata/RHSA-2026:24853","https://access.redhat.com/errata/RHSA-2026:24977","https://access.redhat.com/errata/RHSA-2026:25041","https://access.redhat.com/errata/RHSA-2026:25089","https://access.redhat.com/errata/RHSA-2026:25271","https://access.redhat.com/errata/RHSA-2026:25273","https://access.redhat.com/errata/RHSA-2026:26214","https://access.redhat.com/errata/RHSA-2026:26225","https://access.redhat.com/errata/RHSA-2026:26232","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:36882","https://access.redhat.com/errata/RHSA-2026:50300","https://access.redhat.com/security/cve/CVE-2026-42041","https://bugzilla.redhat.com/show_bug.cgi?id=2461629","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42041.json"],"description":"Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library is vulnerable to a Prototype Pollution \"Gadget\" attack that allows any Object.prototype pollution to silently suppress all HTTP error responses (401, 403, 500, etc.), causing them to be treated as successful responses. This completely bypasses application-level authentication and error handling. The root cause is that validateStatus is the only config property using the mergeDirectKeys merge strategy, which uses JavaScript's in operator — an operator that inherently traverses the prototype chain. When Object.prototype.validateStatus is polluted with () => true, all HTTP status codes are accepted as success. This vulnerability is fixed in 1.15.1 and 0.31.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":3.9,"impactScore":4.3},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42041","epss":0.00656,"percentile":0.51428,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42041","cwe":"CWE-287","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-42041","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-42041","cwe":"CWE-915","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"0.25.0"}},"found":{"vulnerabilityID":"GHSA-w9j2-pvgh-6h63","versionConstraint":"<=0.31.0 (semantic)"},"fix":{"suggestedVersion":"0.31.1"}}],"artifact":{"id":"pkg:npm/axios@0.25.0?package-id=f91bce3cf8a711bf","name":"axios","version":"0.25.0","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:axios:axios:0.25.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@0.25.0","upstreams":[]}},{"vulnerability":{"id":"GO-2026-6610","dataSource":"https://go.dev/cl/835145","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/cl/836385","https://go.dev/issue/81115","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"description":"Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78660","epss":0.00425,"percentile":0.36847,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78660","cwe":"CWE-444","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.60.0"],"state":"fixed","available":[{"version":"0.60.0","date":"2026-10-08","kind":"release"}]},"advisories":[],"risk":0.31875000000000003},"relatedVulnerabilities":[{"id":"CVE-2026-78660","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78660","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/835145","https://go.dev/cl/836385","https://go.dev/issue/81115","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6610"],"description":"Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78660","epss":0.00425,"percentile":0.36847,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78660","cwe":"CWE-444","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.56.0"}},"found":{"vulnerabilityID":"GO-2026-6610","versionConstraint":"<0.60.0 (go)"},"fix":{"suggestedVersion":"0.60.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.56.0?package-id=4ad2b62edbe56c92","name":"golang.org/x/net","version":"v0.56.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.56.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.56.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.56.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o="}}},{"vulnerability":{"id":"GHSA-hqq3-7jhf-c5jx","dataSource":"https://github.com/advisories/GHSA-hqq3-7jhf-c5jx","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/digitalbazaar/forge/security/advisories/GHSA-hqq3-7jhf-c5jx","https://nvd.nist.gov/vuln/detail/CVE-2026-119187","https://github.com/digitalbazaar/forge/commit/817e2ce0d0f6d8a25bc9c2670615c38a9ffdc51c","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1"],"description":"Forge: Denial of service in TLS record processing via call stack exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119187","epss":0.00415,"percentile":0.35807,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119187","cwe":"CWE-674","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["1.4.1"],"state":"fixed","available":[{"version":"1.4.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.31124999999999997},"relatedVulnerabilities":[{"id":"CVE-2026-119187","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119187","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/digitalbazaar/forge/commit/817e2ce0d0f6d8a25bc9c2670615c38a9ffdc51c","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","https://github.com/digitalbazaar/forge/security/advisories/GHSA-hqq3-7jhf-c5jx"],"description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection(), TLS record processing, process() to process the relevant input or security decision. node-forge processed received TLS records recursively, consuming one JavaScript stack frame per record in a single input chunk. A remote peer could send thousands of small records together and exhaust the call stack, causing an uncaught exception and denial of service. This issue is fixed in version 1.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119187","epss":0.00415,"percentile":0.35807,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119187","cwe":"CWE-674","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"node-forge","version":"1.4.0"}},"found":{"vulnerabilityID":"GHSA-hqq3-7jhf-c5jx","versionConstraint":"<=1.4.0 (semantic)"},"fix":{"suggestedVersion":"1.4.1"}}],"artifact":{"id":"pkg:npm/node-forge@1.4.0?package-id=256486d336435126","name":"node-forge","version":"1.4.0","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:digitalbazaar:forge:1.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/node-forge@1.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-8hrf-8g6f-7xwp","dataSource":"https://github.com/advisories/GHSA-8hrf-8g6f-7xwp","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/digitalbazaar/forge/security/advisories/GHSA-8hrf-8g6f-7xwp","https://nvd.nist.gov/vuln/detail/CVE-2026-119188","https://github.com/digitalbazaar/forge/commit/700d977d39f9f8f896c55b0763eebb940a2c087e","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1"],"description":"Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119188","epss":0.00411,"percentile":0.35424,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119188","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-119188","cwe":"CWE-476","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.4.1"],"state":"fixed","available":[{"version":"1.4.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.30825},"relatedVulnerabilities":[{"id":"CVE-2026-119188","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119188","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/digitalbazaar/forge/commit/700d977d39f9f8f896c55b0763eebb940a2c087e","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","https://github.com/digitalbazaar/forge/security/advisories/GHSA-8hrf-8g6f-7xwp"],"description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection(), fragmented handshake message, interleaved record to process the relevant input or security decision. node-forge continued processing after a TLS record of another content type interrupted a fragmented handshake message. A remote peer could trigger an uncaught TypeError in process(), causing the connection or hosting process to fail. This issue is fixed in version 1.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119188","epss":0.00411,"percentile":0.35424,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119188","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-119188","cwe":"CWE-476","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"node-forge","version":"1.4.0"}},"found":{"vulnerabilityID":"GHSA-8hrf-8g6f-7xwp","versionConstraint":"<=1.4.0 (semantic)"},"fix":{"suggestedVersion":"1.4.1"}}],"artifact":{"id":"pkg:npm/node-forge@1.4.0?package-id=256486d336435126","name":"node-forge","version":"1.4.0","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:digitalbazaar:forge:1.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/node-forge@1.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-4v9v-hfq4-rm2v","dataSource":"https://github.com/advisories/GHSA-4v9v-hfq4-rm2v","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-4v9v-hfq4-rm2v","https://nvd.nist.gov/vuln/detail/CVE-2025-30359","https://github.com/webpack/webpack-dev-server/commit/5c9378bb01276357d7af208a0856ca2163db188e","https://github.com/webpack/webpack-dev-server/commit/d2575ad8dfed9207ed810b5ea0ccf465115a2239"],"description":"webpack-dev-server users' source code may be stolen when they access a malicious web site","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":1.7,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-30359","epss":0.00598,"percentile":0.48636,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-30359","cwe":"CWE-749","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["5.2.1"],"state":"fixed","available":[{"version":"5.2.1","date":"2025-06-05","kind":"first-observed"}]},"advisories":[],"risk":0.30797},"relatedVulnerabilities":[{"id":"CVE-2025-30359","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-30359","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/webpack/webpack-dev-server/commit/d2575ad8dfed9207ed810b5ea0ccf465115a2239","https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-4v9v-hfq4-rm2v"],"description":"webpack-dev-server allows users to use webpack with a development server that provides live reloading. Prior to version 5.2.1, webpack-dev-server users' source code may be stolen when they access a malicious web site. Because the request for classic script by a script tag is not subject to same origin policy, an attacker can inject a malicious script in their site and run the script. Note that the attacker has to know the port and the output entrypoint script path. Combined with prototype pollution, the attacker can get a reference to the webpack runtime variables. By using `Function::toString` against the values in `__webpack_modules__`, the attacker can get the source code. Version 5.2.1 contains a patch for the issue.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":1.7,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-30359","epss":0.00598,"percentile":0.48636,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-30359","cwe":"CWE-749","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"webpack-dev-server","version":"4.9.3"}},"found":{"vulnerabilityID":"GHSA-4v9v-hfq4-rm2v","versionConstraint":"<=5.2.0 (semantic)"},"fix":{"suggestedVersion":"5.2.1"}}],"artifact":{"id":"pkg:npm/webpack-dev-server@4.9.3?package-id=d8e6d1db023d5fac","name":"webpack-dev-server","version":"4.9.3","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:webpack-dev-server:webpack-dev-server:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:webpack-dev-server:webpack_dev_server:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:webpack_dev_server:webpack-dev-server:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:webpack_dev_server:webpack_dev_server:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:webpack-dev:webpack-dev-server:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:webpack-dev:webpack_dev_server:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:webpack_dev:webpack-dev-server:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:webpack_dev:webpack_dev_server:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:webpack:webpack-dev-server:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:webpack:webpack_dev_server:4.9.3:*:*:*:*:*:*:*"],"purl":"pkg:npm/webpack-dev-server@4.9.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-2wm5-q62r-hmrv","dataSource":"https://github.com/advisories/GHSA-2wm5-q62r-hmrv","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/omgovich/colord/security/advisories/GHSA-2wm5-q62r-hmrv","https://nvd.nist.gov/vuln/detail/CVE-2026-85062","https://github.com/omgovich/colord/pull/141","https://github.com/omgovich/colord/commit/87018089515ed66a85b1a95c3c7c3fd69a25bac2"],"description":"Colord: Slow rejection of oversized malformed color strings","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-85062","epss":0.00507,"percentile":0.43266,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-85062","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.9.4"],"state":"fixed","available":[{"version":"2.9.4","date":"2026-09-09","kind":"first-observed"}]},"advisories":[],"risk":0.30166499999999996},"relatedVulnerabilities":[{"id":"CVE-2026-85062","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85062","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/omgovich/colord/commit/87018089515ed66a85b1a95c3c7c3fd69a25bac2","https://github.com/omgovich/colord/pull/141","https://github.com/omgovich/colord/security/advisories/GHSA-2wm5-q62r-hmrv"],"description":"Colord is a tiny yet powerful tool for high-performance color manipulations and conversions. Prior to 2.9.4, synchronous CSS color string matchers in src/colorModels/rgbString.ts, src/colorModels/hslString.ts, src/colorModels/hwbString.ts, src/colorModels/lchString.ts, and src/colorModels/cmykString.ts use the ambiguous numeric regular expression ([+-]?\\d*.?\\d+), allowing the same digits to be divided between overlapping quantifiers in quadratically many ways when malformed input is rejected. An attacker who can supply an unbounded color string to colord(), getFormat(), isEqual(), mix(), or contrast(), including through a request body, JSON field, or uploaded stylesheet, can block the processing thread with a multi-kilobyte payload. The affected matchers are parseRgbaString, parseHslaString, parseHwbaString, parseLchaString, and parseCmykaString. This issue is fixed in version 2.9.4.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-85062","epss":0.00507,"percentile":0.43266,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-85062","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"colord","version":"2.9.2"}},"found":{"vulnerabilityID":"GHSA-2wm5-q62r-hmrv","versionConstraint":"<2.9.4 (semantic)"},"fix":{"suggestedVersion":"2.9.4"}}],"artifact":{"id":"pkg:npm/colord@2.9.2?package-id=4f29ecacaef06e07","name":"colord","version":"2.9.2","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:colord:colord:2.9.2:*:*:*:*:*:*:*"],"purl":"pkg:npm/colord@2.9.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-6chq-wfr3-2hj9","dataSource":"https://github.com/advisories/GHSA-6chq-wfr3-2hj9","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-6chq-wfr3-2hj9","https://nvd.nist.gov/vuln/detail/CVE-2026-42035"],"description":"Axios: Header Injection via Prototype Pollution","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42035","epss":0.00403,"percentile":0.3453,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42035","cwe":"CWE-113","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-42035","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.31.1"],"state":"fixed","available":[{"version":"0.31.1","date":"2026-05-05","kind":"first-observed"}]},"advisories":[],"risk":0.300235},"relatedVulnerabilities":[{"id":"CVE-2026-42035","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42035","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-6chq-wfr3-2hj9"],"description":"Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, a prototype pollution gadget exists in the Axios HTTP adapter (lib/adapters/http.js) that allows an attacker to inject arbitrary HTTP headers into outgoing requests. The vulnerability exploits duck-type checking of the data payload, where if Object.prototype is polluted with getHeaders, append, pipe, on, once, and Symbol.toStringTag, Axios misidentifies any plain object payload as a FormData instance and calls the attacker-controlled getHeaders() function, merging the returned headers into the outgoing request. The vulnerable code resides exclusively in lib/adapters/http.js. The prototype pollution source does not need to originate from Axios itself — any prototype pollution primitive in any dependency in the application's dependency tree is sufficient to trigger this gadget. This vulnerability is fixed in 1.15.1 and 0.31.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42035","epss":0.00403,"percentile":0.3453,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42035","cwe":"CWE-113","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-42035","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"0.25.0"}},"found":{"vulnerabilityID":"GHSA-6chq-wfr3-2hj9","versionConstraint":"<=0.31.0 (semantic)"},"fix":{"suggestedVersion":"0.31.1"}}],"artifact":{"id":"pkg:npm/axios@0.25.0?package-id=f91bce3cf8a711bf","name":"axios","version":"0.25.0","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:axios:axios:0.25.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@0.25.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-w5vr-8v7q-w6rv","dataSource":"https://github.com/advisories/GHSA-w5vr-8v7q-w6rv","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-45819","https://github.com/web-platform-dx/baseline-browser-mapping/pull/137/changes#diff-7ae45ad102eab3b6d7e7896acd08c427a9b25b346470d7bc6507b6481575d519","https://github.com/web-platform-dx/baseline-browser-mapping/blob/b7881aa61c8a057e24468ab5ee18c5ecedbbf691/src/index.ts#L142","https://www.npmjs.com/package/baseline-browser-mapping","https://github.com/web-platform-dx/baseline-browser-mapping/pull/137","https://github.com/web-platform-dx/baseline-browser-mapping/commit/de733e2d8959559f7bb255d5927f3afcb6f31589","https://github.com/web-platform-dx/baseline-browser-mapping/releases/tag/v2.11.0"],"description":"baseline-browser-mapping process termination on invalid input causes denial of service","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","metrics":{"baseScore":6.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-45819","epss":0.00507,"percentile":0.43261,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-45819","cwe":"CWE-705","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-45819","cwe":"CWE-755","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}],"fix":{"versions":["2.11.0"],"state":"fixed","available":[{"version":"2.11.0","date":"2026-09-09","kind":"first-observed"}]},"advisories":[],"risk":0.29406},"relatedVulnerabilities":[{"id":"CVE-2026-45819","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45819","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/web-platform-dx/baseline-browser-mapping/blob/b7881aa61c8a057e24468ab5ee18c5ecedbbf691/src/index.ts#L142","https://github.com/web-platform-dx/baseline-browser-mapping/pull/137/changes#diff-7ae45ad102eab3b6d7e7896acd08c427a9b25b346470d7bc6507b6481575d519","https://www.npmjs.com/package/baseline-browser-mapping"],"description":"baseline-browser-mapping 2.x before 2.11.0 calls process.exit() instead of throwing on invalid or conflicting input parameters, and can trigger immediate process termination, causing denial of service.","cvss":[{"source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","metrics":{"baseScore":6.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-45819","epss":0.00507,"percentile":0.43261,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-45819","cwe":"CWE-705","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-45819","cwe":"CWE-755","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"baseline-browser-mapping","version":"2.9.19"}},"found":{"vulnerabilityID":"GHSA-w5vr-8v7q-w6rv","versionConstraint":">=2.0.0,<2.11.0 (semantic)"},"fix":{"suggestedVersion":"2.11.0"}}],"artifact":{"id":"pkg:npm/baseline-browser-mapping@2.9.19?package-id=c95594827760995a","name":"baseline-browser-mapping","version":"2.9.19","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:baseline-browser-mapping:baseline-browser-mapping:2.9.19:*:*:*:*:*:*:*","cpe:2.3:a:baseline-browser-mapping:baseline_browser_mapping:2.9.19:*:*:*:*:*:*:*","cpe:2.3:a:baseline_browser_mapping:baseline-browser-mapping:2.9.19:*:*:*:*:*:*:*","cpe:2.3:a:baseline_browser_mapping:baseline_browser_mapping:2.9.19:*:*:*:*:*:*:*","cpe:2.3:a:baseline-browser:baseline-browser-mapping:2.9.19:*:*:*:*:*:*:*","cpe:2.3:a:baseline-browser:baseline_browser_mapping:2.9.19:*:*:*:*:*:*:*","cpe:2.3:a:baseline_browser:baseline-browser-mapping:2.9.19:*:*:*:*:*:*:*","cpe:2.3:a:baseline_browser:baseline_browser_mapping:2.9.19:*:*:*:*:*:*:*","cpe:2.3:a:baseline:baseline-browser-mapping:2.9.19:*:*:*:*:*:*:*","cpe:2.3:a:baseline:baseline_browser_mapping:2.9.19:*:*:*:*:*:*:*"],"purl":"pkg:npm/baseline-browser-mapping@2.9.19","upstreams":[]}},{"vulnerability":{"id":"GHSA-27r3-jxmh-p828","dataSource":"https://github.com/advisories/GHSA-27r3-jxmh-p828","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/expressjs/body-parser/security/advisories/GHSA-27r3-jxmh-p828","https://nvd.nist.gov/vuln/detail/CVE-2026-111181","https://github.com/expressjs/body-parser/commit/1260c3845f54502a05a87594f09a334786bb34d7","https://github.com/expressjs/body-parser/commit/f7075eae3a84c3473ab4bf0a777da28db208e916","https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/body-parser/releases/tag/1.20.9","https://github.com/expressjs/body-parser/releases/tag/v2.4.0"],"description":"body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111181","epss":0.00388,"percentile":0.32923,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111181","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["1.20.9"],"state":"fixed","available":[{"version":"1.20.9","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.29100000000000004},"relatedVulnerabilities":[{"id":"CVE-2026-111181","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111181","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/body-parser/security/advisories/GHSA-27r3-jxmh-p828"],"description":"body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding such as gzip, body-parser pipes it into a decompression stream and, after reading the body, leaves that stream with no error listener. A payload of one valid compressed frame followed by trailing bytes decodes and the application responds normally, but the trailing bytes then reach the already-finished decoder, which emits an error that is re-thrown as an uncaught exception and terminates the process. No matching route is required because body parsing runs before routing, so any endpoint that parses a body is affected. The issue is fixed in body-parser 2.4.0 and 1.20.9, and users should upgrade to one of those versions or later. As a workaround, disable request-body inflation (set the body-parser inflate option to false) so encoded requests are rejected before any decompression stream is created.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111181","epss":0.00388,"percentile":0.32923,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111181","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"body-parser","version":"1.20.4"}},"found":{"vulnerabilityID":"GHSA-27r3-jxmh-p828","versionConstraint":"<1.20.9 (semantic)"},"fix":{"suggestedVersion":"1.20.9"}}],"artifact":{"id":"pkg:npm/body-parser@1.20.4?package-id=8b258b3b8498883b","name":"body-parser","version":"1.20.4","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:openjsf:body-parser:1.20.4:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/body-parser@1.20.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-2g4f-4pwh-qvx6","dataSource":"https://github.com/advisories/GHSA-2g4f-4pwh-qvx6","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-69873","https://github.com/EthanKim88/ethan-cve-disclosures/blob/main/CVE-2025-69873-ajv-ReDoS.md","https://github.com/ajv-validator/ajv/pull/2586","https://github.com/ajv-validator/ajv/commit/720a23fa453ffae8340e92c9b0fe886c54cfe0d5","https://github.com/ajv-validator/ajv/releases/tag/v8.18.0","https://github.com/ajv-validator/ajv/pull/2588","https://github.com/ajv-validator/ajv/releases/tag/v6.14.0","https://github.com/ajv-validator/ajv/pull/2590","https://github.com/github/advisory-database/pull/6991"],"description":"ajv has ReDoS when using `$data` option","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":5.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-69873","epss":0.00547,"percentile":0.45847,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-69873","cwe":"CWE-1333","source":"cve@mitre.org","type":"Secondary"},{"cve":"CVE-2025-69873","cwe":"CWE-400","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"cve":"CVE-2025-69873","cwe":"CWE-1333","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["6.14.0"],"state":"fixed","available":[{"version":"6.14.0","date":"2026-03-04","kind":"first-observed"}]},"advisories":[],"risk":0.287175},"relatedVulnerabilities":[{"id":"CVE-2025-69873","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69873","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/EthanKim88/ethan-cve-disclosures/blob/main/CVE-2025-69873-ajv-ReDoS.md","https://github.com/advisories/GHSA-2g4f-4pwh-qvx6","https://github.com/ajv-validator/ajv/pull/2588","https://github.com/ajv-validator/ajv/pull/2590","https://github.com/ajv-validator/ajv/releases/tag/v6.14.0","https://github.com/github/advisory-database/pull/6991","https://access.redhat.com/errata/RHSA-2026:10093","https://access.redhat.com/errata/RHSA-2026:13512","https://access.redhat.com/errata/RHSA-2026:14774","https://access.redhat.com/errata/RHSA-2026:15091","https://access.redhat.com/errata/RHSA-2026:16874","https://access.redhat.com/errata/RHSA-2026:19712","https://access.redhat.com/errata/RHSA-2026:26211","https://access.redhat.com/errata/RHSA-2026:26214","https://access.redhat.com/errata/RHSA-2026:33371","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:40984","https://access.redhat.com/errata/RHSA-2026:41941","https://access.redhat.com/errata/RHSA-2026:41944","https://access.redhat.com/errata/RHSA-2026:5168","https://access.redhat.com/errata/RHSA-2026:5807","https://access.redhat.com/errata/RHSA-2026:5907","https://access.redhat.com/errata/RHSA-2026:5910","https://access.redhat.com/errata/RHSA-2026:6192","https://access.redhat.com/errata/RHSA-2026:6277","https://access.redhat.com/errata/RHSA-2026:6309","https://access.redhat.com/errata/RHSA-2026:6497","https://access.redhat.com/errata/RHSA-2026:6567","https://access.redhat.com/errata/RHSA-2026:6568","https://access.redhat.com/errata/RHSA-2026:6802","https://access.redhat.com/errata/RHSA-2026:7314","https://access.redhat.com/errata/RHSA-2026:9742","https://access.redhat.com/security/cve/CVE-2025-69873","https://bugzilla.redhat.com/show_bug.cgi?id=2439070","https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-69873.json"],"description":"ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., \"^(a|a)*$\") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation. This issue is also fixed in version 6.14.0.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"cve@mitre.org","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"exploitabilityScore":1.5,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-69873","epss":0.00547,"percentile":0.45847,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-69873","cwe":"CWE-1333","source":"cve@mitre.org","type":"Secondary"},{"cve":"CVE-2025-69873","cwe":"CWE-400","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"cve":"CVE-2025-69873","cwe":"CWE-1333","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"ajv","version":"6.12.6"}},"found":{"vulnerabilityID":"GHSA-2g4f-4pwh-qvx6","versionConstraint":"<6.14.0 (semantic)"},"fix":{"suggestedVersion":"6.14.0"}}],"artifact":{"id":"pkg:npm/ajv@6.12.6?package-id=50c3c4e30c6343c4","name":"ajv","version":"6.12.6","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:ajv:ajv:6.12.6:*:*:*:*:*:*:*"],"purl":"pkg:npm/ajv@6.12.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-2g4f-4pwh-qvx6","dataSource":"https://github.com/advisories/GHSA-2g4f-4pwh-qvx6","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-69873","https://github.com/EthanKim88/ethan-cve-disclosures/blob/main/CVE-2025-69873-ajv-ReDoS.md","https://github.com/ajv-validator/ajv/pull/2586","https://github.com/ajv-validator/ajv/commit/720a23fa453ffae8340e92c9b0fe886c54cfe0d5","https://github.com/ajv-validator/ajv/releases/tag/v8.18.0","https://github.com/ajv-validator/ajv/pull/2588","https://github.com/ajv-validator/ajv/releases/tag/v6.14.0","https://github.com/ajv-validator/ajv/pull/2590","https://github.com/github/advisory-database/pull/6991"],"description":"ajv has ReDoS when using `$data` option","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":5.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-69873","epss":0.00547,"percentile":0.45847,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-69873","cwe":"CWE-1333","source":"cve@mitre.org","type":"Secondary"},{"cve":"CVE-2025-69873","cwe":"CWE-400","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"cve":"CVE-2025-69873","cwe":"CWE-1333","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["8.18.0"],"state":"fixed","available":[{"version":"8.18.0","date":"2026-03-04","kind":"first-observed"}]},"advisories":[],"risk":0.287175},"relatedVulnerabilities":[{"id":"CVE-2025-69873","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69873","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/EthanKim88/ethan-cve-disclosures/blob/main/CVE-2025-69873-ajv-ReDoS.md","https://github.com/advisories/GHSA-2g4f-4pwh-qvx6","https://github.com/ajv-validator/ajv/pull/2588","https://github.com/ajv-validator/ajv/pull/2590","https://github.com/ajv-validator/ajv/releases/tag/v6.14.0","https://github.com/github/advisory-database/pull/6991","https://access.redhat.com/errata/RHSA-2026:10093","https://access.redhat.com/errata/RHSA-2026:13512","https://access.redhat.com/errata/RHSA-2026:14774","https://access.redhat.com/errata/RHSA-2026:15091","https://access.redhat.com/errata/RHSA-2026:16874","https://access.redhat.com/errata/RHSA-2026:19712","https://access.redhat.com/errata/RHSA-2026:26211","https://access.redhat.com/errata/RHSA-2026:26214","https://access.redhat.com/errata/RHSA-2026:33371","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:40984","https://access.redhat.com/errata/RHSA-2026:41941","https://access.redhat.com/errata/RHSA-2026:41944","https://access.redhat.com/errata/RHSA-2026:5168","https://access.redhat.com/errata/RHSA-2026:5807","https://access.redhat.com/errata/RHSA-2026:5907","https://access.redhat.com/errata/RHSA-2026:5910","https://access.redhat.com/errata/RHSA-2026:6192","https://access.redhat.com/errata/RHSA-2026:6277","https://access.redhat.com/errata/RHSA-2026:6309","https://access.redhat.com/errata/RHSA-2026:6497","https://access.redhat.com/errata/RHSA-2026:6567","https://access.redhat.com/errata/RHSA-2026:6568","https://access.redhat.com/errata/RHSA-2026:6802","https://access.redhat.com/errata/RHSA-2026:7314","https://access.redhat.com/errata/RHSA-2026:9742","https://access.redhat.com/security/cve/CVE-2025-69873","https://bugzilla.redhat.com/show_bug.cgi?id=2439070","https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-69873.json"],"description":"ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., \"^(a|a)*$\") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation. This issue is also fixed in version 6.14.0.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"cve@mitre.org","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"exploitabilityScore":1.5,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-69873","epss":0.00547,"percentile":0.45847,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-69873","cwe":"CWE-1333","source":"cve@mitre.org","type":"Secondary"},{"cve":"CVE-2025-69873","cwe":"CWE-400","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"cve":"CVE-2025-69873","cwe":"CWE-1333","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"ajv","version":"8.11.0"}},"found":{"vulnerabilityID":"GHSA-2g4f-4pwh-qvx6","versionConstraint":">=7.0.0-alpha.0,<8.18.0 (semantic)"},"fix":{"suggestedVersion":"8.18.0"}}],"artifact":{"id":"pkg:npm/ajv@8.11.0?package-id=dd1363f7052f1c3f","name":"ajv","version":"8.11.0","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:ajv:ajv:8.11.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/ajv@8.11.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-2g4f-4pwh-qvx6","dataSource":"https://github.com/advisories/GHSA-2g4f-4pwh-qvx6","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-69873","https://github.com/EthanKim88/ethan-cve-disclosures/blob/main/CVE-2025-69873-ajv-ReDoS.md","https://github.com/ajv-validator/ajv/pull/2586","https://github.com/ajv-validator/ajv/commit/720a23fa453ffae8340e92c9b0fe886c54cfe0d5","https://github.com/ajv-validator/ajv/releases/tag/v8.18.0","https://github.com/ajv-validator/ajv/pull/2588","https://github.com/ajv-validator/ajv/releases/tag/v6.14.0","https://github.com/ajv-validator/ajv/pull/2590","https://github.com/github/advisory-database/pull/6991"],"description":"ajv has ReDoS when using `$data` option","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":5.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-69873","epss":0.00547,"percentile":0.45847,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-69873","cwe":"CWE-1333","source":"cve@mitre.org","type":"Secondary"},{"cve":"CVE-2025-69873","cwe":"CWE-400","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"cve":"CVE-2025-69873","cwe":"CWE-1333","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["8.18.0"],"state":"fixed","available":[{"version":"8.18.0","date":"2026-03-04","kind":"first-observed"}]},"advisories":[],"risk":0.287175},"relatedVulnerabilities":[{"id":"CVE-2025-69873","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69873","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/EthanKim88/ethan-cve-disclosures/blob/main/CVE-2025-69873-ajv-ReDoS.md","https://github.com/advisories/GHSA-2g4f-4pwh-qvx6","https://github.com/ajv-validator/ajv/pull/2588","https://github.com/ajv-validator/ajv/pull/2590","https://github.com/ajv-validator/ajv/releases/tag/v6.14.0","https://github.com/github/advisory-database/pull/6991","https://access.redhat.com/errata/RHSA-2026:10093","https://access.redhat.com/errata/RHSA-2026:13512","https://access.redhat.com/errata/RHSA-2026:14774","https://access.redhat.com/errata/RHSA-2026:15091","https://access.redhat.com/errata/RHSA-2026:16874","https://access.redhat.com/errata/RHSA-2026:19712","https://access.redhat.com/errata/RHSA-2026:26211","https://access.redhat.com/errata/RHSA-2026:26214","https://access.redhat.com/errata/RHSA-2026:33371","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:40984","https://access.redhat.com/errata/RHSA-2026:41941","https://access.redhat.com/errata/RHSA-2026:41944","https://access.redhat.com/errata/RHSA-2026:5168","https://access.redhat.com/errata/RHSA-2026:5807","https://access.redhat.com/errata/RHSA-2026:5907","https://access.redhat.com/errata/RHSA-2026:5910","https://access.redhat.com/errata/RHSA-2026:6192","https://access.redhat.com/errata/RHSA-2026:6277","https://access.redhat.com/errata/RHSA-2026:6309","https://access.redhat.com/errata/RHSA-2026:6497","https://access.redhat.com/errata/RHSA-2026:6567","https://access.redhat.com/errata/RHSA-2026:6568","https://access.redhat.com/errata/RHSA-2026:6802","https://access.redhat.com/errata/RHSA-2026:7314","https://access.redhat.com/errata/RHSA-2026:9742","https://access.redhat.com/security/cve/CVE-2025-69873","https://bugzilla.redhat.com/show_bug.cgi?id=2439070","https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-69873.json"],"description":"ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., \"^(a|a)*$\") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation. This issue is also fixed in version 6.14.0.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"cve@mitre.org","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"exploitabilityScore":1.5,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-69873","epss":0.00547,"percentile":0.45847,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-69873","cwe":"CWE-1333","source":"cve@mitre.org","type":"Secondary"},{"cve":"CVE-2025-69873","cwe":"CWE-400","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"cve":"CVE-2025-69873","cwe":"CWE-1333","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"ajv","version":"8.17.1"}},"found":{"vulnerabilityID":"GHSA-2g4f-4pwh-qvx6","versionConstraint":">=7.0.0-alpha.0,<8.18.0 (semantic)"},"fix":{"suggestedVersion":"8.18.0"}}],"artifact":{"id":"pkg:npm/ajv@8.17.1?package-id=8de52c2eb951ca66","name":"ajv","version":"8.17.1","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:ajv:ajv:8.17.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/ajv@8.17.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-7p8r-x3mc-p8w7","dataSource":"https://github.com/advisories/GHSA-7p8r-x3mc-p8w7","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-7p8r-x3mc-p8w7","https://nvd.nist.gov/vuln/detail/CVE-2026-18446","https://github.com/fastify/fast-uri/commit/f3c6c905f47831007490f466c5945012e905cc52","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v4.1.2"],"description":"fast-uri vulnerable to host confusion via backslash authority introducer","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-18446","epss":0.0038,"percentile":0.32009,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-18446","cwe":"CWE-436","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["3.1.5"],"state":"fixed","available":[{"version":"3.1.5","date":"2026-08-04","kind":"first-observed"}]},"advisories":[],"risk":0.28500000000000003},"relatedVulnerabilities":[{"id":"CVE-2026-18446","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18446","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-7p8r-x3mc-p8w7"],"description":"fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based introducer in place of it (backslash backslash, forward slash backslash, or backslash forward slash) is parsed with no authority and folds into the path. Node's native WHATWG URL parser instead treats a backslash as interchangeable with a forward slash for special schemes, so the two parsers extract different hosts from the same input. Applications that use fast-uri to enforce host based policy such as allowlists, SSRF filtering, or redirect validation before passing the same URL into Node's URL or fetch consumers can be steered to an unintended host. Upgrade to fast-uri 4.1.2, 3.1.5, or 2.4.4.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-18446","epss":0.0038,"percentile":0.32009,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-18446","cwe":"CWE-436","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-7p8r-x3mc-p8w7","versionConstraint":">=3.0.0,<3.1.5 (semantic)"},"fix":{"suggestedVersion":"3.1.5"}}],"artifact":{"id":"pkg:npm/fast-uri@3.1.2?package-id=2988e6ba3a1ed377","name":"fast-uri","version":"3.1.2","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:openjsf:fast-uri:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-395f-4hp3-45gv","dataSource":"https://github.com/advisories/GHSA-395f-4hp3-45gv","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/ljharb/shell-quote/security/advisories/GHSA-395f-4hp3-45gv","https://nvd.nist.gov/vuln/detail/CVE-2026-13311","https://github.com/ljharb/shell-quote/commit/7ff5488599d01c323514f02f5efb74088dd134ec","https://github.com/ljharb/shell-quote/releases/tag/v1.9.0","https://www.npmjs.com/package/shell-quote"],"description":"shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-13311","epss":0.0036,"percentile":0.29834,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-13311","cwe":"CWE-407","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}],"fix":{"versions":["1.9.0"],"state":"fixed","available":[{"version":"1.9.0","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.2808},"relatedVulnerabilities":[{"id":"CVE-2026-13311","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13311","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/ljharb/shell-quote/security/advisories/GHSA-395f-4hp3-45gv","https://www.npmjs.com/package/shell-quote"],"description":"shell-quote prior to 1.8.5 finalizes parsed tokens in parse() using Array.prototype.concat as a reduce accumulator, which reallocates and copies the entire growing array on every iteration. As a result parse() runs in O(n^2) time relative to the number of input tokens. An attacker who can supply an attacker-controlled string to any code path that calls parse() (no shell metacharacters are required; plain space-separated words suffice) can block the single-threaded Node.js event loop for an extended period with a small input, resulting in a denial of service. There is no code execution or data disclosure; impact is to availability only. Fixed in 1.8.5.","cvss":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-13311","epss":0.0036,"percentile":0.29834,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-13311","cwe":"CWE-407","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"shell-quote","version":"1.8.4"}},"found":{"vulnerabilityID":"GHSA-395f-4hp3-45gv","versionConstraint":"<=1.8.4 (semantic)"},"fix":{"suggestedVersion":"1.9.0"}}],"artifact":{"id":"pkg:npm/shell-quote@1.8.4?package-id=3e49c091fe9371c3","name":"shell-quote","version":"1.8.4","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:shell-quote_project:shell-quote:1.8.4:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/shell-quote@1.8.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-x5fp-wj9c-mxmx","dataSource":"https://github.com/advisories/GHSA-x5fp-wj9c-mxmx","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/ljharb/qs/security/advisories/GHSA-w7fw-mjwx-w883","https://github.com/ljharb/qs/security/advisories/GHSA-x5fp-wj9c-mxmx","https://nvd.nist.gov/vuln/detail/CVE-2026-82562","https://github.com/ljharb/qs/commit/8859c37470e11b42b547b275e4e9bd0bc8cc5464"],"description":"qs array-limit bypass via bracket-key comma parsing","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-82562","epss":0.0054,"percentile":0.45457,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-82562","cwe":"CWE-770","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}],"fix":{"versions":["6.16.0"],"state":"fixed","available":[{"version":"6.16.0","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.27},"relatedVulnerabilities":[{"id":"CVE-2026-82562","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82562","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/ljharb/qs/commit/8859c37470e11b42b547b275e4e9bd0bc8cc5464","https://github.com/ljharb/qs/security/advisories/GHSA-w7fw-mjwx-w883","https://github.com/ljharb/qs/security/advisories/GHSA-x5fp-wj9c-mxmx"],"description":"### Summary\n\n\n\nWhen `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comma-separated value under a bracket-push key (`a[]=1,2,3,4`) is split into an array without being compared against `arrayLimit`, while the same value under a flat key (`a=1,2,3,4`), an indexed key (`a[0]=`), a nested key (`a[b]=`), or a dotted key (`a.b=` with `allowDots`) throws the documented `RangeError`. A single parameter such as `a[]=1,2,2,...` therefore produces an inner array of arbitrary length even though the caller opted into the hard limit. This is the `[]=` key form that the fix for CVE-2026-2391 (qs 6.14.2) did not cover.\n\n\n\n### Details\n\n\n\nIn `lib/parse.js`, a comma-separated value under a `[]=` key is split and then wrapped as a single nested element (`val = [val]`, so that each `a[]=x,y` group counts as one element of the outer array). The `arrayLimit` check that 6.14.2 added for comma values runs after that wrap, so for `[]=` parts it only ever saw the wrapper of length 1. 6.15.3 added a pre-split comma count so that an oversized value throws before it is allocated, but gated it on an `isFlatArrayValue` flag that `parseValues` set to `false` for any part containing `[]=`, and did not pass it for object-valued input, so the gap remained.\n\n\n\n#### PoC\n\n\n\n```js\n\n\n\nvar qs = require('qs');\n\n\n\nvar options = { comma: true, arrayLimit: 3, throwOnLimitExceeded: true };\n\n\n\nqs.parse('a=1,2,3,4', options);   // RangeError: Array limit exceeded. Only 3 elements allowed in an array.\n\n\n\nqs.parse('a[]=1,2,3,4', options); // { a: [ [ '1', '2', '3', '4' ] ] }  (no throw)\n\n\n\nqs.parse('a[]=' + '1,'.repeat(1000000) + '1', { comma: true, arrayLimit: 20, throwOnLimitExceeded: true });\n\n\n\n// no throw; a 1,000,001-element inner array is allocated\n\n\n\n```\n\n\n\n#### Fix\n\n\n\n`lib/parse.js`, applied in 8859c37 on `main` and released as v6.16.0: the `isFlatArrayValue` gate is removed, so every comma-split value is counted against `arrayLimit` before splitting regardless of key form. An in-limit group under `a[]=` still counts as one element of the outer array, and the default (`throwOnLimitExceeded: false`) path is unchanged.\n\n\n\n### Affected versions\n\n\n\n`>=6.14.2 <6.16.0`, fixed in v6.16.0.\n\n\n\nv6.14.2 introduced `arrayLimit` enforcement for comma values (the fix for CVE-2026-2391) but only for values not under a `[]=` key, and every release from v6.14.2 through v6.15.3 has the same gap. v6.14.0 and v6.14.1, where `throwOnLimitExceeded` exists but does not apply to any comma form, are covered by CVE-2026-2391 rather than this record. Earlier lines (6.7.x through 6.13.x) have `comma` but no `throwOnLimitExceeded`, so there is no hard cap on any comma path to bypass; releases before 6.7.0 have no `comma` option.\n\n\n\n### Impact\n\n\n\nAn unauthenticated attacker who can reach an application that parses untrusted query strings or urlencoded bodies with both `comma: true` and `throwOnLimitExceeded: true` (both non-default) can bypass the configured limit with a single `a[]=` parameter and force the parser to allocate an array proportional to the request size. The cost is strictly linear in the attacker-supplied bytes (about 0.1 microseconds and 6 to 7 retained bytes per input byte; the same out-of-memory threshold as the documented default `throwOnLimitExceeded: false` path), so a transport-layer request or body size limit bounds it completely (and node's default maximum HTTP header size of 16 KB already bounds the request line, so multi-megabyte payloads need a body parser). The impact is that an opt-in hard limit fails open on one key spelling, not unbounded allocation from a small input.","cvss":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-82562","epss":0.0054,"percentile":0.45457,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-82562","cwe":"CWE-770","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"qs","version":"6.14.2"}},"found":{"vulnerabilityID":"GHSA-x5fp-wj9c-mxmx","versionConstraint":">=6.14.2,<=6.15.3 (semantic)"},"fix":{"suggestedVersion":"6.16.0"}}],"artifact":{"id":"pkg:npm/qs@6.14.2?package-id=29575e25c482e428","name":"qs","version":"6.14.2","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:qs_project:qs:6.14.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/qs@6.14.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-qj8w-gfj5-8c6v","dataSource":"https://github.com/advisories/GHSA-qj8w-gfj5-8c6v","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-qj8w-gfj5-8c6v","https://github.com/yahoo/serialize-javascript/commit/f147e90269b58bb6e539cfdf3d0e20d6ad14204b","https://github.com/yahoo/serialize-javascript/releases/tag/v7.0.5","https://nvd.nist.gov/vuln/detail/CVE-2026-34043","https://github.com/yahoo/serialize-javascript/releases/tag/v5.0.0"],"description":"Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34043","epss":0.00491,"percentile":0.42208,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-34043","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-34043","cwe":"CWE-834","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.0.5"],"state":"fixed","available":[{"version":"7.0.5","date":"2026-03-28","kind":"first-observed"}]},"advisories":[],"risk":0.267595},"relatedVulnerabilities":[{"id":"CVE-2026-34043","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34043","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/yahoo/serialize-javascript/commit/f147e90269b58bb6e539cfdf3d0e20d6ad14204b","https://github.com/yahoo/serialize-javascript/releases/tag/v7.0.5","https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-qj8w-gfj5-8c6v"],"description":"Serialize JavaScript to a superset of JSON that includes regular expressions and functions. Prior to version 7.0.5, there is a Denial of Service (DoS) vulnerability caused by CPU exhaustion. When serializing a specially crafted \"array-like\" object (an object that inherits from Array.prototype but has a very large length property), the process enters an intensive loop that consumes 100% CPU and hangs indefinitely. This issue has been patched in version 7.0.5.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34043","epss":0.00491,"percentile":0.42208,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-34043","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-34043","cwe":"CWE-834","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"serialize-javascript","version":"6.0.2"}},"found":{"vulnerabilityID":"GHSA-qj8w-gfj5-8c6v","versionConstraint":">=5.0.0,<7.0.5 (semantic)"},"fix":{"suggestedVersion":"7.0.5"}}],"artifact":{"id":"pkg:npm/serialize-javascript@6.0.2?package-id=0e9e2be5ca9ee84c","name":"serialize-javascript","version":"6.0.2","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:verizon:serialize-javascript:6.0.2:*:*:*:*:node.js:*:*","cpe:2.3:a:yahoo:serialize_javascript:6.0.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/serialize-javascript@6.0.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-m28w-2pqf-7qgj","dataSource":"https://github.com/advisories/GHSA-m28w-2pqf-7qgj","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-m28w-2pqf-7qgj","https://nvd.nist.gov/vuln/detail/CVE-2026-14631","https://github.com/webpack/webpack-dev-server/pull/5699","https://github.com/webpack/webpack-dev-server/commit/f21ed0f44aceb6132abb591ee8b60d770b6e489f","https://cna.openjsf.org/security-advisories.html"],"description":"webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-14631","epss":0.00517,"percentile":0.43994,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-14631","cwe":"CWE-20","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-14631","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["5.2.6"],"state":"fixed","available":[{"version":"5.2.6","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.266255},"relatedVulnerabilities":[{"id":"CVE-2026-14631","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-14631","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-m28w-2pqf-7qgj"],"description":"webpack-dev-server versions 5.2.5 and earlier terminate the whole Node.js process when an unauthenticated peer sends either a normal HTTP request with a malformed Host header or a WebSocket upgrade to the default /ws endpoint with a malformed Origin header. The malformed value causes an uncaught exception in the host-validation path and crashes the dev server. Impact is limited to availability of the development server, no data disclosure, no code execution. Patches: upgrade to webpack-dev-server 5.2.6. Workarounds: keep the dev server bound to localhost (the default) and do not expose it to untrusted networks.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-14631","epss":0.00517,"percentile":0.43994,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-14631","cwe":"CWE-20","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-14631","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"webpack-dev-server","version":"4.9.3"}},"found":{"vulnerabilityID":"GHSA-m28w-2pqf-7qgj","versionConstraint":"<=5.2.5 (semantic)"},"fix":{"suggestedVersion":"5.2.6"}}],"artifact":{"id":"pkg:npm/webpack-dev-server@4.9.3?package-id=d8e6d1db023d5fac","name":"webpack-dev-server","version":"4.9.3","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:webpack-dev-server:webpack-dev-server:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:webpack-dev-server:webpack_dev_server:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:webpack_dev_server:webpack-dev-server:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:webpack_dev_server:webpack_dev_server:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:webpack-dev:webpack-dev-server:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:webpack-dev:webpack_dev_server:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:webpack_dev:webpack-dev-server:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:webpack_dev:webpack_dev_server:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:webpack:webpack-dev-server:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:webpack:webpack_dev_server:4.9.3:*:*:*:*:*:*:*"],"purl":"pkg:npm/webpack-dev-server@4.9.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-fxqj-rqcc-2cmp","dataSource":"https://github.com/advisories/GHSA-fxqj-rqcc-2cmp","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp","https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8","https://github.com/postcss/postcss/releases/tag/8.5.19"],"description":"PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69153","epss":0.00451,"percentile":0.39211,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69153","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69153","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["8.5.23"],"state":"fixed","available":[{"version":"8.5.23","date":"2026-08-04","kind":"first-observed"}]},"advisories":[],"risk":0.254815},"relatedVulnerabilities":[{"id":"CVE-2026-69153","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-69153","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8","https://github.com/postcss/postcss/releases/tag/8.5.19","https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp"],"description":"PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69153","epss":0.00451,"percentile":0.39211,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69153","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69153","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"postcss","version":"8.5.12"}},"found":{"vulnerabilityID":"GHSA-fxqj-rqcc-2cmp","versionConstraint":"<=8.5.22 (semantic)"},"fix":{"suggestedVersion":"8.5.23"}}],"artifact":{"id":"pkg:npm/postcss@8.5.12?package-id=c33291281cf2cbae","name":"postcss","version":"8.5.12","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:postcss:postcss:8.5.12:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/postcss@8.5.12","upstreams":[]}},{"vulnerability":{"id":"GHSA-3jxr-9vmj-r5cp","dataSource":"https://github.com/advisories/GHSA-3jxr-9vmj-r5cp","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-3jxr-9vmj-r5cp","https://nvd.nist.gov/vuln/detail/CVE-2026-13149","https://github.com/juliangruber/brace-expansion/pull/122","https://github.com/juliangruber/brace-expansion/pull/123","https://github.com/juliangruber/brace-expansion/commit/835d6be91201122d9adffb0c0c8c094189ace265","https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754","https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95","https://github.com/juliangruber/brace-expansion/releases/tag/v1.1.16","https://github.com/juliangruber/brace-expansion/releases/tag/v2.1.2","https://github.com/juliangruber/brace-expansion/releases/tag/v5.0.7","https://www.npmjs.com/package/brace-expansion"],"description":"brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-13149","epss":0.00364,"percentile":0.30245,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-13149","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-13149","cwe":"CWE-407","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}],"fix":{"versions":["1.1.16"],"state":"fixed","available":[{"version":"1.1.16","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.25479999999999997},"relatedVulnerabilities":[{"id":"CVE-2026-13149","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13149","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754","https://www.npmjs.com/package/brace-expansion"],"description":"brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.","cvss":[{"source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-13149","epss":0.00364,"percentile":0.30245,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-13149","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-13149","cwe":"CWE-407","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.13"}},"found":{"vulnerabilityID":"GHSA-3jxr-9vmj-r5cp","versionConstraint":"<1.1.16 (semantic)"},"fix":{"suggestedVersion":"1.1.16"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.13?package-id=3a0d56dc8df5e29f","name":"brace-expansion","version":"1.1.13","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-f5vj-f2hx-8m93","dataSource":"https://github.com/advisories/GHSA-f5vj-f2hx-8m93","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-f5vj-f2hx-8m93","https://nvd.nist.gov/vuln/detail/CVE-2026-14620","https://github.com/webpack/webpack-dev-server/pull/5698","https://github.com/webpack/webpack-dev-server/commit/80cd9eea54975fe632a518d8bd902a260f374e7c","https://cna.openjsf.org/security-advisories.html","https://github.com/webpack/webpack-dev-server/releases/tag/v5.2.6"],"description":"webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L","metrics":{"baseScore":4.7,"exploitabilityScore":2.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-14620","epss":0.00521,"percentile":0.44259,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-14620","cwe":"CWE-352","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-14620","cwe":"CWE-749","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["5.2.6"],"state":"fixed","available":[{"version":"5.2.6","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.252685},"relatedVulnerabilities":[{"id":"CVE-2026-14620","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-14620","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-f5vj-f2hx-8m93"],"description":"webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that perform state-changing actions on any GET request without verifying that the request originated from the dev server's own page. Any website a developer visits while the dev server is running can trigger these endpoints cross-origin with no interaction beyond the visit. An attacker can open an arbitrary existing local file in the developer's editor, including files outside the project root, and repeated requests can spawn editor processes and force recompilations that degrade the developer's machine. Patches: upgrade to webpack-dev-server 5.2.6. Workarounds: none.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L","metrics":{"baseScore":4.7,"exploitabilityScore":2.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L","metrics":{"baseScore":4.7,"exploitabilityScore":2.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-14620","epss":0.00521,"percentile":0.44259,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-14620","cwe":"CWE-352","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-14620","cwe":"CWE-749","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"webpack-dev-server","version":"4.9.3"}},"found":{"vulnerabilityID":"GHSA-f5vj-f2hx-8m93","versionConstraint":"<=5.2.5 (semantic)"},"fix":{"suggestedVersion":"5.2.6"}}],"artifact":{"id":"pkg:npm/webpack-dev-server@4.9.3?package-id=d8e6d1db023d5fac","name":"webpack-dev-server","version":"4.9.3","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:webpack-dev-server:webpack-dev-server:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:webpack-dev-server:webpack_dev_server:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:webpack_dev_server:webpack-dev-server:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:webpack_dev_server:webpack_dev_server:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:webpack-dev:webpack-dev-server:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:webpack-dev:webpack_dev_server:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:webpack_dev:webpack-dev-server:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:webpack_dev:webpack_dev_server:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:webpack:webpack-dev-server:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:webpack:webpack_dev_server:4.9.3:*:*:*:*:*:*:*"],"purl":"pkg:npm/webpack-dev-server@4.9.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-mp7j-qc5w-4988","dataSource":"https://github.com/advisories/GHSA-mp7j-qc5w-4988","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/faye/websocket-driver-node/security/advisories/GHSA-mp7j-qc5w-4988","https://github.com/faye/websocket-driver-node/releases/tag/0.7.5"],"description":"websocket-driver: Resource limit bypass via message compression","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-54490","epss":0.00445,"percentile":0.38693,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-54490","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.7.5"],"state":"fixed","available":[{"version":"0.7.5","date":"2026-07-16","kind":"first-observed"}]},"advisories":[],"risk":0.25142499999999995},"relatedVulnerabilities":[{"id":"CVE-2026-54490","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54490","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/faye/websocket-driver-node/commit/c55679a5b18251dd0a55d18a0cc6a4fd8822b92f","https://github.com/faye/websocket-driver-node/security/advisories/GHSA-mp7j-qc5w-4988"],"description":"websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, if this library is used with the permessage-deflate extension, a WebSocket server or client can be made to accept messages that are larger than the configured maximum message size because the limit is checked against the message frames' length headers, which give the size of the compressed data, not the size after decompression in lib/websocket/driver/hybi.js. This can lead to applications accepting larger messages than expected and exceeding their intended resource usage. This issue is fixed in version 0.7.5.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-54490","epss":0.00445,"percentile":0.38693,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-54490","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"websocket-driver","version":"0.7.4"}},"found":{"vulnerabilityID":"GHSA-mp7j-qc5w-4988","versionConstraint":"<0.7.5 (semantic)"},"fix":{"suggestedVersion":"0.7.5"}}],"artifact":{"id":"pkg:npm/websocket-driver@0.7.4?package-id=1d15158e820d512f","name":"websocket-driver","version":"0.7.4","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:websocket-driver:websocket-driver:0.7.4:*:*:*:*:*:*:*","cpe:2.3:a:websocket-driver:websocket_driver:0.7.4:*:*:*:*:*:*:*","cpe:2.3:a:websocket_driver:websocket-driver:0.7.4:*:*:*:*:*:*:*","cpe:2.3:a:websocket_driver:websocket_driver:0.7.4:*:*:*:*:*:*:*","cpe:2.3:a:websocket:websocket-driver:0.7.4:*:*:*:*:*:*:*","cpe:2.3:a:websocket:websocket_driver:0.7.4:*:*:*:*:*:*:*"],"purl":"pkg:npm/websocket-driver@0.7.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-2v37-7h3g-55p8","dataSource":"https://github.com/advisories/GHSA-2v37-7h3g-55p8","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-67213","https://github.com/ai/nanoid/commit/cb3626d0f3342fdf179cd425fd9c4fbb92c7d0e7","https://github.com/ai/nanoid/releases/tag/5.1.6","https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-zero-size-in-customalphabet-and-customrandom","https://github.com/ai/nanoid/commit/f9d13f150847d117877adee3460a46eceb0cf49b","https://github.com/ai/nanoid/releases/tag/3.3.17","https://github.com/ai/nanoid/commit/e10f8d40ce9d1ab47f66d65a16b48086432730d0","https://github.com/ai/nanoid/releases/tag/3.3.18"],"description":"nanoid: custom generators can loop indefinitely when size is zero","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67213","epss":0.00331,"percentile":0.26286,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67213","cwe":"CWE-835","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["3.3.18"],"state":"fixed","available":[{"version":"3.3.18","date":"2026-08-13","kind":"first-observed"}]},"advisories":[],"risk":0.24080250000000003},"relatedVulnerabilities":[{"id":"CVE-2026-67213","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-67213","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/ai/nanoid/commit/cb3626d0f3342fdf179cd425fd9c4fbb92c7d0e7","https://github.com/ai/nanoid/releases/tag/5.1.6","https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-zero-size-in-customalphabet-and-customrandom"],"description":"nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An application that passes an unvalidated, attacker-controlled size of 0 to these functions is exposed to a denial-of-service condition.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67213","epss":0.00331,"percentile":0.26286,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67213","cwe":"CWE-835","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"nanoid","version":"3.3.11"}},"found":{"vulnerabilityID":"GHSA-2v37-7h3g-55p8","versionConstraint":"<3.3.18 (semantic)"},"fix":{"suggestedVersion":"3.3.18"}}],"artifact":{"id":"pkg:npm/nanoid@3.3.11?package-id=0a3ee96901b64d51","name":"nanoid","version":"3.3.11","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:nanoid_project:nanoid:3.3.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/nanoid@3.3.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-28wg-ghj8-5hjv","dataSource":"https://github.com/advisories/GHSA-28wg-ghj8-5hjv","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-67214","https://github.com/ai/nanoid/commit/6ccc67bbaba71d3d77a21d9b636f4171a268ce49","https://github.com/ai/nanoid/releases/tag/5.1.16","https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-negative-size-in-non-secure-module","https://github.com/ai/nanoid/pull/600","https://github.com/ai/nanoid/pull/601","https://github.com/ai/nanoid/commit/e835c9b71eab832bc6106944bdd26ea96cf2c66d"],"description":"nanoid: non-secure generators can loop indefinitely with negative size","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67214","epss":0.0033,"percentile":0.26154,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67214","cwe":"CWE-835","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["3.3.16"],"state":"fixed","available":[{"version":"3.3.16","date":"2026-08-08","kind":"first-observed"}]},"advisories":[],"risk":0.240075},"relatedVulnerabilities":[{"id":"CVE-2026-67214","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-67214","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/ai/nanoid/commit/6ccc67bbaba71d3d77a21d9b636f4171a268ce49","https://github.com/ai/nanoid/releases/tag/3.3.16","https://github.com/ai/nanoid/releases/tag/5.1.16","https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-negative-size-in-non-secure-module"],"description":"nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67214","epss":0.0033,"percentile":0.26154,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67214","cwe":"CWE-835","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"nanoid","version":"3.3.11"}},"found":{"vulnerabilityID":"GHSA-28wg-ghj8-5hjv","versionConstraint":"<3.3.16 (semantic)"},"fix":{"suggestedVersion":"3.3.16"}}],"artifact":{"id":"pkg:npm/nanoid@3.3.11?package-id=0a3ee96901b64d51","name":"nanoid","version":"3.3.11","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:nanoid_project:nanoid:3.3.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/nanoid@3.3.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-mmx7-hfxf-jppx","dataSource":"https://github.com/advisories/GHSA-mmx7-hfxf-jppx","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-mmx7-hfxf-jppx","https://github.com/axios/axios/pull/11000","https://github.com/axios/axios/pull/11001","https://github.com/axios/axios/commit/1417285c69344bbcc6420a021f67dee0c6fedb2d","https://github.com/axios/axios/commit/32fc489632377d214db55bfa4e2c48486a7d7ce2","https://github.com/axios/axios/releases/tag/v0.33.0","https://github.com/axios/axios/releases/tag/v1.18.0","https://nvd.nist.gov/vuln/detail/CVE-2026-67316","https://nvd.nist.gov/vuln/detail/CVE-2026-68944","https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-bodyless-methods"],"description":"Axios: Prototype pollution gadgets can alter axios request construction","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67316","epss":0.00424,"percentile":0.36738,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67316","cwe":"CWE-1321","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["0.33.0"],"state":"fixed","available":[{"version":"0.33.0","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.23956},"relatedVulnerabilities":[{"id":"CVE-2026-67316","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-67316","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-mmx7-hfxf-jppx","https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-bodyless-methods"],"description":"axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been polluted by a separate vulnerability or dependency. In the bodyless method aliases (axios.get(), axios.delete(), axios.head(), axios.options()), inherited data is read via (config || {}).data before config normalization, causing an attacker-controlled body to be sent on requests that did not set one. Additional low-level paths, only reachable when calling exported adapters/helpers (e.g. lib/adapters/http.js, unsafe/helpers/resolveConfig.js) directly with plain configs and no own proxy or paramsSerializer, can inherit polluted proxy values (routing requests through an attacker-controlled proxy) or paramsSerializer values (attacker-controlled URL serialization). These low-level gadgets do not reproduce through normal high-level axios calls on 1.15.2+. The issue is fixed in axios 1.18.0 and 0.33.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67316","epss":0.00424,"percentile":0.36738,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67316","cwe":"CWE-1321","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"0.25.0"}},"found":{"vulnerabilityID":"GHSA-mmx7-hfxf-jppx","versionConstraint":"<0.33.0 (semantic)"},"fix":{"suggestedVersion":"0.33.0"}}],"artifact":{"id":"pkg:npm/axios@0.25.0?package-id=f91bce3cf8a711bf","name":"axios","version":"0.25.0","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:axios:axios:0.25.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@0.25.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-4vpr-x523-8j87","dataSource":"https://github.com/advisories/GHSA-4vpr-x523-8j87","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/svg/svgo/security/advisories/GHSA-4vpr-x523-8j87","https://nvd.nist.gov/vuln/detail/CVE-2026-84369","https://github.com/svg/svgo/pull/2264","https://github.com/svg/svgo/pull/2269","https://github.com/svg/svgo/pull/2272","https://github.com/svg/svgo/commit/0557385564a5c6c11d76cd934a6cff94451e532c","https://github.com/svg/svgo/commit/994a9f00d79ddec68ce19a1ce9eb8ca08d747e4f","https://github.com/svg/svgo/commit/fd51e474a300417d9361d9302d596b1763146327","https://github.com/svg/svgo/releases/tag/v2.8.4","https://github.com/svg/svgo/releases/tag/v3.3.5","https://github.com/svg/svgo/releases/tag/v4.1.0"],"description":"SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84369","epss":0.0043,"percentile":0.3723,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84369","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.8.4"],"state":"fixed","available":[{"version":"2.8.4","date":"2026-09-09","kind":"first-observed"}]},"advisories":[],"risk":0.23864999999999997},"relatedVulnerabilities":[{"id":"CVE-2026-84369","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84369","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/svg/svgo/commit/0557385564a5c6c11d76cd934a6cff94451e532c","https://github.com/svg/svgo/commit/994a9f00d79ddec68ce19a1ce9eb8ca08d747e4f","https://github.com/svg/svgo/commit/fd51e474a300417d9361d9302d596b1763146327","https://github.com/svg/svgo/pull/2264","https://github.com/svg/svgo/pull/2269","https://github.com/svg/svgo/pull/2272","https://github.com/svg/svgo/releases/tag/v2.8.4","https://github.com/svg/svgo/releases/tag/v3.3.5","https://github.com/svg/svgo/releases/tag/v4.1.0","https://github.com/svg/svgo/security/advisories/GHSA-4vpr-x523-8j87"],"description":"SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3 and implemented in plugins/removeScripts.js, removes SVG and XHTML script elements but does not inspect executable HTML content inside SVG foreignObject elements. Event-handler attributes such as onload and onbeforetoggle, srcdoc documents, and executable URLs in the action, data, formaction, href, and src attributes can remain in attacker-controlled SVG input. When an application uses the plugin as its only protection and serves the optimized SVG in an active browser context, the payload can execute script in the viewer's origin, expose data, modify content, or perform actions as the victim. This issue is fixed in versions 2.8.4, 3.3.5, and 4.1.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84369","epss":0.0043,"percentile":0.3723,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84369","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"svgo","version":"2.8.2"}},"found":{"vulnerabilityID":"GHSA-4vpr-x523-8j87","versionConstraint":">=1.0.0,<2.8.4 (semantic)"},"fix":{"suggestedVersion":"2.8.4"}}],"artifact":{"id":"pkg:npm/svgo@2.8.2?package-id=12d712458b674253","name":"svgo","version":"2.8.2","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:svgo:svgo:2.8.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/svgo@2.8.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-jqcg-44mw-7w3h","dataSource":"https://github.com/advisories/GHSA-jqcg-44mw-7w3h","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h","https://nvd.nist.gov/vuln/detail/CVE-2026-90711","https://github.com/jshttp/proxy-addr/commit/780911d84d18e2c5fa008ed0c0d387631ec11965","https://cna.openjsf.org/security-advisories.html","https://github.com/jshttp/proxy-addr/releases/tag/v2.0.8"],"description":"proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-90711","epss":0.0026,"percentile":0.17705,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-90711","cwe":"CWE-290","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-90711","cwe":"CWE-348","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-90711","cwe":"CWE-697","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["2.0.8"],"state":"fixed","available":[{"version":"2.0.8","date":"2026-10-06","kind":"first-observed"}]},"advisories":[],"risk":0.2353},"relatedVulnerabilities":[{"id":"CVE-2026-90711","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-90711","namespace":"nvd:cpe","severity":"Critical","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h"],"description":"proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as ::ffff:10.0.0.0/8 instead of the correct ::ffff:10.0.0.0/104, is accepted without error but trusts every IPv4 address on the internet rather than the block it names. Because the socket peer then becomes trusted at hop 0, any unauthenticated client can supply an arbitrary X-Forwarded-For header and control the address the application reads, which defeats IP-based access control, rate limiting, geolocation, and audit logging. This is a fail-open regression introduced in version 1.1.0. The issue is fixed in proxy-addr 2.0.8, and users should upgrade to 2.0.8 or later. As a workaround, ensure any IPv4-mapped IPv6 trust subnet uses a prefix length of at least 97, or express the range in plain IPv4 notation.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-90711","epss":0.0026,"percentile":0.17705,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-90711","cwe":"CWE-290","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-90711","cwe":"CWE-348","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-90711","cwe":"CWE-697","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"proxy-addr","version":"2.0.7"}},"found":{"vulnerabilityID":"GHSA-jqcg-44mw-7w3h","versionConstraint":">=1.1.0,<2.0.8 (semantic)"},"fix":{"suggestedVersion":"2.0.8"}}],"artifact":{"id":"pkg:npm/proxy-addr@2.0.7?package-id=8bc2815769c1c815","name":"proxy-addr","version":"2.0.7","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:proxy-addr:proxy-addr:2.0.7:*:*:*:*:*:*:*","cpe:2.3:a:proxy-addr:proxy_addr:2.0.7:*:*:*:*:*:*:*","cpe:2.3:a:proxy_addr:proxy-addr:2.0.7:*:*:*:*:*:*:*","cpe:2.3:a:proxy_addr:proxy_addr:2.0.7:*:*:*:*:*:*:*","cpe:2.3:a:proxy:proxy-addr:2.0.7:*:*:*:*:*:*:*","cpe:2.3:a:proxy:proxy_addr:2.0.7:*:*:*:*:*:*:*"],"purl":"pkg:npm/proxy-addr@2.0.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-xwg4-73v4-xw9w","dataSource":"https://github.com/advisories/GHSA-xwg4-73v4-xw9w","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w","https://nvd.nist.gov/vuln/detail/CVE-2026-73086","https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4","https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3","https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac","https://github.com/ai/nanoid/releases/tag/3.3.12","https://github.com/ai/nanoid/releases/tag/5.1.11"],"description":"nanoid: Integer Overflow or Wraparound","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73086","epss":0.00296,"percentile":0.22343,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73086","cwe":"CWE-190","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.3.12"],"state":"fixed","available":[{"version":"3.3.12","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.22052},"relatedVulnerabilities":[{"id":"CVE-2026-73086","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-73086","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4","https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3","https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac","https://github.com/ai/nanoid/releases/tag/3.3.12","https://github.com/ai/nanoid/releases/tag/5.1.11","https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w"],"description":"nanoid is a secure, URL-friendly, unique string ID generator for JavaScript. Prior to versions 3.3.12 and 5.1.11, the nanoid(size) function in index.js and index.cjs coerces the user-influenced size parameter to a signed 32-bit integer, allowing a value of 2147483648 to become -2147483648 and corrupt the process-wide CSPRNG poolOffset in fillPool(), which causes subsequent session tokens, CSRF tokens, API keys, and unique identifiers to become the deterministic string \"uuuuuuuuuuuuuuuuuuuuu\" until the process restarts. This issue is fixed in versions 3.3.12 and 5.1.11.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73086","epss":0.00296,"percentile":0.22343,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73086","cwe":"CWE-190","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"nanoid","version":"3.3.11"}},"found":{"vulnerabilityID":"GHSA-xwg4-73v4-xw9w","versionConstraint":"<3.3.12 (semantic)"},"fix":{"suggestedVersion":"3.3.12"}}],"artifact":{"id":"pkg:npm/nanoid@3.3.11?package-id=0a3ee96901b64d51","name":"nanoid","version":"3.3.11","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:nanoid_project:nanoid:3.3.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/nanoid@3.3.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-q2hr-2g5m-vwhr","dataSource":"https://github.com/advisories/GHSA-q2hr-2g5m-vwhr","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr","https://nvd.nist.gov/vuln/detail/CVE-2026-102277","https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e"],"description":"brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102277","epss":0.00428,"percentile":0.37125,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102277","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102277","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.1.21"],"state":"fixed","available":[{"version":"1.1.21","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.22042},"relatedVulnerabilities":[{"id":"CVE-2026-102277","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102277","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-input rescans with linear working-string growth cause quadratic CPU time and memory pressure that can block the Node.js event loop. The process eventually recovers, making the impact a recoverable CPU denial of service. This issue is fixed in versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102277","epss":0.00428,"percentile":0.37125,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102277","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102277","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.13"}},"found":{"vulnerabilityID":"GHSA-q2hr-2g5m-vwhr","versionConstraint":"<1.1.21 (semantic)"},"fix":{"suggestedVersion":"1.1.21"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.13?package-id=3a0d56dc8df5e29f","name":"brace-expansion","version":"1.1.13","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-mh29-5h37-fv8m","dataSource":"https://github.com/advisories/GHSA-mh29-5h37-fv8m","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-mh29-5h37-fv8m","https://nvd.nist.gov/vuln/detail/CVE-2025-64718","https://github.com/nodeca/js-yaml/commit/383665ff4248ec2192d1274e934462bb30426879","https://github.com/nodeca/js-yaml/commit/5278870a17454fe8621dbd8c445c412529525266","https://github.com/nodeca/js-yaml/issues/730#issuecomment-3549635876"],"description":"js-yaml has prototype pollution in merge (<<)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-64718","epss":0.00423,"percentile":0.36639,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-64718","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.14.2"],"state":"fixed","available":[{"version":"3.14.2","date":"2025-11-18","kind":"first-observed"}]},"advisories":[],"risk":0.217845},"relatedVulnerabilities":[{"id":"CVE-2025-64718","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-64718","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/nodeca/js-yaml/commit/383665ff4248ec2192d1274e934462bb30426879","https://github.com/nodeca/js-yaml/commit/5278870a17454fe8621dbd8c445c412529525266","https://github.com/nodeca/js-yaml/issues/730#issuecomment-3549635876","https://github.com/nodeca/js-yaml/security/advisories/GHSA-mh29-5h37-fv8m","https://github.com/advisories/GHSA-mh29-5h37-fv8m"],"description":"js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (`__proto__`). All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml 4.1.1 and 3.14.2. Users can protect against this kind of attack on the server by using `node --disable-proto=delete` or `deno` (in Deno, pollution protection is on by default).","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-64718","epss":0.00423,"percentile":0.36639,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-64718","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"3.14.1"}},"found":{"vulnerabilityID":"GHSA-mh29-5h37-fv8m","versionConstraint":"<3.14.2 (semantic)"},"fix":{"suggestedVersion":"3.14.2"}}],"artifact":{"id":"pkg:npm/js-yaml@3.14.1?package-id=311bc8b23a1591c7","name":"js-yaml","version":"3.14.1","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:nodeca:js-yaml:3.14.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@3.14.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-mh29-5h37-fv8m","dataSource":"https://github.com/advisories/GHSA-mh29-5h37-fv8m","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-mh29-5h37-fv8m","https://nvd.nist.gov/vuln/detail/CVE-2025-64718","https://github.com/nodeca/js-yaml/commit/383665ff4248ec2192d1274e934462bb30426879","https://github.com/nodeca/js-yaml/commit/5278870a17454fe8621dbd8c445c412529525266","https://github.com/nodeca/js-yaml/issues/730#issuecomment-3549635876"],"description":"js-yaml has prototype pollution in merge (<<)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-64718","epss":0.00423,"percentile":0.36639,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-64718","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.1.1"],"state":"fixed","available":[{"version":"4.1.1","date":"2025-11-18","kind":"first-observed"}]},"advisories":[],"risk":0.217845},"relatedVulnerabilities":[{"id":"CVE-2025-64718","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-64718","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/nodeca/js-yaml/commit/383665ff4248ec2192d1274e934462bb30426879","https://github.com/nodeca/js-yaml/commit/5278870a17454fe8621dbd8c445c412529525266","https://github.com/nodeca/js-yaml/issues/730#issuecomment-3549635876","https://github.com/nodeca/js-yaml/security/advisories/GHSA-mh29-5h37-fv8m","https://github.com/advisories/GHSA-mh29-5h37-fv8m"],"description":"js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (`__proto__`). All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml 4.1.1 and 3.14.2. Users can protect against this kind of attack on the server by using `node --disable-proto=delete` or `deno` (in Deno, pollution protection is on by default).","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-64718","epss":0.00423,"percentile":0.36639,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-64718","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"4.1.0"}},"found":{"vulnerabilityID":"GHSA-mh29-5h37-fv8m","versionConstraint":">=4.0.0,<4.1.1 (semantic)"},"fix":{"suggestedVersion":"4.1.1"}}],"artifact":{"id":"pkg:npm/js-yaml@4.1.0?package-id=27f207f3c57cf9f3","name":"js-yaml","version":"4.1.0","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:nodeca:js-yaml:4.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@4.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-q8mj-m7cp-5q26","dataSource":"https://github.com/advisories/GHSA-q8mj-m7cp-5q26","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/ljharb/qs/security/advisories/GHSA-q8mj-m7cp-5q26","https://nvd.nist.gov/vuln/detail/CVE-2026-8723","https://github.com/ljharb/qs/commit/21f80b33e5c8b3f7eba1034fff0da4a4a37a1d41"],"description":"qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-8723","epss":0.00399,"percentile":0.34223,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-8723","cwe":"CWE-476","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}],"fix":{"versions":["6.15.2"],"state":"fixed","available":[{"version":"6.15.2","date":"2026-05-23","kind":"first-observed"}]},"advisories":[],"risk":0.21546},"relatedVulnerabilities":[{"id":"CVE-2026-8723","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8723","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/ljharb/qs/commit/21f80b33e5c8b3f7eba1034fff0da4a4a37a1d41","https://github.com/ljharb/qs/security/advisories/GHSA-q8mj-m7cp-5q26"],"description":"### Summary\n\n\n\n`qs.stringify` throws `TypeError` when called with `arrayFormat: 'comma'` and `encodeValuesOnly: true` on an array containing `null` or `undefined`. The throw is synchronous and not handled by any of qs's null-related options (`skipNulls`, `strictNullHandling`).\n\n\n\n### Details\n\n\n\nIn the comma + `encodeValuesOnly` branch, `lib/stringify.js:145` mapped the array through the raw encoder before joining:\n\n\n\n```js\n\n\n\nobj = utils.maybeMap(obj, encoder);\n\n\n\n```\n\n\n\n`utils.encode` (`lib/utils.js:195`) reads `str.length` with no null guard, so a `null` or `undefined` element throws `TypeError`. `skipNulls` and `strictNullHandling` are both checked in the per-element loop below this line and never get a chance to run.\n\n\n\nSame class of bug as the filter-array path fixed in 0c180a4. The vulnerable shape of the comma + `encodeValuesOnly` branch was introduced in 4c4b23d (\"encode comma values more consistently\", PR #463, 2023-01-19), first released in v6.11.1.\n\n\n\n#### PoC\n\n\n\n```js\n\n\n\nconst qs = require('qs');\n\n\n\nqs.stringify({ a: [null, 'b'] },      { arrayFormat: 'comma', encodeValuesOnly: true });\n\n\n\nqs.stringify({ a: [undefined, 'b'] }, { arrayFormat: 'comma', encodeValuesOnly: true });\n\n\n\nqs.stringify({ a: [null] },           { arrayFormat: 'comma', encodeValuesOnly: true });\n\n\n\n// TypeError: Cannot read properties of null (reading 'length')\n\n\n\n//     at encode (lib/utils.js:195:13)\n\n\n\n//     at Object.maybeMap (lib/utils.js:322:37)\n\n\n\n//     at stringify (lib/stringify.js:145:25)\n\n\n\n```\n\n\n\n#### Fix\n\n\n\n`lib/stringify.js:145`, applied in 21f80b3 on `main` and released as v6.15.2:\n\n\n\n```diff\n\n\n\n- obj = utils.maybeMap(obj, encoder);\n\n\n\n+ obj = utils.maybeMap(obj, function (v) {\n\n\n\n+     return v == null ? v : encoder(v);\n\n\n\n+ });\n\n\n\n```\n\n\n\n`null` and `undefined` now pass through `maybeMap` unchanged and reach the `join(',')` step as-is. For `{ a: [null, 'b'] }` this produces `a=,b`, matching the non-`encodeValuesOnly` comma path (which already joins before encoding and produces `a=%2Cb` for the same input). Single-element `[null]` arrays still collapse via the existing `obj.join(',') || null` and remain subject to `skipNulls` / `strictNullHandling` in the main loop.\n\n\n\n### Affected versions\n\n\n\n`>=6.11.1 <6.15.2` — fixed in v6.15.2.\n\n\n\nThe vulnerable code shape was introduced in 4c4b23d and first shipped in v6.11.1. Earlier versions — including all of 6.7.x, 6.8.x, 6.9.x, 6.10.x, and 6.11.0 — implemented the comma + `encodeValuesOnly` path differently (joining before encoding) and are not affected. Empirically verified across released versions.\n\n\n\n### Impact\n\n\n\nApplication code that calls `qs.stringify` with both `arrayFormat: 'comma'` and `encodeValuesOnly: true` (both non-default) on input that may contain a `null` or `undefined` array element will throw synchronously instead of producing a query string. In a typical Node.js HTTP framework (Express, Fastify, Koa, hapi) the sync throw is caught by the framework's error boundary and the affected request returns a 500; the worker process does not exit and subsequent requests are unaffected. The \"kills the worker process\" framing applies only to call sites outside a request-handler error boundary (background jobs, startup paths, stream pipelines) or to deployments with framework error handling explicitly disabled.\n\n\n\nThe vulnerable input is a `null` or `undefined` entry inside an array; this is reachable from JSON request bodies or from application code constructing arrays from user input, but not from standard HTML form submissions (which produce strings or omitted fields, not literal `null`).","cvss":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-8723","epss":0.00399,"percentile":0.34223,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-8723","cwe":"CWE-476","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"qs","version":"6.14.2"}},"found":{"vulnerabilityID":"GHSA-q8mj-m7cp-5q26","versionConstraint":">=6.11.1,<=6.15.1 (semantic)"},"fix":{"suggestedVersion":"6.15.2"}}],"artifact":{"id":"pkg:npm/qs@6.14.2?package-id=29575e25c482e428","name":"qs","version":"6.14.2","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:qs_project:qs:6.14.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/qs@6.14.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-4mjr-xmp4-gh2g","dataSource":"https://github.com/advisories/GHSA-4mjr-xmp4-gh2g","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/ljharb/qs/security/advisories/GHSA-4mjr-xmp4-gh2g","https://nvd.nist.gov/vuln/detail/CVE-2026-82417","https://github.com/ljharb/qs/commit/e83d321ffafb38cf210683ac31714fce6ce1c6c6"],"description":"qs: Denial of Service via Attacker Controlled isBuffer","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-82417","epss":0.00396,"percentile":0.33816,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-82417","cwe":"CWE-248","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-82417","cwe":"CWE-703","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}],"fix":{"versions":["6.16.0"],"state":"fixed","available":[{"version":"6.16.0","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.21384},"relatedVulnerabilities":[{"id":"CVE-2026-82417","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82417","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/ljharb/qs/commit/e83d321ffafb38cf210683ac31714fce6ce1c6c6","https://github.com/ljharb/qs/security/advisories/GHSA-4mjr-xmp4-gh2g"],"description":"### Summary\n\n\n\n`qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member. `utils.isBuffer` duck-types buffers by calling `obj.constructor.isBuffer(obj)` after checking only that the property is truthy, so a value such as `{ constructor: { isBuffer: \"x\" } }` makes the call throw `TypeError: obj.constructor.isBuffer is not a function`.\n\n\n\n### Details\n\n\n\n`lib/stringify.js:127` calls `utils.isBuffer` on every non-primitive value it serializes. `utils.isBuffer` (`lib/utils.js:332`) reads `obj.constructor.isBuffer` and invokes it without verifying that it is a function. `constructor` and `isBuffer` are ordinary property names, so any object carrying them as own properties reaches the unchecked call.\n\n\n\nSuch an object can be built from untrusted input. `qs.parse(\"x[constructor][isBuffer]=y\", { plainObjects: true })` or `{ allowPrototypes: true }` keeps the `constructor` key as an own property (the default parse options drop it), and `JSON.parse(\"{\\\"a\\\":{\\\"constructor\\\":{\\\"isBuffer\\\":\\\"x\\\"}}}\")` produces the same shape with no qs option involved. Express 4 with its default `query parser` setting and body-parser with `extended: true` both call `qs.parse` with `allowPrototypes: true`, so on those stacks `req.query` and `req.body` can carry the shape directly.\n\n\n\n#### PoC\n\n\n\n```js\n\n\n\nvar qs = require(\"qs\");\n\n\n\nqs.stringify(qs.parse(\"x[constructor][isBuffer]=y\", { plainObjects: true }));\n\n\n\nqs.stringify(JSON.parse(\"{\\\"a\\\":{\\\"constructor\\\":{\\\"isBuffer\\\":\\\"x\\\"}}}\"));\n\n\n\n// TypeError: obj.constructor.isBuffer is not a function\n\n\n\n//     at Object.isBuffer (lib/utils.js:332:78)\n\n\n\n//     at stringify (lib/stringify.js:127:45)\n\n\n\n```\n\n\n\n#### Fix\n\n\n\n`lib/utils.js`, applied in e83d321 on `main` and released as v6.16.0:\n\n\n\n```diff\n\n\n\n- return !!(obj.constructor && obj.constructor.isBuffer && obj.constructor.isBuffer(obj));\n\n\n\n+ return !!(obj.constructor && typeof obj.constructor.isBuffer === \"function\" && obj.constructor.isBuffer(obj));\n\n\n\n```\n\n\n\nReal `Buffer`, `safer-buffer`, and browserify `buffer` polyfill instances serialize exactly as before; only the throw is removed.\n\n\n\n### Affected versions\n\n\n\n`>=2.2.5 <6.16.0`, fixed in v6.16.0.\n\n\n\nThe unguarded duck-type was introduced in 3768a75 and first shipped in v2.2.5 (September 2014). v2.2.4 and earlier used `Buffer.isBuffer` and are not affected. Every release from v2.2.5 through v6.15.3 contains the unguarded call.\n\n\n\n### Impact\n\n\n\nAn unauthenticated request can make any code path that re-serializes attacker-influenced data with `qs.stringify` (for example, rebuilding a query string from `req.query` for a redirect or an upstream request, or serializing a parsed JSON body) throw synchronously. In a typical Node.js HTTP framework the throw is caught by the framework error boundary and the affected request returns a 500; the process survives and other requests are unaffected. Where the call runs outside an error boundary, such as an `async` Express 4 handler (where the throw becomes an unhandled promise rejection) or a background job, the process exits, so the impact in that case depends on the application error handling rather than on qs.","cvss":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-82417","epss":0.00396,"percentile":0.33816,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-82417","cwe":"CWE-248","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-82417","cwe":"CWE-703","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"qs","version":"6.14.2"}},"found":{"vulnerabilityID":"GHSA-4mjr-xmp4-gh2g","versionConstraint":">=2.2.5,<6.16.0 (semantic)"},"fix":{"suggestedVersion":"6.16.0"}}],"artifact":{"id":"pkg:npm/qs@6.14.2?package-id=29575e25c482e428","name":"qs","version":"6.14.2","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:qs_project:qs:6.14.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/qs@6.14.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-h67p-54hq-rp68","dataSource":"https://github.com/advisories/GHSA-h67p-54hq-rp68","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-h67p-54hq-rp68","https://nvd.nist.gov/vuln/detail/CVE-2026-53550"],"description":"JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53550","epss":0.00415,"percentile":0.35875,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53550","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.15.0"],"state":"fixed","available":[{"version":"3.15.0","date":"2026-06-29","kind":"first-observed"}]},"advisories":[],"risk":0.21372500000000003},"relatedVulnerabilities":[{"id":"CVE-2026-53550","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53550","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-h67p-54hq-rp68"],"description":"js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relatively small payload (tens of KB), resulting in denial of service. The issue is in merge handling inside lib/loader.js. This vulnerability is fixed in 4.2.0 and 3.15.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53550","epss":0.00415,"percentile":0.35875,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53550","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"3.14.1"}},"found":{"vulnerabilityID":"GHSA-h67p-54hq-rp68","versionConstraint":"<3.15.0 (semantic)"},"fix":{"suggestedVersion":"3.15.0"}}],"artifact":{"id":"pkg:npm/js-yaml@3.14.1?package-id=311bc8b23a1591c7","name":"js-yaml","version":"3.14.1","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:nodeca:js-yaml:3.14.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@3.14.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-h67p-54hq-rp68","dataSource":"https://github.com/advisories/GHSA-h67p-54hq-rp68","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-h67p-54hq-rp68","https://nvd.nist.gov/vuln/detail/CVE-2026-53550"],"description":"JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53550","epss":0.00415,"percentile":0.35875,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53550","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.2.0"],"state":"fixed","available":[{"version":"4.2.0","date":"2026-06-15","kind":"first-observed"}]},"advisories":[],"risk":0.21372500000000003},"relatedVulnerabilities":[{"id":"CVE-2026-53550","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53550","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-h67p-54hq-rp68"],"description":"js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relatively small payload (tens of KB), resulting in denial of service. The issue is in merge handling inside lib/loader.js. This vulnerability is fixed in 4.2.0 and 3.15.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53550","epss":0.00415,"percentile":0.35875,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53550","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"4.1.0"}},"found":{"vulnerabilityID":"GHSA-h67p-54hq-rp68","versionConstraint":">=4.0.0,<=4.1.1 (semantic)"},"fix":{"suggestedVersion":"4.2.0"}}],"artifact":{"id":"pkg:npm/js-yaml@4.1.0?package-id=27f207f3c57cf9f3","name":"js-yaml","version":"4.1.0","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:nodeca:js-yaml:4.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@4.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-rj75-hqrm-r3gf","dataSource":"https://github.com/advisories/GHSA-rj75-hqrm-r3gf","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/postcss/postcss-selector-parser/security/advisories/GHSA-rj75-hqrm-r3gf","https://nvd.nist.gov/vuln/detail/CVE-2026-104844","https://github.com/postcss/postcss-selector-parser/commit/62b191792df0a0bc56062e5a875bc74aae2a51cd","https://github.com/postcss/postcss-selector-parser/releases/tag/7.1.6","https://github.com/postcss/postcss-selector-parser/pull/346","https://github.com/postcss/postcss-selector-parser/commit/70b0779c843462197380d25daa02d1528bf7eae5","https://github.com/postcss/postcss-selector-parser/releases/tag/6.1.5"],"description":"PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-104844","epss":0.00389,"percentile":0.32999,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-104844","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-104844","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["6.1.5"],"state":"fixed","available":[{"version":"6.1.5","date":"2026-10-26","kind":"first-observed"}]},"advisories":[],"risk":0.212005},"relatedVulnerabilities":[{"id":"CVE-2026-104844","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-104844","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/postcss/postcss-selector-parser/commit/62b191792df0a0bc56062e5a875bc74aae2a51cd","https://github.com/postcss/postcss-selector-parser/releases/tag/7.1.6","https://github.com/postcss/postcss-selector-parser/security/advisories/GHSA-rj75-hqrm-r3gf"],"description":"PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it. Prior to 7.1.6, src/parser.js splitWord() can receive a flat selector as one word token carrying many class or ID indexes because period and hash characters are not tokenizer word delimiters. The uniqs() deduplication and per-index class and ID membership checks repeatedly scan the class and ID index arrays, while a separate Sass-interpolation filtering pass also performs repeated linear scanning. Together, these passes make parsing quadratic in the number of indexes and allow a crafted selector to occupy a synchronous parser thread. The maxNestingDepth guard does not mitigate the issue because the hostile selector can have zero nesting depth. Only consumers that synchronously parse untrusted selectors in an exposed request path are affected; ordinary build-time parsing of trusted sources is not affected. This issue is fixed in version 7.1.6.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-104844","epss":0.00389,"percentile":0.32999,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-104844","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-104844","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"postcss-selector-parser","version":"6.0.10"}},"found":{"vulnerabilityID":"GHSA-rj75-hqrm-r3gf","versionConstraint":"<6.1.5 (semantic)"},"fix":{"suggestedVersion":"6.1.5"}}],"artifact":{"id":"pkg:npm/postcss-selector-parser@6.0.10?package-id=904da296f3d98fb7","name":"postcss-selector-parser","version":"6.0.10","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:postcss-selector-parser:postcss-selector-parser:6.0.10:*:*:*:*:*:*:*","cpe:2.3:a:postcss-selector-parser:postcss_selector_parser:6.0.10:*:*:*:*:*:*:*","cpe:2.3:a:postcss_selector_parser:postcss-selector-parser:6.0.10:*:*:*:*:*:*:*","cpe:2.3:a:postcss_selector_parser:postcss_selector_parser:6.0.10:*:*:*:*:*:*:*","cpe:2.3:a:postcss-selector:postcss-selector-parser:6.0.10:*:*:*:*:*:*:*","cpe:2.3:a:postcss-selector:postcss_selector_parser:6.0.10:*:*:*:*:*:*:*","cpe:2.3:a:postcss_selector:postcss-selector-parser:6.0.10:*:*:*:*:*:*:*","cpe:2.3:a:postcss_selector:postcss_selector_parser:6.0.10:*:*:*:*:*:*:*","cpe:2.3:a:postcss:postcss-selector-parser:6.0.10:*:*:*:*:*:*:*","cpe:2.3:a:postcss:postcss_selector_parser:6.0.10:*:*:*:*:*:*:*"],"purl":"pkg:npm/postcss-selector-parser@6.0.10","upstreams":[]}},{"vulnerability":{"id":"GHSA-w5hq-g745-h8pq","dataSource":"https://github.com/advisories/GHSA-w5hq-g745-h8pq","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pq","https://github.com/uuidjs/uuid/commit/3d2c5b0342f0fcb52a5ac681c3d47c13e7444b34","https://github.com/uuidjs/uuid/releases/tag/v14.0.0","https://nvd.nist.gov/vuln/detail/CVE-2026-41907","https://github.com/uuidjs/uuid/commit/32389c887c9e75f90442ee4cc95bbab0c4e8346e","https://github.com/uuidjs/uuid/commit/3d61d6ac1f782cf6b1dd8661c60f11722cd49a0d","https://github.com/uuidjs/uuid/commit/9d27ddf7046ce496ef39569ff84d948eeff9cb2a","https://github.com/uuidjs/uuid/releases/tag/v11.1.1","https://github.com/uuidjs/uuid/releases/tag/v12.0.1","https://github.com/uuidjs/uuid/releases/tag/v13.0.1"],"description":"uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41907","epss":0.0035,"percentile":0.28636,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41907","cwe":"CWE-787","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-41907","cwe":"CWE-823","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["11.1.1"],"state":"fixed","available":[{"version":"11.1.1","date":"2026-05-05","kind":"first-observed"}]},"advisories":[],"risk":0.20825000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-41907","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41907","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pq"],"description":"uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41907","epss":0.0035,"percentile":0.28636,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41907","cwe":"CWE-787","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-41907","cwe":"CWE-823","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"uuid","version":"8.3.2"}},"found":{"vulnerabilityID":"GHSA-w5hq-g745-h8pq","versionConstraint":"<11.1.1 (semantic)"},"fix":{"suggestedVersion":"11.1.1"}}],"artifact":{"id":"pkg:npm/uuid@8.3.2?package-id=6af21239160b2122","name":"uuid","version":"8.3.2","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:uuidjs:uuid:8.3.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/uuid@8.3.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-9jgg-88mc-972h","dataSource":"https://github.com/advisories/GHSA-9jgg-88mc-972h","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-9jgg-88mc-972h","https://nvd.nist.gov/vuln/detail/CVE-2025-30360","https://github.com/webpack/webpack-dev-server/commit/72efaab83381a0e1c4914adf401cbd210b7de7eb","https://github.com/webpack/webpack-dev-server/commit/d2575ad8dfed9207ed810b5ea0ccf465115a2239","https://github.com/webpack/webpack-dev-server/blob/55220a800ba4e30dbde2d98785ecf4c80b32f711/lib/Server.js#L3113-L3127","https://github.com/webpack/webpack-dev-server/commit/5c9378bb01276357d7af208a0856ca2163db188e"],"description":"webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browser","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-30360","epss":0.00357,"percentile":0.29481,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-30360","cwe":"CWE-346","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["5.2.1"],"state":"fixed","available":[{"version":"5.2.1","date":"2025-06-05","kind":"first-observed"}]},"advisories":[],"risk":0.20527499999999999},"relatedVulnerabilities":[{"id":"CVE-2025-30360","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-30360","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/webpack/webpack-dev-server/blob/55220a800ba4e30dbde2d98785ecf4c80b32f711/lib/Server.js#L3113-L3127","https://github.com/webpack/webpack-dev-server/commit/5c9378bb01276357d7af208a0856ca2163db188e","https://github.com/webpack/webpack-dev-server/commit/72efaab83381a0e1c4914adf401cbd210b7de7eb","https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-9jgg-88mc-972h"],"description":"webpack-dev-server allows users to use webpack with a development server that provides live reloading. Prior to version 5.2.1, webpack-dev-server users' source code may be stolen when you access a malicious web site with non-Chromium based browser. The `Origin` header is checked to prevent Cross-site WebSocket hijacking from happening, which was reported by CVE-2018-14732. But webpack-dev-server always allows IP address `Origin` headers. This allows websites that are served on IP addresses to connect WebSocket. An attacker can obtain source code via a method similar to that used to exploit CVE-2018-14732. Version 5.2.1 contains a patch for the issue.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-30360","epss":0.00357,"percentile":0.29481,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-30360","cwe":"CWE-346","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"webpack-dev-server","version":"4.9.3"}},"found":{"vulnerabilityID":"GHSA-9jgg-88mc-972h","versionConstraint":"<=5.2.0 (semantic)"},"fix":{"suggestedVersion":"5.2.1"}}],"artifact":{"id":"pkg:npm/webpack-dev-server@4.9.3?package-id=d8e6d1db023d5fac","name":"webpack-dev-server","version":"4.9.3","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:webpack-dev-server:webpack-dev-server:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:webpack-dev-server:webpack_dev_server:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:webpack_dev_server:webpack-dev-server:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:webpack_dev_server:webpack_dev_server:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:webpack-dev:webpack-dev-server:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:webpack-dev:webpack_dev_server:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:webpack_dev:webpack-dev-server:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:webpack_dev:webpack_dev_server:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:webpack:webpack-dev-server:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:webpack:webpack_dev_server:4.9.3:*:*:*:*:*:*:*"],"purl":"pkg:npm/webpack-dev-server@4.9.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-6pq8-jhm2-2vcw","dataSource":"https://github.com/advisories/GHSA-6pq8-jhm2-2vcw","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw","https://nvd.nist.gov/vuln/detail/CVE-2026-110816","https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727","https://github.com/ljharb/qs/releases/tag/v6.16.1"],"description":"qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110816","epss":0.00368,"percentile":0.30715,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110816","cwe":"CWE-248","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-110816","cwe":"CWE-704","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}],"fix":{"versions":["6.16.1"],"state":"fixed","available":[{"version":"6.16.1","date":"2026-10-27","kind":"first-observed"}]},"advisories":[],"risk":0.19872},"relatedVulnerabilities":[{"id":"CVE-2026-110816","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110816","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727","https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw"],"description":"### Summary\n\n\n\n`qs.stringify` with `arrayFormat: 'comma'` throws `TypeError: Cannot convert object to primitive value` when an array element cannot be coerced to a string, such as an object with an own non-callable `toString` (`{ \"toString\": \"x\" }`) or a null-prototype object. The comma format joins array elements with `Array.prototype.join` and, under `encodeValuesOnly`, first passes each element through `String()` in `utils.encode`; neither guards against an element whose string coercion fails.\n\n\n\n### Details\n\n\n\nIn `lib/stringify.js`, the comma branch collapses the array with `obj.join(',')`. For an element whose own `toString` is not callable, `ToPrimitive` skips it, falls through to `Object.prototype.valueOf` (which returns the object itself), and throws. Under `encodeValuesOnly: true`, the same element first reaches `String(str)` in `utils.encode` (`lib/utils.js`) and throws there. Nested arrays (`{ \"a\": [[{ \"toString\": \"x\" }]] }`) throw the same way, through `Array.prototype.toString`. The `indices`, `brackets`, and `repeat` formats walk into object elements instead of coercing them, and are not affected.\n\n\n\nSuch elements can come from untrusted input. `JSON.parse` produces `{ \"a\": [{ \"toString\": \"x\" }] }` with no qs option involved. `qs.parse(\"a[0][toString]=x\", { allowPrototypes: true })` keeps the `toString` key, and `qs.parse(\"a[][b]=c\", { plainObjects: true })` produces a null-prototype element; the default parse options drop `toString` and produce ordinary objects, which do not throw. Express 4's default `query parser`, Express 5's `extended` query parser, and body-parser's `urlencoded({ extended: true })` all call `qs.parse` with `allowPrototypes: true`.\n\n\n\n#### PoC\n\n\n\n```js\n\n\n\nvar qs = require(\"qs\");\n\n\n\nqs.stringify(JSON.parse(\"{\\\"a\\\":[{\\\"toString\\\":\\\"x\\\"}]}\"), { arrayFormat: \"comma\" });\n\n\n\nqs.stringify(qs.parse(\"a[0][toString]=x\", { allowPrototypes: true }), { arrayFormat: \"comma\" });\n\n\n\nqs.stringify(qs.parse(\"a[][b]=c\", { plainObjects: true }), { arrayFormat: \"comma\", encodeValuesOnly: true });\n\n\n\n// TypeError: Cannot convert object to primitive value\n\n\n\n```\n\n\n\n#### Fix\n\n\n\nApplied in a952e75 on `main` and released as v6.16.1: an element whose string coercion would fail is coerced to its primitive `valueOf`, if any, or else to `Object.prototype.toString`, so it renders as `[object Object]`, the same as any other object element already does under the comma format. Nested arrays are walked the way `join` walks them. Every input that did not previously throw serializes exactly as before, and a `toString` or `valueOf` that itself throws still propagates.\n\n\n\n### Affected versions\n\n\n\n`>=6.7.0 <6.16.1`, fixed in v6.16.1.\n\n\n\nThe `join` path was introduced with the comma format in b84acba and first shipped in v6.7.0; v6.6.x and earlier ignore `arrayFormat: 'comma'` and are not affected. The `encodeValuesOnly` `String()` site was introduced in 4c4b23d (v6.11.1); before that, the same input throws at `join`. Every release from v6.7.0 through v6.16.0 is affected.\n\n\n\n### Impact\n\n\n\nAn unauthenticated request can make any code path that re-serializes attacker-influenced data with `qs.stringify` and `arrayFormat: 'comma'` (for example, rebuilding a query string from `req.query` for a redirect or an upstream request, or serializing a parsed JSON body) throw synchronously. In a typical Node.js HTTP framework the throw is caught by the framework error boundary and the affected request returns a 500; the process survives and other requests are unaffected. Where the call runs outside an error boundary, such as an `async` Express 4 handler (where the throw becomes an unhandled promise rejection) or a bare `http` request handler, the process exits, so the impact in that case depends on the application error handling rather than on qs. The default `arrayFormat` (`indices`) is not affected.","cvss":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110816","epss":0.00368,"percentile":0.30715,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110816","cwe":"CWE-248","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-110816","cwe":"CWE-704","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"qs","version":"6.14.2"}},"found":{"vulnerabilityID":"GHSA-6pq8-jhm2-2vcw","versionConstraint":">=6.7.0,<=6.16.0 (semantic)"},"fix":{"suggestedVersion":"6.16.1"}}],"artifact":{"id":"pkg:npm/qs@6.14.2?package-id=29575e25c482e428","name":"qs","version":"6.14.2","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:qs_project:qs:6.14.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/qs@6.14.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-wr44-6hxh-3jwq","dataSource":"https://github.com/advisories/GHSA-wr44-6hxh-3jwq","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-90771","https://github.com/hapijs/joi/issues/3150","https://github.com/hapijs/joi/commit/5b8333c9177e08b4ef4ed02903c2d657084e7afb","https://github.com/hapijs/joi","https://github.com/hapijs/joi/blob/v18.2.8/lib/messages.js","https://www.vulncheck.com/advisories/joi-before-17.13.8-and-18.2.9-prototype-pollution-via-messages","https://github.com/hapijs/joi/pull/3151","https://github.com/hapijs/joi/pull/3153","https://github.com/hapijs/joi/commit/1d2001cad9971327a62c9fd8eb1afec20cd784d2","https://github.com/hapijs/joi/releases/tag/v17.13.8","https://github.com/hapijs/joi/releases/tag/v18.2.9"],"description":"joi messages compilation allows prototype replacement through __proto__ error codes","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-90771","epss":0.00389,"percentile":0.33034,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-90771","cwe":"CWE-1321","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["17.13.8"],"state":"fixed","available":[{"version":"17.13.8","date":"2026-10-06","kind":"first-observed"}]},"advisories":[],"risk":0.19449999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-90771","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-90771","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/hapijs/joi","https://github.com/hapijs/joi/blob/v18.2.8/lib/messages.js","https://github.com/hapijs/joi/commit/5b8333c9177e08b4ef4ed02903c2d657084e7afb","https://github.com/hapijs/joi/issues/3150","https://www.vulncheck.com/advisories/joi-before-17.13.8-and-18.2.9-prototype-pollution-via-messages"],"description":"joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts __proto__ as an error code. Attackers can supply __proto__ keys in custom messages to replace the returned object's prototype, breaking downstream code relying on Object.prototype methods.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-90771","epss":0.00389,"percentile":0.33034,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-90771","cwe":"CWE-1321","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"joi","version":"17.13.4"}},"found":{"vulnerabilityID":"GHSA-wr44-6hxh-3jwq","versionConstraint":"<17.13.8 (semantic)"},"fix":{"suggestedVersion":"17.13.8"}}],"artifact":{"id":"pkg:npm/joi@17.13.4?package-id=72e4936d944f22ba","name":"joi","version":"17.13.4","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:joi:joi:17.13.4:*:*:*:*:*:*:*"],"purl":"pkg:npm/joi@17.13.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-mrwp-f3q8-3g9p","dataSource":"https://github.com/advisories/GHSA-mrwp-f3q8-3g9p","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-mrwp-f3q8-3g9p","https://nvd.nist.gov/vuln/detail/CVE-2026-116689","https://github.com/follow-redirects/follow-redirects/commit/b0a7751e9cd64cd8eeb6ec67d2f206a9cc88d3f8","https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.2"],"description":"follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-116689","epss":0.00266,"percentile":0.18805,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-116689","cwe":"CWE-201","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.16.2"],"state":"fixed","available":[{"version":"1.16.2","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.193515},"relatedVulnerabilities":[{"id":"CVE-2026-116689","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116689","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/follow-redirects/follow-redirects/commit/b0a7751e9cd64cd8eeb6ec67d2f206a9cc88d3f8","https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.2","https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-mrwp-f3q8-3g9p"],"description":"follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.2, the documented sensitiveHeaders option is checked with value instanceof Array, so an array created in another JavaScript realm is replaced with an empty list even though Array.isArray recognizes it. When a request then follows an attacker-controlled cross-origin redirect, a custom credential header named in that discarded list can be forwarded to the redirect destination. This issue is fixed in version 1.16.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-116689","epss":0.00266,"percentile":0.18805,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-116689","cwe":"CWE-201","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"follow-redirects","version":"1.16.0"}},"found":{"vulnerabilityID":"GHSA-mrwp-f3q8-3g9p","versionConstraint":">=1.16.0,<=1.16.1 (semantic)"},"fix":{"suggestedVersion":"1.16.2"}}],"artifact":{"id":"pkg:npm/follow-redirects@1.16.0?package-id=253204e466e2b8c0","name":"follow-redirects","version":"1.16.0","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:follow-redirects:follow_redirects:1.16.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/follow-redirects@1.16.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-86w9-cpqp-85rv","dataSource":"https://github.com/advisories/GHSA-86w9-cpqp-85rv","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-85393","https://github.com/digitalbazaar/forge/issues/1149","https://github.com/advisories/GHSA-ppp5-5v6c-4jwp","https://github.com/digitalbazaar/forge/blob/v1.4.0/lib/asn1.js","https://github.com/digitalbazaar/forge/blob/v1.4.0/lib/rsa.js","https://www.vulncheck.com/advisories/node-forge-through-1.4.0-rsa-pkcs-1-1.5-signature-forgery-via-nested-digestalgorithm-padding","https://github.com/digitalbazaar/forge/pull/1152"],"description":"node-forge RSA PKCS#1 v1.5 signature verification accepts extra nested DigestAlgorithm elements","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-85393","epss":0.00248,"percentile":0.16158,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-85393","cwe":"CWE-347","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.19344},"relatedVulnerabilities":[{"id":"CVE-2026-85393","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85393","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/advisories/GHSA-ppp5-5v6c-4jwp","https://github.com/digitalbazaar/forge","https://github.com/digitalbazaar/forge/blob/v1.4.0/lib/asn1.js","https://github.com/digitalbazaar/forge/blob/v1.4.0/lib/rsa.js","https://github.com/digitalbazaar/forge/issues/1149","https://www.vulncheck.com/advisories/node-forge-through-1.4.0-rsa-pkcs-1-1.5-signature-forgery-via-nested-digestalgorithm-padding"],"description":"node-forge through 1.4.0 fails to validate element count in nested DigestAlgorithm sequences during RSA PKCS#1 v1.5 signature verification. Attackers can embed garbage bytes inside the DigestAlgorithm sequence to forge valid signatures for arbitrary messages using low-exponent RSA keys. This is an incomplete fix for CVE-2026-33894.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-85393","epss":0.00248,"percentile":0.16158,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-85393","cwe":"CWE-347","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"node-forge","version":"1.4.0"}},"found":{"vulnerabilityID":"GHSA-86w9-cpqp-85rv","versionConstraint":"<=1.4.0 (semantic)"}}],"artifact":{"id":"pkg:npm/node-forge@1.4.0?package-id=256486d336435126","name":"node-forge","version":"1.4.0","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:digitalbazaar:forge:1.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/node-forge@1.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-m7pr-hjqh-92cm","dataSource":"https://github.com/advisories/GHSA-m7pr-hjqh-92cm","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-m7pr-hjqh-92cm","https://nvd.nist.gov/vuln/detail/CVE-2026-42038"],"description":"Axios: no_proxy bypass via IP alias allows SSRF","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","metrics":{"baseScore":6.8,"exploitabilityScore":2.3,"impactScore":4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42038","epss":0.00324,"percentile":0.25441,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42038","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.31.1"],"state":"fixed","available":[{"version":"0.31.1","date":"2026-05-05","kind":"first-observed"}]},"advisories":[],"risk":0.19116},"relatedVulnerabilities":[{"id":"CVE-2026-42038","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42038","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-m7pr-hjqh-92cm"],"description":"Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, he fix for no_proxy hostname normalization bypass is incomplete. When no_proxy=localhost is set, requests to 127.0.0.1 and [::1] still route through the proxy instead of bypassing it. The shouldBypassProxy() function does pure string matching — it does not resolve IP aliases or loopback equivalents. This vulnerability is fixed in 1.15.1 and 0.31.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","metrics":{"baseScore":6.8,"exploitabilityScore":2.3,"impactScore":4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42038","epss":0.00324,"percentile":0.25441,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42038","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"0.25.0"}},"found":{"vulnerabilityID":"GHSA-m7pr-hjqh-92cm","versionConstraint":"<=0.31.0 (semantic)"},"fix":{"suggestedVersion":"0.31.1"}}],"artifact":{"id":"pkg:npm/axios@0.25.0?package-id=f91bce3cf8a711bf","name":"axios","version":"0.25.0","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:axios:axios:0.25.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@0.25.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-5x38-2vff-x55p","dataSource":"https://github.com/advisories/GHSA-5x38-2vff-x55p","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/digitalbazaar/forge/security/advisories/GHSA-5x38-2vff-x55p","https://nvd.nist.gov/vuln/detail/CVE-2026-119190","https://github.com/digitalbazaar/forge/commit/58c06bc251856b409c30ecb35a93f5f6c9bbc84a","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1"],"description":"Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119190","epss":0.00246,"percentile":0.15897,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119190","cwe":"CWE-295","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-119190","cwe":"CWE-436","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.4.1"],"state":"fixed","available":[{"version":"1.4.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.18327000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-119190","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119190","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/digitalbazaar/forge/commit/58c06bc251856b409c30ecb35a93f5f6c9bbc84a","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","https://github.com/digitalbazaar/forge/security/advisories/GHSA-5x38-2vff-x55p"],"description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge parsed deprecated extension OIDs 2.5.29.10 and 2.5.29.13 as basicConstraints, and pki.verifyCertificateChain() used the first extension with that name. Exploitation requires a CA trusted by the application to issue a certificate carrying an attacker-supplied deprecated-OID extension, commonly because the CA copies extensions from a certificate signing request. By placing a permissive deprecated extension before the genuine 2.5.29.19 basicConstraints extension, the certificate holder could have the certificate accepted as a CA and issue certificates for arbitrary names, enabling server or client impersonation. If the issuing CA adds a keyUsage extension without keyCertSign, node-forge rejects the chain. This issue is fixed in version 1.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119190","epss":0.00246,"percentile":0.15897,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119190","cwe":"CWE-295","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-119190","cwe":"CWE-436","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"node-forge","version":"1.4.0"}},"found":{"vulnerabilityID":"GHSA-5x38-2vff-x55p","versionConstraint":"<=1.4.0 (semantic)"},"fix":{"suggestedVersion":"1.4.1"}}],"artifact":{"id":"pkg:npm/node-forge@1.4.0?package-id=256486d336435126","name":"node-forge","version":"1.4.0","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:digitalbazaar:forge:1.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/node-forge@1.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-gcqx-w48m-w2h4","dataSource":"https://github.com/advisories/GHSA-gcqx-w48m-w2h4","namespace":"github:language:javascript","severity":"Low","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-93753","https://github.com/TehShrike/deepmerge/issues/273","https://github.com/TehShrike/deepmerge/blob/5b87756a5671635679001cbac72aa42f23472c81/index.js#L39-L60","https://www.vulncheck.com/advisories/deepmerge-through-4.3.1-prototype-poisoning-via-mergeobject"],"description":"deepmerge mergeObject() allows prototype poisoning of returned objects","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U","metrics":{"baseScore":2.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-93753","epss":0.00514,"percentile":0.43823,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-93753","cwe":"CWE-1321","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.17989999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-93753","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93753","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/TehShrike/deepmerge","https://github.com/TehShrike/deepmerge/blob/5b87756a5671635679001cbac72aa42f23472c81/index.js#L39-L60","https://github.com/TehShrike/deepmerge/issues/273","https://www.vulncheck.com/advisories/deepmerge-through-4.3.1-prototype-poisoning-via-mergeobject"],"description":"deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject() function that fails to properly validate keys being written to target objects. Attackers can supply malicious source objects in merge operations to inject attacker-controlled properties into the returned object's prototype, causing applications to inherit unintended values when accessing properties without own-property checks.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-93753","epss":0.00514,"percentile":0.43823,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-93753","cwe":"CWE-1321","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"deepmerge","version":"4.2.2"}},"found":{"vulnerabilityID":"GHSA-gcqx-w48m-w2h4","versionConstraint":">=4.2.0,<=4.3.1 (semantic)"}}],"artifact":{"id":"pkg:npm/deepmerge@4.2.2?package-id=c1668cfa18cb1cf0","name":"deepmerge","version":"4.2.2","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:deepmerge:deepmerge:4.2.2:*:*:*:*:*:*:*"],"purl":"pkg:npm/deepmerge@4.2.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-7q8q-rj6j-mhjq","dataSource":"https://github.com/advisories/GHSA-7q8q-rj6j-mhjq","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-7q8q-rj6j-mhjq","https://github.com/axios/axios/pull/11000","https://github.com/axios/axios/pull/11001","https://github.com/axios/axios/commit/1417285c69344bbcc6420a021f67dee0c6fedb2d","https://github.com/axios/axios/commit/32fc489632377d214db55bfa4e2c48486a7d7ce2","https://github.com/axios/axios/releases/tag/v0.33.0","https://github.com/axios/axios/releases/tag/v1.18.0","https://nvd.nist.gov/vuln/detail/CVE-2026-67319","https://nvd.nist.gov/vuln/detail/CVE-2026-69123","https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-nested-option-objects"],"description":"Axios: Nested axios option objects can consume polluted prototype values","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67319","epss":0.00318,"percentile":0.24744,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67319","cwe":"CWE-1321","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["0.33.0"],"state":"fixed","available":[{"version":"0.33.0","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.17966999999999997},"relatedVulnerabilities":[{"id":"CVE-2026-67319","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-67319","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/axios/axios/security/advisories/GHSA-7q8q-rj6j-mhjq","https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-nested-option-objects"],"description":"axios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option objects when the JavaScript process's Object.prototype has already been polluted by another component. While the top-level merged config uses a null prototype, nested plain objects such as auth and paramsSerializer are cloned into ordinary objects and read without own-property checks. When an application passes placeholder nested objects such as auth: {} or paramsSerializer: {}, inherited username/password values can cause silent injection of an Authorization: Basic header, and inherited encode/serialize values can alter query-string serialization (full serializer replacement requires a function-valued pollution primitive). This is exploitable only in the presence of pre-existing prototype pollution.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67319","epss":0.00318,"percentile":0.24744,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67319","cwe":"CWE-1321","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"0.25.0"}},"found":{"vulnerabilityID":"GHSA-7q8q-rj6j-mhjq","versionConstraint":">=0.8.0,<0.33.0 (semantic)"},"fix":{"suggestedVersion":"0.33.0"}}],"artifact":{"id":"pkg:npm/axios@0.25.0?package-id=f91bce3cf8a711bf","name":"axios","version":"0.25.0","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:axios:axios:0.25.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@0.25.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-qw65-cvwx-89v3","dataSource":"https://github.com/advisories/GHSA-qw65-cvwx-89v3","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3","https://nvd.nist.gov/vuln/detail/CVE-2026-84292","https://github.com/fastify/fast-uri/commit/820e8478dd7da3d09f187bfaf35d50b71f67b8b4","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v2.4.6","https://github.com/fastify/fast-uri/releases/tag/v3.1.7","https://github.com/fastify/fast-uri/releases/tag/v4.1.4"],"description":"fast-uri vulnerable to authority injection via an unvalidated port in serialize","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84292","epss":0.00239,"percentile":0.15045,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84292","cwe":"CWE-116","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["3.1.7"],"state":"fixed","available":[{"version":"3.1.7","date":"2026-09-29","kind":"first-observed"}]},"advisories":[],"risk":0.17925000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-84292","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84292","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3"],"description":"fast-uri serializes the port component of a URI without validating it. When recomposing the authority, the userinfo and host components are escaped but the port is concatenated verbatim, so a port value that is not a sequence of digits can inject authority delimiters, demoting the intended host to userinfo and pointing the authority at an attacker-controlled host. Both fast-uri and Node's URL read the result back as the attacker's host with no error, so re-validating the built URI does not catch it. This affects applications that build URIs from parts and assign untrusted data to the port component through the serialize, normalize, or equal functions in their object forms. The issue affects fast-uri versions before 2.4.6, from 3.0.0 before 3.1.7, and from 4.0.0 before 4.1.4. It is fixed in 2.4.6, 3.1.7, and 4.1.4, where recomposeAuthority rejects any port that is not a digit sequence per RFC 3986.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84292","epss":0.00239,"percentile":0.15045,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84292","cwe":"CWE-116","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-qw65-cvwx-89v3","versionConstraint":">=3.0.0,<3.1.7 (semantic)"},"fix":{"suggestedVersion":"3.1.7"}}],"artifact":{"id":"pkg:npm/fast-uri@3.1.2?package-id=2988e6ba3a1ed377","name":"fast-uri","version":"3.1.2","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:openjsf:fast-uri:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-qc2q-p7wx-3px3","dataSource":"https://github.com/advisories/GHSA-qc2q-p7wx-3px3","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/grpc/grpc-go/security/advisories/GHSA-qc2q-p7wx-3px3","https://nvd.nist.gov/vuln/detail/CVE-2026-84303","https://github.com/grpc/grpc-go/pull/9332","https://github.com/grpc/grpc-go/pull/9335","https://github.com/grpc/grpc-go/commit/db9482836c298f234c896cf82ab68cafc78237f8","https://github.com/grpc/grpc-go/commit/ebba6f3f1b206e2b4dc4d1d5a96d18430302c2fe","https://github.com/grpc/grpc-go/releases/tag/v1.83.1"],"description":"gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84303","epss":0.00311,"percentile":0.23996,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84303","cwe":"CWE-178","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-84303","cwe":"CWE-863","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.83.1"],"state":"fixed","available":[{"version":"1.83.1","date":"2026-09-09","kind":"first-observed"}]},"advisories":[],"risk":0.17571499999999998},"relatedVulnerabilities":[{"id":"CVE-2026-84303","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84303","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/grpc/grpc-go/commit/db9482836c298f234c896cf82ab68cafc78237f8","https://github.com/grpc/grpc-go/commit/ebba6f3f1b206e2b4dc4d1d5a96d18430302c2fe","https://github.com/grpc/grpc-go/pull/9332","https://github.com/grpc/grpc-go/pull/9335","https://github.com/grpc/grpc-go/releases/tag/v1.83.1","https://github.com/grpc/grpc-go/security/advisories/GHSA-qc2q-p7wx-3px3"],"description":"gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does not lowercase header matcher names in normalizeHeaderMatcher even though incoming metadata keys are lowercase. A DENY policy using a mixed-case name such as X-Role or User-Agent therefore does not match and fails open, allowing requests that should be rejected. The same case mismatch permits :Scheme or Grpc-Status to evade gRFC A41 validation and prevents Host from being rewritten to :authority. This issue is fixed in version 1.83.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84303","epss":0.00311,"percentile":0.23996,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84303","cwe":"CWE-178","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-84303","cwe":"CWE-863","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"google.golang.org/grpc","version":"v1.82.1"}},"found":{"vulnerabilityID":"GHSA-qc2q-p7wx-3px3","versionConstraint":"<=1.83.0 (go)"},"fix":{"suggestedVersion":"1.83.1"}}],"artifact":{"id":"pkg:golang/google.golang.org/grpc@v1.82.1?package-id=2caab00b35c7e04a","name":"google.golang.org/grpc","version":"v1.82.1","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:google:grpc:v1.82.1:*:*:*:*:*:*:*"],"purl":"pkg:golang/google.golang.org/grpc@v1.82.1","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:NnAxzGRA0677vCa4BUkOAnO5+FfQqVl9iUXeD0IqcGE="}}},{"vulnerability":{"id":"GHSA-jqff-g426-hqxp","dataSource":"https://github.com/advisories/GHSA-jqff-g426-hqxp","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-jqff-g426-hqxp","https://nvd.nist.gov/vuln/detail/CVE-2026-76172","https://github.com/fastify/fast-uri/commit/37f3417c82994279656854f83ce938acd81c3862","https://github.com/fastify/fast-uri/commit/a941e626411f576f8d90883231e57b6c9d0ff98b","https://github.com/fastify/fast-uri/commit/c6a74bfd9d8c6b0df5362b3c7ae88d8021cb1e39","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v2.4.5","https://github.com/fastify/fast-uri/releases/tag/v3.1.6","https://github.com/fastify/fast-uri/releases/tag/v4.1.3"],"description":"fast-uri vulnerable to host confusion via percent-encoded scheme normalization","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-76172","epss":0.00232,"percentile":0.14137,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-76172","cwe":"CWE-177","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["3.1.6"],"state":"fixed","available":[{"version":"3.1.6","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.174},"relatedVulnerabilities":[{"id":"CVE-2026-76172","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76172","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-jqff-g426-hqxp"],"description":"fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and serialization writes the scheme back out verbatim, unlike the host component which is re-escaped. As a result an input whose scheme carries percent-encoded slashes parses as a scheme with no authority, so the parsed host and error are both undefined, yet resolving or normalizing that same input emits a network-path reference whose authority is attacker-chosen and re-parses to that host. An application that allowlists on the parsed host, or treats a reference with no authority as safe to resolve against its base, gets the opposite of what it checked, giving an off-site redirect, server-side request forgery, or address-policy bypass. The legacy decoder also expands non-standard escape forms, widening the issue past upstream filters, and control characters in the scheme can reach the output as raw carriage return and line feed. The affected versions are 2.3.1 up to but not including 2.4.5, 3.0.0 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which reject a scheme that is not valid after decoding. Users should upgrade to a patched version.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-76172","epss":0.00232,"percentile":0.14137,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-76172","cwe":"CWE-177","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-jqff-g426-hqxp","versionConstraint":">=3.0.0,<3.1.6 (semantic)"},"fix":{"suggestedVersion":"3.1.6"}}],"artifact":{"id":"pkg:npm/fast-uri@3.1.2?package-id=2988e6ba3a1ed377","name":"fast-uri","version":"3.1.2","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:openjsf:fast-uri:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-g3hv-75wg-m249","dataSource":"https://github.com/advisories/GHSA-g3hv-75wg-m249","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249","https://nvd.nist.gov/vuln/detail/CVE-2026-118764","https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1"],"description":"minimatch has potential denial of service via globparts amplification","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["11.0.1"],"state":"fixed","available":[{"version":"11.0.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.173145},"relatedVulnerabilities":[{"id":"CVE-2026-118764","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118764","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1","https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.0.4"}},"found":{"vulnerabilityID":"GHSA-g3hv-75wg-m249","versionConstraint":"<11.0.1 (semantic)"},"fix":{"suggestedVersion":"11.0.1"}}],"artifact":{"id":"pkg:npm/minimatch@3.0.4?package-id=4657685090d0c0b4","name":"minimatch","version":"3.0.4","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.0.4:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.0.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-g3hv-75wg-m249","dataSource":"https://github.com/advisories/GHSA-g3hv-75wg-m249","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249","https://nvd.nist.gov/vuln/detail/CVE-2026-118764","https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1"],"description":"minimatch has potential denial of service via globparts amplification","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["11.0.1"],"state":"fixed","available":[{"version":"11.0.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.173145},"relatedVulnerabilities":[{"id":"CVE-2026-118764","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118764","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1","https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-g3hv-75wg-m249","versionConstraint":"<11.0.1 (semantic)"},"fix":{"suggestedVersion":"11.0.1"}}],"artifact":{"id":"pkg:npm/minimatch@3.1.2?package-id=0d0adedb8aec12d6","name":"minimatch","version":"3.1.2","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-5c9x-8gcm-mpgx","dataSource":"https://github.com/advisories/GHSA-5c9x-8gcm-mpgx","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-5c9x-8gcm-mpgx","https://nvd.nist.gov/vuln/detail/CVE-2026-42034"],"description":"Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42034","epss":0.00327,"percentile":0.25853,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42034","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.31.1"],"state":"fixed","available":[{"version":"0.31.1","date":"2026-05-05","kind":"first-observed"}]},"advisories":[],"risk":0.168405},"relatedVulnerabilities":[{"id":"CVE-2026-42034","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42034","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-5c9x-8gcm-mpgx"],"description":"Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, for stream request bodies, maxBodyLength is bypassed when maxRedirects is set to 0 (native http/https transport path). Oversized streamed uploads are sent fully even when the caller sets strict body limits. This vulnerability is fixed in 1.15.1 and 0.31.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42034","epss":0.00327,"percentile":0.25853,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42034","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"0.25.0"}},"found":{"vulnerabilityID":"GHSA-5c9x-8gcm-mpgx","versionConstraint":"<=0.31.0 (semantic)"},"fix":{"suggestedVersion":"0.31.1"}}],"artifact":{"id":"pkg:npm/axios@0.25.0?package-id=f91bce3cf8a711bf","name":"axios","version":"0.25.0","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:axios:axios:0.25.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@0.25.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-vf2m-468p-8v99","dataSource":"https://github.com/advisories/GHSA-vf2m-468p-8v99","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-vf2m-468p-8v99","https://nvd.nist.gov/vuln/detail/CVE-2026-42036"],"description":"Axios: HTTP adapter streamed responses bypass maxContentLength","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42036","epss":0.00327,"percentile":0.25853,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42036","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.31.1"],"state":"fixed","available":[{"version":"0.31.1","date":"2026-05-05","kind":"first-observed"}]},"advisories":[],"risk":0.168405},"relatedVulnerabilities":[{"id":"CVE-2026-42036","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42036","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-vf2m-468p-8v99"],"description":"Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when responseType: 'stream' is used, Axios returns the response stream without enforcing maxContentLength. This bypasses configured response-size limits and allows unbounded downstream consumption. This vulnerability is fixed in 1.15.1 and 0.31.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42036","epss":0.00327,"percentile":0.25853,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42036","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"0.25.0"}},"found":{"vulnerabilityID":"GHSA-vf2m-468p-8v99","versionConstraint":"<=0.31.0 (semantic)"},"fix":{"suggestedVersion":"0.31.1"}}],"artifact":{"id":"pkg:npm/axios@0.25.0?package-id=f91bce3cf8a711bf","name":"axios","version":"0.25.0","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:axios:axios:0.25.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@0.25.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-f65p-4m7j-42xc","dataSource":"https://github.com/advisories/GHSA-f65p-4m7j-42xc","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-f65p-4m7j-42xc","https://nvd.nist.gov/vuln/detail/CVE-2026-75975","https://github.com/fastify/fast-uri/commit/3728465caacef4b16bc84b7d14760f1c8fe41595","https://github.com/fastify/fast-uri/commit/607bfbe953f28a14c2e06ae64aff38c81ca2937f","https://github.com/fastify/fast-uri/commit/9161eded1ff55fad9d9714c6ad6c0f0283547799","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v2.4.5","https://github.com/fastify/fast-uri/releases/tag/v3.1.6","https://github.com/fastify/fast-uri/releases/tag/v4.1.3"],"description":"fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-75975","epss":0.0022,"percentile":0.12579,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-75975","cwe":"CWE-20","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-75975","cwe":"CWE-918","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["3.1.6"],"state":"fixed","available":[{"version":"3.1.6","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.165},"relatedVulnerabilities":[{"id":"CVE-2026-75975","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75975","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-f65p-4m7j-42xc"],"description":"fast-uri is a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not validate the complete IPv6 grammar, so invalid trailing text in an authority can be silently discarded and a malformed attacker-controlled host is turned into a different valid IPv6 destination. For example, a bracketed literal with invalid trailing characters is normalized to the unspecified address, which a Node HTTP client then connects to a local service over loopback, and other malformed literals collapse to private-range addresses. No error is set on the parsed result, so an application checking the error field cannot detect the rewrite. An application that normalizes untrusted URLs before outbound requests, redirects, proxy routing, or address-policy enforcement can be redirected to a local or private IPv6 target, giving a server-side request forgery and address-policy bypass primitive. The affected versions are 2.3.1 up to but not including 2.4.5, 3.0.0 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which validate bracketed IP literals against the full grammar and mark malformed literals as authority errors. Users should upgrade to a patched version.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-75975","epss":0.0022,"percentile":0.12579,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-75975","cwe":"CWE-20","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-75975","cwe":"CWE-918","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-f65p-4m7j-42xc","versionConstraint":">=3.0.0,<3.1.6 (semantic)"},"fix":{"suggestedVersion":"3.1.6"}}],"artifact":{"id":"pkg:npm/fast-uri@3.1.2?package-id=2988e6ba3a1ed377","name":"fast-uri","version":"3.1.2","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:openjsf:fast-uri:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-fph4-wmhf-6fwf","dataSource":"https://github.com/advisories/GHSA-fph4-wmhf-6fwf","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-fph4-wmhf-6fwf","https://nvd.nist.gov/vuln/detail/CVE-2026-75899","https://github.com/fastify/fast-uri/commit/2642290672e7211c990aaed3749c2ce667d0af4f","https://github.com/fastify/fast-uri/commit/8c15dbe94ec50bb8e595791ebb42c35cef0fd304","https://github.com/fastify/fast-uri/commit/ae92a4c5d8c4b6c9e447f048d5fcbde7eebd5514","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v2.4.5","https://github.com/fastify/fast-uri/releases/tag/v3.1.6","https://github.com/fastify/fast-uri/releases/tag/v4.1.3"],"description":"fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-75899","epss":0.0022,"percentile":0.12579,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-75899","cwe":"CWE-174","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-75899","cwe":"CWE-918","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["3.1.6"],"state":"fixed","available":[{"version":"3.1.6","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.165},"relatedVulnerabilities":[{"id":"CVE-2026-75899","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75899","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-fph4-wmhf-6fwf"],"description":"fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a single call to normalize or resolve can turn nested percent-encoded input into a different network destination such as a loopback hostname or address. For example, a doubly encoded host that spells out a loopback name decodes to that live host in one operation, which contradicts RFC 3986 section 2.4 that an implementation must not decode the same string more than once. An application that normalizes or resolves an untrusted HTTP-family URI before outbound routing, redirect validation, or a host-policy check can receive a destination different from the one the original encoded host represented, giving a server-side request forgery and host-policy bypass primitive. This is an incomplete-fix variant of CVE-2026-6322. The affected versions are 2.4.1 up to but not including 2.4.5, 3.1.2 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which normalize percent escapes once and preserve encoded percent signs. Users should upgrade to a patched version.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-75899","epss":0.0022,"percentile":0.12579,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-75899","cwe":"CWE-174","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-75899","cwe":"CWE-918","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-fph4-wmhf-6fwf","versionConstraint":">=3.1.2,<3.1.6 (semantic)"},"fix":{"suggestedVersion":"3.1.6"}}],"artifact":{"id":"pkg:npm/fast-uri@3.1.2?package-id=2988e6ba3a1ed377","name":"fast-uri","version":"3.1.2","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:openjsf:fast-uri:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-898c-q2cr-xwhg","dataSource":"https://github.com/advisories/GHSA-898c-q2cr-xwhg","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-898c-q2cr-xwhg","https://nvd.nist.gov/vuln/detail/CVE-2018-16487","https://nvd.nist.gov/vuln/detail/CVE-2026-44490"],"description":"axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44490","epss":0.00332,"percentile":0.26477,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44490","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.32.0"],"state":"fixed","available":[{"version":"0.32.0","date":"2026-05-29","kind":"first-observed"}]},"advisories":[],"risk":0.16268000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-44490","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44490","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-898c-q2cr-xwhg"],"description":"Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, axios exposes two read-side prototype-pollution gadgets. When Object.prototype is polluted by an upstream dependency in the same process (e.g. lodash _.merge / CVE-2018-16487), axios silently picks up the polluted values. (1) lib/utils.js line 406 builds merge()'s accumulator as result = {}, so result[targetKey] (line 414) walks Object.prototype and the polluted bucket's own keys are copied into the merged headers and ride out on the wire. (2) lib/core/mergeConfig.js line 26 builds the hasOwnProperty descriptor as a plain-object literal. Object.defineProperty reads descriptor.get/descriptor.set via the prototype chain, so a polluted Object.prototype.get or Object.prototype.set makes the call throw TypeError synchronously on every axios request. This vulnerability is fixed in 0.32.0 and 1.16.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"exploitabilityScore":3.9,"impactScore":4.3},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44490","epss":0.00332,"percentile":0.26477,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44490","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"0.25.0"}},"found":{"vulnerabilityID":"GHSA-898c-q2cr-xwhg","versionConstraint":"<=0.31.1 (semantic)"},"fix":{"suggestedVersion":"0.32.0"}}],"artifact":{"id":"pkg:npm/axios@0.25.0?package-id=f91bce3cf8a711bf","name":"axios","version":"0.25.0","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:axios:axios:0.25.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@0.25.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-79cf-xcqc-c78w","dataSource":"https://github.com/advisories/GHSA-79cf-xcqc-c78w","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-4v9v-hfq4-rm2v","https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-79cf-xcqc-c78w","https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-9jgg-88mc-972h","https://nvd.nist.gov/vuln/detail/CVE-2026-6402","https://cna.openjsf.org/security-advisories.html"],"description":"webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":1.7,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-6402","epss":0.00291,"percentile":0.21732,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-6402","cwe":"CWE-749","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["5.2.4"],"state":"fixed","available":[{"version":"5.2.4","date":"2026-05-18","kind":"first-observed"}]},"advisories":[],"risk":0.149865},"relatedVulnerabilities":[{"id":"CVE-2026-6402","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6402","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-79cf-xcqc-c78w"],"description":"webpack-dev-server versions up to and including 5.2.3 are vulnerable to cross-origin source code exposure when serving over a non-potentially trustworthy origin such as plain HTTP. The previous fix relied on the Sec-Fetch-Mode and Sec-Fetch-Site request headers, which browsers omit for non-trustworthy origins, allowing a malicious site to load the bundled source as a script and read it across origins. Impact: an attacker controlling a website visited by a developer running webpack-dev-server can recover the application source code when the dev server runs over HTTP at a guessable host and port. Chromium based browsers from Chrome 142 onward are not affected due to local network access restrictions. Upgrade to webpack-dev-server 5.2.4 or later, which sets Cross-Origin-Resource-Policy: same-origin on responses.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":1.7,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-6402","epss":0.00291,"percentile":0.21732,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-6402","cwe":"CWE-749","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"webpack-dev-server","version":"4.9.3"}},"found":{"vulnerabilityID":"GHSA-79cf-xcqc-c78w","versionConstraint":"<=5.2.3 (semantic)"},"fix":{"suggestedVersion":"5.2.4"}}],"artifact":{"id":"pkg:npm/webpack-dev-server@4.9.3?package-id=d8e6d1db023d5fac","name":"webpack-dev-server","version":"4.9.3","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:webpack-dev-server:webpack-dev-server:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:webpack-dev-server:webpack_dev_server:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:webpack_dev_server:webpack-dev-server:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:webpack_dev_server:webpack_dev_server:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:webpack-dev:webpack-dev-server:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:webpack-dev:webpack_dev_server:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:webpack_dev:webpack-dev-server:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:webpack_dev:webpack_dev_server:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:webpack:webpack-dev-server:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:webpack:webpack_dev_server:4.9.3:*:*:*:*:*:*:*"],"purl":"pkg:npm/webpack-dev-server@4.9.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-w74x-v6f9-j3xg","dataSource":"https://github.com/advisories/GHSA-w74x-v6f9-j3xg","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-w74x-v6f9-j3xg","https://nvd.nist.gov/vuln/detail/CVE-2026-110306","https://github.com/fastify/fast-uri/commit/39933a1f1422986f14e2d844f552238feb40f5d4","https://github.com/fastify/fast-uri/commit/597f254c86d151568511eeb9a1df761fd12520b3","https://github.com/fastify/fast-uri/commit/e60e716f41d1d73717e2d803d20b68d2c6d20a0f","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v2.4.8","https://github.com/fastify/fast-uri/releases/tag/v3.1.9","https://github.com/fastify/fast-uri/releases/tag/v4.2.3"],"description":"fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110306","epss":0.0025,"percentile":0.16356,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110306","cwe":"CWE-172","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-110306","cwe":"CWE-180","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["3.1.9"],"state":"fixed","available":[{"version":"3.1.9","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.13874999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-110306","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110306","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-w74x-v6f9-j3xg"],"description":"fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, fast-uri percent-decodes the scheme component with the legacy global unescape() function before validating it, so an input whose decoded scheme is a dangerous token is emitted as a live scheme even though RFC 3986 does not allow percent-encoding in a scheme and no other parser accepts it. An application that screens dangerous schemes on the raw input and then stores or renders the normalized or resolved result can turn an inert string into an executable javascript, data, or vbscript URL, producing a stored or reflected cross-site scripting vector, and the equal() comparison treats an encoded and a plain scheme as the same, which can bypass equality-based allowlists. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to one of these versions or later. As a workaround, reject input whose scheme part contains a percent sign, or check the parsed scheme against an allowlist after normalization and use that same parsed result rather than the raw string.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110306","epss":0.0025,"percentile":0.16356,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110306","cwe":"CWE-172","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-110306","cwe":"CWE-180","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-w74x-v6f9-j3xg","versionConstraint":">=3.0.0,<3.1.9 (semantic)"},"fix":{"suggestedVersion":"3.1.9"}}],"artifact":{"id":"pkg:npm/fast-uri@3.1.2?package-id=2988e6ba3a1ed377","name":"fast-uri","version":"3.1.2","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:openjsf:fast-uri:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-v422-hmwv-36x6","dataSource":"https://github.com/advisories/GHSA-v422-hmwv-36x6","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/expressjs/body-parser/security/advisories/GHSA-v422-hmwv-36x6","https://nvd.nist.gov/vuln/detail/CVE-2026-12590","https://github.com/expressjs/body-parser/pull/698","https://github.com/expressjs/body-parser/pull/741","https://github.com/expressjs/body-parser/commit/2322e111cc321413ec2b7b76d01be533d3de9d7d","https://github.com/expressjs/body-parser/commit/3492672eee593d5c158f239b6e9115498a5dbeac","https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/body-parser/releases/tag/1.20.6","https://github.com/expressjs/body-parser/releases/tag/v2.3.0"],"description":"body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-12590","epss":0.00412,"percentile":0.355,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-12590","cwe":"CWE-770","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["1.20.6"],"state":"fixed","available":[{"version":"1.20.6","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.13802},"relatedVulnerabilities":[{"id":"CVE-2026-12590","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12590","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/body-parser/security/advisories/GHSA-v422-hmwv-36x6"],"description":"Impact: In body-parser versions prior to 1.20.6 (1.x line) and 2.3.0 (2.x line), when the parser is configured with an invalid limit option value such as an unparseable string or NaN, bytes.parse returns null and the request body size check is silently skipped. Applications that rely on limit as their primary safeguard against oversized request bodies will accept arbitrarily large payloads, leading to excessive memory and CPU usage and denial of service. Patches: This issue is fixed in body-parser 1.20.6 and 2.3.0. After the fix, invalid limit values throw a clear error at parser construction time instead of silently disabling enforcement, while null and undefined continue to fall back to the default limit of 100kb. Workarounds: Validate the limit value before passing it to body-parser. For example, parse the value at startup and reject any configuration where the result is null or a non-finite number.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-12590","epss":0.00412,"percentile":0.355,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-12590","cwe":"CWE-770","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"body-parser","version":"1.20.4"}},"found":{"vulnerabilityID":"GHSA-v422-hmwv-36x6","versionConstraint":"<1.20.6 (semantic)"},"fix":{"suggestedVersion":"1.20.6"}}],"artifact":{"id":"pkg:npm/body-parser@1.20.4?package-id=8b258b3b8498883b","name":"body-parser","version":"1.20.4","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:openjsf:body-parser:1.20.4:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/body-parser@1.20.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-6w3j-5fw6-r9vr","dataSource":"https://github.com/advisories/GHSA-6w3j-5fw6-r9vr","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/hapijs/joi/security/advisories/GHSA-6w3j-5fw6-r9vr","https://nvd.nist.gov/vuln/detail/CVE-2026-84368","https://github.com/hapijs/joi/pull/3138","https://github.com/hapijs/joi/pull/3139","https://github.com/hapijs/joi/commit/8d0b808f3e874d28f9078f61b7742290989afb36","https://github.com/hapijs/joi/commit/90d07571923c90e3432a328fc041d1cda03d30fa"],"description":"joi: Prototype pollution via a `__proto__` language key in custom messages","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84368","epss":0.00389,"percentile":0.33034,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84368","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["17.13.6"],"state":"fixed","available":[{"version":"17.13.6","date":"2026-09-09","kind":"first-observed"}]},"advisories":[],"risk":0.130315},"relatedVulnerabilities":[{"id":"CVE-2026-84368","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84368","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/hapijs/joi/commit/8d0b808f3e874d28f9078f61b7742290989afb36","https://github.com/hapijs/joi/commit/90d07571923c90e3432a328fc041d1cda03d30fa","https://github.com/hapijs/joi/pull/3138","https://github.com/hapijs/joi/pull/3139","https://github.com/hapijs/joi/security/advisories/GHSA-6w3j-5fw6-r9vr"],"description":"joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.6 and 18.2.5, the @hapi/joi package through 17.1.1 and the successor joi package contain prototype pollution in lib/messages.js, where exports.compile() and exports.merge() reuse inherited objects for attacker-controlled language keys supplied through messages(), message(), prefs({ messages }), Joi.extend({ messages }), or rule({ message }). A language key named __proto__ writes properties onto Object.prototype, and constructor writes to the Object function's static properties. A consuming application that gates on the presence of an inherited property can take the wrong branch for every inspected object. The flaw is not reachable from data that joi validates and requires an application to feed untrusted input directly into schema-construction configuration. This issue is fixed in joi versions 17.13.6 and 18.2.5; no fixed @hapi/joi version is available.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84368","epss":0.00389,"percentile":0.33034,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84368","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"joi","version":"17.13.4"}},"found":{"vulnerabilityID":"GHSA-6w3j-5fw6-r9vr","versionConstraint":">=17.2.0,<17.13.6 (semantic)"},"fix":{"suggestedVersion":"17.13.6"}}],"artifact":{"id":"pkg:npm/joi@17.13.4?package-id=72e4936d944f22ba","name":"joi","version":"17.13.4","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:joi:joi:17.13.4:*:*:*:*:*:*:*"],"purl":"pkg:npm/joi@17.13.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-gg4h-3hg2-grpc","dataSource":"https://github.com/advisories/GHSA-gg4h-3hg2-grpc","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/hapijs/joi/security/advisories/GHSA-gg4h-3hg2-grpc","https://nvd.nist.gov/vuln/detail/CVE-2026-84367","https://github.com/hapijs/joi/pull/3134","https://github.com/hapijs/joi/pull/3135","https://github.com/hapijs/joi/commit/162f367aa178d2e1ebec8dc1164e5fe16536ddf6","https://github.com/hapijs/joi/commit/172ececa192feda532b743d77bc9d3e523d19b01","https://github.com/hapijs/joi/releases/tag/v17.13.5","https://github.com/hapijs/joi/releases/tag/v18.2.4"],"description":"joi: object().rename() with a template target can set the validated object's prototype","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84367","epss":0.00389,"percentile":0.33034,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84367","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["17.13.5"],"state":"fixed","available":[{"version":"17.13.5","date":"2026-09-09","kind":"first-observed"}]},"advisories":[],"risk":0.130315},"relatedVulnerabilities":[{"id":"CVE-2026-84367","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84367","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/hapijs/joi/commit/162f367aa178d2e1ebec8dc1164e5fe16536ddf6","https://github.com/hapijs/joi/commit/172ececa192feda532b743d77bc9d3e523d19b01","https://github.com/hapijs/joi/pull/3134","https://github.com/hapijs/joi/pull/3135","https://github.com/hapijs/joi/security/advisories/GHSA-gg4h-3hg2-grpc"],"description":"joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.5 and 18.2.4, joi's lib/types/keys.js internals.rename() implementation used by object().rename() permits a schema that renames keys with a regular-expression source and a Joi.expression() or Joi.x() target that interpolates the pattern's own match data, combined with { multiple: true }, to derive a target from an attacker-controlled input key. An attacker can send x-__proto__ with an object value, causing the target to render as __proto__ and set the prototype of the object returned by validate() instead of creating an own key. The global Object.prototype is not modified, so the effect is confined to the object returned by that validation call. Static-string targets and schemas using the default { multiple: false } are not affected. This issue is fixed in versions 17.13.5 and 18.2.4.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84367","epss":0.00389,"percentile":0.33034,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84367","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"joi","version":"17.13.4"}},"found":{"vulnerabilityID":"GHSA-gg4h-3hg2-grpc","versionConstraint":">=16.0.0,<17.13.5 (semantic)"},"fix":{"suggestedVersion":"17.13.5"}}],"artifact":{"id":"pkg:npm/joi@17.13.4?package-id=72e4936d944f22ba","name":"joi","version":"17.13.4","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:joi:joi:17.13.4:*:*:*:*:*:*:*"],"purl":"pkg:npm/joi@17.13.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-6wvx-3r32-xmcg","dataSource":"https://github.com/advisories/GHSA-6wvx-3r32-xmcg","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/digitalbazaar/forge/security/advisories/GHSA-6wvx-3r32-xmcg","https://nvd.nist.gov/vuln/detail/CVE-2026-118777","https://github.com/digitalbazaar/forge/commit/797c3f816a22748a96fceebb34eb3a6716853991","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1"],"description":"Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118777","epss":0.00255,"percentile":0.17162,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118777","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.4.1"],"state":"fixed","available":[{"version":"1.4.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.12494999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-118777","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118777","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/digitalbazaar/forge/commit/797c3f816a22748a96fceebb34eb3a6716853991","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","https://github.com/digitalbazaar/forge/security/advisories/GHSA-6wvx-3r32-xmcg"],"description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the forge.http client stored cookie names and paths from Set-Cookie response headers in ordinary JavaScript objects. A malicious server could use the cookie name __proto__ so that the attacker-controlled cookie path was written as a property on Object.prototype, or use inherited names such as constructor to modify Object. An empty cookie value could use the removal path to delete an inherited Object.prototype property. Applications using forge.http directly or through forge.xhr are affected; applications that do not use forge.http are unaffected. This issue is fixed in version 1.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118777","epss":0.00255,"percentile":0.17162,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118777","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"node-forge","version":"1.4.0"}},"found":{"vulnerabilityID":"GHSA-6wvx-3r32-xmcg","versionConstraint":"<=1.4.0 (semantic)"},"fix":{"suggestedVersion":"1.4.1"}}],"artifact":{"id":"pkg:npm/node-forge@1.4.0?package-id=256486d336435126","name":"node-forge","version":"1.4.0","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:digitalbazaar:forge:1.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/node-forge@1.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-hrr3-gc8f-f4qj","dataSource":"https://github.com/advisories/GHSA-hrr3-gc8f-f4qj","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-hrr3-gc8f-f4qj","https://nvd.nist.gov/vuln/detail/CVE-2026-86472","https://github.com/fastify/fast-uri/commit/5dabb86732aa2a7655e258719970e61e12b6b4d1","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v2.4.7","https://github.com/fastify/fast-uri/releases/tag/v3.1.8","https://github.com/fastify/fast-uri/releases/tag/v4.1.5"],"description":"fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-86472","epss":0.00253,"percentile":0.16802,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-86472","cwe":"CWE-178","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["3.1.8"],"state":"fixed","available":[{"version":"3.1.8","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.12397000000000001},"relatedVulnerabilities":[{"id":"CVE-2026-86472","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86472","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-hrr3-gc8f-f4qj"],"description":"fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv. In versions before 2.4.7, from 3.0.0 through 3.1.7, and from 4.0.0 through 4.1.4, fast-uri folds the host to lowercase before it percent-decodes the host, so a percent-encoded uppercase octet such as %41 decodes to a literal A that is never folded. For a scheme-relative reference such as //host there is no scheme, so the host canonicalization that would normally repair this does not run, and parse, normalize, and equal then disagree on the same host. An application that makes a case-sensitive host decision on fast-uri output, for example a host allowlist or denylist that compares the parsed host or uses equal, can be steered past the check with a percent-encoded uppercase octet, and because hostnames are case-insensitive in DNS and HTTP the evading spelling still reaches the host the check meant to gate. The issue is fixed in fast-uri 2.4.7, 3.1.8, and 4.1.5, and users should upgrade to one of those versions or later. As a workaround, compare hosts case-insensitively by lowercasing the parsed host before any allowlist or denylist decision.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-86472","epss":0.00253,"percentile":0.16802,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-86472","cwe":"CWE-178","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-hrr3-gc8f-f4qj","versionConstraint":">=3.0.0,<3.1.8 (semantic)"},"fix":{"suggestedVersion":"3.1.8"}}],"artifact":{"id":"pkg:npm/fast-uri@3.1.2?package-id=2988e6ba3a1ed377","name":"fast-uri","version":"3.1.2","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:openjsf:fast-uri:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-5cwg-6vw7-rj6p","dataSource":"https://github.com/advisories/GHSA-5cwg-6vw7-rj6p","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/digitalbazaar/forge/security/advisories/GHSA-5cwg-6vw7-rj6p","https://nvd.nist.gov/vuln/detail/CVE-2026-119186","https://github.com/digitalbazaar/forge/commit/236845d96c71207259f91638d0138bba8e2fd624","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1"],"description":"Forge: AES-GCM authentication bypass via unvalidated tagLength option","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119186","epss":0.00206,"percentile":0.10693,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119186","cwe":"CWE-354","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-119186","cwe":"CWE-1284","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.4.1"],"state":"fixed","available":[{"version":"1.4.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.11227000000000001},"relatedVulnerabilities":[{"id":"CVE-2026-119186","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119186","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/digitalbazaar/forge/commit/236845d96c71207259f91638d0138bba8e2fd624","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","https://github.com/digitalbazaar/forge/security/advisories/GHSA-5cwg-6vw7-rj6p"],"description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge did not validate the AES-GCM tagLength option passed to start() during decryption through forge.cipher.createDecipher(). When an application derived tagLength from received data or used an unset or zero-like configuration value, a value that converted to zero together with an empty or missing authentication tag caused the calculated and supplied tags to compare as empty, so decipher.finish() accepted unauthenticated ciphertext. Applications that omit tagLength to use the 128-bit default or pass a fixed valid tag length are unaffected. This issue is fixed in version 1.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119186","epss":0.00206,"percentile":0.10693,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119186","cwe":"CWE-354","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-119186","cwe":"CWE-1284","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"node-forge","version":"1.4.0"}},"found":{"vulnerabilityID":"GHSA-5cwg-6vw7-rj6p","versionConstraint":"<=1.4.0 (semantic)"},"fix":{"suggestedVersion":"1.4.1"}}],"artifact":{"id":"pkg:npm/node-forge@1.4.0?package-id=256486d336435126","name":"node-forge","version":"1.4.0","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:digitalbazaar:forge:1.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/node-forge@1.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-525v-9gp9-w22h","dataSource":"https://github.com/advisories/GHSA-525v-9gp9-w22h","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/digitalbazaar/forge/security/advisories/GHSA-525v-9gp9-w22h","https://nvd.nist.gov/vuln/detail/CVE-2026-118778","https://github.com/digitalbazaar/forge/commit/7be9fbd40df2e2f15f29fea2846b1c87d58f6888","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1"],"description":"Forge: TLS client crash when the server sends no certificate","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118778","epss":0.00204,"percentile":0.10367,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118778","cwe":"CWE-476","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["1.4.1"],"state":"fixed","available":[{"version":"1.4.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.11118000000000003},"relatedVulnerabilities":[{"id":"CVE-2026-118778","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118778","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/digitalbazaar/forge/commit/7be9fbd40df2e2f15f29fea2846b1c87d58f6888","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","https://github.com/digitalbazaar/forge/security/advisories/GHSA-525v-9gp9-w22h"],"description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection(), c.session.serverCertificate, RSA key exchange to process the relevant input or security decision. node-forge's TLS client checked the wrong property when deciding whether a server certificate was missing. A malicious TLS server or on-path peer could omit the Certificate message and reach code that dereferenced the absent certificate, causing an uncaught exception and terminating the connection or process. This issue is fixed in version 1.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118778","epss":0.00204,"percentile":0.10367,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118778","cwe":"CWE-476","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"node-forge","version":"1.4.0"}},"found":{"vulnerabilityID":"GHSA-525v-9gp9-w22h","versionConstraint":"<=1.4.0 (semantic)"},"fix":{"suggestedVersion":"1.4.1"}}],"artifact":{"id":"pkg:npm/node-forge@1.4.0?package-id=256486d336435126","name":"node-forge","version":"1.4.0","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:digitalbazaar:forge:1.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/node-forge@1.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-xx6v-rp6x-q39c","dataSource":"https://github.com/advisories/GHSA-xx6v-rp6x-q39c","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-xx6v-rp6x-q39c","https://nvd.nist.gov/vuln/detail/CVE-2026-42042"],"description":"Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"exploitabilityScore":2.9,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42042","epss":0.0021,"percentile":0.11182,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42042","cwe":"CWE-183","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-42042","cwe":"CWE-201","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.31.1"],"state":"fixed","available":[{"version":"0.31.1","date":"2026-05-05","kind":"first-observed"}]},"advisories":[],"risk":0.10919999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-42042","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42042","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-xx6v-rp6x-q39c"],"description":"Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library's XSRF token protection logic uses JavaScript truthy/falsy semantics instead of strict boolean comparison for the withXSRFToken config property. When this property is set to any truthy non-boolean value (via prototype pollution or misconfiguration), the same-origin check (isURLSameOrigin) is short-circuited, causing XSRF tokens to be sent to all request targets including cross-origin servers controlled by an attacker. This vulnerability is fixed in 1.15.1 and 0.31.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"exploitabilityScore":2.9,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42042","epss":0.0021,"percentile":0.11182,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42042","cwe":"CWE-183","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-42042","cwe":"CWE-201","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"0.25.0"}},"found":{"vulnerabilityID":"GHSA-xx6v-rp6x-q39c","versionConstraint":"<=0.31.0 (semantic)"},"fix":{"suggestedVersion":"0.31.1"}}],"artifact":{"id":"pkg:npm/axios@0.25.0?package-id=f91bce3cf8a711bf","name":"axios","version":"0.25.0","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:axios:axios:0.25.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@0.25.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-4642-5mcj-2rqw","dataSource":"https://github.com/advisories/GHSA-4642-5mcj-2rqw","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/digitalbazaar/forge/security/advisories/GHSA-4642-5mcj-2rqw","https://nvd.nist.gov/vuln/detail/CVE-2026-118775","https://github.com/digitalbazaar/forge/commit/e56a3dde8e4e63bae566bb32546eeaf92f515e1e","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1"],"description":"Forge: ASN.1 OID first arc truncation in asn1.oidToDer","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118775","epss":0.00313,"percentile":0.24276,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118775","cwe":"CWE-190","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.4.1"],"state":"fixed","available":[{"version":"1.4.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.10485499999999999},"relatedVulnerabilities":[{"id":"CVE-2026-118775","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118775","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/digitalbazaar/forge/commit/e56a3dde8e4e63bae566bb32546eeaf92f515e1e","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","https://github.com/digitalbazaar/forge/security/advisories/GHSA-4642-5mcj-2rqw"],"description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, asn1.oidToDer() in lib/asn1.js did not range-check the first two arcs of an OID. An application that accepted an untrusted OID string, checked or authorized that string, and then encoded it with asn1.oidToDer() could emit DER representing a different, trusted OID from the one that was checked. DER parsing is not affected. This issue is fixed in version 1.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118775","epss":0.00313,"percentile":0.24276,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118775","cwe":"CWE-190","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"node-forge","version":"1.4.0"}},"found":{"vulnerabilityID":"GHSA-4642-5mcj-2rqw","versionConstraint":"<=1.4.0 (semantic)"},"fix":{"suggestedVersion":"1.4.1"}}],"artifact":{"id":"pkg:npm/node-forge@1.4.0?package-id=256486d336435126","name":"node-forge","version":"1.4.0","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:digitalbazaar:forge:1.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/node-forge@1.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-333x-w4r6-6crp","dataSource":"https://github.com/advisories/GHSA-333x-w4r6-6crp","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-333x-w4r6-6crp","https://nvd.nist.gov/vuln/detail/CVE-2026-110725","https://github.com/fastify/fast-uri/commit/39e6493c1356f30a0084171627eb266786e1620e","https://github.com/fastify/fast-uri/commit/a9b8d67353630aab053cd727cf629023dd018d2b","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v2.4.8","https://github.com/fastify/fast-uri/releases/tag/v3.1.9","https://github.com/fastify/fast-uri/releases/tag/v4.2.3"],"description":"fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110725","epss":0.00302,"percentile":0.23001,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110725","cwe":"CWE-41","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-110725","cwe":"CWE-116","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["3.1.9"],"state":"fixed","available":[{"version":"3.1.9","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.10117},"relatedVulnerabilities":[{"id":"CVE-2026-110725","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110725","namespace":"nvd:cpe","severity":"Low","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-333x-w4r6-6crp"],"description":"fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, when serialize(), normalize(), or resolve() are called with the non-default option reference set to suffix on a reference that has no authority, the emitted relative reference can contain a bare colon in its first path segment without escaping it, even though RFC 3986 forbids that because it makes the string reparse as an absolute URI with a scheme. An application that serializes or normalizes a relative reference with the suffix option and then treats the result as a URI can turn inert input into a live javascript, data, or vbscript URL, a cross-site scripting vector, and the equal() comparison can conflate a scheme-bearing reference with a relative one. Exposure is limited to applications using the non-default suffix reference option. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to one of these versions or later. As a workaround, avoid the suffix reference option on untrusted input, or percent-encode a colon in the first path segment of the result before treating it as a URI.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110725","epss":0.00302,"percentile":0.23001,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110725","cwe":"CWE-41","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-110725","cwe":"CWE-116","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-333x-w4r6-6crp","versionConstraint":">=3.0.0,<3.1.9 (semantic)"},"fix":{"suggestedVersion":"3.1.9"}}],"artifact":{"id":"pkg:npm/fast-uri@3.1.2?package-id=2988e6ba3a1ed377","name":"fast-uri","version":"3.1.2","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:openjsf:fast-uri:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GO-2026-6866","dataSource":"https://go.dev/cl/855121","namespace":"govulndb:language:go","severity":"Unknown","urls":["https://go.dev/issue/82622","https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs"],"description":"In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as <mglyph> or <malignmark> fostered under <mtext>), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output.\n\nContinue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text.","cvss":[],"epss":[{"cve":"CVE-2026-97045","epss":0.00202,"percentile":0.10121,"date":"2026-10-31"}],"fix":{"versions":["0.62.0"],"state":"fixed","available":[{"version":"0.62.0","date":"2026-10-27","kind":"release"}]},"advisories":[],"risk":0.101},"relatedVulnerabilities":[{"id":"CVE-2026-97045","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97045","namespace":"nvd:cpe","severity":"Unknown","urls":["https://go.dev/cl/855121","https://go.dev/issue/82622","https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs","https://pkg.go.dev/vuln/GO-2026-6866"],"description":"In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as <mglyph> or <malignmark> fostered under <mtext>), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output. Continue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text.","cvss":[],"epss":[{"cve":"CVE-2026-97045","epss":0.00202,"percentile":0.10121,"date":"2026-10-31"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.56.0"}},"found":{"vulnerabilityID":"GO-2026-6866","versionConstraint":"<0.62.0 (go)"},"fix":{"suggestedVersion":"0.62.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.56.0?package-id=4ad2b62edbe56c92","name":"golang.org/x/net","version":"v0.56.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.56.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.56.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.56.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o="}}},{"vulnerability":{"id":"GHSA-xhq7-xmqj-769h","dataSource":"https://github.com/advisories/GHSA-xhq7-xmqj-769h","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-xhq7-xmqj-769h","https://nvd.nist.gov/vuln/detail/CVE-2026-110095","https://github.com/fastify/fast-uri/commit/048bbd0a252971be86d6579f0dfc87f8de5b9c47","https://github.com/fastify/fast-uri/commit/52774a5c35df36b0bbe439cd4c12c3dc0e50e3b9","https://github.com/fastify/fast-uri/commit/7c19f8b97ec51f1f20b4e3d9d5820cb8d5176058","https://github.com/fastify/fast-uri/commit/9eb8759a9825c046f57f7f695f1944bc39b88abd","https://github.com/fastify/fast-uri/commit/acc5c5d60c4209571789496e1732468911c7e12a","https://github.com/fastify/fast-uri/commit/b110a3571c37dfcf9d1c72ce2e2e178c78d1a424","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v2.4.8","https://github.com/fastify/fast-uri/releases/tag/v3.1.9","https://github.com/fastify/fast-uri/releases/tag/v4.2.3"],"description":"fast-uri vulnerable to improper path equivalence in relative reference normalization","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110095","epss":0.00289,"percentile":0.21549,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110095","cwe":"CWE-41","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["3.1.9"],"state":"fixed","available":[{"version":"3.1.9","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.096815},"relatedVulnerabilities":[{"id":"CVE-2026-110095","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110095","namespace":"nvd:cpe","severity":"Low","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-xhq7-xmqj-769h"],"description":"fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, the normalize() and serialize() functions apply RFC 3986 dot-segment removal to the path of a relative-path reference, even though that algorithm is defined only for the merged target path during resolution, so a leading parent-directory segment can be dropped and a document-relative reference can become root-relative. An application that normalizes an attacker-supplied or user-supplied relative reference and then resolves it, or uses it as a cache, deduplication, or authorization key, can have the reference escape its intended directory and point at a different resource. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to one of these versions or later. As a workaround, resolve a relative reference against its absolute base first and normalize the absolute result instead of normalizing the reference beforehand.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110095","epss":0.00289,"percentile":0.21549,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110095","cwe":"CWE-41","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-xhq7-xmqj-769h","versionConstraint":">=3.0.0,<3.1.9 (semantic)"},"fix":{"suggestedVersion":"3.1.9"}}],"artifact":{"id":"pkg:npm/fast-uri@3.1.2?package-id=2988e6ba3a1ed377","name":"fast-uri","version":"3.1.2","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:openjsf:fast-uri:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-jc66-7q78-782g","dataSource":"https://github.com/advisories/GHSA-jc66-7q78-782g","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/digitalbazaar/forge/security/advisories/GHSA-jc66-7q78-782g","https://nvd.nist.gov/vuln/detail/CVE-2026-118782","https://github.com/digitalbazaar/forge/commit/d9584aa56824972858366d5187b3d29e46bf3656","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1"],"description":"Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118782","epss":0.00125,"percentile":0.02194,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118782","cwe":"CWE-354","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-118782","cwe":"CWE-1284","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["1.4.1"],"state":"fixed","available":[{"version":"1.4.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.09375},"relatedVulnerabilities":[{"id":"CVE-2026-118782","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118782","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/digitalbazaar/forge/commit/d9584aa56824972858366d5187b3d29e46bf3656","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","https://github.com/digitalbazaar/forge/security/advisories/GHSA-jc66-7q78-782g"],"description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge accepted a PKCS#12 MAC or PKCS#12 password-based encryption iteration count of zero or less. pki.pbe.generatePkcs12Key() then returned a constant key independent of the password and salt, allowing crafted PKCS#12 input processed by forge.pkcs12.pkcs12FromAsn1() to bypass password-based integrity checks. Predictable encryption keys and IVs also affected PKCS#12 PBE using pbeWithSHAAnd3-KeyTripleDES-CBC or pbewithSHAAnd40BitRC2-CBC, including shrouded key bags, encrypted SafeContents, and PKCS#8 ENCRYPTED PRIVATE KEY input processed independently by forge.pki.decryptPrivateKeyInfo(). PBES2/PBKDF2-encrypted content is unaffected. This issue is fixed in version 1.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118782","epss":0.00125,"percentile":0.02194,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118782","cwe":"CWE-354","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-118782","cwe":"CWE-1284","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"node-forge","version":"1.4.0"}},"found":{"vulnerabilityID":"GHSA-jc66-7q78-782g","versionConstraint":"<=1.4.0 (semantic)"},"fix":{"suggestedVersion":"1.4.1"}}],"artifact":{"id":"pkg:npm/node-forge@1.4.0?package-id=256486d336435126","name":"node-forge","version":"1.4.0","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:digitalbazaar:forge:1.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/node-forge@1.4.0","upstreams":[]}},{"vulnerability":{"id":"GO-2026-6860","dataSource":"https://go.dev/cl/849365","namespace":"govulndb:language:go","severity":"Unknown","urls":["https://go.dev/issue/82224","https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs"],"description":"When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as \"a</x>\") caused O(n^2) allocations and byte copies.\n\nAccumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.","cvss":[],"epss":[{"cve":"CVE-2026-78661","epss":0.00185,"percentile":0.08066,"date":"2026-10-31"}],"fix":{"versions":["0.62.0"],"state":"fixed","available":[{"version":"0.62.0","date":"2026-10-27","kind":"release"}]},"advisories":[],"risk":0.0925},"relatedVulnerabilities":[{"id":"CVE-2026-78661","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78661","namespace":"nvd:cpe","severity":"Unknown","urls":["https://go.dev/cl/849365","https://go.dev/issue/82224","https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs","https://pkg.go.dev/vuln/GO-2026-6860"],"description":"When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as \"a</x>\") caused O(n^2) allocations and byte copies. Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.","cvss":[],"epss":[{"cve":"CVE-2026-78661","epss":0.00185,"percentile":0.08066,"date":"2026-10-31"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.56.0"}},"found":{"vulnerabilityID":"GO-2026-6860","versionConstraint":"<0.62.0 (go)"},"fix":{"suggestedVersion":"0.62.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.56.0?package-id=4ad2b62edbe56c92","name":"golang.org/x/net","version":"v0.56.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.56.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.56.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.56.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o="}}},{"vulnerability":{"id":"GHSA-mx8g-39q3-5c79","dataSource":"https://github.com/advisories/GHSA-mx8g-39q3-5c79","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-mx8g-39q3-5c79","https://nvd.nist.gov/vuln/detail/CVE-2026-9595","https://github.com/facebook/create-react-app/pull/7444","https://github.com/webpack/webpack-dev-server/pull/4316","https://github.com/vuejs/vue-cli/commit/72ba7505aff2a8314e82aa5082379a77504a1fcb","https://cna.openjsf.org/security-advisories.html"],"description":"webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-9595","epss":0.00163,"percentile":0.05469,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-9595","cwe":"CWE-346","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-9595","cwe":"CWE-441","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["5.2.5"],"state":"fixed","available":[{"version":"5.2.5","date":"2026-06-18","kind":"first-observed"}]},"advisories":[],"risk":0.08394499999999999},"relatedVulnerabilities":[{"id":"CVE-2026-9595","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9595","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/facebook/create-react-app/pull/7444","https://github.com/vuejs/vue-cli/commit/72ba7505aff2a8314e82aa5082379a77504a1fcb","https://github.com/webpack/webpack-dev-server/pull/4316","https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-mx8g-39q3-5c79"],"description":"Impact: When a user-configured proxy on webpack-dev-server has a broad context (e.g. /) and ws: true, it also intercepts the dev server's own HMR WebSocket and forwards it to the proxy target. This leaks the browser's cookies and Origin header to the backend, bypasses the dev server's Host/Origin validation, and corrupts the HMR socket (both HMR and the proxy end up writing to the same socket).\n\nPatches: Fixed in webpack-dev-server@5.2.5.\n\nWorkarounds: Scope user-defined proxy context to specific paths instead of /, or omit ws: true from the proxy entry when WebSocket forwarding is not required.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"exploitabilityScore":2.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-9595","epss":0.00163,"percentile":0.05469,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-9595","cwe":"CWE-346","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-9595","cwe":"CWE-441","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"webpack-dev-server","version":"4.9.3"}},"found":{"vulnerabilityID":"GHSA-mx8g-39q3-5c79","versionConstraint":"<5.2.5 (semantic)"},"fix":{"suggestedVersion":"5.2.5"}}],"artifact":{"id":"pkg:npm/webpack-dev-server@4.9.3?package-id=d8e6d1db023d5fac","name":"webpack-dev-server","version":"4.9.3","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:webpack-dev-server:webpack-dev-server:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:webpack-dev-server:webpack_dev_server:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:webpack_dev_server:webpack-dev-server:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:webpack_dev_server:webpack_dev_server:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:webpack-dev:webpack-dev-server:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:webpack-dev:webpack_dev_server:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:webpack_dev:webpack-dev-server:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:webpack_dev:webpack_dev_server:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:webpack:webpack-dev-server:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:webpack:webpack_dev_server:4.9.3:*:*:*:*:*:*:*"],"purl":"pkg:npm/webpack-dev-server@4.9.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-m5mm-p8h7-m29v","dataSource":"https://github.com/advisories/GHSA-m5mm-p8h7-m29v","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-m5mm-p8h7-m29v","https://github.com/yahoo/serialize-javascript/pull/235","https://github.com/yahoo/serialize-javascript/commit/2864b3c6260a3bfd52d2db3e70d1a079de108a61","https://github.com/yahoo/serialize-javascript/releases/tag/v7.1.3"],"description":"Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","metrics":{"baseScore":2.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-115897","epss":0.00307,"percentile":0.23501,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-115897","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.1.3"],"state":"fixed","available":[{"version":"7.1.3","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.078285},"relatedVulnerabilities":[{"id":"CVE-2026-115897","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115897","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/yahoo/serialize-javascript/commit/2864b3c6260a3bfd52d2db3e70d1a079de108a61","https://github.com/yahoo/serialize-javascript/pull/235","https://github.com/yahoo/serialize-javascript/releases/tag/v7.1.3","https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-m5mm-p8h7-m29v"],"description":"Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. Prior to 7.1.3, the function-source escaping logic does not neutralize a bare closing-script prefix when attacker-influenced function source text ends exactly at that prefix. Because each function body is escaped independently, a delimiter supplied by surrounding serialized output can terminate an HTML script element, and a later serialized value supplies injected markup that becomes a live element in the page. Exploitation requires control of a serialized function's source text, such as through a spoofed toString(). This issue is fixed in version 7.1.3.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-115897","epss":0.00307,"percentile":0.23501,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-115897","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"serialize-javascript","version":"6.0.2"}},"found":{"vulnerabilityID":"GHSA-m5mm-p8h7-m29v","versionConstraint":"<7.1.3 (semantic)"},"fix":{"suggestedVersion":"7.1.3"}}],"artifact":{"id":"pkg:npm/serialize-javascript@6.0.2?package-id=0e9e2be5ca9ee84c","name":"serialize-javascript","version":"6.0.2","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:verizon:serialize-javascript:6.0.2:*:*:*:*:node.js:*:*","cpe:2.3:a:yahoo:serialize_javascript:6.0.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/serialize-javascript@6.0.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-xhjh-pmcv-23jw","dataSource":"https://github.com/advisories/GHSA-xhjh-pmcv-23jw","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/axios/axios/security/advisories/GHSA-xhjh-pmcv-23jw","https://nvd.nist.gov/vuln/detail/CVE-2026-42040"],"description":"Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42040","epss":0.00217,"percentile":0.12188,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42040","cwe":"CWE-116","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-42040","cwe":"CWE-626","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.31.1"],"state":"fixed","available":[{"version":"0.31.1","date":"2026-05-05","kind":"first-observed"}]},"advisories":[],"risk":0.072695},"relatedVulnerabilities":[{"id":"CVE-2026-42040","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42040","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/axios/axios/security/advisories/GHSA-xhjh-pmcv-23jw"],"description":"Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the encode() function in lib/helpers/AxiosURLSearchParams.js contains a character mapping (charMap) at line 21 that reverses the safe percent-encoding of null bytes. After encodeURIComponent('\\x00') correctly produces the safe sequence %00, the charMap entry '%00': '\\x00' converts it back to a raw null byte. Primary impact is limited because the standard axios request flow is not affected. This vulnerability is fixed in 1.15.1 and 0.31.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42040","epss":0.00217,"percentile":0.12188,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42040","cwe":"CWE-116","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-42040","cwe":"CWE-626","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"0.25.0"}},"found":{"vulnerabilityID":"GHSA-xhjh-pmcv-23jw","versionConstraint":"<=0.31.0 (semantic)"},"fix":{"suggestedVersion":"0.31.1"}}],"artifact":{"id":"pkg:npm/axios@0.25.0?package-id=f91bce3cf8a711bf","name":"axios","version":"0.25.0","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:axios:axios:0.25.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@0.25.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-76c9-3jph-rj3q","dataSource":"https://github.com/advisories/GHSA-76c9-3jph-rj3q","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/jshttp/on-headers/security/advisories/GHSA-76c9-3jph-rj3q","https://nvd.nist.gov/vuln/detail/CVE-2025-7339","https://github.com/expressjs/morgan/issues/315","https://github.com/jshttp/on-headers/issues/15","https://github.com/jshttp/on-headers/commit/c6e384908c9c6127d18831d16ab0bd96e1231867","https://cna.openjsf.org/security-advisories.html"],"description":"on-headers is vulnerable to http response header manipulation","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.4,"exploitabilityScore":0.8,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-7339","epss":0.00208,"percentile":0.10904,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-7339","cwe":"CWE-241","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["1.1.0"],"state":"fixed","available":[{"version":"1.1.0","date":"2025-07-18","kind":"first-observed"}]},"advisories":[],"risk":0.06655999999999998},"relatedVulnerabilities":[{"id":"CVE-2025-7339","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-7339","namespace":"nvd:cpe","severity":"Low","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/morgan/issues/315","https://github.com/jshttp/on-headers/commit/c6e384908c9c6127d18831d16ab0bd96e1231867","https://github.com/jshttp/on-headers/issues/15","https://github.com/jshttp/on-headers/security/advisories/GHSA-76c9-3jph-rj3q"],"description":"on-headers is a node.js middleware for listening to when a response writes headers. A bug in on-headers versions `<1.1.0` may result in response headers being inadvertently modified when an array is passed to `response.writeHead()`. Users should upgrade to version 1.1.0 to receive a patch. Uses are strongly encouraged to upgrade to `1.1.0`, but this issue can be worked around by passing an object to `response.writeHead()` rather than an array.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.4,"exploitabilityScore":0.8,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-7339","epss":0.00208,"percentile":0.10904,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-7339","cwe":"CWE-241","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"on-headers","version":"1.0.2"}},"found":{"vulnerabilityID":"GHSA-76c9-3jph-rj3q","versionConstraint":"<1.1.0 (semantic)"},"fix":{"suggestedVersion":"1.1.0"}}],"artifact":{"id":"pkg:npm/on-headers@1.0.2?package-id=4d4c0828cf93cfdc","name":"on-headers","version":"1.0.2","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:on-headers:on-headers:1.0.2:*:*:*:*:*:*:*","cpe:2.3:a:on-headers:on_headers:1.0.2:*:*:*:*:*:*:*","cpe:2.3:a:on_headers:on-headers:1.0.2:*:*:*:*:*:*:*","cpe:2.3:a:on_headers:on_headers:1.0.2:*:*:*:*:*:*:*","cpe:2.3:a:on:on-headers:1.0.2:*:*:*:*:*:*:*","cpe:2.3:a:on:on_headers:1.0.2:*:*:*:*:*:*:*"],"purl":"pkg:npm/on-headers@1.0.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-8wmf-6v46-5gfg","dataSource":"https://github.com/advisories/GHSA-8wmf-6v46-5gfg","namespace":"github:language:go","severity":"Low","urls":["https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg","https://nvd.nist.gov/vuln/detail/CVE-2026-81870","https://github.com/open-telemetry/opentelemetry-go/pull/8438","https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38","https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0"],"description":"OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-81870","epss":0.00266,"percentile":0.1856,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-81870","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-81870","cwe":"CWE-532","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.45.0"],"state":"fixed","available":[{"version":"1.45.0","date":"2026-09-18","kind":"first-observed"}]},"advisories":[],"risk":0.0665},"relatedVulnerabilities":[{"id":"CVE-2026-81870","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-81870","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38","https://github.com/open-telemetry/opentelemetry-go/pull/8438","https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg"],"description":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.5.0 to 1.44.0, sdk/trace.NewTracerProvider emits a TracerProvider created internal Info-level diagnostic event whose MarshalLog implementations recursively include span processor, exporter, and client configuration. Applications that call otel.SetLogger to enable OpenTelemetry internal Info logging can therefore record OTLP gRPC and HTTP collector endpoints, the OTLP HTTP Insecure flag, and complete Zipkin collector URLs. A person or system with access to those logs can learn internal collector topology and can recover credentials or tokens embedded in Zipkin URL user information or query strings. The default OpenTelemetry logger does not emit the event, and this path does not log OTLP authentication headers, TLS key material, or span payloads. This issue is fixed in version 1.45.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-81870","epss":0.00266,"percentile":0.1856,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-81870","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-81870","cwe":"CWE-532","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"go.opentelemetry.io/otel/exporters/otlp/otlptrace","version":"v1.44.0"}},"found":{"vulnerabilityID":"GHSA-8wmf-6v46-5gfg","versionConstraint":">=1.5.0,<=1.44.0 (go)"},"fix":{"suggestedVersion":"1.45.0"}}],"artifact":{"id":"pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace@v1.44.0?package-id=7e34dbb654c3cdde","name":"go.opentelemetry.io/otel/exporters/otlp/otlptrace","version":"v1.44.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:otel:exporters\\/otlp\\/otlptrace:v1.44.0:*:*:*:*:*:*:*"],"purl":"pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace@v1.44.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:4YsVu3B8+3qtWYYrsUYgn0OG78pN0rnNPRGX4SbokQI="}}},{"vulnerability":{"id":"GHSA-8wmf-6v46-5gfg","dataSource":"https://github.com/advisories/GHSA-8wmf-6v46-5gfg","namespace":"github:language:go","severity":"Low","urls":["https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg","https://nvd.nist.gov/vuln/detail/CVE-2026-81870","https://github.com/open-telemetry/opentelemetry-go/pull/8438","https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38","https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0"],"description":"OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-81870","epss":0.00266,"percentile":0.1856,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-81870","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-81870","cwe":"CWE-532","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.45.0"],"state":"fixed","available":[{"version":"1.45.0","date":"2026-09-18","kind":"first-observed"}]},"advisories":[],"risk":0.0665},"relatedVulnerabilities":[{"id":"CVE-2026-81870","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-81870","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38","https://github.com/open-telemetry/opentelemetry-go/pull/8438","https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg"],"description":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.5.0 to 1.44.0, sdk/trace.NewTracerProvider emits a TracerProvider created internal Info-level diagnostic event whose MarshalLog implementations recursively include span processor, exporter, and client configuration. Applications that call otel.SetLogger to enable OpenTelemetry internal Info logging can therefore record OTLP gRPC and HTTP collector endpoints, the OTLP HTTP Insecure flag, and complete Zipkin collector URLs. A person or system with access to those logs can learn internal collector topology and can recover credentials or tokens embedded in Zipkin URL user information or query strings. The default OpenTelemetry logger does not emit the event, and this path does not log OTLP authentication headers, TLS key material, or span payloads. This issue is fixed in version 1.45.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-81870","epss":0.00266,"percentile":0.1856,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-81870","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-81870","cwe":"CWE-532","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc","version":"v1.44.0"}},"found":{"vulnerabilityID":"GHSA-8wmf-6v46-5gfg","versionConstraint":">=1.5.0,<=1.44.0 (go)"},"fix":{"suggestedVersion":"1.45.0"}}],"artifact":{"id":"pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@v1.44.0?package-id=8f9a8a94339f3ebc","name":"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc","version":"v1.44.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:otel:exporters\\/otlp\\/otlptrace\\/otlptracegrpc:v1.44.0:*:*:*:*:*:*:*"],"purl":"pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@v1.44.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:qazEJlUOQzhCpzQpFETGby7EdqjI1wsd0W+6Gg1SCTU="}}},{"vulnerability":{"id":"GHSA-8wmf-6v46-5gfg","dataSource":"https://github.com/advisories/GHSA-8wmf-6v46-5gfg","namespace":"github:language:go","severity":"Low","urls":["https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg","https://nvd.nist.gov/vuln/detail/CVE-2026-81870","https://github.com/open-telemetry/opentelemetry-go/pull/8438","https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38","https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0"],"description":"OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-81870","epss":0.00266,"percentile":0.1856,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-81870","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-81870","cwe":"CWE-532","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.45.0"],"state":"fixed","available":[{"version":"1.45.0","date":"2026-09-18","kind":"first-observed"}]},"advisories":[],"risk":0.0665},"relatedVulnerabilities":[{"id":"CVE-2026-81870","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-81870","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38","https://github.com/open-telemetry/opentelemetry-go/pull/8438","https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg"],"description":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.5.0 to 1.44.0, sdk/trace.NewTracerProvider emits a TracerProvider created internal Info-level diagnostic event whose MarshalLog implementations recursively include span processor, exporter, and client configuration. Applications that call otel.SetLogger to enable OpenTelemetry internal Info logging can therefore record OTLP gRPC and HTTP collector endpoints, the OTLP HTTP Insecure flag, and complete Zipkin collector URLs. A person or system with access to those logs can learn internal collector topology and can recover credentials or tokens embedded in Zipkin URL user information or query strings. The default OpenTelemetry logger does not emit the event, and this path does not log OTLP authentication headers, TLS key material, or span payloads. This issue is fixed in version 1.45.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-81870","epss":0.00266,"percentile":0.1856,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-81870","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-81870","cwe":"CWE-532","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"go.opentelemetry.io/otel/sdk","version":"v1.44.0"}},"found":{"vulnerabilityID":"GHSA-8wmf-6v46-5gfg","versionConstraint":">=1.5.0,<=1.44.0 (go)"},"fix":{"suggestedVersion":"1.45.0"}}],"artifact":{"id":"pkg:golang/go.opentelemetry.io/otel/sdk@v1.44.0?package-id=182b6051dc7fda66","name":"go.opentelemetry.io/otel/sdk","version":"v1.44.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:otel:sdk:v1.44.0:*:*:*:*:*:*:*"],"purl":"pkg:golang/go.opentelemetry.io/otel/sdk@v1.44.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:nHYwb9lK+fJPU/dnT6s7W7Z8itMWyqrnVfbheVYrZ58="}}},{"vulnerability":{"id":"GHSA-j6qf-3m9c-vwj3","dataSource":"https://github.com/advisories/GHSA-j6qf-3m9c-vwj3","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/go-chi/chi/security/advisories/GHSA-j6qf-3m9c-vwj3","https://nvd.nist.gov/vuln/detail/CVE-2026-114437","https://github.com/go-chi/chi/pull/1214","https://github.com/go-chi/chi/commit/7f9b7448f51d28804fac98c0a17bc2a7cec1079f","https://github.com/go-chi/chi/releases/tag/v5.4.0","https://www.tenable.com/security/research/tra-2026-66"],"description":"chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-114437","epss":0.00129,"percentile":0.02558,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-114437","cwe":"CWE-348","source":"vulnreport@tenable.com","type":"Secondary"}],"fix":{"versions":["5.4.0"],"state":"fixed","available":[{"version":"5.4.0","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.06320999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-114437","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114437","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/go-chi/chi/security/advisories/GHSA-j6qf-3m9c-vwj3","https://www.tenable.com/security/research/tra-2026-66"],"description":"In the Golang Chi web framework, the ClientIPFromXFF middleware skips any X-Forwarded-For entry in a configured trusted CIDR but never verifies that the direct TCP peer in http.Request.RemoteAddr belongs to that CIDR. A client that can reach the Go server directly can therefore append a trusted-looking proxy address and choose the client IP returned by middleware.GetClientIP.\n\nThis issue affects chi before 5.4.0.","cvss":[{"source":"vulnreport@tenable.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}},{"source":"vulnreport@tenable.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-114437","epss":0.00129,"percentile":0.02558,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-114437","cwe":"CWE-348","source":"vulnreport@tenable.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/go-chi/chi/v5","version":"v5.3.0"}},"found":{"vulnerabilityID":"GHSA-j6qf-3m9c-vwj3","versionConstraint":"<=5.3.2 (go)"},"fix":{"suggestedVersion":"5.4.0"}}],"artifact":{"id":"pkg:golang/github.com/go-chi/chi/v5@v5.3.0?package-id=1de3f0e7a31df1d5","name":"github.com/go-chi/chi/v5","version":"v5.3.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:go-chi:chi\\/v5:v5.3.0:*:*:*:*:*:*:*","cpe:2.3:a:go_chi:chi\\/v5:v5.3.0:*:*:*:*:*:*:*","cpe:2.3:a:go:chi\\/v5:v5.3.0:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/go-chi/chi/v5@v5.3.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:halUjDxhshgXHMrao5bB8eNBXo/rnzwr8m5m36glehM="}}},{"vulnerability":{"id":"GHSA-4487-j8r4-4g2f","dataSource":"https://github.com/advisories/GHSA-4487-j8r4-4g2f","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/digitalbazaar/forge/security/advisories/GHSA-4487-j8r4-4g2f","https://nvd.nist.gov/vuln/detail/CVE-2026-118780","https://github.com/digitalbazaar/forge/commit/f6555609bd30f442fbfacd543155928ceccf98d0","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1"],"description":"Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118780","epss":0.00172,"percentile":0.06586,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118780","cwe":"CWE-295","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-118780","cwe":"CWE-471","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["1.4.1"],"state":"fixed","available":[{"version":"1.4.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.05761999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-118780","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118780","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/digitalbazaar/forge/commit/f6555609bd30f442fbfacd543155928ceccf98d0","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","https://github.com/digitalbazaar/forge/security/advisories/GHSA-4487-j8r4-4g2f"],"description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used pki.verifyCertificateChain(), pki.createCaStore(), duplicate subject names to process the relevant input or security decision. node-forge modified the CA store while trying certificates that shared a subject name during pki.verifyCertificateChain(). A failed chain verification could permanently remove trusted CA certificates from the store, causing later valid chains to fail and creating a persistent availability impact for applications that reused the store. This issue is fixed in version 1.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118780","epss":0.00172,"percentile":0.06586,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118780","cwe":"CWE-295","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-118780","cwe":"CWE-471","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"node-forge","version":"1.4.0"}},"found":{"vulnerabilityID":"GHSA-4487-j8r4-4g2f","versionConstraint":"<=1.4.0 (semantic)"},"fix":{"suggestedVersion":"1.4.1"}}],"artifact":{"id":"pkg:npm/node-forge@1.4.0?package-id=256486d336435126","name":"node-forge","version":"1.4.0","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:digitalbazaar:forge:1.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/node-forge@1.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-4x5r-pxfx-6jf8","dataSource":"https://github.com/advisories/GHSA-4x5r-pxfx-6jf8","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/babel/babel/security/advisories/GHSA-4x5r-pxfx-6jf8","https://babeljs.io/docs/options#inputsourcemap","https://nvd.nist.gov/vuln/detail/CVE-2026-49356"],"description":"@babel/core: Arbitrary File Read via sourceMappingURL Comment","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","metrics":{"baseScore":3.2,"exploitabilityScore":1.5,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-49356","epss":0.00152,"percentile":0.04306,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-49356","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-49356","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.29.6"],"state":"fixed","available":[{"version":"7.29.6","date":"2026-06-15","kind":"first-observed"}]},"advisories":[],"risk":0.04712},"relatedVulnerabilities":[{"id":"CVE-2026-49356","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-49356","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/babel/babel/security/advisories/GHSA-4x5r-pxfx-6jf8"],"description":"Babel is a compiler for writing next generation JavaScript. Prior to 8.0.0-rc.6 and 7.29.6, @babel/core affected by an arbitrary file read via a sourceMappingURL comment. Using @babel/core to compile maliciously crafted code can allow an attacker to read any source map from the system that is running Babel, if the attacker controls the input source code, can read the output source code, and knows the path of the source map file that they want to read. This vulnerability is fixed in 8.0.0-rc.6 and 7.29.6.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","metrics":{"baseScore":3.6,"exploitabilityScore":1.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","metrics":{"baseScore":3.2,"exploitabilityScore":1.5,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-49356","epss":0.00152,"percentile":0.04306,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-49356","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-49356","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@babel/core","version":"7.12.9"}},"found":{"vulnerabilityID":"GHSA-4x5r-pxfx-6jf8","versionConstraint":"<=7.29.0 (semantic)"},"fix":{"suggestedVersion":"7.29.6"}}],"artifact":{"id":"pkg:npm/%40babel/core@7.12.9?package-id=b1bfdd4eca45a11a","name":"@babel/core","version":"7.12.9","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:\\@babel\\/core:\\@babel\\/core:7.12.9:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40babel/core@7.12.9","upstreams":[]}},{"vulnerability":{"id":"GHSA-4x5r-pxfx-6jf8","dataSource":"https://github.com/advisories/GHSA-4x5r-pxfx-6jf8","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/babel/babel/security/advisories/GHSA-4x5r-pxfx-6jf8","https://babeljs.io/docs/options#inputsourcemap","https://nvd.nist.gov/vuln/detail/CVE-2026-49356"],"description":"@babel/core: Arbitrary File Read via sourceMappingURL Comment","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","metrics":{"baseScore":3.2,"exploitabilityScore":1.5,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-49356","epss":0.00152,"percentile":0.04306,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-49356","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-49356","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.29.6"],"state":"fixed","available":[{"version":"7.29.6","date":"2026-06-15","kind":"first-observed"}]},"advisories":[],"risk":0.04712},"relatedVulnerabilities":[{"id":"CVE-2026-49356","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-49356","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/babel/babel/security/advisories/GHSA-4x5r-pxfx-6jf8"],"description":"Babel is a compiler for writing next generation JavaScript. Prior to 8.0.0-rc.6 and 7.29.6, @babel/core affected by an arbitrary file read via a sourceMappingURL comment. Using @babel/core to compile maliciously crafted code can allow an attacker to read any source map from the system that is running Babel, if the attacker controls the input source code, can read the output source code, and knows the path of the source map file that they want to read. This vulnerability is fixed in 8.0.0-rc.6 and 7.29.6.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","metrics":{"baseScore":3.6,"exploitabilityScore":1.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","metrics":{"baseScore":3.2,"exploitabilityScore":1.5,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-49356","epss":0.00152,"percentile":0.04306,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-49356","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-49356","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@babel/core","version":"7.18.6"}},"found":{"vulnerabilityID":"GHSA-4x5r-pxfx-6jf8","versionConstraint":"<=7.29.0 (semantic)"},"fix":{"suggestedVersion":"7.29.6"}}],"artifact":{"id":"pkg:npm/%40babel/core@7.18.6?package-id=14191eb7453d3f91","name":"@babel/core","version":"7.18.6","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:\\@babel\\/core:\\@babel\\/core:7.18.6:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40babel/core@7.18.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-h6cr-wjv9-3cpp","dataSource":"https://github.com/advisories/GHSA-h6cr-wjv9-3cpp","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/digitalbazaar/forge/security/advisories/GHSA-h6cr-wjv9-3cpp","https://nvd.nist.gov/vuln/detail/CVE-2026-118781","https://github.com/digitalbazaar/forge/commit/e96c47b7f006dec66fb7bb1934e7375498b04a72","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1"],"description":"Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"exploitabilityScore":1.5,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118781","epss":0.00119,"percentile":0.01735,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118781","cwe":"CWE-835","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.4.1"],"state":"fixed","available":[{"version":"1.4.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.035105},"relatedVulnerabilities":[{"id":"CVE-2026-118781","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118781","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/digitalbazaar/forge/commit/e96c47b7f006dec66fb7bb1934e7375498b04a72","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","https://github.com/digitalbazaar/forge/security/advisories/GHSA-h6cr-wjv9-3cpp"],"description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used BigInteger.prototype.modInverse(), bnModInverse(), lib/jsbn.js, RSA public exponent e to process the relevant input or security decision. node-forge's bundled jsbn implementation entered an infinite loop when BigInteger.prototype.modInverse() received a negative value or modulus. An attacker who could control the RSA public exponent passed to key generation, or a direct modInverse() operand, could block the Node.js event loop at full CPU. Parsed DER, PEM, JWK, PKCS#12, X.509, and TLS values are unsigned and cannot trigger this issue. This issue is fixed in version 1.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"exploitabilityScore":1.5,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118781","epss":0.00119,"percentile":0.01735,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118781","cwe":"CWE-835","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"node-forge","version":"1.4.0"}},"found":{"vulnerabilityID":"GHSA-h6cr-wjv9-3cpp","versionConstraint":"<=1.4.0 (semantic)"},"fix":{"suggestedVersion":"1.4.1"}}],"artifact":{"id":"pkg:npm/node-forge@1.4.0?package-id=256486d336435126","name":"node-forge","version":"1.4.0","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:digitalbazaar:forge:1.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/node-forge@1.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-5p4m-2wfm-xmqj","dataSource":"https://github.com/advisories/GHSA-5p4m-2wfm-xmqj","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj"],"description":"JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"fix":{"versions":["3.15.1"],"state":"fixed","available":[{"version":"3.15.1","date":"2026-08-07","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"3.14.1"}},"found":{"vulnerabilityID":"GHSA-5p4m-2wfm-xmqj","versionConstraint":">=3.0.0,<3.15.1 (semantic)"},"fix":{"suggestedVersion":"3.15.1"}}],"artifact":{"id":"pkg:npm/js-yaml@3.14.1?package-id=311bc8b23a1591c7","name":"js-yaml","version":"3.14.1","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:nodeca:js-yaml:3.14.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@3.14.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-5p4m-2wfm-xmqj","dataSource":"https://github.com/advisories/GHSA-5p4m-2wfm-xmqj","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj"],"description":"JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"fix":{"versions":["4.3.1"],"state":"fixed","available":[{"version":"4.3.1","date":"2026-08-07","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"4.1.0"}},"found":{"vulnerabilityID":"GHSA-5p4m-2wfm-xmqj","versionConstraint":">=4.0.0,<4.3.1 (semantic)"},"fix":{"suggestedVersion":"4.3.1"}}],"artifact":{"id":"pkg:npm/js-yaml@4.1.0?package-id=27f207f3c57cf9f3","name":"js-yaml","version":"4.1.0","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:nodeca:js-yaml:4.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@4.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-5c6j-r48x-rmvq","dataSource":"https://github.com/advisories/GHSA-5c6j-r48x-rmvq","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-5c6j-r48x-rmvq","https://nvd.nist.gov/vuln/detail/CVE-2020-7660","https://github.com/yahoo/serialize-javascript/commit/2e609d0a9f4f5b097f0945af88bd45b9c7fb48d9","https://github.com/advisories/GHSA-hxcc-f52p-wc94","https://github.com/yahoo/serialize-javascript/releases/tag/v7.0.3"],"description":"Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}}],"fix":{"versions":["7.0.3"],"state":"fixed","available":[{"version":"7.0.3","date":"2026-02-28","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"serialize-javascript","version":"6.0.2"}},"found":{"vulnerabilityID":"GHSA-5c6j-r48x-rmvq","versionConstraint":"<=7.0.2 (semantic)"},"fix":{"suggestedVersion":"7.0.3"}}],"artifact":{"id":"pkg:npm/serialize-javascript@6.0.2?package-id=0e9e2be5ca9ee84c","name":"serialize-javascript","version":"6.0.2","type":"npm","locations":[{"path":"/website/yarn.lock","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:verizon:serialize-javascript:6.0.2:*:*:*:*:node.js:*:*","cpe:2.3:a:yahoo:serialize_javascript:6.0.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/serialize-javascript@6.0.2","upstreams":[]}},{"vulnerability":{"id":"GO-2026-5932","dataSource":"https://go.dev/issue/44226","namespace":"govulndb:language:go","severity":"Unknown","urls":[],"description":"The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used.\n\nIf you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package.","cvss":[],"fix":{"versions":[],"state":""},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/crypto","version":"v0.53.0"}},"found":{"vulnerabilityID":"GO-2026-5932","versionConstraint":"none (unknown)"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.53.0?package-id=0a9169df163c853a","name":"golang.org/x/crypto","version":"v0.53.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:crypto:v0.53.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.53.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.53.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto="}}}],"source":{"type":"file","target":"open-policy-agent/gatekeeper"},"distro":{"name":"","version":"","idLike":null},"descriptor":{"name":"grype","version":"0.121.0","configuration":{"output":["json"],"file":"./grype.json","pretty":false,"distro":"","add-cpes-if-none":false,"output-template-file":"","check-for-app-update":true,"only-fixed":false,"only-notfixed":false,"ignore-wontfix":"","platform":"","search":{"scope":"squashed","unindexed-archives":false,"indexed-archives":true},"ignore":[{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"kernel-headers","version":"","language":"","type":"rpm","location":"","upstream-name":"kernel"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux(-.*)?-headers-.*","version":"","language":"","type":"deb","location":"","upstream-name":"linux.*"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux-libc-dev","version":"","language":"","type":"deb","location":"","upstream-name":"linux"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux-kbuild-.*","version":"","language":"","type":"deb","location":"","upstream-name":"linux.*"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"}],"exclude":[],"externalSources":{"enable":false,"maven":{"searchUpstreamBySha1":true,"baseUrl":"https://search.maven.org/solrsearch/select","rateLimit":300000000}},"match":{"java":{"using-cpes":false},"jvm":{"using-cpes":true},"dotnet":{"using-cpes":false},"golang":{"using-cpes":false,"always-use-cpe-for-stdlib":false,"allow-main-module-pseudo-version-comparison":false},"javascript":{"using-cpes":false},"python":{"using-cpes":false},"ruby":{"using-cpes":false},"rust":{"using-cpes":false},"hex":{"using-cpes":false},"stock":{"using-cpes":true},"dpkg":{"using-cpes":false,"missing-epoch-strategy":"zero","use-cpes-for-eol":false},"rpm":{"using-cpes":false,"missing-epoch-strategy":"auto","use-cpes-for-eol":false}},"fail-on-severity":"","registry":{"insecure-skip-tls-verify":false,"insecure-use-http":false,"ca-cert":""},"show-suppressed":false,"include-matcher-suppressions":false,"by-cve":false,"SortBy":{"sort-by":"risk"},"name":"","default-image-pull-source":"","from":null,"vex-documents":[],"vex-add":[],"match-upstream-kernel-headers":false,"fix-channel":{"redhat-eus":{"apply":"auto","versions":">= 8.0"},"ubuntu-esm":{"apply":"auto","versions":""}},"timestamp":true,"alerts":{"enable-eol-distro-warnings":true},"db":{"cache-dir":"$HOME/.cache/grype/db","update-url":"https://grype.anchore.io/databases","ca-cert":"","auto-update":true,"validate-by-hash-on-start":true,"validate-age":true,"max-allowed-built-age":432000000000000,"require-update-check":false,"update-available-timeout":30000000000,"update-download-timeout":300000000000,"max-update-check-frequency":7200000000000},"exp":{},"dev":{"db":{"debug":false}}},"db":{"status":{"schemaVersion":"v6.1.10","from":"https://grype.anchore.io/databases/v6/vulnerability-db_v6.1.10_2026-11-01T00:24:34Z_1793514012.tar.zst?checksum=sha256%3Ad0e1af9e6491440e1a671d0a0aafc32c5c7cb5cda787dcec3482799ef298f31c","built":"2026-11-01T06:20:12Z","path":"$HOME/.cache/grype/db/6/vulnerability.db","valid":true},"providers":{"alma":{"captured":"2026-11-01T00:24:39Z","input":"xxh64:d398731e6455b022"},"alpine":{"captured":"2026-11-01T00:24:47Z","input":"xxh64:c40c8985935df81b"},"amazon":{"captured":"2026-11-01T00:24:37Z","input":"xxh64:ee129200b14d5c8a"},"arch":{"captured":"2026-11-01T00:24:47Z","input":"xxh64:14f6c24dd6cd12c8"},"bitnami":{"captured":"2026-11-01T00:24:34Z","input":"xxh64:971619846357ae10"},"chainguard":{"captured":"2026-11-01T00:24:48Z","input":"xxh64:dfbf78c7fc58a603"},"chainguard-libraries":{"captured":"2026-11-01T00:24:50Z","input":"xxh64:db9c34dd1b7bc8d0"},"debian":{"captured":"2026-11-01T00:24:52Z","input":"xxh64:078c82a49c8cb529"},"echo":{"captured":"2026-11-01T00:24:41Z","input":"xxh64:1d0df98736854a48"},"eol":{"captured":"2026-11-01T00:24:59Z","input":"xxh64:0f2164b3e62ba44b"},"epss":{"captured":"2026-11-01T00:25:00Z","input":"xxh64:0d4c3b8d2c2e5188"},"fedora":{"captured":"2026-11-01T00:24:40Z","input":"xxh64:28fe3d1d8ae41f9b"},"github":{"captured":"2026-11-01T00:24:57Z","input":"xxh64:076a86d2dc5c9e83"},"govulndb":{"captured":"2026-11-01T00:24:45Z","input":"xxh64:56e169604e12196e"},"hummingbird":{"captured":"2026-11-01T00:27:26Z","input":"xxh64:e86abd0466410fb6"},"kev":{"captured":"2026-11-01T00:25:06Z","input":"xxh64:cb0f4041bd51c379"},"mariner":{"captured":"2026-11-01T00:24:56Z","input":"xxh64:003337efdc7e1888"},"minimos":{"captured":"2026-11-01T00:24:56Z","input":"xxh64:219c30ffded7a12c"},"nvd":{"captured":"2026-11-01T00:25:41Z","input":"xxh64:75e41eec415fdb0a"},"oracle":{"captured":"2026-11-01T00:24:42Z","input":"xxh64:0546c2dd11a85c07"},"photon":{"captured":"2026-11-01T00:24:37Z","input":"xxh64:8dbfd0c521fd470a"},"rhel":{"captured":"2026-11-01T01:08:40Z","input":"xxh64:57c5e6a7f9f134ff"},"secureos":{"captured":"2026-11-01T00:24:34Z","input":"xxh64:ac7fa7f44e8ed7dd"},"sles":{"captured":"2026-11-01T00:26:56Z","input":"xxh64:025a1565b2cc7cdf"},"ubuntu":{"captured":"2026-11-01T00:25:58Z","input":"xxh64:9ab4d29f0ea6275d"},"wolfi":{"captured":"2026-11-01T00:25:02Z","input":"xxh64:d27b08e998baab8e"}}},"timestamp":"2026-11-02T03:09:21.0355923Z"}}